[Federal Register Volume 85, Number 122 (Wednesday, June 24, 2020)]
[Notices]
[Pages 37932-37938]
[FR Doc No: 2020-13618]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. RM20-12-000]

Potential Enhancements to the Critical Infrastructure Protection
Reliability Standards

AGENCY: Federal Energy Regulatory Commission, DOE.

ACTION: Notice of Inquiry.

-----------------------------------------------------------------------

SUMMARY: The Federal Energy Regulatory Commission (Commission)

seeks comment on certain potential enhancements to the currently-
effective Critical Infrastructure Protection (CIP) Reliability
Standards. In particular, the Commission seeks comment on whether the
CIP Reliability Standards adequately address the following topics: (i)
Cybersecurity risks pertaining to data security, (ii) detection of
anomalies and events, and (iii) mitigation of cybersecurity events. In
addition, the Commission seeks comment on the potential risk of a
coordinated cyberattack on geographically distributed targets and
whether Commission action including potential modifications to the CIP
Reliability Standards would be appropriate to address such risk.

DATES: Initial Comments are due August 24, 2020, and Reply Comments are
due September 22, 2020.

ADDRESSES: Comments, identified by docket number, may be filed in the
following ways:
     Electronic Filing through http://www.ferc.gov. Documents
created electronically using word processing software should be filed
in native applications or print-to-PDF format and not in a scanned
format.
     Mail/Hand Delivery: Those unable to file electronically
may mail or hand-deliver comments to: Federal Energy Regulatory
Commission, Secretary of the Commission, 888 First Street NE,
Washington, DC 20426.
     Instructions: For detailed instructions on submitting
comments, see the Comment Procedures Section of this document.

FOR FURTHER INFORMATION CONTACT:
    Vincent Le (Technical Information), Office of Electric Reliability,
Federal Energy Regulatory Commission, 888 First Street NE, Washington,
DC 20426,<PHONE_NUMBER><EMAIL_ADDRESS>    Kevin Ryan (Legal Information), Office of the General Counsel,
Federal Energy Regulatory Commission, 888 First Street NE, Washington,
DC 20426,<PHONE_NUMBER><EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:
    1. In this Notice of Inquiry (NOI), the Commission seeks comment on
whether the currently-effective Critical Infrastructure Protection
(CIP) Reliability Standards adequately address the following topics:
(i) Cybersecurity risks pertaining to data security, (ii) detection of
anomalies and events, and (iii) mitigation of cybersecurity events. In
addition, the Commission seeks comment on the potential risk of a
coordinated cyberattack on geographically distributed targets and
whether Commission action, including potential modifications to the CIP
Reliability Standards, would be appropriate to address such risk.
    2. The Commission-approved CIP Reliability Standards are intended
to provide a risk-based, defense in depth (i.e., multiple, redundant
``defensive'' measures) approach to cybersecurity of the bulk electric
system. Since the approval of the first mandatory CIP Reliability
Standards in 2008, these standards have been modified on multiple
occasions to address emerging issues and to improve the cybersecurity
posture of the bulk electric system.\1\ Yet, new cyber threats continue
to evolve, and the Reliability Standards should keep pace to maintain a
robust, defense in depth approach to electric grid cybersecurity.
---------------------------------------------------------------------------

    \1\ See, e.g., Version 5 Critical Infrastructure Protection
Reliability Standards, Order No. 791, 78 FR 72,755 (Dec. 3, 2013),
145 FERC ] 61,160 (2013), order on clarification and reh'g, Order
No. 791-A, 146 FERC ] 61,188 (2014); Revised Critical Infrastructure
Protection Reliability Standards, Order No. 822, 154 FERC ] 61,037,
reh'g denied, Order No. 822-A, 156 FERC ] 61,052 (2016); Revised
Critical Infrastructure Protection Reliability Standard CIP-003-7--
Cyber Security--Security Management Controls, Order No. 843, 163
FERC ] 61,032 (2018).
---------------------------------------------------------------------------

    3. With this in mind, Commission staff undertook a review of the
National Institute of Standards and Technology (NIST) Cyber Security
Framework (NIST Framework), which sets forth a comprehensive,
repeatable structure to guide cybersecurity activities and to consider
cybersecurity risks as part of an organization's risk management
processes of its critical infrastructure.\2\ Commission staff compared
the content of the NIST Framework with the substance of the CIP
Reliability Standards, and identified certain topics addressed in the
NIST Framework that may not be adequately addressed in the CIP
Reliability Standards. Commission staff further analyzed whether the
identified topics are within the scope of the CIP Reliability
Standards.\3\ Commission staff then studied whether the potential
``gaps'' that are within the scope of the CIP Reliability Standards
presented a significant risk to bulk electric system reliability. Based
on this analysis, Commission staff identified the three NIST Framework
categories that are the subject of this NOI: (i) Cybersecurity risks
pertaining to data security, (ii) detection of anomalies and events,
and (iii) mitigation of cybersecurity events.
---------------------------------------------------------------------------

    \2\ NIST, Framework for Improving Critical Infrastructure
Cybersecurity Version 1.1, Executive Summary at v, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf.
    \3\ The NIST Framework provisions that pertain to business
organization activity were not considered appropriate to address in
the CIP Reliability Standards. For example, the NIST Framework
provisions that pertain to the Governance Category (ID.GV) were not
considered appropriate to be addressed in the CIP Reliability
Standards since they address the policies, procedures, and processes
to manage and monitor the organization's regulatory, legal, risk,
environmental, and operational requirements that inform the
management of cybersecurity risk.
---------------------------------------------------------------------------

    4. In addition, the Commission seeks comment on the risk of a
coordinated cyberattack on the bulk electric system and potential
Commission action to address such risk. In general, bulk electric
system planning is based on the ability to withstand a system's single
largest contingency, known as an N-1 event. The Commission has
questioned whether greater defense in depth is warranted to better
protect the bulk electric system from a coordinated attack on multiple
BES Cyber Assets.\4\ The risk of such a coordinated attack may be
exacerbated by the recent shift from larger, centralized generation
resources to smaller, more geographically distributed generation
resources. The Commission seeks comment on the need to address the risk
of a coordinated cyberattack on the bulk electric system, as well as
potential approaches to address the matter, such as voluntary or
mandatory participation in grid exercises, other types of training to
prepare for a coordinated attack, and modifications to the current
applicability thresholds in Reliability Standard CIP-002-5.1a that
would subject additional facilities to the CIP controls that apply to
medium and/or high impact BES Cyber Assets.\5\
---------------------------------------------------------------------------

    \4\ Mandatory Reliability Standards for Critical Infrastructure
Protection, Order No. 706, 122 FERC ] 61,040, at P 256, order on
reh'g, Order No. 706-A, 123 FERC ] 61,174 (2008), order on
clarification, Order No, 706-B, 126 FERC ] 61,229, order on
clarification, Order No. 706-C, 127 FERC ] 61,273 (2009). NERC
defines BES Cyber Asset as a ``Cyber Asset that if rendered
unavailable, degraded, or misused would, within 15 minutes of its
required operation, misoperation, or non[hyphen]operation, adversely
impact one or more Facilities, systems, or equipment, which, if
destroyed, degraded, or otherwise rendered unavailable when needed,
would affect the reliable operation of the Bulk Electric System.''
Glossary of Terms Used in NERC Reliability Standards, http://www.nerc.com/files/glossary_of_terms.pdf.
    \5\ Reliability Standard CIP-002-5.1a (Bulk Electric System
Cyber System Categorization) requires a registered entity to
categorize its cyber systems in terms of low, medium, and high
impact to the grid. These impact ratings determine which
requirements in NERC Reliability Standards CIP-004 though CIP-013
apply to BES Cyber Systems. Attachment 1 of the Reliability
Standards, ``Impact Rating Criteria,'' identifies the criteria for
identifying cyber systems as low, medium or high impact. For
example, a control center used to perform the functions of a
balancing authority for generation equal to or greater than an
aggregate of 3,000 megawatts (MW) in a single interconnection is
designated a high impact asset. A control center that performs the
operations of a generator operator for an aggregate highest rated
net real power equal to or exceeding 1,500 MW in a single
interconnection is designated as a medium impact asset.

---------------------------------------------------------------------------

I. Background

A. CIP Reliability Standards

    5. In January 2008, the Commission issued Order No. 706, which
approved the first set of mandatory CIP Reliability Standards
addressing cybersecurity. In Order No. 706, the Commission stated inter
alia that NERC should look to NIST as a source for improving the CIP
Reliability Standards. The Commission also indicated that it may
address the appropriateness of adopting NIST cybersecurity standards in
the CIP Reliability Standards in a future proceeding:

    The Commission continues to believe--and is further persuaded by
the comments--that NERC should monitor the development and
implementation of the NIST standards to determine if they contain
provisions that will protect the Bulk-Power System better than the
CIP Reliability Standards. . . . Consistent with the CIP NOPR, any
provisions that will better protect the Bulk-Power System should be
addressed in NERC's Reliability Standards development process. The
Commission may revisit this issue in future proceedings as part of
an evaluation of existing Reliability Standards or the need for new
CIP Reliability Standards, . . . .\6\
---------------------------------------------------------------------------

    \6\ Order No. 706, 122 FERC ] 61,040 at P 233.

    Moreover, although Order No. 706 did not directly address the issue
of a potential coordinated attack on cyber assets, the Commission did
express concern that focus on the N-1 planning principle may not be
appropriate in the context of a cybersecurity because an attacker may
simultaneously attack multiple assets. In particular, the Commission
---------------------------------------------------------------------------
observed:

    While the N minus 1 criterion may be appropriate in transmission
planning, use of an N minus 1 criterion for the risk-based
assessment in CIP-002-1 would result in the nonsensical result that
no substations or generating plants need to be protected from cyber
events. A cyber attack can strike multiple assets simultaneously,
and a cyber attack can cause damage to an asset for such a time
period that other asset outages may occur before the damaged asset
can be returned to service. Thus, the fact that the system was
developed to withstand the loss of any single asset should not be
the basis for not protecting that asset.\7\
---------------------------------------------------------------------------

    \7\ Id. P 256.

    6. NIST has continued to serve as an important source for the
improvement of the CIP Reliability Standards. For example, in 2013, the
Commission issued Order No. 791, which approved the CIP Version 5
Standards.\8\ The CIP Version 5 Standards adapted a new approach to
identifying BES Cyber Assets subject to the CIP Standards, categorizing
such assets as of low, medium and high impact. NERC explained that it
developed this tiered approach based on a review of NIST cyber security
standards.\9\
---------------------------------------------------------------------------

    \8\ Version 5 Critical Infrastructure Protection Reliability
Standards, Order No. 791, 145 FERC ] 61,160 (2013), order on
clarification and reh'g, Order No. 791-A, 146 FERC ] 61,188 (2014).
    \9\ See Order No. 791, 145 FERC ] 61,160 at P 14. On August 26,
2019, the U.S. Government Accountability Office (GAO) submitted a
report to Congress that addressed the completeness of the CIP
Reliability Standards in comparison to the subject matter addressed
in the NIST Framework as well as the risks to the electric grid from
a coordinated cyberattack. GAO, Critical Infrastructure Protection:
Actions Needed to Address Significant Cybersecurity Risks Facing the
Electric Grid (Aug. 2019), https://www.gao.gov/assets/710/701079.pdf.
---------------------------------------------------------------------------

B. The NIST Framework

    7. The NIST Framework was developed in response to Executive Order
13,636 ``Improving Critical Infrastructure Cybersecurity,'' issued on
February 12, 2013.\10\ The NIST Framework version 1.0 was released in
February 2014 and revised version 1.1 was released in April 2018.
Executive Order 13,636 stated that the NIST Framework was designed to
``reduce cyber risks to critical infrastructure[,] . . . [and] shall
include a set of standards, methodologies, procedures, and processes
that align policy, business, and technological approaches to address
cyber risks[,] . . . [and] incorporate voluntary consensus standards
and industry best practices to the fullest extent possible.'' \11\
---------------------------------------------------------------------------

    \10\ Exec. Order No. 13,636, 78 FR 11737 (Feb. 19, 2013).
    \11\ Id. at 11741.
---------------------------------------------------------------------------

    8. The NIST Framework consists of five Functions that each provide
a high-level, strategic view of one part of an organization's
cybersecurity risk management. The five Functions are:
     Identify--Develop the organizational understanding to
manage cybersecurity risk to systems, assets, data, and capabilities;
     Protect--Develop and implement appropriate safeguards to
ensure delivery of critical services;
     Detect--Develop and implement appropriate activities to
identify the occurrence of a cybersecurity event;
     Respond--Develop and implement the appropriate activities
to take action regarding a detected cybersecurity event; and
     Recover--Develop and implement appropriate activities to
maintain plans for resilience and to restore any capabilities or
services that were impaired due to a cybersecurity event.
    9. Each of the five Functions is composed of Categories and
Subcategories, with the five Functions having a total of 23 Categories
and 108 Subcategories. Categories are defined as cybersecurity outcomes
closely tied to programmatic needs and activities. The 23 Categories
that are organized within the five Functions, are as follows: (1)
Identify Function (Asset Management, Business Environment, Governance,
Risk Assessment, Risk Management Strategy, and Supply Chain Risk
Management); (2) Protect Function (Identity Management and Access
Control, Awareness and Training, Data Security, Information Protection
Process and Procedures, Maintenance, and Protective Technology); (3)
Detect Function (Anomalies and Events, Security Continuous Monitoring,
and Detection Process); (4) Respond Function (Response Planning,
Communications, Analysis, Mitigation, and Improvements); and (5)
Recover Function (Recovery Planning, Improvements, and Communications).

II. Discussion

A. The NIST Framework

1. Analysis
    10. Based on a comparison of the NIST Framework and CIP Reliability
Standards, Commission staff identified three NIST Framework Categories
that may not be adequately addressed in the CIP Reliability Standards,
and thus could reflect potential reliability gaps: (i) Cybersecurity
risks pertaining to data security, (ii) detection of anomalies and
events, and (iii) mitigation of cybersecurity events.
a. Data Security Category
    11. The NIST Framework Data Security Category (PR.DS) specifies
activities to manage information and records (i.e., data) consistent
with an organization's risk strategy to protect the confidentiality,
integrity, and availability of information and data. The Data Security
Category identifies internal controls in eight Subcategories to require
that: (1) Data at rest is protected (PR.DS-1); (2) data in transit is
protected (PR.DS-2); (3) assets are formally managed throughout
removal, transfer, and disposition (PR.DS-3); (4) adequate capacity to
ensure availability is maintained (PR.DS-4); (5) protections against
data leaks are implemented (PR.DS-5); (6) integrity checking mechanisms
are used to verify software, firmware, and information integrity
(PR.DS-6); (7) the development and testing environment(s) are separate
from the production environment (PR.DS-7); and (8) integrity checking
mechanisms

are used to verify hardware integrity (PR.DS-8).\12\
---------------------------------------------------------------------------

    \12\ See NIST Cybersecurity Framework at 32-33.
---------------------------------------------------------------------------

    12. Commission staff analysis indicates that two NIST Data Security
Subcategories may not be adequately addressed in the CIP Reliability
Standards. First, the Subcategory requiring adequate capacity to ensure
availability is maintained (PR.DS-4) does not appear to be addressed in
Reliability Standard CIP-011-2 (Information Protection) or Reliability
Standard CIP-012-1 (Communications between Control Centers), which
addresses real-time assessment and real-time monitoring data while
being transmitted between any applicable control center. Reliability
Standard CIP-011-2 addresses the confidentiality and integrity of
medium and high impact BES Cyber System information, but it does not
address availability of information and does not apply to low impact
BES Cyber Systems. Reliability Standard CIP-012-1, which has not yet
gone into effect, augments the data protection controls in the CIP
Reliability Standard, but it is limited to real-time assessment and
monitoring data transmitted between control centers.\13\ The loss of
BES Cyber System information availability could result in a loss of the
ability to accurately maintain or restore the bulk electric system,
which could affect reliability.
---------------------------------------------------------------------------

    \13\ In Order No. 866, the Commission approved Reliability
Standard CIP-012-1 and also directed NERC to modify the Reliability
Standard to require protections regarding the availability of links
and data communicated between control centers. Critical
Infrastructure Protection Reliability Standard CIP-012-1--Cyber
Security--Communications Between Control Centers, Order No. 866, 170
FERC ] 61,031 (2020).
---------------------------------------------------------------------------

    13. In addition, while integrity checking mechanisms to verify
software, firmware, and information integrity (PR.DS-6) are partially
addressed by Reliability Standard CIP-013-1 (Supply Chain Risk
Management), the requirements do not apply to low impact BES Cyber
Systems, nor do they apply to information, such as a digital manual
provided with a software tool, for low, medium, or high impact BES
Cyber Systems. Not verifying software, firmware, and information
integrity may allow a malicious actor to bypass existing security
controls without detection.
    14. In sum, the absence of CIP Reliability Standard requirements
corresponding to Subcategories PR.DS-4 and PR-DS-6 in the NIST
Framework could represent a potential gap in the CIP Reliability
Standards.
b. Anomalies and Events Category
    15. The NIST Framework Anomalies and Events Category (DE.AE)
identifies security controls to detect anomalous activity and
understand the potential impact of events. Specifically, the Anomalies
and Events Category identifies internal controls in five Subcategories
to require that: (1) A baseline of network operations and expected data
flows for users and systems is established and managed (DE.AE-1); (2)
detected events are analyzed to understand attack targets and methods
(DE.AE-2); (3) event data are aggregated and correlated from multiple
sources and sensors (DE.AE-3); (4) the impact of events is determined
(DE.AE-4); and (5) incident alert thresholds are established (DE.AE-
5).\14\
---------------------------------------------------------------------------

    \14\ See NIST Cybersecurity Framework at 37-38.
---------------------------------------------------------------------------

    16. Reliability Standard CIP-008-5 (Incident Reporting and Response
Planning) specifies incident response requirements to mitigate the risk
to the reliable operation of the bulk electric system resulting from a
cyber security incident.\15\ This includes a requirement that
applicable entities have a process to ``identify, classify, and respond
to Cyber Security Incidents,'' which corresponds to Subcategories
DE.AE-2 and DE.AE-4.\16\ However, Reliability Standard CIP-008-5 is
only applicable to medium and high impact BES Cyber Systems.
Accordingly, there is no requirement, similar to Subcategories DE.AE-2
and DE.AE-4, for low impact BES Cyber Systems. If a low impact BES
Cyber System is compromised and an analysis is not performed, the
compromised low impact BES Cyber System can potentially be used to gain
access to other BES Cyber Systems, including medium and high impact BES
Cyber Systems.
---------------------------------------------------------------------------

    \15\ Reliability Standard CIP-008-6, which becomes effective on
January 1, 2021, expands the current version's scope to include
Electronic Access Control or Monitoring Systems and suspicious
activity, but it does not include low impact BES Cyber Systems.
    \16\ Reliability Standard CIP-008-5, Requirement R1.1.
---------------------------------------------------------------------------

c. Mitigation Category
    17. The NIST Framework Mitigation Category (RS.MI) specifies
activities to prevent the expansion of a cybersecurity event, mitigate
any effects and resolve the incident. The Mitigation Category
identifies internal controls in three Subcategories to require that:
(1) Incidents are contained (RS.MI-1); (2) incidents are mitigated
(RS.MI-2); and (3) newly identified vulnerabilities are mitigated or
documented as accepted risks (RS.MI-3).\17\
---------------------------------------------------------------------------

    \17\ See NIST Cybersecurity Framework at 42-43.
---------------------------------------------------------------------------

    18. Reliability Standard CIP-008-5 requires responsible entities to
document their cybersecurity incident response plans and provide
evidence of incident response processes or procedures that address
incident handling. However, Reliability Standard CIP-008-5 does not
specifically require incident containment or mitigation as discussed in
Subcategories RS.MI-1 and RS.MI-2.\18\ In addition, Reliability
Standard CIP-008-5 does not apply to low impact BES Cyber Systems.
Similarly, while Reliability Standard CIP-010-2 (Configuration
Management and Vulnerability Assessments) addresses the need to
mitigate newly identified vulnerabilities for medium and high impact
BES Cyber Systems consistent with Subcategory RS.MI-3, it does not
apply to low impact BES Cyber Systems. As noted above, without proper
containment and mitigation, the compromise of a low impact BES Cyber
System can potentially be used as a launching point to gain access to
other BES Cyber Systems, including medium and high impact BES Cyber
Systems.
---------------------------------------------------------------------------

    \18\ Reliability Standard CIP-008-6 also does not specifically
address incident containment or mitigation.
---------------------------------------------------------------------------

2. Request for Comments
    19. The Commission seeks comment on whether the currently effective
CIP Reliability Standards adequately address aspects of the NIST
Framework that support bulk electric system reliability and associated
operational technology (i.e., industrial control systems), as well as
current and projected cybersecurity risks. As discussed above, there
may be subcategories in the NIST Framework that are not adequately
addressed in the CIP Reliability Standards, or addressed only with
regard to medium and high impact BES Cyber Assets but not low impact
BES Cyber Assets. While differences between the CIP Reliability
Standards and the NIST Framework are to be expected, the Commission
seeks comment on whether the differences identified herein reflect
potential reliability gaps in the CIP Reliability Standards that should
be addressed.
    20. Below, we pose questions that commenters should address in
their submissions. However, commenters need not address every topic or
answer every question identified below.

    A1. The security controls in the Data Security Category require
the management of information and records (i.e., data) consistent
with an organization's risk strategy to protect the confidentiality,
integrity, and availability of information and data. The Commission
seeks comment on whether the CIP Reliability Standards adequately
address

each data security subcategory as outlined in the NIST Framework
and, if not, what are possible solutions, and in particular:
     Do the CIP Reliability Standards adequately address
Data Security Subcategories PR.DS-4 and PR.DS-6 for medium and high
impact BES Cyber Systems, and if so how?
     Do the CIP Reliability Standards adequately address the
same Subcategories for low impact BES Cyber Systems, and if so how?
     If the CIP Reliability Standards do not adequately
address these Subcategories, or any other Data Security
Subcategories, for either low, medium or high impact BES Cyber
Systems, explain whether this poses a risk to the reliable operation
of the Bulk-Power System today and the Bulk-Power System of the near
future.
    A2. The security controls in the Anomalies and Events Category
require that anomalous activity is detected and the potential impact
of events is understood. Furthermore, it requires that detected
events are analyzed to understand attack targets and methods. The
Commission seeks comment on whether the CIP Reliability Standards
adequately address the detection and mitigation of anomalous
activity as outlined in the NIST Framework and, if not, what are
possible solutions, and in particular:
     Should low impact BES Cyber Systems be covered by
Anomalies and Events Subcategories DE.AE-2 and DE.AE-4?
     Do the CIP Reliability Standards adequately address
Anomalies and Events Subcategories DE.AE-2 and DE.AE-4 for low
impact BES Cyber Systems, and if so how?
     If the CIP Reliability Standards do not adequately
address these Subcategories for low impact BES Cyber Systems,
explain whether this poses a risk to the reliable operation of the
Bulk-Power System today and the Bulk-Power System of the near
future.
     If the CIP Reliability Standards do not adequately
address any other Anomalies and Events Subcategories, for either
low, medium or high impact BES Cyber Systems, explain whether this
poses a risk to the reliable operation of the Bulk-Power System
today and the Bulk-Power System of the near future.
    A3. The security controls in the Mitigation Category require
that newly identified vulnerabilities are mitigated or,
alternatively, documented as accepted risks. Response activities are
performed to prevent expansion of an event, mitigate its effects,
and resolve the incident. The Commission seeks comment on whether
the CIP Reliability Standards adequately address the mitigation of
newly identified vulnerabilities as outlined in the NIST Framework
and, if not, what are possible solutions, and in particular:
     Do the CIP Reliability Standards adequately address
Mitigation Subcategories RS.MI-1 and RS.MI-2 for low, medium and
high impact BES Cyber Systems, and if so how?
     Do the CIP Reliability Standards adequately address
Mitigation Subcategory RS.MI-3 for low impact BES Cyber Systems, and
if so how?
     If the CIP Reliability Standards do not adequately
address these Subcategories for low, medium or high impact BES Cyber
Systems, explain whether this poses a risk to the reliable operation
of the Bulk-Power System today and the Bulk-Power System of the near
future.

B. Coordinated Cyberattack Assessment

1. Analysis
    21. As discussed below, this NOI seeks comment on the risk of a
coordinated cyberattack on the bulk electric system and the potential
need for Commission action to address such risk.
    22. Since the Commission approved the first mandatory CIP
Reliability Standards in 2008, the generation resource mix has shifted
away from larger, centralized generation resources to the expanding
integration of smaller, geographically distributed generation
resources. Accordingly, an increasing number of generation resources
are categorized as low impact BES Cyber Systems, because they do not
meet the thresholds in Reliability Standard CIP-002-5.1a for medium or
high impact BES Cyber Systems, and therefore are not required to comply
with the full suite of CIP Reliability Standards.\19\
---------------------------------------------------------------------------

    \19\ Reliability Standard CIP-002-5.1a (Cyber Security--BES
Cyber System Categorization), Attachment 1 (Impact Rating Criteria).
---------------------------------------------------------------------------

    23. In 2008, when the CIP Reliability Standards first became
effective, it might have been more effective to focus cybersecurity
protections on larger generation plants than smaller plants. However,
given the shift to smaller generation resources, it is worth examining
whether a sophisticated threat actor could initiate a coordinated
cyberattack targeting geographically distributed generation resources,
posing an unacceptable risk to bulk electric system reliability. Such a
coordinated cyberattack would present itself as a ``common mode
failure,'' which could be similar in risk to a wide-scale disruption to
fuel supplies, such as an attack on a natural gas pipeline.
    24. Recent publicly available studies and reports have assessed the
potential reliability impacts of a coordinated cyberattack on
geographically distributed targets. These sources evaluated the impact
to the power grid from simultaneous or near simultaneous loss of
geographically distributed electrical facilities that could result in
widespread loss of electrical services, including long-duration, large-
scale disturbances. The following three reports highlight the potential
risks to Bulk-Power System reliability.
    25. First, the NERC's 2019 Supply Chain Risk Assessment, based on
information obtained through a mandatory data request to industry,
concludes that a coordinated cyberattack ``could greatly affect [bulk
electric system] reliability beyond the local area.'' \20\ The Supply
Chain Risk Assessment examined the nature and complexity of
cybersecurity supply chain risks, including those associated with low
impact assets, and it found that:
---------------------------------------------------------------------------

    \20\ See NERC, Supply Chain Risk Assessment: Analysis of Data
Collected under the NERC Rules of Procedure Section 1600 Data
Request, at vi (Dec. 9, 2019) https://www.nerc.com/pa/comp/SupplyChainRiskMitigationProgramDL/SupplyChainRiskAssesmentReport.pdf.

    While [low impact] locations represent a small percentage of all
transmission stations and substation locations, the combined effect
of a coordinated cyberattack on multiple locations could affect BES
reliability beyond the local area. The analysis of third-party
electronic access to generation resource locations is even more
concerning. More than 50% of all low impact locations of generation
resources allow third-party electronic access. As with transmission
stations and substations, the combined effect of a coordinated
cyberattack could greatly affect BES reliability beyond the local
---------------------------------------------------------------------------
area.

    Based on this assessment, NERC staff recommended that the Supply
Chain Reliability Standards should be modified to include low impact
BES Cyber Systems with remote electronic access connectivity.\21\
---------------------------------------------------------------------------

    \21\ Id. The NERC Board of Trustees adopted an alternative
proposal to initiate a project to modify Reliability Standard CIP-
003-8 to include policies for low impact BES Cyber Systems for
malicious communications and vendor remote access, while continuing
to evaluate the effectiveness and sufficiency of the supply chain
risk management Reliability Standards. NERC, Resolution for Agenda
Item 8.d: Supply Chain Recommendations (February 6, 2020), https://www.nerc.com/gov/bot/Agenda%20highlights%20and%20Mintues%202013/Approved_Resolution_%20Supply%20Chain%20Follow%20Up%20(2-6-
2020).pdf.
---------------------------------------------------------------------------

    26. Second, on September 4, 2019, NERC published a Lessons Learned
document regarding a denial-of-service attack against multiple remote
generation sites whose BES Cyber Systems are categorized as low impact.
The document explained that a known vulnerability in the web interface
of a vendor's firewall was exploited, allowing an unauthenticated
attacker to cause unexpected reboots of the devices. The reboots
resulted in a denial of service condition at a low impact control
center and multiple remote low impact generation sites. This resulted
in brief communications outages (i.e., less than five minutes) between
field devices at the generation sites, as well as between the
generation sites and the control center. Although the cyberattack did
not cause a disturbance, it met the definition of a coordinated
cyberattack,

and it is possible that this was the first coordinated cyberattack on
the Bulk-Power System. The document recommended that ``[e]ven in cases
involving low-Impact BES assets, an entity should strive for good cyber
security policies and procedures'' by considering adopting security
controls for low impact BES Cyber Assets above those required under the
CIP Reliability Standards.\22\
---------------------------------------------------------------------------

    \22\ NERC, Lesson Learned Risks Posed by Firewall Firmware
Vulnerabilities, at 2-3 (Sept. 4, 2019).
---------------------------------------------------------------------------

    27. Finally, on January 29, 2019, the United States Office of the
Director of National Intelligence (ODNI) reported to the United States
Senate Select Committee on Intelligence concerning potential nation
state risks.\23\ Specifically, the ODNI reported that:
---------------------------------------------------------------------------

    \23\ ODNI, Worldwide Threat Assessment of the US Intelligence
Community (Jan. 29, 2019), https://www.dni.gov/files/ODNI/documents/2019-ATA-SFR-SSCI.pdf.
---------------------------------------------------------------------------

    Russia has the ability to execute cyber attacks in the United
States that generate localized, temporary disruptive effects on
critical infrastructure--such as disrupting an electrical distribution
network for at least a few hours--similar to those demonstrated in
Ukraine in 2015 and 2016. Moscow is mapping our critical infrastructure
with the long-term goal of being able to cause substantial damage.\24\
---------------------------------------------------------------------------

    \24\ Id. at 5.
---------------------------------------------------------------------------

    28. In addition, ODNI reported that, ``China has the ability to
launch cyber attacks that cause localized, temporary disruptive effects
on critical infrastructure--such as disruption of a natural gas
pipeline for days to weeks--in the United States.'' \25\ ODNI concluded
that our nation state adversaries and strategic competitors will
increasingly use cyber capabilities to, among other things, disrupt
critical infrastructure.
---------------------------------------------------------------------------

    \25\ Id. at 6.
---------------------------------------------------------------------------

    29. The loss of power supply to an Interconnection can and has
caused instability, uncontrolled separation, and cascading failures.
Unreliable operations can be caused by either near simultaneous or
sequential loss of facilities, which cause thermal, voltage, and/or
stability limits to be violated. Simultaneous or near simultaneous loss
of multiple facilities under 1,500 MW can cause these effects, which
has been demonstrated historically \26\ and through simulations.\27\
The loss of even a single facility can cause thermal overloads on
parallel facilities. Combined or sequential losses can trigger safety
systems such as underfrequency load shedding relays to operate across
the Interconnection which, in turn, could lead to instability and
cascading outages. Based on the review of publicly available
information discussed above, it is possible that such incidents could
be caused by a coordinated cyberattack on geographically distributed
targets.
---------------------------------------------------------------------------

    \26\ See generally U.S.-Canada Power System Outage Task Force,
Final Report on the August 14 Blackout in the United States and
Canada: Causes and Recommendations (April 2004), http://www.ferc.gov/cust-protect/moi/blackout.asp.
    \27\ See, e.g., NERC, Frequency Response Initiative Report: The
Reliability Impact of Frequency Response (October 30, 2012).
---------------------------------------------------------------------------

2. Request for Comments
    30. The Commission seeks comment on the potential risk of a
coordinated cyberattack on geographically distributed targets and
whether modifications to the CIP Reliability Standards, including
potential modifications to the current MW thresholds, would be
appropriate to address such risks. In particular, the Commission seeks
comment regarding the procedures and security controls that are
currently employed to protect against the potential risk of a
geographically distributed coordinated cyberattack and whether
modifications to the CIP Reliability Standards would be appropriate to
address such risks.

    B1. Are there operating processes and procedures that can be
used to evaluate, mitigate, protect against, and recover from
potential geographically distributed coordinated cyberattacks?
Describe generally the efficiency and effectiveness of these
operating processes and procedures, including response to and
recovery from a potential geographically distributed coordinated
cyberattack.
    B2. Are there security controls that can be used to evaluate,
mitigate, and protect against potential geographically distributed
coordinated cyberattacks? Describe generally the efficiency and
effectiveness of these security controls in mitigating the risk of a
potential geographically distributed coordinated cyberattack.
    B3. Which, if any, of these processes, procedures, or security
controls could enhance the currently approved CIP Reliability
Standards to better address the risk of a geographically distributed
coordinated cyberattack?
    B4. What future changes to the bulk electric system design could
affect the potential risks of geographically distributed coordinated
cyberattacks?
    B5. Are current regional drill exercises and operator training
effective in preparing to mitigate and recover from a geographically
distributed coordinated cyberattack?
     Does current initial system operator training, or
refresher training, either in class or in EMS simulation, include
training to recognize and respond to a coordinated cyberattack, and
should that training be required?
     Do system operators and their leadership participate,
and if so, how often, in regional drills and training exercises that
simulate coordinated cyberattacks on the Bulk Electric System, and
should participation in such exercises be required?
     Do system operators and their leadership participate,
and if so, how often, in regional drills and training exercises that
simulate coordinated cyberattacks on other critical infrastructure
in addition to the bulk electric system (i.e., communication
systems, pipelines, water systems, etc.), and should participation
in such exercises be mandatory?
     Discuss whether any aspects of drill exercises or
operating training pertaining to mitigation and recover from a
geographically distributed coordinated cyberattack should be
incorporated into the Reliability Standards. In particular, while
some entities may voluntarily engage in drill exercises or training,
should this be required of all entities, or specific functional
categories? Should participation of specific personnel categories or
leadership be required?
    B6. Describe the effectiveness of industry information sharing
at mitigating potential geographically distributed coordinated
cyberattacks?
    B7. Discuss whether the thresholds established in Reliability
Standard CIP-002-5.1a, Attachment 1, Section 2 are appropriate to
address the risk of a geographically distributed coordinated
cyberattack.
     If not, what would be appropriate method or approach to
identify thresholds to address the risk.
     Alternatively, what additional security controls, if
implemented, would be appropriate to address the risk?

III. Comment Procedures

    31. The Commission invites interested persons to submit comments on
the matters and issues proposed in this notice, including any related
matters or alternative proposals that commenters may wish to discuss.
Comments are due August 24, 2020, and Reply Comments are due September
22, 2020. Comments must refer to Docket No. RM20-12-000, and must
include the commenter's name, the organization they represent, if
applicable, and their address.
    32. The Commission encourages comments to be filed electronically
via the eFiling link on the Commission's website at http://www.ferc.gov. The Commission accepts most standard word-processing
formats. Documents created electronically using word-processing
software should be filed in native applications or print-to-PDF format
and not in a scanned format. Commenters filing electronically do not
need to make a paper filing.
    33. Commenters that are not able to file comments electronically
must send an original of their comments to: Federal Energy Regulatory
Commission, Secretary of the Commission, 888 First Street NE,
Washington, DC 20426.
    34. All comments will be placed in the Commission's public files
and may

be viewed, printed, or downloaded remotely as described in the Document
Availability section below. Commenters on this proposal are not
required to serve copies of their comments on other commenters.

IV. Document Availability

    35. In addition to publishing the full text of this document in the
Federal Register, the Commission provides all interested persons an
opportunity to view and/or print the contents of this document via the
internet through the Commission's Home Page (http://www.ferc.gov) and
in the Commission's Public Reference Room during normal business hours
(8:30 a.m. to 5:00 p.m. eastern time) at 888 First Street NE, Room 2A,
Washington, DC 20426.
    36. From the Commission's Home Page on the internet, this
information is available on eLibrary. The full text of this document is
available on eLibrary in PDF and Microsoft Word format for viewing,
printing, and/or downloading. To access this document in eLibrary, type
the docket number excluding the last three digits of this document in
the docket number field.
    37. User assistance is available for eLibrary and the Commission's
website during normal business hours from the Commission's Online
Support at<PHONE_NUMBER> (toll free at 1-866-208-3676) or email at
<EMAIL_ADDRESS>or the Public Reference Room at (202) 502-
8371, TTY<PHONE_NUMBER>. Email the Public Reference Room at
<EMAIL_ADDRESS>
    By direction of the Commission.

    Issued: June 18, 2020.
Nathaniel J. Davis, Sr.,
Deputy Secretary.
[FR Doc. 2020-13618 Filed 6-23-20; 8:45 am]
BILLING CODE 6717-01-P


[Federal Register: March 31, 2010 (Volume 75, Number 61)]
[Notices]
[Page 16090-16091]
[DOCID:fr31mr10-51]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Project No. 1494-384]

Grand River Dam Authority; Notice of Application for Amendment of
License and Soliciting Comments, Motions To Intervene, and Protests

March 24, 2010.
    Take notice that the following hydroelectric application has been
filed with the Commission and is available for public inspection:
    a. Application Type: Non-project use of project lands and waters.
    b. Project No: 1494-384.
    c. Date Filed: March 11, 2010, supplemented on March 17, 2010.
    d. Applicant: Grand River Dam Authority.
    e. Name of Project: Pensacola Project.
    f. Location: The proposed non-project use is located on Grand Lake
O' the Cherokees in Delaware County, Oklahoma.
    g. Filed Pursuant to: Federal Power Act, 16 U.S.C. 791a-825r.
    h. Applicant Contact: Ms. Tamara E. Jahnke, Assistant General
Council, Grand Dam River Authority, P.O. Box 409, Vinita, Oklahoma
74301,<PHONE_NUMBER>.
    i. FERC Contact: Any questions on this notice should be addressed
to Shana High at<PHONE_NUMBER>.
    j. Deadline for filing comments, motions to intervene, and protest:
April 26, 2010.
    Comments, Motions to Intervene, and Protests may be filed
electronically via the Internet. See, 18 CFR 385.2001(a)(1)(iii) and
the instructions

on the Commission's Web site at http:// www.ferc.gov under the ``e-
Filing'' link. If unable to be filed electronically, documents may be
paper-filed. To paper-file, an original and eight copies should be
mailed to: Secretary, Federal Energy Regulatory Commission, 888 First
Street, NE., Washington, DC 20426. For more information on how to
submit these types of filings, please go to the Commission's Web site
located at http:// www.ferc.gov.filing-comments.asp. Please include the
project number (P-1494-384) on any comments or motions filed.
    The Commission's Rules of Practice and Procedure require all
interveners filing documents with the Commission to serve a copy of
that document on each person whose name appears on the official service
list for the project. Further, if an intervener files comments or
documents with the Commission relating to the merits of an issue that
may affect the responsibilities of a particular resource agency, they
must also serve a copy of the document on that resource agency. A copy
of any motion to intervene must also be served upon each representative
of the Applicant specified in the particular application.
    k. Description of Request: GRDA requests Commission authorization
to permit BAK, LLC, d/b/a Elk River Landing to expand its current
marina. After completing the proposed expansion, the marina would have
three docks, with a total of 86 covered boat slips, and a concession
dock.
    l. Locations of the Application: A copy of the application is
available for inspection and reproduction at the Commission's Public
Reference Room, located at 888 First Street, NE., Room 2A, Washington,
DC 20426, or by calling<PHONE_NUMBER>. This filing may also be viewed
on the Commission's Web site at http://www.ferc.gov using the
``eLibrary'' link. Enter the docket number excluding the last three
digits in the docket number field to access the document. You may also
register online at http://www.ferc.gov/docs-filing/esubscription.asp to
be notified via e-mail of new filings and issuances related to this or
other pending projects. For assistance, call 1-866-208-3676 or e-mail
<EMAIL_ADDRESS>for TTY, call<PHONE_NUMBER>. A copy is
also available for inspection and reproduction at the address in item
(h) above.
    m. Individuals desiring to be included on the Commission's mailing
list should so indicate by writing to the Secretary of the Commission.
    n. Comments, Protests, or Motions to Intervene: Anyone may submit
comments, a protest, or a motion to intervene in accordance with the
requirements of Rules of Practice and Procedure, 18 CFR 385.210, .211,
.214. In determining the appropriate action to take, the Commission
will consider all protests or other comments filed, but only those who
file a motion to intervene in accordance with the Commission's Rules
may become a party to the proceeding. Any comments, protests, or
motions to intervene must be received on or before the specified
comment date for the particular application.
    o. Any filings must bear in all capital letters the title
``COMMENTS'', ``PROTEST'', or ``MOTION TO INTERVENE'', as applicable,
and the Project Number of the particular application to which the
filing refers.
    p. Agency Comments: Federal, State, and local agencies are invited
to file comments on the described application. A copy of the
application may be obtained by agencies directly from the Applicant. If
an agency does not file comments within the time specified for filing
comments, it will be presumed to have no comments. One copy of an
agency's comments must also be sent to the Applicant's representatives.

Kimberly D. Bose,
Secretary.
[FR Doc. 2010-7145 Filed 3-30-10; 8:45 am]
BILLING CODE 6717-01-P


[Federal Register Volume 86, Number 218 (Tuesday, November 16, 2021)]
[Notices]
[Page 63375]
[FR Doc No: 2021-24947]

=======================================================================
-----------------------------------------------------------------------

ENVIRONMENTAL PROTECTION AGENCY

[EPA-R07-RCRA-2021-0665; FRL-9126-01-R7]

Kansas: Notice of Modification to Kansas' Research, Development
and Demonstration (RD&D) Permit Provisions for Municipal Solid Waste
Landfills (MSWLF)

AGENCY: Environmental Protection Agency (EPA).

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: On May 10, 2016, EPA issued a revision to the regulations
allowing Research, Development and Demonstration (RD&D) permits to
increase the number of permit renewals allowed to six, for a total
permit term of up to 21 years. On October 19, 2016, Kansas Department
of Health and Environment (KDHE) submitted a notification to EPA Region
7 regarding a modification by policy to its RD&D program. EPA
acknowledges receipt of Kansas' notification regarding a modification
to its RD&D program, and that Kansas' notification meets the
requirements set forth in the Federal Register document that published
on May 10, 2016.

DATES: The modification to the Kansas RD&D permit program will become
applicable on November 16, 2021.

FOR FURTHER INFORMATION CONTACT: Marcus G. Rivas, U.S. EPA Region 7
Land, Chemicals and Redevelopment Division; 11201 Renner Boulevard,
Lenexa, Kansas 66219,<PHONE_NUMBER>, [email protected].

SUPPLEMENTARY INFORMATION:

A. Background

    On March 22, 2004, EPA issued a final rule amending the Municipal
Solid Waste Landfills (MSWLF) criteria in 40 CFR part 258 to allow for
RD&D permits (69 FR 13242). This rule allows for variances from
specified criteria for a limited period of time, to be implemented
through state-issued RD&D permits. RD&D permits are available only in
states with approved MSWLF permit programs that have been modified to
incorporate RD&D permit authority. On May 10, 2016, the EPA issued a
revision to the regulations allowing RD&D permits to increase the
number of permit renewals allowed to six, for a total permit term of up
to 21 years (40 CFR 258.4).
    While states are not required to incorporate this new RD&D permit
provision into their previous approved MSWLF program, those states
interested in increasing the total length of time for which RD&D
permits can be issued, from 12 years to 21 years, must provide
notification to EPA in accordance with 40 CFR part 239.
    On September 4, 2009, Kansas received approval of its RD&D permit
program (74 FR 45769). Kansas' RD&D provisions can be found in Kansas
Statutes Annotated (K.S.A.) Chapter 65--Public Health, Article 34--
Solid Waste and Kansas Administrative Regulations (K.A.R.), Agency 28--
Kansas Department of Health and Environment, Article 29--Solid Waste
Management. On October 19, 2016, KDHE submitted a notification to EPA
Region 7 of its modification of its RD&D program through policy,
increasing the total length of time for which RD&D permits can be
issued from 12 years to 21 years as described in the Federal Register
document that published on May 10, 2016, (81 FR 28720) and at 40 CFR
239.12.

B. EPA Acknowledgment of Notification

    In today's Federal Register document, EPA acknowledges receipt of
the notification provided by Kansas of its modification by policy in
increasing the total length of time for which RD&D permits can be
issued from 12 years to 21 years, and that Kansas' notification meets
the requirements set forth at 81 FR 28720 and 40 CFR 239.12.
    Authority: This action is issued under the authority of section
2002, 4005 and 4010(c) of the Solid Waste Disposal Act, as amended, 40
U.S.C. 6912, 6945 and 6949(a).

    Dated: November 8, 2021.
Edward H. Chu,
Acting Regional Administrator, Region 7.
[FR Doc. 2021-24947 Filed 11-15-21; 8:45 am]
BILLING CODE 6560-50-P


[Federal Register Volume 83, Number 135 (Friday, July 13, 2018)]
[Notices]
[Page 32663]
[FR Doc No: 2018-14980]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. CP18-516-000]

Notice of Applications: Maritimes & Northeast Pipeline, LLC

    Take notice that on June 29, 2018, Maritimes & Northeast Pipeline,
L.L.C. (Maritimes), 5400 Westheimer Court, Houston, Texas 77056-5310,
filed an application under section 7(b) of the Natural Gas Act (NGA)
and Part 157 of the Commission's rules and regulations to abandon by
lease 7,214 dekatherms per day of capacity on its jointly-owned
pipeline facilities to Portland Natural Gas Transmission System
(Portland Natural Gas), all as more fully described in the application
which is on file with the Commission and open to public inspection.
Specifically, Maritimes states that the lease agreement's primary term
begins on the later of November 1, 2019 or the date on which Portland
Natural Gas places Phase II of its Portland Natural Gas XPress Project
into service and ends on a date not to extend beyond November 1, 2045.
The lease will continue from month to month thereafter unless
terminated by a party pursuant to the terms of the lease agreement. The
filing may also be viewed on the web at http://www.ferc.gov using the
``eLibrary'' link. Enter the docket number excluding the last three
digits in the docket number field to access the document. For
assistance, contact FERC at [email protected] or call toll-
free,<PHONE_NUMBER> or TTY,<PHONE_NUMBER>
    Any questions regarding this application should be directed to Lisa
A. Connolly, Director, Rates and Certificates, Maritimes & Northeast
Management Company, LLC, 5400 Westheimer Court, Houston, Texas 77056-
5310, or call<PHONE_NUMBER>, or email: [email protected].
    Pursuant to section 157.9 of the Commission's rules (18 CFR 157.9),
within 90 days of this Notice, the Commission staff will either:
Complete its environmental assessment (EA) and place it into the
Commission's public record (eLibrary) for this proceeding; or issue a
Notice of Schedule for Environmental Review. If a Notice of Schedule
for Environmental Review is issued, it will indicate, among other
milestones, the anticipated date for the Commission staff's issuance of
the final environmental impact statement (FEIS) or EA for this
proposal. The filing of the EA in the Commission's public record for
this proceeding or the issuance of a Notice of Schedule for
Environmental Review will serve to notify federal and state agencies of
the timing for the completion of all necessary reviews, and the
subsequent need to complete all federal authorizations within 90 days
of the date of issuance of the Commission staff's FEIS or EA.
    There are two ways to become involved in the Commission's review of
this project. First, any person wishing to obtain legal status by
becoming a party to the proceedings for this project should, on or
before the comment date stated below file with the Federal Energy
Regulatory Commission, 888 First Street NE, Washington, DC 20426, a
motion to intervene in accordance with the requirements of the
Commission's Rules of Practice and Procedure (18 CFR 385.214 or
385.211) and the Regulations under the NGA (18 CFR 157.10). A person
obtaining party status will be placed on the service list maintained by
the Secretary of the Commission and will receive copies of all
documents filed by the applicant and by all other parties. A party must
submit 7 copies of filings made in the proceeding with the Commission
and must mail a copy to the applicant and to every other party. Only
parties to the proceeding can ask for court review of Commission orders
in the proceeding.
    However, a person does not have to intervene in order to have
comments considered. The second way to participate is by filing with
the Secretary of the Commission, as soon as possible, an original and
two copies of comments in support of or in opposition to this project.
The Commission will consider these comments in determining the
appropriate action to be taken, but the filing of a comment alone will
not serve to make the filer a party to the proceeding. The Commission's
rules require that persons filing comments in opposition to the project
provide copies of their protests only to the party or parties directly
involved in the protest.
    Persons who wish to comment only on the environmental review of
this project should submit an original and two copies of their comments
to the Secretary of the Commission. Environmental commentors will be
placed on the Commission's environmental mailing list, will receive
copies of the environmental documents, and will be notified of meetings
associated with the Commission's environmental review process.
Environmental commentors will not be required to serve copies of filed
documents on all other parties. However, the non-party commentors will
not receive copies of all documents filed by other parties or issued by
the Commission (except for the mailing of environmental documents
issued by the Commission) and will not have the right to seek court
review of the Commission's final order.
    The Commission strongly encourages electronic filings of comments,
protests and interventions in lieu of paper using the eFiling link at
http://www.ferc.gov. Persons unable to file electronically should
submit an original and 5 copies of the protest or intervention to the
Federal Energy regulatory Commission, 888 First Street NE, Washington,
DC 20426.
    Comment Date: 5:00 p.m. Eastern Time on July 30, 2018.

    Dated: July 9, 2018.
Nathaniel J. Davis, Sr.,
Deputy Secretary.
[FR Doc. 2018-14980 Filed 7-12-18; 8:45 am]
 BILLING CODE 6717-01-P


[Federal Register Volume 86, Number 52 (Friday, March 19, 2021)]
[Notices]
[Page 14898]
[FR Doc No: 2021-05723]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket No. ER21-1374-000]

Diamond Energy PJM, LLC; Supplemental Notice That Initial Market-
Based Rate Filing Includes Request for Blanket Section 204
Authorization

    This is a supplemental notice in the above-referenced Diamond
Energy PJM, LLC's application for market-based rate authority, with an
accompanying rate tariff, noting that such application includes a
request for blanket authorization, under 18 CFR part 34, of future
issuances of securities and assumptions of liability.
    Any person desiring to intervene or to protest should file with the
Federal Energy Regulatory Commission, 888 First Street NE, Washington,
DC 20426, in accordance with Rules 211 and 214 of the Commission's
Rules of Practice and Procedure (18 CFR 385.211 and 385.214). Anyone
filing a motion to intervene or protest must serve a copy of that
document on the Applicant.
    Notice is hereby given that the deadline for filing protests with
regard to the applicant's request for blanket authorization, under 18
CFR part 34, of future issuances of securities and assumptions of
liability, is April 5, 2021.
    The Commission encourages electronic submission of protests and
interventions in lieu of paper, using the FERC Online links at http://www.ferc.gov. To facilitate electronic service, persons with internet
access who will eFile a document and/or be listed as a contact for an
intervenor must create and validate an eRegistration account using the
eRegistration link. Select the eFiling link to log on and submit the
intervention or protests.
    Persons unable to file electronically may mail similar pleadings to
the Federal Energy Regulatory Commission, 888 First Street NE,
Washington, DC 20426. Hand delivered submissions in docketed
proceedings should be delivered to Health and Human Services, 12225
Wilkins Avenue, Rockville, Maryland 20852.
    In addition to publishing the full text of this document in the
Federal Register, the Commission provides all interested persons an
opportunity to view and/or print the contents of this document via the
internet through the Commission's Home Page (http://www.ferc.gov) using
the ``eLibrary'' link. Enter the docket number excluding the last three
digits in the docket number field to access the document. At this time,
the Commission has suspended access to the Commission's Public
Reference Room, due to the proclamation declaring a National Emergency
concerning the Novel Coronavirus Disease (COVID-19), issued by the
President on March 13, 2020. For assistance, contact the Federal Energy
Regulatory Commission at<EMAIL_ADDRESS>or call toll-free,
(886) 208-3676 or TYY,<PHONE_NUMBER>.

    Dated: March 15, 2021.
Kimberly D. Bose,
Secretary.
[FR Doc. 2021-05723 Filed 3-18-21; 8:45 am]
BILLING CODE 6717-01-P


[Federal Register Volume 83, Number 125 (Thursday, June 28, 2018)]
[Proposed Rules]
[Pages 30370-30377]
[FR Doc No: 2018-13795]

=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 39

[Docket No. FAA-2018-0431; Product Identifier 2018-NE-16-AD]
RIN 2120-AA64

Airworthiness Directives; International Aero Engines (IAE)
Turbofan Engines

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Notice of proposed rulemaking (NPRM).

-----------------------------------------------------------------------

SUMMARY: We propose to adopt a new airworthiness directive (AD) for
certain International Aero Engines (IAE) PW1133G-JM, PW1133GA-JM,
PW1130G-JM, PW1127G-JM, PW1127GA-JM, PW1127G1-JM, PW1124G-JM, PW1124G1-
JM, and PW1122G-JM turbofan engines with a certain high-pressure
compressor (HPC) front hub installed. This proposed AD was prompted by
corrosion found on the HPC front hub. This proposed AD would require
replacing the HPC front hub with a part eligible for installation. We
are proposing this AD to address the unsafe condition on these
products.

DATES: We must receive comments on this proposed AD by August 13, 2018.

ADDRESSES: You may send comments, using the procedures found in 14 CFR
11.43 and 11.45, by any of the following methods:
     Federal eRulemaking Portal: Go to http://www.regulations.gov. Follow the instructions for submitting comments.
     Fax:<PHONE_NUMBER>.
     Mail: U.S. Department of Transportation, Docket
Operations, M-30, West Building Ground Floor, Room W12-140, 1200 New
Jersey Avenue SE, Washington, DC 20590.
     Hand Delivery: Deliver to Mail address above between 9
a.m. and 5 p.m., Monday through Friday, except Federal holidays.

    For service information identified in this NPRM, contact
International Aero Engines (IAE), 400 Main Street, East Hartford, CT
06118; phone:<PHONE_NUMBER>; email: [email protected]; internet: http://fleetcare.pw.utc.com. You may view this service information at the FAA,
Engine and Propeller Standards Branch, 1200 District Avenue,
Burlington, MA 01803. For information on the availability of this
material at the FAA, call<PHONE_NUMBER>.

Examining the AD Docket

    You may examine the AD docket on the internet at http://www.regulations.gov by searching for and locating Docket No. FAA-2018-
0431; or in person at Docket Operations between 9 a.m. and 5 p.m.,
Monday through Friday, except Federal holidays. The AD docket contains
this NPRM, the regulatory evaluation, any comments received, and other
information. The street address for Docket Operations (phone: 800-647-
5527) is listed above. Comments will be available in the AD docket
shortly after receipt.

FOR FURTHER INFORMATION CONTACT: Kevin M. Clark, Aerospace Engineer,
ECO Branch, FAA, 1200 District Avenue, Burlington, MA 01803; phone:
781-238-7088; fax:<PHONE_NUMBER>; email: [email protected].

SUPPLEMENTARY INFORMATION:

Comments Invited

    We invite you to send any written relevant data, views, or
arguments about this proposal. Send your comments to an address listed
under the ADDRESSES section. Include ``Docket No. FAA-2018-0431;
Product Identifier 2018-NE-16-AD'' at the beginning of your comments.
We specifically invite comments on the overall regulatory, economic,
environmental, and energy aspects of this NPRM. We will consider all
comments received by the closing date and may amend this NPRM because
of those comments.
    We will post all comments we receive, without change, to http://www.regulations.gov, including any personal information you provide. We
will also post a report summarizing each substantive verbal contact we
receive about this NPRM.

Discussion

    We received a report that corrosion was found on HPC front hub,
part number (P/N) 30G2401. The HPC front hub exhibited deposits that
could not be removed using standard procedures and worsened over time.
After further investigation, pitting corrosion was found below the
painted surface. This condition, if not addressed, could result in
uncontained HPC front hub release, damage to the engine, and damage to
the airplane.

Related Service Information

    We reviewed Section PW1000G-C-05-10-00-02A-288A-D of the PW1100G-JM
Series Airworthiness Limitations Manual, P/N 5316993, dated September
30, 2015. Section PW1000G-C-05-10-00-02A-288A-D provides guidance for
an approved FAA method of mixed model cycles since new calculation.

FAA's Determination

    We are proposing this AD because we evaluated all the relevant
information and determined the unsafe condition described previously is
likely to exist or develop in other products of the same type design.

Proposed AD Requirements

    This proposed AD would require removing from service the HPC front
hub, P/N 30G2401, and replacing it with a part eligible for
installation.

Costs of Compliance

    We estimate that this proposed AD affects 16 engines installed on
airplanes of U.S. registry.
    We estimate the following costs to comply with this proposed AD:

                                                 Estimated Costs
----------------------------------------------------------------------------------------------------------------
                                                                                Cost per      Cost on U.S.
                Action                         Labor cost           Parts cost        product        operators
----------------------------------------------------------------------------------------------------------------
Replace HPC front hub.................  0 work-hours x $85 per           $11,600         $11,600        $185,600
                                         hour = $0.
----------------------------------------------------------------------------------------------------------------

Authority for This Rulemaking

    Title 49 of the United States Code specifies the FAA's authority to
issue rules on aviation safety. Subtitle I, section 106, describes the
authority of the FAA Administrator. Subtitle VII: Aviation Programs,
describes in more detail the scope of the Agency's authority.
    We are issuing this rulemaking under the authority described in
Subtitle VII, Part A, Subpart III, Section 44701: ``General
requirements.'' Under that section, Congress charges the FAA with
promoting safe flight of civil aircraft in air commerce by prescribing
regulations for practices, methods, and procedures the Administrator
finds necessary for safety in air commerce. This regulation is within
the scope of that authority because it addresses an unsafe condition
that is likely to exist or develop on products identified in this
rulemaking action.
    This AD is issued in accordance with authority delegated by the
Executive Director, Aircraft Certification Service, as authorized by
FAA Order 8000.51C. In accordance with that order, issuance of ADs is
normally a function of the Compliance and Airworthiness Division, but
during this transition period, the Executive Director has delegated the
authority to issue ADs applicable to engines, propellers, and
associated appliances to the Manager, Engine and Propeller Standards
Branch, Policy and Innovation Division.

Regulatory Findings

    We determined that this proposed AD would not have federalism
implications under Executive Order 13132. This proposed AD would not
have a substantial direct effect on the States, on the relationship
between the national government and the States, or on the distribution
of power and responsibilities among the various levels of government.
    For the reasons discussed above, I certify this proposed
regulation:
    (1) Is not a ``significant regulatory action'' under Executive
Order 12866,
    (2) Is not a ``significant rule'' under the DOT Regulatory Policies
and Procedures (44 FR 11034, February 26, 1979),
    (3) Will not affect intrastate aviation in Alaska, and
    (4) Will not have a significant economic impact, positive or
negative, on a substantial number of small entities under the criteria
of the Regulatory Flexibility Act.

List of Subjects in 14 CFR Part 39

    Air transportation, Aircraft, Aviation safety, Incorporation by
reference, Safety.

The Proposed Amendment

    Accordingly, under the authority delegated to me by the
Administrator, the FAA proposes to amend 14 CFR part 39 as follows:

PART 39--AIRWORTHINESS DIRECTIVES

0
1. The authority citation for part 39 continues to read as follows:

    Authority:  49 U.S.C. 106(g), 40113, 44701.

Sec.  39.13  [Amended]

0
2. The FAA amends Sec.  39.13 by adding the following new airworthiness
directive (AD):

International Aero Engines: Docket No. FAA-2018-0431; Product
Identifier 2018-NE-16-AD.

(a) Comments Due Date

    We must receive comments by August 13, 2018.

(b) Affected ADs

    None.

(c) Applicability

    This AD applies to International Aero Engines (IAE) PW1133G-JM,
PW1133GA-JM, PW1130G-JM, PW1127G-JM, PW1127GA-JM, PW1127G1-JM,
PW1124G-JM, PW1124G1-JM, and PW1122G-JM turbofan engines with high-
pressure compressor (HPC) front hub, part number (P/N) 30G2401,
installed.

(d) Subject

    Joint Aircraft System Component (JASC) Code 7230, Turbine Engine
Compressor Section.

(e) Unsafe Condition

    This AD was prompted by corrosion found on the HPC front hub. We
are issuing this AD to prevent cracking and failure of the HPC front
hub. The unsafe condition, if not addressed, could result in
uncontained HPC front hub release, damage to the engine, and damage
to the airplane.

(f) Compliance

    Comply with this AD within the compliance times specified,
unless already done.

(g) Required Actions

    Remove from service the HPC front hub, P/N 30G2401, within 120
days after the effective date of this AD, or as follows, whichever
occurs later, and replace with a part eligible for installation:
    (1) For PW1122G-JM, PW1124G1-JM, PW1124G-JM, PW1127G1-JM,
PW1127GA-JM, and PW1127G-JM engines, remove the HPC front hub before
exceeding 6,180 cycles since new (CSN) or within five years since
the ship date listed in Table 1 to paragraph (g) of this AD,
whichever occurs first.
    (2) For PW1130G-JM, PW1133GA-JM, and PW1133G-JM engines, remove
the HPC front hub before exceeding 4,440 CSN or within four years
since the ship date listed in Table 1 to paragraph (g) of this AD,
whichever occurs first.
    (3) For engines operating as a mix of models listed in
paragraphs (g)(1) and (2) of this AD, remove the HPC front hub using
a CSN calculated by an approved FAA method or within four years
since the ship date listed in Table 1 to paragraph (g) of this AD,
whichever occurs first. You may find guidance for an approved FAA
method of mixed model CSN calculation in Section PW1000G-C-05-10-00-
02A-288A-D of the PW1100G-JM Series Airworthiness Limitations
Manual, P/N 5316993, dated September 30, 2015.
    (4) For any HPC front hub, P/N 30G2401, whose serial number is
not listed in Table 1 to paragraph (g) of this AD, use October 21,
2015, as the ship date.
 BILLING CODE 4910-13-P

[GRAPHIC] [TIFF OMITTED] TP28JN18.007

[GRAPHIC] [TIFF OMITTED] TP28JN18.008

[GRAPHIC] [TIFF OMITTED] TP28JN18.009

[GRAPHIC] [TIFF OMITTED] TP28JN18.010

[GRAPHIC] [TIFF OMITTED] TP28JN18.011

 BILLING CODE 4910-13-C

(h) Alternative Methods of Compliance (AMOCs)

    (1) The Manager, ECO Branch, FAA, has the authority to approve
AMOCs for this AD, if requested using the procedures found in 14 CFR
39.19. In accordance with 14 CFR 39.19, send your request to your
principal inspector or local Flight Standards District Office, as
appropriate. If sending information directly to the manager of the
certification office, send it to the attention of the person
identified in paragraph (i)(1) of this AD. You may email your
request to: [email protected].
    (2) Before using any approved AMOC, notify your appropriate
principal inspector, or lacking a principal inspector, the manager
of the local flight standards district office/certificate holding
district office.

(i) Related Information

    (1) For more information about this AD, contact Kevin M. Clark,
Aerospace Engineer, ECO Branch, FAA, 1200 District Avenue,
Burlington, MA 01803; phone:<PHONE_NUMBER>; fax:<PHONE_NUMBER>; email:
[email protected].
    (2) For service information identified in this AD, contact
International Aero Engines (IAE), 400 Main Street, East Hartford, CT
06118; phone:<PHONE_NUMBER>; email: [email protected]; internet:
http://fleetcare.pw.utc.com. You may view this referenced service
information at the FAA, Engine and Propeller Standards Branch, 1200
District Avenue, Burlington, MA 01803. For information on the
availability of this material at the FAA, call<PHONE_NUMBER>.

    Issued in Burlington, MA, on June 22, 2018.
Robert J. Ganley,
Manager, Engine and Propeller Standards Branch, Aircraft Certification
Service.
[FR Doc. 2018-13795 Filed 6-27-18; 8:45 am]
 BILLING CODE 4910-13-P


[Federal Register Volume 80, Number 39 (Friday, February 27, 2015)]
[Notices]
[Page 10744]
[FR Doc No: 2015-04225]

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[File No. 500-1]

In the Matter of Dittybase Technologies, Inc.; Order of
Suspension of Trading

February 25, 2015.
    It appears to the Securities and Exchange Commission that there is
a lack of current and accurate information concerning the securities of
Dittybase Technologies, Inc. because it has not filed any periodic
reports since the period ended December 31, 2008.
    The Commission is of the opinion that the public interest and the
protection of investors require a suspension of trading in the
securities of the above-listed company. Therefore, it is ordered,
pursuant to Section 12(k) of the Securities Exchange Act of 1934, that
trading in the securities of the above-listed company is suspended for
the period from 9:30 a.m. EST on February 25, 2015, through 11:59 p.m.
EDT on March 10, 2015.

    By the Commission.
Jill M. Peterson,
Assistant Secretary.
[FR Doc. 2015-04225 Filed 2-25-15; 4:15 pm]
BILLING CODE 8011-01-P


[Federal Register Volume 76, Number 63 (Friday, April 1, 2011)]
[Notices]
[Pages 18216-18217]
[FR Doc No: 2011-7685]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Project No. 2009-145]

Dominion Virginia Power/North Carolina Power; Notice of
Availability of Shoreline Management Plan Update for the Shoshone Falls
Project and Soliciting Comments, Motions To Intervene, and Protests

    Take notice that the following hydroelectric application has been
filed with the Commission and is available for public inspection:
    a. Application Type: Revised Shoreline Management Plan.
    b. Project No.: 2778-062.
    c. Date Filed: December 29, 2010.
    d. Applicant: Dominion Virginia Power/North Carolina Power.
    e. Name of Project: Roanoke Rapids and Gaston Hydroelectric
Project.
    f. Location: The project is located in south-central Idaho on the
Snake River from river mile 612.5 to river mile 617.1 in Twin Falls and
Jerome counties.
    g. Filed Pursuant to: Federal Power Act, 16 U.S.C. 791a-825r.
    h. Applicant Contact: L. Lewis Wardle, Licensing Program
Coordinator, Idaho Power, P.O. Box 70, 1221 W Idaho Street, Boise, ID
83702,<PHONE_NUMBER><EMAIL_ADDRESS>    i. FERC Contact: Dr. Mark Ivy,<PHONE_NUMBER><EMAIL_ADDRESS>    j. Deadline for filing comments, motions to intervene, and
protests: April 25, 2011.
    All documents may be filed electronically via the Internet. See, 18
CFR 385.2001(a)(1)(iii) and the instructions on the Commission's Web
site at http://www.ferc.gov/docs-filing/efiling.asp. If unable to be
filed electronically, documents may be paper-filed. To paper-file, an
original and seven copies should be mailed to: Secretary, Federal
Energy Regulatory Commission, 888 First Street, NE., Washington, DC
20426. Commenters can submit brief comments up to 6,000 characters,
without prior registration, using the eComment system at http://www.ferc.gov/docs-filing/ecomment.asp. You must include your name and
contact information at the end of your comments.
    Please include the project number (P-2009-145) on any comments,
motions, or recommendations filed.
    k. Description of the Application: Dominion Virginia Power/North
Carolina Power, licensee of the Roanoke Rapids and Gaston Hydroelectric
Project, has filed a revised Shoreline Management Plan (SMP) for the
project.

The SMP is a comprehensive plan to protect and enhance the two lakes'
natural resources while encouraging economic development activities
that complement or have neutral effects on those natural resources in a
manner that is consistent with license requirements and project
purposes, and to address the needs and interests of stakeholders.
    l. Locations of the Application: A copy of the application is
available for inspection and reproduction at the Commission's Public
Reference Room, located at 888 First Street, NE., Room 2A, Washington,
DC 20426, or by calling<PHONE_NUMBER>. This filing may also be viewed
on the Commission's Web site at http://www.ferc.gov using the
``eLibrary'' link. Enter the docket number excluding the last three
digits in the docket number field to access the document. You may also
register online at http://www.ferc.gov/docs-filing/esubscription.asp to
be notified via e-mail of new filings and issuances related to this or
other pending projects. For assistance, call 1-866-208-3676 or e-mail
<EMAIL_ADDRESS>for TTY, call<PHONE_NUMBER>. A copy is
also available for inspection and reproduction at the address in item
(h) above.
    m. Individuals desiring to be included on the Commission's mailing
list should so indicate by writing to the Secretary of the Commission.
    n. Comments, Protests, or Motions to Intervene: Anyone may submit
comments, a protest, or a motion to intervene in accordance with the
requirements of Rules of Practice and Procedure, 18 CFR 385.210, .211,
.214. In determining the appropriate action to take, the Commission
will consider all protests or other comments filed, but only those who
file a motion to intervene in accordance with the Commission's Rules
may become a party to the proceeding. Any comments, protests, or
motions to intervene must be received on or before the specified
comment date for the particular application.
    o. Filing and Service of Responsive Documents: Any filing must (1)
bear in all capital letters the title ``COMMENTS'', ``PROTEST'', or
``MOTION TO INTERVENE'' as applicable; (2) set forth in the heading the
name of the applicant and the project number of the application to
which the filing responds; (3) furnish the name, address, and telephone
number of the person protesting or intervening; and (4) otherwise
comply with the requirements of 18 CFR 385.2001 through 385.2005. All
comments, motions to intervene, or protests must set forth their
evidentiary basis and otherwise comply with the requirements of 18 CFR
4.34(b). All comments, motions to intervene, or protests should relate
to project works which are the subject of the amendment application.
Agencies may obtain copies of the application directly from the
applicant. A copy of any protest or motion to intervene must be served
upon each representative of the applicant specified in the particular
application. If an intervener files comments or documents with the
Commission relating to the merits of an issue that may affect the
responsibilities of a particular resource agency, they must also serve
a copy of the document on that resource agency. A copy of all other
filings in reference to this application must be accompanied by proof
of service on all persons listed in the service list prepared by the
Commission in this proceeding, in accordance with 18 CFR 4.34(b) and
385.2010.

    Dated: March 25, 2011.
Kimberly D. Bose,
Secretary.
[FR Doc. 2011-7685 Filed 3-31-11; 8:45 am]
BILLING CODE 6717-01-P