News Release: November 20, 2014
FERC Approves Physical Security Grid Reliability Standards
The Federal Energy Regulatory Commission (FERC) acted today to enhance the physical security for the most-critical Bulk-Power System facilities and reduce the overall vulnerability of the grid to attacks by approving a physical security Reliability Standard submitted by the North American Electric Reliability Corporation (NERC).
The final rule approved today reflects views expressed in 39 sets of comments on the Notice of Proposed Rulemaking (NOPR) issued in July. In March, the Commission had directed NERC to develop and submit new Reliability Standards that require owners and operators of the Bulk-Power System to perform a risk assessment of their systems to identify critical facilities; evaluate potential threats to, and vulnerabilities of, those facilities; and develop and implement a security plan to protect against attacks on those facilities.
Today’s final rule adopts the NOPR proposal to direct NERC to remove wording that the Commission believes could narrow the scope and number of identified critical facilities. Under this directive, NERC has six months from the effective date of this final rule to remove the word “widespread” or, alternatively, propose modifications that address concerns that the term is unclear with respect to the obligations it imposes on applicable entities, how it would be implemented by applicable entities, and how it would be enforced. The final rule does not adopt the other directive proposed in the NOPR concerning the ability of applicable governmental authorities (the Commission and any other appropriate federal or provincial authorities) to add or remove facilities from an entity’s list of critical facilities. Instead, the Commission will use its audit authority to determine if any further action by the Commission is needed.
The Commission also adopted the NOPR proposal requiring NERC to submit an informational filing that addresses whether the physical security Reliability Standard should be applicable to additional control centers, consistent with the scope of critical facilities under other Critical Infrastructure Protection standards, but gives NERC two years to do so. The Commission decided that the second proposed informational filing on the analysis on grid resiliency is not necessary, and instead it will consider ways for industry to best inform the Commission of current and future resiliency efforts, which could take the form of reports and/or technical conferences to address specific areas of concern.