RM96-1-042 NAESB FERC-545 FERC-549C supporting statement

8

FERC-545 (OMB Control No. 1902-0154)

FERC-549C (OMB Control No. 1902-0174)

Docket No. RM96-1-042 NOPR (issued 1/19/2021)

RIN: 1902-AF80

SUPPORTING STATEMENT FOR

FERC-545 [(Gas Pipeline Rates: Rate Change (Non-Formal)]

in Docket No. RM96-1-042

The Federal Energy Regulatory Commission (Commission or FERC) requests that the Office of Management and Budget (OMB) review/approve changes to and the extension of the FERC-545 information collection [(Gas Pipeline Rates: Rate Change (Non-Formal)], as stated in the NOPR in Docket No. RM96-1-042.

The Commission is submitting this consolidated supporting statement to OMB with one ICR for each of the two separate OMB Control Numbers (1902-0154 for FERC-545 and 1902-0174 for FERC-549C).

1. CIRCUMSTANCES THAT MAKE THE COLLECTION OF INFORMATION NECESSARY

NOPR in Docket RM96-1-042

Since 1996, the Commission has adopted regulations to standardize the business practices and communication methodologies of interstate natural gas pipelines to create a more integrated and efficient pipeline grid. These regulations have been promulgated in the Order No. 587 series of orders,¹ wherein the Commission has incorporated by reference standards for interstate natural gas pipeline business practices and electronic communications that were developed and adopted by NAESB’s WGQ. Upon incorporation by reference, this version of the standards will replace the currently incorporated version (Version 3.1) of those business practice standards.

1. On August 17, 2020, NAESB filed a report informing the Commission that it had adopted and ratified WGQ Version 3.2 of its business practice standards applicable to interstate natural gas pipelines. Version 3.2 of the WGQ includes business practice standards developed and modified in response to industry requests and directives from the NAESB Board of Directors. This version also includes the standards developed in response to the recommendations of Sandia National Laboratory (Sandia),² which in 2019 issued a cybersecurity surety assessment of the NAESB standards sponsored by DOE (Sandia Surety Assessment),³ and the standards developed to enable the use of distributed ledger technologies when transacting the NAESB Base Contract for Sale and Purchase of Natural Gas. The NAESB report identifies all the changes made to the WGQ Version 3.1 Standards and summarizes the deliberations that led to the changes being made. It also identifies changes to the existing standards that were considered but not adopted due to a lack of consensus or other reasons. In response to the recommendations in the Sandia report, the proposals in this NOPR would, if implemented, upgrade current business practices and communication standards by updating the Quadrant EDM Related Standards and IET Related Standards to specifically: (1) require the implementation of fixes or patches for known vulnerabilities as soon as reasonably practicable in coordination with other trading partners; (2) specify notification timelines to provide notice to trading partners of any systems or software that have not been updated and the potential impact of using the vulnerable system; (3) include both specific and broad adoptions of system security measures and specific notification and coordination during outages with affected trading partners; (4) maintain a minimum encryption strength of 128 bits, (5) specify that OpenPGP should be used to create public and private keys for privacy and digital signature applications; (6) specify HTTPS whenever secure communication is required to protect information in transit and support overall privacy needs; (7) use the largest feasible key length consistent with implementation of current business processes; (8) state that secure web sites should employ individual user credentials; and (9) encourage security assessments and coordination between customers, vendors, and trading partners. Further, in response to industry requests or through the normal course of WGQ activities, the proposals in this NOPR would, if implemented, upgrade current business practices and communication standards by specifically: (1) updating the Nominations Related Standards to allow a Service Requester to determine which rights of the contract its segmentation nomination is using; (2) updating the Quadrant EDM Related Standards to (i) define a NAESB standard time frame for information to be retained on a pipeline’s Informational Postings web site, (ii) allow for processing functions at the line item level on Customer Activities web sites and allow for the use of icons and/or graphical control elements for navigation and/or processing functions, and (iii) make minor revisions designed to add clarity, update the minimum technical characteristics to account for changes in technology since the previous version (Version 3.1) of the WGQ standards, and update the minimum and suggested operating systems and web browsers that entities should support; (3) updating multiple sets of standards to remove references to the term “gigacalories” and add the term “gigajoules” as the standard quantity for nominations, confirmations, and scheduling in Mexico; and (4) revising the NAESB WGQ data sets or other technical implementation documentation while not resulting in modifications to the underlying business practice standards. The package of standards also includes minor corrections. The implementation of these data requirements will provide additional transparency to Informational Postings web sites and will improve communication standards. The implementation of these standards and regulations will promote the additional efficiency and reliability of the natural gas industries’ operations thereby helping the Commission to carry out its responsibilities under the NGA. In addition, the Commission’s Office of Enforcement will use the data for general industry oversight. We have reviewed the requirements pertaining to business practices of interstate natural gas pipelines and made a preliminary determination that the proposed revisions are necessary to establish a more efficient and integrated pipeline grid. These requirements conform to our plan for efficient information collection, communication, and management within the natural gas pipeline industries. We determined through our internal review, that there is specific, objective support for the burden estimates associated with the information requirements.

2. HOW, BY WHOM, AND FOR WHAT PURPOSE THE INFORMATION IS TO BE USED AND THE CONSEQUENCES OF NOT COLLECTING THE INFORMATION

In this NOPR, we propose to incorporate by reference, in our regulations, Version 3.2 of the NAESB WGQ consensus business practice standards, with certain exceptions.⁴ We propose that compliance filings made in accordance with a final rule be made 120 days after issuance of a final rule in this proceeding or on the first business day thereafter if falling on a weekend or holiday, with an effective date 180 days from the date compliance filings are due in this proceeding or the first business day thereafter if falling on a weekend or holiday. This will allow time for the Commission to process the compliance filings before the effective date of the new standards. As the Commission found in Order No. 587, adoption of consensus standards is appropriate, because the consensus process helps ensure the reasonableness of the standards by requiring that the standards draw support from a broad spectrum of industry participants representing all segments of the industry. Moreover, because the industry conducts business under these standards, the Commission's regulations should reflect those standards that have the widest possible support. In section 12(d) of the National Technology Transfer and Advancement Act of 1995, Congress affirmatively requires federal agencies to use technical standards developed by voluntary consensus standards organizations, like NAESB, to carry out policy objectives or activities.

Modifications to Previous Version of Standards

Modifications in Response to the Sandia Surety Assessment

NAESB revised previously incorporated standards and developed new standards in response to the recommendations in the Sandia Surety Assessment. Specifically, NAESB adopted revisions to the WGQ EDM Related Business Practice Standards, which establish the framework for the electronic dissemination and communication of information between parties in the North American wholesale gas marketplace, and to the WGQ IET Related Business Practice Standards, which define the implementation of various technologies necessary to communicate transactions and other electronic data using standard protocols for electronic commerce over the internet between trading partners. First, NAESB adopted two new standards, 4.3.109 and 10.3.28, to provide that trading partners should evaluate software fixes or patches for known vulnerabilities within 30 days and implement the fix or patch as soon as reasonably practicable based on the severity of the risk. Second, NAESB adopted two new standards, 4.3.110 and 10.3.29, to provide that trading partners should mutually agree to the version of the EDM and IET to be used. Third, the new standards specify notification and coordination timelines with trading partners, where applicable, to address vulnerable systems or software as soon as possible. Fourth, the Sandia Surety Assessment recommended that NAESB consider guidelines for configuration and logging, network traffic monitoring, alerting systems, and manual continuity of operations in the event of abnormal behavior or failure conditions within the system. In response, NAESB added language to new Standards 4.3.110 and 10.3.28 to include both specific and broad adoptions of such system security measures.

Further, NAESB added language to existing Standards 4.3.60, 4.3.61, 10.2.33, and 10.3.25 to clarify the Transport Layer Security protocol,⁵ which encrypts data to hide information from electronic observers on the internet. NAESB also deleted all references to the Secure Sockets Layer protocol in the standards.

Concerning identification key lengths, the Sandia Surety Assessment recommended that Rivest-Shamir-Adelman keys⁶ must be no shorter than 2048 bits, Elliptic Curve Digital Signature Algorithm keys⁷ must be no shorter than 224 bits, Hash⁸ algorithms should be from the Secure Hash Algorithm (SHA)-2⁹ or SHA-3 families, and acceptable Advanced Encryption Standard key lengths range from 128, to 192, to 256. The Sandia Surety Assessment recommended that, in general, implementors use the largest feasible key length consistent with implementation of current business processes. In response, NAESB deleted Standard 4.3.83 to remove legacy support references and maintain a minimum encryption strength of 128 bits. Further, NAESB revised existing Standards 10.2.34 and 10.3.15 to delete a proprietary Pretty Good Privacy (PGP)¹⁰‑related hyperlink and to accommodate license-free OpenPGP,¹¹ respectively. NAESB also adopted a new Standard 10.2.39 to specify that OpenPGP should be used to create public and private keys for privacy and digital signature applications.

Further, NAESB revised existing Standards 4.3.60, 4.3.84, 10.3.4, and 10.3.16 to specify Hyper-Text Transport Protocol Secure (HTTPS),¹² which is an encrypted version of Hyper-Text Transport Protocol (HTTP),¹³ whenever a secure communication is required to protect information in transit and support overall privacy needs. Moreover, NAESB revised existing Standards 4.3.60 and 10.3.16 to require multi-factor (e.g., two-factor) authentication on an individual basis and state that secure web sites should employ individual user credentials.

Modifications in Response to Industry Request

The following section describes standards development efforts undertaken by NAESB in response to industry requests or through the normal course of WGQ activities that resulted in modifications to the Nomination Related Standards, QEDM Standards, and an effort that impacted multiple sets of standards. NAESB made corresponding revisions, where appropriate, to the related data sets and technical implementation as part of the standards development effort.

Nomination Related Standards

NAESB revised existing Standards 1.3.27, 1.4.1, and 1.4.2 to add a new data element “Capacity Block ID” to allow a Service Requester to determine which primary point rights of the contract their segmented nomination¹⁴ is using and eliminate an existing manual business process from the TSP to automate the business process.

Quadrant Electronic Delivery Mechanisms Related Standards

NAESB developed two new standards, Standard 4.3.107 to establish a standard data retention period for retrieval of Operationally Available data from the Informational Postings Web site, and Standard 4.3.108, to establish a standard data retention period for retrieval of Notices for the subcategories of Critical, Non-Critical and Planned Service Outage from the Informational Postings Web site.

Revisions Impacting Multiple Standards

NAESB revised multiple standards¹⁵ and data sets¹⁶ to remove references to the term “gigacalories” and add the term “gigajoules,” consistent with the standard quantity for nominations, confirmations, and scheduling in Mexico.

Other Material in NAESB’s Report

NAESB revised multiple data sets which impacted technical implementation documentation only.

Further, NAESB revised its optional model contracts and corresponding Mexican and Canadian Addendums to reflect a standard digital representation of natural gas trade events. NAESB states that these revisions are intended to capitalize on smart contracts and distributed ledger technologies.

Standards Proposed Not to be Incorporated by Reference

We propose to continue our past practice¹⁷ of not incorporating by reference into our regulations any optional model contracts because we do not require the use of these contracts and therefore we do not need to include them in our regulations.¹⁸ In addition, consistent with our findings in past proceedings, we are not proposing to incorporate by reference the Wholesale Electric Quadrant/WGQ eTariff Related Standards because the Commission adopted and posted its standards and protocols for electronic tariff filings¹⁹

Proposed Implementation Procedures

We propose to continue the compliance filing requirements as revised in Order No. 587-V.²⁰ We propose that compliance filings made in accordance with a final rule be made 120 days after issuance of a final rule in this proceeding or on the first business day thereafter if falling on a weekend or holiday, with an effective date 180 days from the date compliance filings are due in this proceeding or the first business day thereafter if falling on a weekend or holiday. As the Commission found in Order No. 587-V, adoption of the revised compliance filing requirements increases the transparency of the interstate natural gas pipelines’ incorporation by reference of the NAESB WGQ Standards so that shippers and the Commission will know which tariff provision(s) implements each standard as well as the status of each standard.²¹

Consistent with our practice since Order No. 587-V, each pipeline must designate a single tariff section under which every NAESB WGQ Standard incorporated by reference by the Commission is listed.²² For each standard, the pipeline must specify in the tariff section or tariff sheet(s) listing all the NAESB standards:

1. whether the standard is incorporated by reference;

2. for those standards not incorporated by reference, the tariff provision that complies with the standard; or

3. for those standards with which the pipeline does not comply, an explanatory statement, including an indication of whether the pipeline has been granted a waiver, extension of time, or other variance with respect to compliance with the standard.²³

Likewise, consistent with past practice, we will post on our eLibrary web site (under Docket No. RM96-1-042) a sample tariff format, to provide filers an illustrative example to aid them in preparing their compliance filings. Consistent with our policy since Order No. 587-V,²⁴ we propose that requests for waivers that do not meet the requirements set forth in Order No. 587-V will not be granted. In particular, as we explained in Order No. 587-V, waivers are unnecessary and will not be granted when the standard applies only on condition the pipeline performs a business function and the pipeline currently does not perform that function.²⁵If the pipeline is requesting a continuation of an existing waiver or extension of time, it must include a table in its transmittal letter that identifies the standard for which the Commission granted a waiver or extension of time, and the docket number or order citation to the proceeding in which the Commission granted the waiver or extension of time. The pipeline also must present an explanation for why such waiver or extension of time should remain in force with regard to the WGQ Version 3.2 Standards. This continues our practice of having pipelines include in their tariffs a common location that identifies the way in which the pipeline is incorporating all the NAESB WGQ Standards and the standards with which it is required to comply.

3. DESCRIBE ANY CONSIDERATION FOR THE USE OF IMPROVED INFORMATION TECHNOLOGY TO REDUCE BURDEN AND TECHNICAL OR LEGAL OBSTACLES TO REDUCING BURDEN

In previous rulemakings,²⁶ the Commission implemented the capability and requirement for electronic filing of all tariff submissions. FERC also improved the security of submitting those electronic filings and the pipelines’ on-line process of appointing and modifying agents with the authority to make a filing on the pipeline’s behalf (providing filing companies with greater control over the agents eligible to make specific types of filings on their behalf).

The standards we are proposing consist of seven suites of NAESB WGQ Business Practice Standards that address a variety of topics and are designed to streamline the transactional processes for the wholesale natural gas industry by promoting a more competitive and efficient market. These include the: WGQ Additional Business Practice Standards; WGQ Nominations Related Business Practice Standards; WGQ Flowing Gas Related Business Practice Standards; WGQ Invoicing Related Business Practice Standards; Quadrant Electronic Delivery Mechanism Related Business Practice Standards; Capacity Release Related Business Practice Standards; and Internet Electronic Transport Related Business Practice Standards. We summarize these standards below:

The WGQ Additional Business Practice Standards address six areas: Creditworthiness; Storage Information; Gas/Electric Operational Communications; Operational Capacity; Unsubscribed Capacity; and Location Data Download.

• The Creditworthiness related standards describe requirements for the exchange of information, notification, and communication between parties during the creditworthiness evaluation process.

• The Storage Information related standards define the information to be provided to natural gas service requesters related to storage activities and/or balances.

• The Gas/Electric Operational Communications related standards define communication protocols intended to improve coordination between the gas and electric industries in daily operational communications between transportation service providers and gas-fired power plants. The standards include requirements for communicating anticipated power generation fuel for the upcoming day as well as any operating problems that might hinder gas-fired power plants from receiving contractual gas quantities.

• The Operational Capacity related standards define requirements of the transportation service provider related to the reporting and requesting of a transportation service provider’s operational capacity, total scheduled quantity, and operationally available capacity.

• The Unsubscribed Capacity related standards define requirements of the transportation service provider related to the reporting and requesting of a transportation service provider’s available unsubscribed capacity.

• The Location Data Download related standards define requirements for the use of codes assigned by the transportation service provider for locations and common codes for parties communicating electronically.

4. DESCRIBE EFFORTS TO IDENTIFY DUPLICATION AND SHOW SPECIFICALLY WHY ANY SIMILAR INFORMATION ALREADY AVAILABLE CANNOT BE USED OR MODIFIED FOR USE FOR THE PURPOSE(S) DESCRIBED IN INSTRUCTION NO. 2.

Commission filings and data requirements are periodically reviewed in conjunction with OMB clearance expiration dates. This includes a review of the Commission’s regulations and data requirements to identify duplication. No duplication of the information collection requirements has been found.

5. METHODS USED TO MINIMIZE BURDEN IN COLLECTION OF INFORMATION INVOLVING SMALL ENTITIES

The Small Business Administration's (SBA) Office of Size Standards develops the numerical definition of a small business as matched to North American Industry Classification System Codes (NAICS). The SBA (in 13 CFR 121.101) has established a size standard for pipelines transporting natural gas, stating that a firm is a small entity if its annual receipts (including those of its affiliates) are $30 million or less.²⁷

The FERC-545 and FERC-549C is a filing requirement related to pipeline rate filing obligations for the transportation and storage of natural gas. The filing collects data from both large and small respondent companies. The data required were designed to impose the least possible burden for companies, while collecting the information required for processing the filings. Use of the Internet to file documents electronically is the primary method the Commission uses to minimize the filing burden.

6. CONSEQUENCE TO FEDERAL PROGRAM IF COLLECTION WERE CONDUCTED LESS FREQUENTLY

FERC-545 and FERC-549C is a one-time compliance filing. Failure to collect the information would prohibit the Commission from properly monitoring and evaluating pipeline transactions and meeting statutory obligations under the NGPA and NGA.

7. EXPLAIN ANY SPECIAL CIRCUMSTANCES RELATING TO THE INFORMATION COLLECTION

The FERC-545 and FERC-549C presents no special circumstances.

8. DESCRIBE EFFORTS TO CONSULT OUTSIDE THE AGENCY: SUMMARIZE PUBLIC COMMENTS AND AGENCY'S RESPONSE TO THESE COMMENTS

The federal register notice published on March 5, 2021 to solicit comment. Comments are due by April 19,2021.

9. EXPLAIN ANY PAYMENT OR GIFTS TO RESPONDENTS

There are no payments or gifts made or given to respondents associated with collections FERC-545 and 549C.

10. DESCRIBE ANY ASSURANCE OF CONFIDENTIALITY PROVIDED TO RESPONDENTS

The FERC-545 and FERC-549C data is public. In general, for all submittals to the Commission, filers may submit specific requests for confidential treatment to the extent permitted by law; details are available in 18 C.F.R. Section 388.112.

11. PROVIDE ADDITIONAL JUSTIFICATION FOR ANY QUESTIONS OF A SENSITIVE NATURE, SUCH AS SEXUAL BEHAVIOR AND ATTITUDES, RELIGIOUS BELIEFS, AND OTHER MATTERS THAT ARE COMMONLY CONSIDERED PRIVATE.

There are no questions of a sensitive nature in the reporting requirements.

12. ESTIMATED BURDEN OF COLLECTION OF INFORMATION

The Commission’s burden estimates for the proposals in this NOPR are for one-time implementation of the information collection requirements of this NOPR (including tariff filing, documentation of the process and procedures, and information technology work).

The collections of information related to this NOPR fall under FERC–545 (Gas Pipeline Rates: Rate Change (Non-Formal))²⁸ and FERC–549C (Standards for Business Practices of Interstate Natural Gas Pipelines).²⁹ The following estimates of reporting burden are related only to this NOPR and anticipate the costs to pipelines for compliance with our proposals in this NOPR. The burden estimates are primarily related to implementing these standards and regulations and will not result in ongoing costs.

RM96-1-042 NOPR (Standards for Business Practices of Interstate Natural Gas Pipelines)
	Number of Respondents30 (1)	Annual Number of Responses per Respondent (2)	Total Number of Responses (1)*(2)= (3)	Average Burden Hr. Per Response (4)	Total Annual Burden Hours & Total Annual Cost31 (3)*(4)=(5)	Annual Costs Per Respondent ($) (5)/ (1) = (6)
FERC-545 (one-time)	178	1	178	10 hrs.; $1,010	1,780 hrs.; $179,780	$1,010
FERC-549C (one-time)	178	1	178	100 hrs.; $10,100	17,800 hrs.; $1,797,800	$10,100
TOTAL			356		19,580 hrs.; $1,977,580

The one-time burden (for both the FERC-545 and FERC-549C) will take place in Year 1 and will be averaged over three years:

FERC-545: 1,780 hours ÷ 3 = 593 hours/year over three years

FERC-549C: 17,800 hours ÷ 3 = 5,933 hours/year over three years

The number of responses is also averaged over three years (for both the FERC-545 and FERC-549C):

FERC-545: 178 responses ÷ 3 = 59 responses/year

FERC-549C: 178 responses ÷ 3 = 59 responses/year

The responses and burden for Years 1-3 will total respectively as follows:

Year 1: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

Year 2: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

Year 3: 59 responses; 593 hours (FERC-545); 5,933 hours (FERC-549C)

13. ESTIMATE OF THE TOTAL ANNUAL COST BURDEN TO RESPONDENTS

There are no capital or start-up costs for the requirements in the NOPR in RM96-1-042 that are not associated with the burden hours. All of the costs are related to burden hours and are detailed in Questions #12 and #15.

14. ESTIMATED ANNUALIZED COST TO FEDERAL GOVERNMENT

The following federal costs relate only to the new requirements in the NOPR.

	Number of Hours or FTE’s	Estimated Annual Federal Cost ($)32
PRA33 Administration Cost34	-	$ 6,47535
Data Processing and Analysis, Sub-Total36	137	$172,329
FERC-545	0.75	$129,247
FERC-549C	0.25	$43,082
FERC Total	1	$178,804

15. REASONS FOR CHANGES IN BURDEN INCLUDING THE NEED FOR ANY INCREASE

The NOPR in RM96-1-042 amends the Commission’s regulations at 18 CFR 284.12(a) to incorporate by reference the latest version (Version 3.2) of seven business practice standards applicable to interstate natural gas pipelines adopted by NAESB’s WGQ. By incorporating these standards by reference into the Commission’s regulations the Commission has made compliance mandatory and enforceable. Non-compliance, absent a specific waiver, violates the Commission’s regulations as well as the terms of each pipeline’s tariff. The final rule revises and replaces the existing incorporated business practices standards (the Version 3.1 standards) to make two substantive revisions to its Nominations Related Standards, one to establish a standard rounding process for elapsed-prorated-scheduled quantity calculations, and a second to revise the specifications for the information to be included in a nomination request.

NAESB also adopted three revisions to the Quadrant Electronic Delivery Mechanism Related Standards. First, it has increased the allowable field length in ASCII Comma Separated Value Files to 3000 characters. Second, it has adopted new Standard 4.3.106 to allow checkboxes and radio buttons in the Transmission Service Providers’ Electronic Bulletin Boards. Third, NAESB modified its standards to update the operating systems and web browsers that entities should support on behalf of users. Additionally, clarifying language was added to the Secure Sockets Layer/Transport Layer Security protocols.

Other changes adopted by NAESB to the business practice standards included changes to the NAESB WGQ data sets and other technical implementation documentation as well as revisions to the Flowing Gas Related data sets and technical implementation. Further, NAESB revised the Imbalance Trade data set and revised two Senders Option data elements. In addition, NAESB adopted revisions to the Capacity Release Related data sets and technical implementation. NAESB also revised Standard 6.3.1 (i.e., the NAESB Base Contract for Sale and Purchase of Natural Gas) to add language directing users to NAESB’s copyright disclaimer posted on the NAESB website. Identical language was added to three additional NAESB WGQ Contracts.

Lastly, NAESB added a self-identification provision that assists end users in determining whether counterparties are commercial market participants as defined by the United States Commodity Futures Trading Commission.

Summary table of changes to burden hours, with current approved inventory, as listed in ROCIS and reginfo.gov follow. (The additional burden is being implemented due to due to the NOPR in RM96-1-042 is being averaged over Years 1-3, as discussed in #12 above.)

	Total Request	Previously Approved	Change due to Adjustment in Estimate	Change Due to Agency Discretion
FERC-545
Annual Number of Responses	1,465	1287	178	0
Annual Time Burden (Hr.)	240,668	238,888	1,780	0
Annual Cost Burden ($)	$0	$0	$0	$0

	Total Request	Previously Approved	Change due to Adjustment in Estimate	Change Due to Agency Discretion
FERC-549C
Annual Number of Responses	723	545	178	0
Annual Time Burden (Hr.)	66,050	48,250	17,800	0
Annual Cost Burden ($)	$0	$0	$0	$0

16. TIME SCHEDULE FOR PUBLICATION OF DATA

There are no publications of the information.

17. DISPLAY OF EXPIRATION DATE

The expiration dates are displayed on ferc.gov with links to the updated table from http://www.ferc.gov/docs-filing/efiling.asp.

18. EXCEPTIONS TO THE CERTIFICATION STATEMENT

There are no exceptions.

1 This series of orders began with the Commission’s issuance of Standards for Bus. Practices of Interstate Nat. Gas Pipelines, Ord. No. 587, FERC Stats.
& Regs. ¶ 31,038 (1996).

2 Sandia is a multidisciplinary national laboratory and federally funded research and development center for the U.S. Department of Energy’s (DOE) National Nuclear Security Administration that supports numerous federal, state, and local government agencies, companies, and organizations.

3 In April 2017, NAESB announced that Sandia, through funding provided by DOE, would be performing a surety assessment of the NAESB standards. As determined by Sandia and DOE, the purpose of the surety assessment was to analyze cybersecurity elements within the standards, focusing on four areas: (1) the NAESB Certification Program for Accredited Certification Authorities, including the Wholesale Electric Quadrant (WEQ)-012 Public Key Infrastructure Business Practice Standards, the NAESB Accreditation Requirements for Authorized Certificate Authorities, and the Authorized Certification Authority Process; (2) the WEQ Open Access Same-Time Information Systems suite of standards; (3) the WGQ and Retail Markets Quadrant Internet Electronic Transport (IET) and Quadrant Electronic Delivery Mechanism (EDM) Related Standards Manual; and (4) a high-level dependency analysis between the gas and electric markets to evaluate the different security paradigms the markets employ.

4 In the discussion below we identify the NAESB WGQ Version 3.2 Standards that we propose not to incorporate by reference.

5 The National Institute of Standards and Technology Special Pub. 800-52 requires government Transport Layer Security servers and clients to support Transport Layer Security Version 1.2 and recommends support for Transport Layer Security Version 1.3 by the year 2024.

6 Rivest-Shamir-Adelman is a public key infrastructure algorithm composed of a public component and a private component that is typically installed on a recognized Certificate Authority.

7 Elliptic Curve Digital Signature Algorithm public keys generate an encrypted signature to validate data.

8 A Hash is cryptology technique used for digital signatures in which a series of numbers that may represent, for example, a password, an image, a document, or an executable file is used to generate a cryptographic hash (i.e., a large number).

9 SHA-2 is a set of cryptographic hash functions.

10 PGP is a proprietary (i.e., an organization must pay to use it) encryption program developed to enhance the confidentiality and integrity of data.

11 OpenPGP is an encryption standard defined by the Internet Engineering Task Force enabling design and implementation free of licensing fees. At present, the encryption method is generally considered the most secure.

12 HTTPS authentication encrypts username and password combinations as part of a Uniform Resource Locator address. To obtain an HTTPS connection, a web browser must contact a trusted, commercial Certificate Authority, such as a NAESB Authorized Certificate Authority, to obtain the web server’s public key, and follow other applicable HTTPS procedures.

13 HTTP is the original communications protocol of the Internet which enables a web browser to depict text, pictures, shapes, live data, and click targets on a web browser. However, username and password combinations are not encrypted in HTTP basic authentication.

14 In order for a Service Requester to have control over its segmented nomination(s), the Transportation Service Provider (TSP) will require a “Capacity Block ID” to be submitted with each nomination line item specifying a Transaction Type of “Segmented.”

15 NAESB WGQ Version 3.2 Standards 1.3.14, 1.3.15, 1.3.82, and 3.3.3.

16 NAESB WGQ Version 3.2 Standards 0.4.1 through 0.4.3, 1.4.1, 1.4.3 through 1.4.6, 2.4.1, 2.4.6, 2.4.17, 3.4.1, 3.4.2, 5.4.24 through 5.4.26.

17 See, e.g., Standards for Bus. Practices of Interstate Nat. Gas Pipelines, Notice of Proposed Rulemaking, 164 FERC ¶ 61,125, at P 16 (2018) (WGQ Version 3.1 NOPR).

18 Id., Standards for Bus. Practices of Interstate Nat. Gas Pipelines, Ord. No. 587-V, 140 FERC ¶ 61,036, at n.11 (2012) (Ord. No. 587-V).

19 WGQ Version 3.1 NOPR, 164 FERC ¶ 61,125 at P 16; Elec. Tariff Filings, Ord. No. 714, 124 FERC ¶ 61,270 (2008).

20 Ord. No. 587-V, 140 FERC ¶ 61,036 at PP 36-39.

21 Trans-Union Interstate Pipeline L.P., 141 FERC ¶ 61,167, at P 36 (2012) (Ord. No. 587-V Compliance Order).

22 Id. P 36; WGQ Version 3.1 NOPR, 164 FERC ¶ 61,125 at P 18.

23 Shippers can use the Commission’s electronic tariff system to locate the tariff record containing the NAESB standards, which will indicate the docket in which any waiver or extension of time was granted.

24 Ord. No. 587-V, 140 FERC ¶ 61,036.

25 Ord. No. 587-V Compliance Order, 141 FERC ¶ 61,167 at PP 4, 38.

26 More information is available on FERC’s eTariff page at http://www.ferc.gov/docs-filing/etariff.asp .

27 U.S. Small Business Administration, Table of Small Business Size Standards for Pipeline Transportation of Natural Gas, NAICS Code 486210, available at https://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf, Subsector 486.

Matched to North American Industry Classification System Codes, Natural Gas Pipeline Transportation, NAICS Code 486210, page 27.

28 FERC-545 covers rate change filings made by natural gas pipelines, including tariff changes.

29 FERC-549C covers Standards for Business Practices of Interstate Natural Gas Pipelines.

30 The number of respondents is the number of entities in which a change in burden from the current standards to the proposed exists, not the total number of entities from the current or proposed standards that are applicable.

31 The estimated hourly cost (salary plus benefits) provided in this section is based on the salary figures for May 2019 posted by the Bureau of Labor Statistics for the Utilities sector (available at https://www.bls.gov/oes/current/naics3_221000.htm) and scaled to reflect benefits using the relative importance of employer costs for employee compensation from June 2020 (available at https://www.bls.gov/news.release/ecec.nr0.htm). The hourly estimates for salary plus benefits are:

Computer and Information Systems Manager (Occupation Code: 11-3021), $101.58

Computer and Information Analysts (Occupation Code: 15-1120(1221), $87.42

Electrical Engineer (Occupation Code: 17-2071), $70.19

Legal (Occupation Code: 23-0000), $142.65

The average hourly cost (salary plus benefits), weighting all of these skill sets evenly, is $100.50. We round it to $101/hour.

32 Based on FERC’s Fiscal Year 2019 average cost per FTE (salary plus benefits) of $172,329 per year (or 2,080 work hours), rounded to $83.00 per hour.

33 Paperwork Reduction Act of 1995 (PRA)

34 The PRA Administration Cost is $ 6,475, and includes preparing supporting statements, notices, and other activities associated with Paperwork Reduction Act compliance.

35 This cost will be applied to both the FERC-545 and FERC-549C information collections as related their respective ICRs.

36 The estimate of federal FTE’s and the indicated split between FERC-545 and FERC-549C is based on staff’s experience and the fact that the FERC-545 filings are one-time filings, with the FERC-549C requirements both one-time and on-going.

37 The 1 FTE we are estimating here in connection with the issuance of the NOPR in Docket No. RM96-1-042 does not represent an additional FTE. Rather, 1 FTE represents federal effort as applied to both FERC-545 and FERC-549C currently and after the Final Rule is effective.