Electric Emergency Incident and Disturbance Report

U.S. DEPARTMENT OF ENERGY

DOE-417

ELECTRIC EMERGENCY INCIDENT AND DISTURBANCE REPORT

OMB No.: 1901-0288

Expiration Date: xx/xx/xxxx

Burden per Response: 1.8 hours

_QUESTIONS

If you have any questions about Form DOE-417 after reading the instructions, please contact the Office of Electricity (OE) at (202) 586-2892, or oe417@hq.doe.gov

For additional information write to the following address:

Assistant Secretary

Office of Cybersecurity, Energy Security, and Emergency Response

1000 Independence Ave, SW Washington, DC 20585

Emergency Contact: DOE Operations Center Phone Number:

(202) 586-8100; Fax Number: (202) 586-8485; Email: [email protected].

PURPOSE

The U.S. Department of Energy (DOE), under its relevant authorities, has established mandatory reporting requirements for electric emergency incidents and disturbances in the United States. DOE collects this information from the electric power industry on Form DOE-417 to meet its overall national security and Department of Homeland Security’s National Response Framework responsibilities. DOE will use the data from this form to obtain current information regarding emergency situations on U.S. electric energy supply systems. DOE’s Energy Information Administration (EIA) will use the data for reporting on electric power emergency incidents and disturbances in monthly EIA reports. The data also may be used to develop legislative recommendations, reports to the Congress and as a basis for DOE investigations following severe, prolonged, or repeated electric power reliability problems.

HOW TO SUBMIT

Online (Preferred Method): An online submission should be made through the DOE-417 Online System at: https://www.oe.netl.doe.gov/OE417/

Instructions on how to use the online system can be accessed at: https://www.oe.netl.doe.gov/oe417.aspx

Instructions on how to report via facsimile, email or telephone are printed on Schedule 1 of Form DOE-417.

Fax: If you experience problems submitting via the online submission form, you may fax the form to the following facsimile number: (202) 586-8485.

Telephone: If you experience problems submitting via online, email or fax, please call and report the information to the following telephone number: (202) 586-8100. This telephone number is staffed 24/7.

Email: If you experience problems submitting via the online submission form, you may email the form to: [email protected].

COPIES OF SURVEY FORMS AND

INSTRUCTIONS

Copies in portable document format (PDF). You may access the materials by following the steps:

 Go to DOE’s Electric Emergency Incident and Disturbance Rep ort website at: http://www.oe.netl.doe.gov/oe417

 Click on the link for the Form or for the Instructions.

GENERAL INSTRUCTIONS

Form DOE-417 is a mandatory emergency form filed by specific electric power industry actors when at least one of the qualifying criteria is met–pursuant to Section 13(b) of the Federal Energy Administration Act of 1974 (Public Law 93-275). Details regarding qualifying criteria and relevant actors are provided below and on the form.

Form DOE-417 alerts the Department of Energy to electrical emergency incidents and disruptions. The ability of the DOE to quickly respond to energy emergencies that may impact the nation’s infrastructure and help alleviate or prevent further disruptions depends on the industry’s prompt response. As such, the timely filing of this form is of paramount importance. Many electric utilities have received approval to operate the Balancing Authority and/or Reliability Coordinator functions from the North American Electric Reliability Corporation (NERC). In addition, electric utilities also have computer centers and physical security departments. (Regional Transmission Organizations (RTOs) and Independent System Operators (ISOs) are established by the Federal Energy Regulatory Commission and are considered electric utilities.)

WHO MUST SUBMIT

1. Balancing Authorities (BA), Reliability Coordinators (RC), some Generating Entities, and Electric Utilities, including those located Puerto Rico, the Virgin Islands, Guam or other U.S. possessions are responsible for completing all relevant portions of the form when any of the criteria are met requiring the filing of Form DOE-417.

a. All electric utilities must provide information to a BA when necessary for their reporting obligations and file Form

DOE-417 in cases where a BA will not be involved.

Note: this includes U.S.-based utilities for whom balancing authority oversight responsibilities are handled by electrical systems located across an international border.

b. Foreign utilities, handling U.S. balancing authority responsibilities, may wish to file this information voluntarily to the DOE. Any U.S.-based utility in this international situation must inform DOE that these filings will come from a foreign-based electric system.

2. Computer centers and physical security departments of electric utilities may file directly with DOE on the selected areas identified in the Form DOE-417 instructions.

Note: This information does not have to flow directly into the officials running the BA and RC and then be forwarded to DOE.

3. Joint filing: BAs’ and RCs’ can file notifications for joint filings. BAs can also file a combined report with electric utilities under their electrical oversight. Alternatively, all information can be passed to the BA who then files a single report.

Note: DOE requests that it be notified of those entities that plan to file jointly and of those electric utilities that want to file separately. (Notification can be done at the time of the filing.)

FUNCTIONAL RESPONSIBILITY OF FILING ENTITIES

All entities must file on all line items except for the following exclusions:

 Electric Utilities - There are no exclusions allowed, all items need to be addressed.

 Balancing Authority (BA) - Reporting on the count of customers (and the amount of load, if the BA is based at a Regional Transmission Organization or Independent System Operator) is required only for the Final Report. A BA located in vertically integrated utilities, a municipality, federal utility, state-owned or cooperative will report the amount of load and counts of customers.

 Reliability Coordinators (RC) - Reporting on the count of customers is excluded. If the RC has an agreement with the Regional Transmission Organization to supply the customer counts, the RC can supply this information.

 Generating Entities - Entities who have 300 MW or more of generation dedicated to one or more end-use customers (e.g. retail or industrial customers) are required to file the form if criteria 2, 3, 6, 11, or 14 are met.

 Local Utilities in Alaska, Hawaii, Puerto Rico, the U.S.

Virgin Islands, and the U.S. Territories - If the local electrical system is less than 300 MW, then only file if criteria 1, 3, 4, or 5 are met.

 Computer, telecommunication, and physical security offices that support the BA, RC, and electric utility or are located within the entity - These support centers or offices can file information, in lieu of the emergency offices, on criteria 1, 3, 10, or 11 in direct submissions to DOE. These support centers or offices will address no other incident types.

WHEN TO SUBMIT

Form DOE-417 is considered an emergency form. Schedule 1, lines N - S in Schedule 2, and the Cyber Attributes on line T (if criteria 2 or 14 are met) of the form must be submitted to the DOE only when at least one of the alert criteria on page one or two of the form is met. Depending on the nature of the situation, Form DOE-417 must be filed either within one hour; six hours; by the end of the next calendar day after a determination of an attempted cyber compromise; or by the later of 24 hours after the recognition of the incident OR by the end of the next business day of the incident.

Criteria for Filing:

EMERGENCY ALERT: Within One Hour of Incident: Schedule 1 and lines N – S and the Cyber Attributes on line T (if criteria 2 is met) of Schedule 2 must be filed if one or more of the following criteria are met:

1. Physical attack that causes major interruptions or impacts to critical infrastructure facilities or to operations.

2. Reportable Cyber Security Incident.

3. Cyber event that is not a Reportable Cyber Security Incident that causes interruptions of electrical system operations.

4. Complete operational failure or shut-down of the transmission and/or distribution electrical system.

5. Electrical System Separation (Islanding) where part or parts of a power grid remain(s) operational in an otherwise blacked out area or within the partial failure of an integrated electrical system.

6. Uncontrolled loss of 300 Megawatts or more of firm system loads for more than 15 minutes or more from a single incident.

7. Firm load shedding of 100 Megawatts or more implemented under emergency operational policy

8. System-wide voltage reductions of 3 percent or more.

9. Public appeal to reduce the use of electricity for purposes of maintaining the continuity of the Bulk Electric System.

Note: If the incident or disturbance is having a critical impact on operational events, respondents must balance their operational requirements with this mandatory reporting requirement. In such instances, telephone notification to the DOE Emergency Operations Center (202-586-8100) is acceptable, pending a written submission of the completed form.

NORMAL REPORT: Within Six Hours of Incident: Schedule 1 and lines N – S of Schedule 2 must be filed if one or more of the following criteria are met and none of the Emergency Alert criteria apply:

10. Physical attack that could potentially impact electric power system adequacy or reliability; or vandalism which targets components of any security systems.

11. Cyber event that could potentially impact electric power system adequacy or reliability.

12. Loss of electric service to more than 50,000 customers for

1 hour or more.

13. Fuel supply emergencies that could impact electric power system adequacy or reliability.

ATTEMPTED CYBER COMPROMISE: Within 1 calendar day of determination of the attempted cyber compromise: Schedule 1 and lines N-S and the Cyber Attributes on line T of Schedule 2 must be filed if the following criterion is met and none of the Emergency Alert or Normal Report criteria apply:

14. Cyber Security Incident that was an attempt to compromise

High or Medium Impact Bulk Electric System Cyber Systems

or their associated Electronic Access Control or Monitoring

Systems.

SYSTEM REPORT: By the later of 24 hours after the recognition of the incident OR by the end of the next business day. Note: 4:00pm local time will be considered the end of the business day: Schedule 1 and lines N - S of Schedule 2 must be filed if one or more of the following criteria are met and none of the Emergency Alert, Normal Report, or Attempted Cyber Compromise criteria apply:

15. Damage or destruction of a Facility within its Reliability Coordinator Area, Balancing Authority Area or Transmission Operator Area that results in action(s) to avoid a Bulk Electric System Emergency.

16. Damage or destruction of its Facility that results from actual or suspected intentional human action.

17. Physical threat to its Facility excluding weather or natural disaster related threats, which has the potential to degrade the normal operation of the Facility. Or suspicious device or activity at its Facility.

18. Physical threat to its Bulk Electric System control center, excluding weather or natural disaster related threats, which has the potential to degrade the normal operation of the control center. OR suspicious device or activity at its Bulk Electric System control center.

19. Bulk Electric System Emergency resulting in voltage deviation on a Facility; A voltage deviation of equal to or greater than 10% of nominal voltage sustained for greater than or equal to 15 continuous minutes.

20. Uncontrolled loss of 200 Megawatts or more of firm system loads for 15 minutes or more from a single incident for entities with previous year’s peak demand less than or equal to 3,000 Megawatts

21. Total generation loss, within one minute of: greater than or equal to 2,000 Megawatts in the Eastern or Western Interconnection or greater than or equal to 1,400 Megawatts in the ERCOT Interconnection.

22. Complete loss of off-site power (LOOP) affecting a nuclear generating station per the Nuclear Plant Interface Requirements.

23. Unexpected Transmission loss within its area, contrary to design, of three or more Bulk Electric System Facilities caused by a common disturbance (excluding successful automatic reclosing).

24. Unplanned evacuation from its Bulk Electric System control center facility for 30 continuous minutes or more.

25. Complete loss of Interpersonal Communication and Alternative Interpersonal Communication capability affecting its staffed Bulk Electric System control center for 30 continuous minutes or more.

26. Complete loss of monitoring or control capability at its staffed Bulk Electric System control center for 30 continuous minutes or more.

Update Report – Schedule 1 and lines N - S in Schedule 2 and the Cyber Attributes on line T (if criteria 2 or 14 are met) should be re-submitted if significant information (or changes) regarding a reported incident or disturbance becomes available after the initial Emergency Alert or Normal Alert Report was submitted. Add the new information and/or changes to the original submission and resubmit the form, checking Update as the Alert Status on line A of the form.

Within 72 hours of incident a Final Report must be filed unless an interim update has been provided. An updated Form DOE-417 Schedule 1 and all of Schedule 2 are both due within 72 hours of the incident to provide complete disruption information.

 Complete and revise Schedule 1 as necessary and check

“Final” as Alert Status on line A.

On Schedule 2 provide a narrative description of the event and actions taken to resolve the incident. Include, as appropriate, the cause of the incident or disturbance, change in frequency, mitigation actions taken, the equipment damaged, critical infrastructure interrupted, and effects on other systems, and preliminary results from any investigations. Be sure to identify the estimated restoration date, the name of any lost high voltage substations or switchyards, whether there was any electrical system separation (and if there were, what the islanding boundaries were), and the name of the generators and voltage lines that were lost (shown by capacity type and voltage size grouping). Also include Cyber Attributes for cyber events, including the functional impact, the attack vector used, and the level of intrusion that was achieved or attempted. Equivalent documents containing this information can be supplied to meet this requirement; this includes the North American Electric Reliability Corporation (NERC) EOP-004 Disturbance Report.

Prior to submitting the form to DOE using the online DOE-417 system (available here: https://www.oe.netl.doe.gov/OE417/ ), respondents are given a choice whether to share information collected on the DOE-417 form with NERC, the Electricity Information Sharing and Analysis Center (E-ISAC), or the DHS CISA Central or their successor(s) (as required by CIP-008). This choice is clearly identified on the form line W and in the online data collection system.

For respondents that have reporting requirements under EOP-004, criteria 6, 7, and 15-26 satisfy the EOP-004 reporting if shared with NERC by DOE. For respondents that have reporting requirements under CIP-008, criteria 2 and 14 satisfy the CIP-008 reporting if shared with the E-ISAC and DHS CISA Central by DOE. For DOE to share the form, the appropriate boxes must be selected under Schedule 2, line W. If a particular incident meets both EOP-004 and CIP-008 requirements, then the respondent can file separate DOE-417 reports, if they only want certain information to be shared by DOE with NERC, the E-ISAC, and DHS CISA Central. DOE will share all of the information provided on the form with the entities selected in Schedule 2, line W.

SPECIFIC INSTRUCTIONS

Definitions of electric power industry terminology and other terms are available on the EIA website and in Appendix B, the Glossary for these instructions. Refer to the above for details on accessing the EIA website. Please refer to these definitions before completing the survey form.

Schedule 1

Criteria for filing: Examine the Criteria for Filing on page 1 and page 2 of the form to determine if a form needs to be filled out. Check all criteria (boxes 1-26) that apply to the situation or incident. If any of criteria 1-9 apply to the incident, then the form must be filed within one hour of the incident and respondents should check the Emergency Alert box on line A. If any of the boxes

10-13 are checked AND none of the boxes 1-9 have been checked, then the form must be filed within 6 hours of the incident and respondents should check the Normal Report box on the Alert Status (line A). If box 14 is checked AND none of the boxes 1-13 have been checked, then the form must be filed by the end of the next calendar day after the determination of the attempted cyber compromise and respondents should check the Attempted Cyber Compromise box on line A. If any of the boxes 15-26 are checked AND none of the boxes 1-14 have been checked, then the form must be filed by the later of 24 hours after the recognition of the incident OR by the end of the next business day and respondents should check the System Report box on the Alert Status (line A). An updated Schedule 1 also should be submitted with all of Schedule 2 filled out as the Final Report, 72 hours after the incident.

Organization Filing section lines A – D

 Line A, Alert Status: Check the Emergency Alert box if at least one of criteria 1-9 apply; check Normal Report box if only one or more of criteria 10-13 apply; check Attempted Cyber Compromise if criterion 14 applies; check System Report box if only one or more of criteria 15-26 apply; check Update box if this filing is a re-submission due to important changes or corrections from the prior submission; check Final box to indicate this is the final report submitted for the incident, which should be filed 72 hours after the incident or disturbance was detected.

 Line B, FOIA Exemption(s): Check the applicable boxes if a Freedom of Information Act (FOIA) exemption(s) applies to lines C and D if criteria 2, 3. 11, or 14 are checked.

 Lines C and D: Enter the name and address of the organization filing the report.

Incident and Disturbance Data -- Completely fill out all parts of Lines E-M that apply and are known at time of initial filling.

 Line E Geographic Area(s) Affected, Enter the name of the State(s) and political subdivision(s) (i.e., city, town, county, etc.) affected by the incident. Please identify in general terms the largest area affected by the incident. (This does not represent a requirement to list all the cities and towns in a region or State.) If you are unsure what geographic areas are affected at the time of the initial submission of Schedule 1 of the form, check the unknown box; when the geographic locations are determined fill in this data on line E of the form and re-submit the form, checking the Update or Final Alert Status box on line A, as applicable.

 Line F Date/Time Incident Began (mm-dd-yy/hh:mm), Enter the month, day, and year, the time, in 24-hour time format, and check the appropriate time zone when that the incident began.

 Line G Date/Time Incident Ended (mm-dd-yy/hh:mm), Enter the month, day, and year, the time, in 24-hour time format, and check the appropriate time zone when the event no longer met any of the 24 criteria.

 Line H Did the incident/disturbance originate in your system/area? If known, check the Yes or No box; otherwise check the unknown box. If the unknown box is checked at the time of initial submission, and later this is determined, check the Yes or No box as applicable when re- submitting the form as either an Update or Final report.

 Line I Estimate of Amount of Demand Involved (Peak Megawatts), Enter the amount of the peak demand involved over the entire incident. If amount is unknown and you are unable to make an estimate, then leave this blank. Provide the actual number or an estimate in any Update notice or Final report.

 Line J Estimate of Number of Customers Affected, Enter the total number of customers affected during the entire incident or disturbance which could be more than the peak number in the case of rolling blackouts. If this number cannot be estimated when the form is initially submitted, check the unknown box; when the number of customers can be estimated, fill in this data on line I of the form and re-submit the form, checking the Update or Final Alert Status box on line 1, as applicable.

 Line K Type of Emergency: Cause – check all that apply:

 Unknown

 Physical Attack: An attack on any part of your system suspected of being a deliberate attack or sabotage that disrupts system operations or had the intent to harm the national security of the United States.

 Threat of Physical Attack: Threatened attack on any part of your system that if acted upon disrupts system operations or had the intent to harm the national security of the United States.

 Vandalism: Vandalism to any part of your system that does not otherwise constitute a physical attack or theft.

 Theft: Theft or burglary of components or materials within you system.

 Cyber Event (Information Technology): An event occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality, or availability of the electrical system. An Information Technology (IT) cyber event is a cyber-attack on the business systems/networks that impacts an electrical service.

 Cyber Event (Operational Technology): An event occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality, or availability of the electrical system. An Operational Technology (OT) cyber event is a cyber-attack on systems/networks of industrial control systems (ICS) including Supervisory Control and Data Acquisition (SCADA) and other control system configurations.

 Fuel supply emergencies, interruption, or deficiency: Check if an existing or anticipated fuel supply emergency situation occurred.

 Generator loss or failure not due to fuel supply interruption or deficiency or transmission failure

 Transmission equipment failure (not including substation or switchyard): If failure of or damage to transmission equipment occurred, causing disruption to service or reliability.

 Failure at high voltage substation or switchyard: If substations or switchyards (230+ kV AC or 200+ kV DC) were adversely affected, causing disruption to service or reliability.

 Weather or Natural Disaster: Check if severe weather (thunderstorms, ice storms, etc.) or natural disasters (hurricanes, floods, tornadoes, solar activity, etc.) have caused service disruption.

 Operator Action(s): Check if service or reliability disruption is attributable to operator action.

 Other: Check if the cause is known, but not one of those listed above.

 Additional Information/Comments: Include any description of the cause which can be publically released.

 Line L Type of Emergency: Impact- check all that apply:

 None

 Control center loss, failure, or evacuation: One or more facilities hosting operating personnel that monitor and control the Bulk Electric System (BES) in real-time to perform the reliability tasks, including their associated data centers, of: 1) a Reliability Coordinator, 2) a Balancing Authority, 3) a Transmission Operator for transmission Facilities at two or more locations, or 4) a Generator Operator for generation Facilities at two or more locations

 Loss or degradation of control center monitoring or communication systems: Communications between facilities that monitor and control the Bulk Electric System (BES) in real-time to perform the reliability tasks, including their associated data centers

 Damage or destruction of a facility

 Electrical system separation (islanding): If impact was that islanding has occurred.

 Complete operational failure or shutdown of the transmission and/or distribution system: If impact was total system failure occurred.

 Major transmission system interruption: An event has occurred that required action(s) to relieve voltage or loading conditions; or transmission separation or islanding has occurred.

 Major distribution system interruption: A significant uncontrolled loss of load has occurred, or an unexpected controlled loss of load is required.

 Uncontrolled loss of 200 MW or more of firm system loads for 15 minutes or more

 Loss of electric service to more than 50,000 customers for 1 hour or more

 System-wide voltage reductions or 3 percent or more:

 Voltage deviation on an individual facility of ≥10% for more than 15 minutes

 Inadequate electric resources to serve load: Insufficient generation exists to meet demand, or unexpected problems or inadequacies develop that impact operational and/or system reliability.

 Generating capacity loss of 1,400 MW or more.

 Generating capacity loss of 2,000 MW or more

 Complete loss of off-site power to a nuclear generating station: Loss of the electric power supply provided from the electric system to the nuclear power plant distribution system as required per the nuclear power plant license.

 Other: Check if the impact is known, but not one of those listed above.

 Additional Information/Comments: Include any description of the impact which can be publically released.

 Line M Type of Emergency: Action Taken, check all that apply:

 Public appeal to reduce the use of electricity for the purpose of maintaining the continuity of the electric power system: If public appeals to reduce the use of electricity for purposes of maintaining the continuity of the bulk electric power system were issued. Check only if appeals were issued during emergency conditions. Do not check if appeals were energy conservation related.

 Implemented a Warning, Alert, or Contingency Plan: If existing short-term contingency plans were implemented to reduce demand, maximize generation to maintain the bulk power system, and/or address other reliability issues.

 Voltage Reduction: If system wide voltage reductions of 3 percent or greater were implemented.

 Shed Firm Load: If in order to maintain the bulk power system, system operators called for load shedding of 100 MW or greater of firm-load customers’ demand, or if firm load customers were disconnected from the bulk power system during emergency conditions.

 Shed Interruptible Load: If in order to maintain the bulk electric system, system operators called for load shedding of 100 MW or greater of pre-selected interruptible load customers’ demand, or if those interruptible customers were disconnected from the bulk power system during emergency conditions. Do not check if terminations were under contract agreements during normal operations.

 Repaired/Restored: check if system was repaired or restored.

 Mitigation(s) Implemented: check if mitigations for the event were implemented.

 Other: check if other actions were taken.

 Additional Information/Comments: Include any description of the actions taken that can be publically released.

Schedule 2

When to File: Lines N - S of Schedule 2 must be filed per the timeline established by criteria 1 - 26. If criteria 2 or 14 applies, then the Cyber Attributes on line T must also be filed per the timeline established by criteria 2 or 14. All of Schedule 2 must be filed within 72 hours of the incident along with an updated Schedule 1.

 Line N FOIA Exemption(s): Identify whether Schedule 2 contains information that may be applicable to a FOIA exemption(s).

 Lines O – S: Name of Official that needs to be contacted for follow up. Fill in contact information on official to contact for follow up.

 Line T Narrative: Provide a description of the incident and actions to resolve it.

 Line U Estimated Restoration: Provide an estimate when

restoration of customers who are able to receive power will be

complete.

 Line V Assets Impacted: Provide the names of the assets impacted

by this event.

SPECIAL INVESTIGATIONS

Under its authorities, DOE may instigate a special investigation into incidents affecting the electric power industry that involve more than BAs and Reliability Coordinators. DOE may address any energy concern or may contact any utility or business entity that participates in the electric power industry for technical information concerning a particular incident. These special investigations are infrequent.

PROVISIONS REGARDING CONFIDENTIALITY OF INFORMATION

The information reported on Schedule 1, except for lines C and D if boxes in line B are checked and to the extent that it satisfies the criteria for exemption under FOIA, will be considered “public information” and may be publicly released in company or individually identifiable form.

Information on Schedule 2 of the form and lines C and D of Schedule 1 will not be disclosed to the public to the extent that it satisfies the criteria for exemption under FOIA, 5 U.S.C. § 552, the DOE regulations, 10 C.F.R. § 1004.11, implementing the FOIA, the Trade Secrets Act, 18 U.S.C. § 1905, and Critical Energy Infrastructure Information regulations as defined by the Federal Energy Regulatory Commission pursuant to section 215A(d) of the Federal Power Act, as amended. DOE will protect the information in accordance with its confidentiality and security policies and procedures. Potential releases in response to FOIA requests may occur following a case-by-case determination of the appropriate level of data protection.

In accordance with the FOIA, the DOE provides company-specific protected data to other Federal agencies when requested for official use. The information reported on this form may also be made available, upon request, to another component of DOE; to any Committee of Congress, the U.S. General Accountability Office, or other Federal agencies authorized by law to receive such information. A court of competent jurisdiction may obtain this information in response to an order. The information may be used for any non-statistical purposes such as administrative, regulatory, law enforcement, or adjudicatory purposes.

The data collected on Form DOE-417, Electric Emergency Incident and disturbance Report, will be used by DOE to meet its overall national security and National Response Framework responsibilities.

SANCTIONS

DOE is authorized to collect the information on Form DOE-417 under the Federal Energy Administration Act of 1974 (Pub. L. No. 93-275, 15 U.S.C. 761 et seq.) as amended, the Federal Power Act (16 U.S.C 791a et seq.), the DOE Organization Act (Public Law No. 95-91, 42 U.S.C. 7101 et seq.) as amended, and the Public Utility Regulatory Policies Act of 1978, Sect. 209 (Public Law No. 95-317, 92 stat. 3117, 16 U.S.C. 824a-2). The timely submission of Form DOE-417 by those required to report is mandatory under Section 13(b) of the Federal Energy Administration Act of 1974 as amended. The timely submission of Form OE-417 by those required to report is mandatory under Title 15 U.S.C. §772(b), as amended. Failure to respond may result in a civil penalty of not more than $10,821 each day for each violation. The government may bring a civil action to prohibit reporting violations that may result in a temporary restraining order or a preliminary or permanent injunction without bond. In such civil action, the court may also issue mandatory injunctions commanding any person to comply with these reporting requirements. The government may bring a civil action to prohibit reporting violations, which may result in a temporary restraining order or a preliminary or permanent injunction without bond. In such civil action, the court may also issue mandatory injunctions commanding any person to comply with these reporting requirements. Title 18 U.S.C. § 1001 makes it a criminal offense for any person knowingly and willingly to make to any Agency or Department of the United States any false, fictitious, or fraudulent statements as to any matter within its jurisdiction.

FILING FORMS WITH THE FEDERAL GOVERNMENT AND ESTIMATED REPORTING BURDEN

Respondents are not required to file or reply to any Federal collection of information unless it has a valid OMB control number. The public reporting burden for Schedule 1 is estimated to average 10 minutes per response and 1.5 hours for Schedule 2, including reviewing the form and instructions, gathering information, and submitting the form during an emergency situation. The burden per response has been calculated to be 1.8 hours on average. Send comments regarding this burden estimate or any other aspect of this collection of information including suggestions for reducing this burden to:

Office of Cybersecurity, Energy Security, and Emergency Response, CR-20 1000 Independence Avenue, SW, Washington, D.C. 20585; and to the Office of Information and Regulatory Affairs, Office of Management and Budget, Washington, D.C. 20503.

U.S. Department of Energy Form DOE-417	ELECTRIC EMERGENCY INCIDENT AND DISTURBANCE REPORT	Form Approved OMB No. 1901-0288 Approval Expires: xx/xx/xx
Appendix A - QUICK REFERENCE GUIDE
WHO MUST REPORT
Entity – Functional Responsibility	What is Excluded
Electric Utilities	There are no exclusions allowed. All items need to be addressed.
Balancing Authorities	Reporting on the count of customers (and the amount of load, if the BA is based at a Regional Transmission Organization (RTO) or Independent System Operator) is required only for the Final Report. A BA located in vertically integrated utilities, a municipality, federal utility, state-owned or cooperative will report the amount of load and counts of customers.
Reliability Coordinators	Reporting on the count of customers is excluded. If the RC has an agreement with the RTO to supply the customer counts, the RC can supply this information
Generating Entities	Entities who have 300 MW or more of generation detected to one or more end-use customers are required to file the form if criteria 2, 3, 6, 11, or 14 are met.
Local Utilities in Alaska, Hawaii, Puerto Rico, the U.S. Virgin Islands, and the U.S. Territories	If the local electrical system is less than 300 MW, then only file if criteria 1, 3, 4, or 5 are met.
Computer, telecommunication, and physical security offices that support the BA, RC, and electric utility or located within the entity	These support centers or offices can file information, in lieu of the emergency offices, on incident types 1, 3, 10 or 11 in direct submissions to DOE. These support centers or offices will address no other incident types.
WHEN TO SUBMIT
Schedule	Time Limit
Submit Emergency Alert - Schedule 1 and lines N – S of Schedule 2 and if criterion 2 is met, also submit line T of Schedule 2	Within 1 hour after the incident if any of criteria 1-9 is met.
Submit Normal Report - Schedule 1 and lines N – S of Schedule 2	Within 6 hours after the incident if any of criteria 10-13 is met and criteria 1-9 has not been met.
Submit Attempted Cyber Compromise – Schedule 1 and lines N - T	By the end of the next calendar day after a determination of the attempted cyber compromise.
Submit System Report - Schedule 1 and lines N – S of Schedule 2	By the later of 24 hours after the recognition of the incident OR by the end of the next business day. Note: 4:00 pm local time will be considered the end of the business day.
Submit Update - Schedule 1 and lines N – S of Schedule 2	As applicable after initial submission if significant new information is available or if significant changes occurred since submission.
Submit Final - Schedule 1 and Schedule 2	Within 72 hours after incident.
HOW TO SUBMIT
How	Website/Email Address/Phone Number
Online (Preferred Method)	https://www.oe.netl.doe.gov/OE417/
Telephone (Staffed 24/7)	(202) 586-8100
Fax	(202) 586-8485 (only when other methods are not available)
Email	[email protected] (only when other methods are not available)

APPENDIX B

_GLOSSARY

Balancing Authority (BA): The responsible entity that integrates resource plans ahead of time, maintains load-interchange-generation balance within a Balancing Authority Area, and supports Interconnection frequency in real time.

Complete Operational Failure: An emergency event where an electrically isolated or interconnected electrical system suffers total system collapse that results in the shutdown of the transmission and/or distribution electrical system. If communications are affected, then reporting is done as soon as practical after restoration of an operational control center.

Cyber Event: A disruption on the electrical system and/or communication system(s) caused by unauthorized access to computer software and communications systems or networks including hardware, software, and data.

Cyber Security Incident: See NERC Glossary.

Cyber/computer/telecom: Cyber/computer systems are those used in a power entity organization for electric power operations, power marketing or corporate IT (information technology) functions.

Electric Utility: A corporation, person, agency, authority, or other legal entity or instrumentality aligned with distribution facilities for delivery of electric energy for use primarily by the public. Included are investor-owned electric utilities, municipal and State utilities, Federal electric utilities, and rural electric cooperatives. A few entities that are tariff based and corporately aligned with companies that own distribution facilities are also included

Electrical System Separation – Islanding: Part or parts of the utility grid remain(s) operational in an otherwise blacked out area.

Electronic Access Control or Monitoring Systems: See NERC Glossary.

Firm Load: Power provided to customers that is continuously available on demand and which is subject to interruption only under extreme circumstances.

Fuel Supply Emergency: Existing or anticipated fuel supply situations that could threaten continuity of the bulk electric power supply system, including: (1) Fuel inventories or hydro project water storage levels at 50 percent or less of normal, with a projected continued downward trend, (2) Emergency generation requiring abnormal use of a particular fuel with the potential to reduce supply or stocks to a level that threatens the reliability or adequacy of electric service.

Generating Entity: Any combination of physically connected generators, reactors, boilers, combustion turbines, and other prime movers operated together to produce electric power.

Independent System Operator (ISO): An independent entity that coordinates regional transmission in a manner that is non- discriminatory against any transmission owners, operators or users, and ensures a safe and reliable electric system.

Interruptible Load: This Demand-Side Management category represents the consumer load that, in accordance with contractual arrangements, can be interrupted at the time of annual peak load by the action of the consumer at the direct request of the system operator. Reporting on the Form DOE-417 is limited to those interruptions implemented under emergency operational policy or contingency plans.

Major Distribution System Interruption: Loss of load has occurred in a controlled or uncontrolled fashion that exceeds the reporting thresholds.

Major Generation Inadequacy: When there is insufficient generation to meet demand, forcing a service interruption or disruption.

Major Transmission Interruption: The disruption of the movement or transfer of electric energy over an interconnected group of lines and associated equipment between points of supply and points at which it is transformed for delivery to other electric systems that will deliver it in their distribution systems to end-use consumers. Major interruptions are those disruptions that impact the reliability of the electrical system that cannot be addressed by use of alternate transmission paths or cause the potential of additional system disabling contingencies. These transmission events require action(s) to relieve voltage or loading conditions, or transmission separation or islanding has occurred.

Regional Transmission Organization (RTO): Independent entities that control and operate regional electric transmission grids free of any discriminatory practices.

Reliability Coordinators: The entity that is the highest level of authority who is responsible for the reliable operation of the Bulk Electric System, has the Wide Area view of the Bulk Electric System, and has the operating tools, processes and procedures, including the authority to prevent or mitigate emergency operating situations in both next-day analysis and real-time operations.

Reportable Cyber Security Incident: See NERC Glossary.

Telecommunications: Critical telecommunications are those systems that are essential for the power industry system operation including wireline and wireless, both voice and data.

Transmission Operator: The entity responsible for the reliability of its “local” transmission system, and that operates or directs the operations of the transmission facilities.

Voltage Reduction: Any intentional reduction of system voltage for reasons of maintaining the continuity of service of the bulk electric system.

NERC Glossary: A glossary of additional terms defined by the North American Electric Reliability Corporation (NERC) are available on NERC’s website at: http://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf