WECC COMPLIANCE OUTREACH OPEN WEBINAR

1. WECC COMPLIANCE OUTREACH OPEN WEBINAR Thursday, May 15, 2014 2:00 pm MT

2. Agenda • CIP v5 Updates – B. Castagnetto • BES Primer – B. Sudduth & K. Wilson • Website Confidentiality – C. Albrecht • TOP-001 R3 – P. O’Donnell & J. McGhee • PRC-005 Workshop – P. O’Donnell & L. Scholl

3. Brent CastagnettoManager, Cyber Security Audits and Investigations CIP v5 Update WECC Open Webinar Thursday, May 15, 2014

4. Lisa Wood, CISA, CBRM, CBRACompliance Auditor, Cyber Security CIP-003-6 R2 Low Impact Update May 15, 2014

5. Agenda • SDT Progress • CIP-003-6 R2 Draft Language • Anticipated Dates • Comment Form

6. CIP-003-5 R2 Progress • The Standard Drafting Team (SDT) has been hard at work • Still working on the requirements, measures, and rationale. • CIP-003-5 draft is now CIP-003-6 • Nothing is final as of yet • Changed to table format

7. CIP-003-6 R2 Current DRAFT R2. Each Responsible Entity for its assets containing low impact BES Cyber Systems shall:

8. CIP-003-6 R2 DRAFT (continued)

9. CIP-003 R2 DRAFT(continued)

10. CIP-003-6 R2 DRAFT (continued

11. CIP-003-6 R2 Anticipated Dates • If you’d like to get on the SDT_plus distribution list, contact Ryan Stewart with NERC at: ryan.stewart@nerc.net

12. CIP-003-6 R2 Comment Form

13. Wrap-up • Stay tuned for more information surrounding low impact BCS.

14. Questions? Lisa Wood, CISA CBRM, CBRA ComplianceAuditor, Cyber Security lwood@wecc.biz Desk: 801-819-7601 Cell: 801-300-0225

15. Kenneth WilsonWECC Staff Bulk Electric System (BES) Definition Update May 15, 2014 Outreach Webinar

16. BES Definition at a Glance • Consistent, uniform way to determine BES assets • Effective 7/1/2014 • Transition period through 7/2016 • ERO enterprise common process and tool for implementation • Documents and training readily available • BES web page – one stop shopping • Regional and NERC staff resources available to answer detailed questions and implementation

17. Bulk Electric System (BES): Unless modified by the lists shown below, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy. Establishes the overall demarcation point between BES and non-BES Elements. BES ‘Core’ Definition

18. Provide additional clarification for the purposes of identifying specific Elements that are included in the BES.  I1. BES Transformers I2. Real Power Resources I3. Blackstart Resources I4. Dispersed power producing resources meeting certain criteria I5. Reactive Power Resources BES Definition Inclusions

19. Provide additional clarification for the purposes of identifying specific Elements that may be excluded from the BES.  E1. Radial Systems E2. Retail Generation E3. Local Networks E4. Reactive Power Devices installed solely for retail customers BES Definition Exclusions

20. Consistent methodology outlined in the BES Definition Reference Document STEP 1: CORE DEFINITION STEP 2: INCLUSIONS STEP 3: EXCLUSIONS STEP 3: EXCLUSIONS should be applied in the following sequence: E2 Retail Generation (supersedes I2 Real Power Resources) E4 Retail Reactive Power Devices (supersedes I5 Reactive Power Resources) E3 Local Networks (does not exclude interconnection facilities or generators) E1 Radial Systems (does not exclude interconnection facilities or generators) How to Apply the BES Definition, Inclusions, and Exclusions

21. BES Notifications • Applies to newly self-identified inclusions to and exclusions from the BES • Assures that entities are appropriately implementing the revised definition • Compliance obligations cease for facilities excluded from the BES • 24-month implementation period to bring newly-identified Facilities included in the BES into compliance

22. Self-Determination Notification Information Requirements • Each notification should at a minimum include the following: • Current one-line diagrams • For E2 Retail Generation Exclusion notifications • Net Capacity Transactional Data (12 months of hourly data) • Standby, back-up and maintenance power service documentation • For E3 Local Network Exclusion notifications • Power Flow Transactional Data (24 months of hourly data)

23. BES Exception Requests • Considerations: • Applicable to all Exception Requests • Applicable to specific Elements or groups of Elements Must demonstrate that the requested facilities are (for inclusions) or are not (for exclusions) necessary for the reliable operation of the interconnected transmission system

24. Who can Submit an Exception Request? • Owner of the Element(s) • Regional Entity • Entity with Scope of Responsibility for the Element(s) under consideration: • Regional Entity • Planning Authority • Reliability Coordinator • Transmission Operator • Transmission Planner • Balancing Authority

25. The Exception Request Process Submitting Entity prepares Exception Request RE initial screening and applicable entity input Appeal of Rejection based on completeness Up to 75 days RE substantive review and recommendation Technical Review Panel input (if applicable) Up to 6 months NERC Panel Review and Decision Challenge of NERC Decision (Rule 1703) Up to 120 days

26. Many Resources to Assist You • Bulk Electric System Definition Reference Document Describes the application of the BES Definition • BES Notification Review Guidelines Describes how ERO Enterprise staff will review Self-Determined Notifications submitted through BESnet • BES Exception Request Evaluation Guidelines Describes how ERO Enterprise staff will review Exception Requests submitted through BESnet • BES Implementation Reference Document Outlines standards applicability and registration expectations • BESnet Application Users Guide Manual for the online BESnet application

27. For Additional Information • Go to www.nerc.com • Under Program Areas and Departments, click Reliability Assessment and Performance Analysis • From there, click Bulk Electric System (BES) Definition, Notification, and Exception Process Project

28. For Additional Information http://www.nerc.com/pa/RAPA/Pages/BES.aspx

29. BESnet Schedule • May 12, 2014: BESnet system available for each registered entity’s BESnet Administrator to create an ERO Platform account and/or request access to BESnet • Access requests will be reviewed by Regional BESnet Administrators • May 30, 2014: BESnet system available for each registered entity’s BESnet users to create an ERO Platform account and/or request access to BESnet • Access requests will be reviewed by Entity BESnet Administrators • July 1, 2014: BESnet system available users to submit Self-Determined Notifications and Exception Requests • Notifications and Exceptions will be processed by Regions and NERC

30. BESnet Training Schedule • BESnet Training Schedule (tentative) • May 15-30 – NERC will post • BESnetVideo Training Modules • BESnetUser Guides • BES Business Process Video Training Modules • June 2 – BES Business Process Q&A Webinar • June 4 – WECC BESnet Training at CUG meeting

31. BESnet Training Schedule • BESnet Training Schedule (tentative) • June 10 – Standing Committee Q&A Workshop • June 16 – BES Business Process Q&A Webinar • June 23 – BES Business Process Q&A Webinar • June 30 – BES Business Process Q&A Webinar • June TBD – NERC BESnet Training Webinar

32. WECC Staff Contacts • Application of “Core” Definition and Definitional Exclusion Submittals, De-registration Process • Notification of Self-Determinations • Rules of Procedure Exception Process • Contacts • WECC Support • Support@wecc.biz, Tel. (801) 883-6879, or • Kenneth Wilson • Email: ken@wecc.biz, Tel. (801) 883-6886

33. Kenneth Wilson – ken@wecc.biz Questions?

34. Chris AlbrechtLegal Counsel WECC Confidentiality Agreement WECC Open Webinar May 15, 2014

35. Background • WECC Information Sharing Policy (ISP) - Confidential Information may only be shared with persons who have: • demonstrated a legitimate need; and • have executed a non-disclosure agreement. • ISP presumes that WECC members have a legitimate need.

36. Agreement • Acceptance of the WECC Confidentiality Agreement is required to access non-public information on the WECC website. • May agree via the pop-up or print, sign and mail to WECC. • Without agreement, access to Confidential Information on the WECC website will be removed (can still access public portions).

37. Individual Basis • Website interaction, logins and permissions are all on an individual basis. • WECC determined responsibility and agreement should be at the individual level. • Concerns with acting in individual capacity • Implemented suggestion of members/federal entities • Opportunity to specify whether acting as authorized representative of an employer

38. Other WECC NDAs • The WECC Synchrophasor and Operating Reliability Data Sharing Agreement (UNDA) not sufficient • Does not cover all information on the WECC website. • Applies only to synchrophasor and operating (system control/metered) data submitted to Peak Reliability. • Current plan is to assign UNDA to Peak Reliability. • There is no other WECC NDA that covers all confidential information on the WECC website.

39. Questions Chris Albrecht WECC Legal Counsel 801-819-7616 calbrecht@wecc.biz

40. Reliability DirectivesWECC Open WebinarMay 15, 2014 Phil O’Donnell Manager, Operations and Planning Audits

41. Standards Involving Directives

42. Generic Directive Language Deconstructed The receiver of the directive “shall comply with reliability directives issued by…” the issuer of the directive… “unless such actions would violate safety, equipment, regulatory or statutory requirements”. “Under these circumstances” the receiver of the directive “shall immediately inform” the issuer of the directive “of the inability to perform the directive so that” the issuer of the directive “can implement alternate remedial actions”.

43. What You Should Not Do. • Receiver is not expected to take directive actions which would • Jeopordize safety • This includes safety of your company personnel and safety of the public • Damage equipment • Should not be expected to damage equipment or exceed any limits which could violate operating requirements • Violate regulatory requirements • Do not follow one regulation which violates another • Violate statutory requirements • Do not break the law

44. Be Aware • Issuer of the directive will generally be focused on a bigger picture of the situation. • Receiver may not initially be provided all of the information. • Time may be critical. (for reliability conditions) • Issuer knows that load shed will impact street lights and elevators and can have some safety impacts. • Issuer may not know of unusual local conditions, unique circumstances, laws or regulations.

45. Your Obligations • Inform the issuer of the directive if complying with the directive as issued would cause any impact on safety, equipment or other regulatory or legal obligations. • Offer any alternatives you can come up with. • Agree on expectations and outcomes. • The directive as issued may be the only option.

46. Phil O’Donnell Manager, O&P Audits & Investigations podonnell@wecc.biz

47. Phil O’Donnell andLaura Scholl PRC-005 Workshop July 29 – 30, 2014 Salt Lake City, UT

48. Upcoming Events • WECC Compliance 101 Webinar | May 29 - 2:00p MT • WECC CUG & CIPUG Meetings | June 3 - 5 in Salt Lake City • WECC Open Webinar | June 19 – 2:00p MT • WECC PRC-005 Workshop | July 29 – 30 in Salt Lake City

49. WECC Open Webinar May 15, 2014