creates unnecessary uncertainty about the existence of potential
vulnerabilities. Responsible entities should not be able to opt out of
compliance with mandatory Reliability Standards. The Commission,
therefore, directs the ERO to remove acceptance of risk language from
the CIP Reliability Standards.
    151. In response to concerns raised by NERC, EEI and others, we
agree that this action should occur through the Reliability Standards
development process. In response to the concerns of many commenters who
argue that it should be possible to propose alternative language, we
note that this is consistent with the Reliability Standards development
process. However, any alternative language that provides a similar
opportunity for a responsible entity to opt out of compliance would be
subject to remand. Rather, the Commission believes that alternative
language that deals with such issues in terms of technical feasibility
is preferable. To that end, we have adapted the concept of technical
exceptions to encompass a broader range of valid justifications.
Elsewhere in this Final Rule we address the criticism that our actions
are overly prescriptive and those remarks apply equally here.
    152. Expanding the use of the technical feasibility conditions
would address the desire for flexibility expressed by some commenters
while providing the control that the Commission finds to be necessary.
It would provide for documentation, reporting and approval of how
responsible entities have elected to comply with the CIP Reliability
Standards and thus would permit the ERO and Regional Entities to assess
the significance of any possible vulnerability. As to the argument by
METC-ITC that a technical feasibility exception may not be possible in
all cases, we note that we have found that technical feasibility should
not be limited simply to whether something is technically possible but
also whether it is technically safe and operationally reasonable. Thus,
this approach addresses the issue of inadequately tested patches raised
by APPA/LPPC, and similar general concerns raised by Tampa Electric.
    153. In response to Entergy, we note that a long-established
practice of risk acceptance by senior management does not mean that a
continuation of this practice is appropriate under a new system of
mandatory cyber security Reliability Standards. We have addressed
Entergy's concerns about costs-related legacy equipment in connection
with technical feasibility.
    154. Many commenters defend retention of the acceptance of risk
language by pointing out that it is impossible to eliminate all risk.
While likely true, it is beside the point. The acceptance of risk
language in the CIP Reliability Standards fails to acknowledge that the
real issue is whether the nature and level of inevitable risk is
acceptable from a system-wide perspective. Within a system of CIP
Reliability Standards intended to protect the Bulk-Power System as a
whole, that problem can be addressed by a system that documents and
reports the risks in question and ultimately subjects them to approval
by the ERO or Regional Entities. The Commission's concern in the CIP
NOPR was with the lack of appropriate controls, and eliminating
references to acceptance of risk does not imply that all risk can be
eliminated.
    155. We disagree with Mr. Brown that mutual distrust means that
risks accepted by one entity do not affect others on an interconnected
control system. A mutual distrust approach is a good security posture.
However, its value depends on how well it is implemented. There will
likely be a variety of levels of sophistication applied to implementing
mutual distrust. It is not a basis for allowing other responsible
entities to ignore their obligations under mandatory CIP Reliability
Standards.
    156. Accordingly, the Commission directs the ERO to develop through
its Reliability Standards development process revised CIP Reliability
Standards that eliminate references to acceptance of risk.
3. Technical Feasibility
a. NOPR Proposal
    157. As the Commission explained in the CIP NOPR, two proposed CIP
Reliability Standards provide exceptions from compliance with
Requirements based on ``technical feasibility.'' \65\ The NERC Glossary
does not define the term ``technically feasible,'' nor do the CIP
Reliability Standards themselves specify how an entity is to determine
whether an action is technically feasible. NERC's FAQ document provides
the following guidance on the meaning of the phrase ``where technically
feasible: ''

    \65\ CIP NOPR at P 68-69. The ``technically feasible'' phrase is
found in CIP-005-1, Requirements R2.4, R2.6, R3.1, R3.2 and CIP-007-
1, Requirements R4, R5.3, R6, R6.3. Additionally, CIP-007,
Requirement R2.3 uses ``technical limitations'' to similar effect.

    Technical feasibility refers only to engineering possibility and
is expected to be a ``can/cannot'' determination in every
circumstance. It is also intended to be determined in light of the
equipment and facilities already owned by the responsible entity.
The responsible entity is not required to replace any equipment in
order to achieve compliance with the Cyber Security Standards. When
existing equipment is replaced, however, the responsible entity is
expected to use reasonable business judgment to evaluate the need to
upgrade the equipment so that the new equipment can perform a
particular specified technical function in order to meet the
requirements of these standards.\66\
---------------------------------------------------------------------------

    \66\ FAQ document at 1.

    158. Based on these concerns, the Commission proposed in the CIP
NOPR to allow, in the near term, exceptions from compliance based on
the concept of ``technical feasibility'' in a limited set of
circumstances, but also stated that responsible entities should not be
permitted to invoke technical feasibility on the basis of ``reasonable
business judgment.'' In addition, a responsible entity should not be
able to except itself unilaterally from a Requirement of a mandatory
CIP Reliability Standard with no oversight.
    159. Thus, the Commission proposed in the CIP NOPR to direct that
the ERO establish a structure to require accountability from those who
rely on ``technical feasibility'' as the basis for an exception. The
CIP NOPR described such a structure as requiring a responsible entity
to: (1) Develop and implement interim mitigation steps to address the
vulnerabilities associated with each exception; (2) develop and
implement a remediation plan to eliminate the exception, including
interim milestones and a reasonable completion date; and (3) obtain
written

approval of these steps by the senior manager assigned with overall
responsibility for leading and managing the entity's implementation of,
and adherence to, the CIP Reliability Standards as provided in CIP-003-
1, Requirement R2.\67\
---------------------------------------------------------------------------

    \67\ CIP NOPR at P 79.
---------------------------------------------------------------------------

    160. The Commission stated in the CIP NOPR that this proposed
structure should include a review by senior management of the
expediency and effectiveness of the manner in which a responsible
entity has addressed each of these three proposed conditions. In
addition, the Commission proposed to require a responsible entity to
report and justify to the ERO and the Regional Entity for approval each
exception and its expected duration. In situations where any of the
proposed conditions are not satisfied, the Commission proposed that the
ERO or the Regional Entity would inform the responsible entity that its
claim to an exception based on technical feasibility is insufficient
and therefore not approved. Failure to timely rectify the deficiency
would invalidate the exception for compliance purposes.
    161. The Commission stated its belief that it is important that the
ERO, Regional Entities and the Commission understand the circumstances
and manner in which responsible entities invoke the technical
feasibility provision as well as other provisions that function as
exceptions to the CIP Reliability Standards. The Commission, therefore,
proposed to direct the ERO to submit an annual report that would
include, at a minimum, the frequency of the use of such provisions, the
circumstances or justifications that prompt their use, the interim
mitigation measures used to address the vulnerabilities, and the
milestone schedule to eliminate them and to bring the entities into
compliance to eliminate future reliance on the exception.
    162. The Commission sought comment on additional categories of
information that should be included in the content of this report that
would be useful for the Commission, as well as the ERO and Regional
Entities, in evaluating the invocation of technical feasibility and
similar provisions, and the impact on protection of critical assets.
    163. Finally, the Commission proposed to direct the ERO to consider
making ``technically feasible,'' and derivative forms of that phrase as
used in the CIP Reliability Standards, defined terms in the NERC
Glossary, pursuant to the prior clarifications, without any reference
to reasonable business judgment.
    164. Below, we first address issues related to the general
rationale underlying technical feasibility exceptions. We then address
issues connected with documentation of exceptions and their remediation
and mitigation. Finally, we address the approval of these exceptions.
b. Technical Feasibility Generally
i. Comments
    165. Numerous commenters focused on the need for technical
feasibility exceptions generally and their underlying rationale. Most
support technical feasibility exceptions in some form.
    166. Texas Commission expresses concern that technical feasibility
could be used to justify inaction. It states that flexibility can be
achieved by other means, but if reference to technical feasibility is
retained, responsible entities should not be allowed to use it to avoid
taking necessary action. Texas Commission comments that it is
reasonable to develop a process under which entities with known
vulnerabilities self-report to NERC and the Regional Entity and provide
a timeline for correcting these deficiencies.
    167. NERC states that the Commission properly recognized the
appropriateness of an exception based on technical feasibility and
suggests that it be designated an ``exemption for reliability.'' \68\
NERC supports clarification of the Reliability Standards to ensure that
an exemption is documented and justified in terms of its impact on
Bulk-Power System reliability. ReliabilityFirst makes similar
proposals.
---------------------------------------------------------------------------

    \68\ NERC comments at 20-22.
---------------------------------------------------------------------------

    168. NERC and others believe that the appropriate way to address
the Commission's specific proposed directives is through the
Commission-approved Reliability Standards development process.\69\
Northern California supports the Commission's recommendation that the
ERO re-examine and clarify the meaning of technical feasibility and
provide guidance on the appropriate procedures for claiming an
exemption based on it. Ontario IESO comments that, if the term
reasonable business judgment is removed from the CIP Reliability
Standards, industry and the ERO may find other areas where the concept
of technical feasibility is applicable when revising the CIP
Reliability Standards. NRECA states that technical feasibility is a
matter on which the Commission should defer to the ERO's technical
expertise and not adhere to a one-size-fits-all approach.
---------------------------------------------------------------------------

    \69\ E.g., Alliant, Manitoba Hydro, Northern California and
NRECA.
---------------------------------------------------------------------------

    169. NERC explains that the CIP Reliability Standards include
references to technical feasibility to recognize that, in many cases,
equipment in place in substation and generating plant environments was
implemented with operational functions paramount to all other
considerations, including security. This equipment is not at the end of
its useful life and historically has not been designed with ready
access to software updates and patches. Such software upgrades that
could increase functionality without directly contributing to
reliability generally have not been made. NERC states that modern
replacement equipment is more readily compatible with an environment
where updates and patches are more commonplace and security
functionality is an understood necessity. Securable equipment will be
used when equipment is replaced due to natural end-of-life or failure,
but this modern equipment represents a very small percentage of the
installed base of all cyber equipment in substations and generating
plants.
    170. Many commenters, including APPA/LPPC, Duke, Entergy, NRECA and
ReliabilityFirst, concur with this explanation of rationale for the
references to technical feasibility. Duke agrees that technical
feasibility exceptions should be controlled, but it argues that
replacing legacy equipment on an accelerated schedule could create
industry-wide logistical problems and unwarranted ratepayer impacts.
NRECA maintains that rapid replacement of equipment would mean costs
for customers, could overwhelm the supply chain, and could lead to
premature obsolescence of replacement equipment as security technology
continues to improve. Consumers Energy states that technical
feasibility exceptions are proposed as a last resort that is forced by
the limitations of available technology, support and service
limitations of existing technology, and as-built limitations.
    171. Entergy maintains that the older equipment in question
generally cannot be compromised through typical hacker techniques, and
physical access to it is often required. This presents greater
challenges for attackers and means that only local impact will result
from a successful attack. Entergy recommends allowing industry three to
five years to upgrade critical assets with modern cyber controls that
will provide the needed operational efficiency

improvements and that would be properly secured as a matter of course.
    172. ReliabilityFirst notes that a very small percentage of the
installed base of all cyber equipment in substations and power plants
incorporates security functionality. Consumers Energy explains that
older control systems can still be very reliable, but many assets
identified as critical cyber assets do not have malware and virus
protection, in some cases due to technology conflicts with virus and
malware protection systems. In addition, managing updates on devices
that are continuously online is a difficult task. Consumers Energy
states that there are adequate alternate measures in such cases such as
firewalls with content security functions that restrict any options for
infecting systems with viruses and that implement intrusion detection
for the perimeter with advanced content security services.
    173. NERC states that the drafting team believed that cyber
security standards should not unnecessarily impede the primary mission
of maintaining reliable Bulk-Power System operations. NERC and
ReliabilityFirst argue that changes must be carefully planned and
tested to ensure that no unintended consequences occur. Technologies
are constantly evolving, and it is impractical to think that equipment
always can maintain a leading-edge cyber security posture without
introducing operating issues.
    174. Manitoba Hydro states that industry attempted to strike a
balance for security at the various types of facilities while
recognizing the large base of legacy systems at remote locations. The
security framework focused on routable protocols and dial up access.
The Commission's proposals to limit technical feasibility exceptions
and implement a defense in depth measure in front of legacy systems
would have a nominal impact on control centers but a significant impact
on other facilities, systems and equipment, forcing unjustified early
equipment replacement or installation of technology to provide
mitigating controls. Manitoba Hydro argues that modifying the
Reliability Standards on this point could add considerable work for
responsible entities and require modifications to the implementation
period.
    175. Northern Indiana, Ontario Power and SoCal Edison support
retaining the term technical feasibility. Ontario Power maintains that
removing references to technical feasibility could be interpreted by
some to mean that mandatory compliance is required, regardless of the
cost, the impact on production systems, or the risk to the Bulk-Power
System. Northern Indiana concurs with the Commission's proposal to
treat instances of technical infeasibility as exceptions that require
reporting and certain alternative courses of action. However, it
disagrees with what it describes as the Commission's restrictive
interpretation of the term and urges the Commission to acknowledge that
technical infeasibility may apply to future assets as well. Northern
Indiana advocates that the Commission instead direct NERC to interpret
technical feasibility narrowly with regard to the technical
characteristics of both existing and future assets. Northern Indiana
states that the Commission should not assume technical infeasibility
will exist only during the transition period and not afterwards, nor
should it assume only one single means will exist, on a going forward
basis, to comply with the Reliability Standards.
    176. Mr. Brown states that technical feasibility has less to do
with whether to comply than with how to comply. Whether or not
something is technically feasible is purely an engineering issue. On
the other hand, whether or when to replace equipment that cannot do
something due to technical feasibility with equipment that can do so is
purely a managerial decision. Mr. Brown states that in light of his
interpretation of reasonable business judgment, the Commission should
have much less concern about the interplay between technical
feasibility and reasonable business judgment.
    177. Teltone states that it is now easy to incorporate CIP-related
features such as two-factor authentication (with unique user names and
passwords) to both dial-up and Internet protocol devices without
replacing them, upgrading their software, or taking them offline.
Access and usage logging of legacy devices at substations is easily
accomplished, something Teltone maintains should quell the problem of
technical feasibility.
ii. Commission Determination
    178. The Commission adopts the CIP NOPR proposal and directs the
ERO to develop a set of conditions or criteria that a responsible
entity must follow when relying on the technical feasibility exception
contained in specific Requirements of the CIP Reliability Standards. We
will modify some of our proposed criteria for that framework of
accountability further below. We are persuaded by commenters that the
proposed conditions for invoking the technical feasibility exception
should allow for operational considerations. In response to Northern
Indiana and other commenters, we note that the Commission did not
propose to eliminate references to technical feasibility from the CIP
Reliability Standards, only that the term be interpreted narrowly and
without reference to considerations of business judgment.
    179. In response to those commenters who argue that the
Commission's concerns and directives should be addressed through the
Reliability Standards development process, we agree that to the degree
revisions to the Reliability Standards are necessary to address our
concerns, they would be made through that process. We disagree,
however, with the arguments that claim we are rewriting the CIP
Reliability Standards or adhering to a one-size-fits-all approach. With
respect to the latter point, we note that technical feasibility issues
are by their nature something that must be dealt with on a case-by-case
basis, as they only arise in specific circumstances. Our concern here
is primarily with the framework within which decisions on technical
feasibility are made and ensuring that this framework promotes sound
decisions that lead to effective results. The oversight provisions we
describe below are essential elements of such a framework.
    180. We agree with NERC and other commenters on the underlying
rationale for a technical feasibility exception, i.e., that there is
long-life equipment in place that is not readily compatible with a
modern environment where cyber security issues are an acknowledged
concern. While equipment replacement will often be appropriate to
comply with the CIP Reliability Standards, such as in instances where
equipment is near the end of its useful life or when alternative or
supplemental security measures are not possible, we acknowledge that
the possibility of being required to replace equipment before the end
of its useful life is a valid concern.
    181. The Commission, however, disagrees with Northern Indiana that
technical feasibility should be interpreted to apply to future assets
also. The justification presented for technical feasibility exceptions
is rooted in the problem of long-life legacy equipment and the economic
considerations involved in the replacement of such equipment before the
end of its useful life. We recognize that these considerations can be
valid in some cases, but Northern Indiana has not explained why
technical feasibility exceptions should apply to replacement equipment.
The Commission neither assumes that technical infeasibility issues will
be present only during the transition period, nor does it assume

that on a going forward basis there will be only one single means to
comply with the CIP Reliability Standards. It does assume, however,
that all responsible entities eventually will be able to achieve full
compliance with the CIP Reliability Standards when the legacy equipment
that creates the need for the exception is supplemented, upgraded or
replaced.
    182. The Commission agrees with various commenters that the
implementation of the CIP Reliability Standards should not be permitted
to have an adverse effect on reliability and that proper implementation
requires that care be taken to avoid unintended consequences. We thus
believe it is important to clarify that the meaning of ``technical
feasibility'' should not be limited simply to whether something is
technically possible but also whether it is technically safe and
operationally reasonable.
    183. We disagree with Mr. Brown's view that whether or when to
replace equipment that cannot do something due to technical feasibility
with equipment that can do so is purely a managerial decision,
especially since he intertwines this proposition with the concept of
reasonable business judgment. While we accept NERC's rationale for
technical feasibility exceptions, as discussed below, an integral issue
in individual cases where legacy equipment presents a technical
feasibility issue is whether an alternative course of action protects
the reliability of the Bulk-Power System to an equal or greater degree
than compliance would. This is not a purely managerial decision
involving reasonable business judgment, regardless of what meaning one
imparts to that term.
    184. While a number of commenters agree that it is important to
clarify the meaning of technical feasibility, none appear to support
defining the term in the NERC Glossary. Therefore, in light of the
comments received generally and the specific guidance that we are
providing to the ERO in connection with technical feasibility, we
conclude that a definition of this type is unnecessary. A definition
cannot substitute for a framework of conditions or criteria to provide
accountability, and if those conditions or criteria are implemented, a
definition is not needed. We do not agree with NERC that replacing the
term technical feasibility with ``exemption for reliability'' would be
helpful. We note, in particular, that an ``exemption'' normally is
understood to be a release from an obligation whereas what is under
discussion here is an exception that forms an alternative obligation.
    185. While the Commission will not address the merits of any
particular technology, we note that Teltone's comments raise an
important general consideration when developing policy on technical
feasibility. While technical limitations present real issues, and while
one should not be overly optimistic that technological developments
will resolve them sooner than expected, one should not be overly
pessimistic either. Indeed, high standards should, if anything,
encourage the development of technical solutions.
    186. Based on the above considerations, the Commission adopts its
proposal in the CIP NOPR that technical feasibility exceptions may be
permitted if appropriate conditions are in place. The term technical
feasibility should be interpreted narrowly to not include
considerations of business judgment, but we agree with commenters that
it should include operational and safety considerations.
c. Technical Feasibility Exception Mitigation and Remediation
    187. As mentioned above, in the CIP NOPR, the Commission proposed a
three step structure to require accountability when a responsible
entity relies on technical feasibility as the basis for an exception.
This proposed structure would require a responsible entity to: (1)
Develop and implement interim mitigation steps to address the
vulnerabilities associated with each exception; (2) develop and
implement a remediation plan to eliminate the exception, including
interim milestones and a reasonable completion date; and (3) obtain
written approval of these steps by the senior manager assigned with
overall responsibility for leading and managing the entity's
implementation of, and adherence to, the CIP Reliability Standards,
along with regional approval through the ERO.
i. Comments
    188. NERC supports clarification of the CIP Reliability Standards
to ensure that the use of a technical feasibility exemption must be
documented and justified in terms of its impact on Bulk-Power System
reliability. Duke also agrees with the proposal to require
documentation, including appropriate mitigation and a senior
management-approved remediation plan.
    189. National Grid states that the Commission's mitigation proposal
is reasonable and appropriate, but it maintains that the Commission
should clarify that acceptable mitigation for older assets entails
measures short of replacement, upgrades, or retrofits. A mitigation
requirement otherwise would undermine any relief associated with an
exception. Mitigation measures for vulnerabilities associated with
older assets will need to be in place as long as those assets remain in
service. National Grid states that the Commission's references to
``interim'' mitigation and remediation implementation milestones could
suggest that older assets must be replaced before the end of their
useful lives or that the mitigation measures would not be as effective
as the solutions codified in the Reliability Standards. National Grid
argues that mitigation measures should be as or more effective than
compliance, and in the case of minor technical or administrative
requirements, replacement of certain assets before the end of their
useful lives would be wasteful and inefficient.
    190. SPP believes it is reasonable to treat technical feasibility
as a documented exception. Such exceptions should be reviewed and
approved annually, but identifying a reasonable completion date for
remediation may not always be possible. SPP states that to require
remediation of a technical feasibility exception by a date certain is
contrary to the Commission's acknowledgement that cost can be a
prohibiting factor. Technical limitations may prohibit compliance with
a requirement. The appropriate response in such cases is to mitigate
the risk by implementing compensating measures. SPP questions the need
for remediation where compensating measures are equally effective in
reducing risk. It recommends that responsible entities be required
initially to mitigate the risk and then evaluate and document whether
further remediation is required and technically feasible as part of the
exception approval process.
    191. Northern Indiana believes a remediation plan should seek to
eliminate the exception to the extent possible, but complete
elimination may not be possible in all cases. Northern Indiana states
that the Commission should consider the development and implementation
of a remediation plan to eliminate the exception to the extent
possible. Tampa Electric submits that it is unreasonable to require a
remediation plan in every case. Sometimes there is no technology that
would permit compliance with the letter of the CIP Reliability
Standard.
ii. Commission Determination
    192. With some minor refinements discussed below, the Commission
adopts the CIP NOPR proposal for a

three step structure to require accountability when a responsible
entity relies on technical feasibility as the basis for an exception.
We address mitigation and remediation in this section and direct the
ERO to develop: (1) A requirement that the responsible entity must
develop, document and implement a mitigation plan that achieves a
comparable level of security to the Requirement; and (2) a requirement
that use of the technical feasibility exception by a responsible entity
must be accompanied by a remediation plan and timeline for eliminating
the use of the technical feasibility exception. While the CIP NOPR
proposed that each remediation plan contain a reasonable completion
date, the Commission is persuaded by the comments of National Grid and
SPP that a date certain for remediation may not be possible in some
instances. While we expect remediation by a date certain to be the
norm, we will not require a date certain for remediation in every
instance that a responsible entity invokes the technical feasibility
exception. An entity must provide an explanation when it believes that
it is not possible for a remediation plan to provide a reasonable
completion date.
    193. We also agree with Northern Indiana that in some instances
remediation can be required only to the extent possible. For example,
in some cases it may never be possible to enclose certain critical
cyber assets within a six-sided physical boundary as required under
CIP-006-1. However, such cases need to be sufficiently justified, the
mitigation strategies must be ongoing and effective, and the
justification must be subject to periodic review. We also are mindful
that accelerated replacement of equipment can be economically wasteful
where security is not otherwise compromised. We thus agree with
National Grid that where mitigation measures are as or more effective
than compliance, and in the case of minor technical or administrative
requirements, replacement of certain assets before the end of their
useful lives can be wasteful and inefficient. We also agree with SPP
that remediation might not be necessary where compensating measures are
equally effective in reducing risk. However, such cases must be subject
to clear criteria and periodic review and, where necessary, updates.
    194. However, in adopting this approach, we do not intend to
suggest that it would never be necessary to replace equipment before
the end of its useful life to achieve cyber security goals. Where
equipment is near the end of its useful life or if insufficient
mitigation measures are available, the equipment should be replaced.
However, such situations must be dealt with on a case-by-case basis. We
emphasize that responsible entities must protect assets that are
critical to the reliable operation of the Bulk-Power System.
d. Approval and Control of Specific Exceptions
    195. This section discusses the Commission's directions with regard
to approval of a technical feasibility exception, the third component
of our framework for allowing technical feasibility exceptions. As
described above, the CIP NOPR proposed that NERC develop a requirement
that a responsible entity relying on the technical feasibility
exception must obtain written approval of a remediation plan by a
senior manager.\70\ The Commission also proposed that the responsible
entity report and justify to the ERO and the Regional Entity for
approval of each exception. In addition, the Commission proposed to
direct that the ERO submit an annual report regarding industry use of
the technical feasibility exception.
---------------------------------------------------------------------------

    \70\ CIP NOPR at P 79.
---------------------------------------------------------------------------

i. Comments
    196. California Commission states that approval of technical
feasibility exceptions by the ERO and the relevant Regional Entity is
critical because it prevents attempts to manipulate the system and
induces responsible action.
    197. National Grid supports providing Regional Entities with notice
of technical feasibility exceptions and audits of exceptions by
Regional Entities. It states that a central clearinghouse that catalogs
all technical feasibility exceptions would be helpful because of the
interdependencies among the Bulk-Power System assets. This
clearinghouse could verify whether reliance on exceptions (or the
associated mitigation measures) adequately maintains reliability and
does not create reliability issues for neighboring systems. ISO-NE
states that reporting exceptions to Regional Entities would be useful
in identifying CIP Reliability Standards and Requirements with frequent
implementation issues that call for modifications.
    198. In contrast, ISO/RTO Council, EEI and others do not believe
that reporting and approval of technical feasibility exceptions is
appropriate.\71\ EEI states it does not believe that NERC or the
Regional Entities have the technical expertise to make these types of
determinations. ISO-NE states it is unlikely that either Regional
Entities or the ERO will have the necessary skills to evaluate the
broad spectrum of situations that the industry presents. MidAmerican
states that requiring ERO and Regional Entity approval would burden
those entities, create delays, and divert resources away from more
urgent cyber security concerns. Tampa Electric states that the
Commission should ensure that delays do not interfere with timely
compliance by responsible entities. Idaho Power believes that the
Commission's proposals on technical feasibility would place
administrative burdens on both company and the Regional Entities that
outweigh the benefits. Idaho Power sees little value in policing the
use of the technical feasibility exception with such a burdensome
administrative process that may, in the end, delay the resolution of
legitimate technical feasibility issues.
---------------------------------------------------------------------------

    \71\ E.g., FirstEnergy, ISO-NE, KCPL, SERC-CIPC and SoCal
Edison.
---------------------------------------------------------------------------

    199. ReliabilityFirst argues that a responsible entity's senior
manager must already approve any exceptions, making reporting and
approval unnecessary, and it will be very difficult for the ERO or
Regional Entity staff to review a responsible entity's exceptions
effectively and assess them realistically. SERC-CIPC recommends that
the requirement to authorize and document exceptions remain with the
entity's designated senior manager.
    200. ISO/RTO Council argues that granting the Regional Entities
authority to adjudicate exceptions along with the ability to apply
sanctions for non-compliance creates a conflict of interest. Auditors
should be independent, and an assessor should not be involved with
review and approval of policy exceptions. ISO/RTO Council argues that
instead of requiring that exceptions be reported and justified, the
Commission should consider directing the ERO to detail the type of
justifications and considerations that must be documented when invoking
a technical feasibility exemption. Responsible entities would then be
required to incorporate them into their analysis of possible
exemptions.
    201. EEI, OGE and SoCal Edison question how the ERO and Regional
Entities would determine what is technically feasible for a particular
model of equipment in a specific context. If there is to be external
review and approval, there should be an appeals process, and that would
delay implementation of future revisions to the CIP Reliability
Standards. Alliant, EEI and Tampa Electric believe that NERC should
require that decisions on technically feasible be subject to audits

that are ultimately reported to the Commission. Duke, KCPL and SoCal
Edison maintain that evaluation of technical feasibility issues should
be left to compliance audits.
    202. Northern Indiana seeks clarification of the information that
will be needed to justify an exception. It suggests that, similar to
the Commission's proposed approach regarding self-certification, a
responsible entity should have the opportunity to consult with the ERO
and Regional Entities. Northern Indiana also advocates the waiver of
monetary penalties during this time as well as within the timeframe of
any remediation plan.
    203. APPA/LPPC state that the Commission should clarify that when a
Regional Entity or the ERO rejects a technical feasibility exception
request, the responsible entity may rely on the exception until it has
been ruled upon. In addition, the organization should be allowed a
reasonable time to come into compliance.
    204. Entergy states that there is no indication that the benefits
of reporting exceptions would outweigh the detriments, but if further
reporting is required, it recommends a single annual report from each
registered entity that includes a summary description of the exceptions
and actions taken or to be taken. The ERO could use this report to
satisfy its annual reporting requirement.
    205. A number of other commenters emphasize the sensitivity of
information about technical feasibility exceptions. SPP states that an
annual report must contain information that qualifies as Critical
Energy Infrastructure Information (CEII) to be of any value. SERC-CIPC
also recommends CEII treatment for this information. SPP is concerned
that if the report is not treated as CEII, sensitive data could be
inadvertently made public. To protect against disclosure, SPP proposes
that the ERO could make exception documentation available for
Commission staff inspection in the ERO offices as a possible
alternative to a report. National Grid states that information about
exceptions should be subject to adequate information protection
controls to avoid disclosure and misuse.
    206. Duke opposes an annual report by the ERO to the Commission
because, even if it does not contain CEII, it will compromise security
by publicly identifying problem areas for the industry and the
mitigation measures being employed. If a report must be submitted,
there must be stringent and enforceable confidentiality measures to
prevent inadvertent or unauthorized disclosure. OGE believes reporting
and approval for all exceptions is contrary to the purpose of the CIP
Reliability Standards because information on exceptions sent to the ERO
or Regional Entity could indicate weaknesses in security that could be
compromised and exposed. These same concerns lead Xcel to urge that
Regional Entities develop confidentiality protocols for such
communications.
    207. ISO-NE states that detailed technical descriptions of
exceptions should not be passed to the Regional Entities or the ERO
because the information would be potential vulnerability information
that the responsible entity should protect as critical cyber asset
information under CIP-003-1, Requirement R4. Tampa Electric states
that, if the Commission decides to require ERO or Regional Entity
review, it should also prescribe controls to ensure the confidentiality
and security of the information under review.
    208. Although not commenting specifically on reporting of technical
feasibility issues, Bonneville notes that under the Freedom of
Information Act (FOIA), release of information to an external party
generally waives any privileges against disclosure with respect to
subsequent requests to the federal agency for that same information.
Bonneville is concerned that submission of critical asset information
to the Regional Entity, particularly the vulnerability-related
rationales for including and excluding various facilities on the
critical asset list, may act as such a waiver.
ii. Commission Determination
    209. For the reasons discussed below, the Commission concludes that
technical feasibility exceptions should be reported and justified and
subject to approval by the ERO or the relevant Regional Entity. The
Commission thus adopts its CIP NOPR proposal that use and
implementation of technical feasibility exceptions must be governed by
a clear set of criteria. However, because we are persuaded by the
commenters, we have modified certain elements of our original proposal,
as discussed below.
    210. Most objections to the CIP NOPR proposal regarding the review
and approval of technical feasibility exceptions are not objections in
principle but rather focus on practical issues of implementation, such
as limited ERO and Regional Entity resources and sensitivity of the
information in question. To the extent that objections in principle
have been raised, we disagree. Thus, we disagree with
ReliabilityFirst's argument that senior manager approval of exceptions
is unnecessary because of the responsibilities already assigned to the
senior manager by CIP-003-1. These technical feasibility exceptions
implicate matters that go beyond the purview of individual responsible
entities and must be subject to review and approval by those with a
wider-area view and general responsibility for system reliability. We
also disagree with the ISO/RTO Council that the Commission should
simply direct the ERO to detail the type of justifications and
considerations that must be documented when invoking a technical
feasibility exemption. While such guidance could be useful, it cannot
substitute for reporting, review, and approval, which is necessary to
address concerns that extend beyond the reach of an individual
responsible entity.
    211. With regard to the senior management approval, we continue to
believe that internal approval is an important component of an overall
framework of accountability with regard to use of the technical
feasibility exception. Therefore, we adopt this aspect of our CIP NIPR
proposal and direct the ERO to include approval of the mitigation and
remediation steps by the senior manager (identified pursuant to CIP-
003-1) in the course of developing this framework of accountability.
    212. However, the practical considerations pointed out by a number
of the comments have convinced us to adopt an approach to the issue of
external oversight different from the one originally proposed. We
agree, in particular, with those commenters who argue that pre-approval
could tax ERO and Regional Entity resources, delay implementation, and
possibly create undue risks that sensitive information will be
disclosed.
    213. The Commission agrees with National Grid that Regional
Entities should, in the first instance, receive and catalogue notices
of technical feasibility exceptions that are claimed. Such notices must
include estimates of the degree to which mitigation measures achieve
the goals set by a CIP Reliability Standard and be in sufficient detail
to allow verification of whether reliance on exceptions (or the
associated mitigation measures) adequately maintains reliability and
does not create reliability issues for neighboring systems. Initial
submission of notices should be provided by responsible entities at
least by the ``Compliant'' stage of implementation in order to allow
Regional Entities to plan for

auditing exceptions, as described in more detail below.
    214. The Commission also agrees with National Grid, EEI and others
that actual evaluation and approval of technical feasibility exceptions
should be performed in the first instance in the audit process. This
would allow assessment of exceptions within their specific context and
thus facilitate greater understanding in evaluating individual
exceptions, as well as related mitigation steps and remediation plans.
This also would increase the amount of sensitive information that
remains on-site and reduces the risk of improper disclosure. In
addition, it will allow the ERO and Regional Entities, informed by the
initial notices discussed above, to include personnel in audit teams
with sufficient expertise to judge the need for a technical feasibility
exception and the sufficiency of preferred mitigation measures.\72\
---------------------------------------------------------------------------

    \72\ General reliance on the audit process does not preclude the
Commission, the ERO or a Regional Entity from exercising its
authority to review a claimed exception, whether resulting from a
complaint, an incident or on its own initiative outside of the audit
process.
---------------------------------------------------------------------------

    215. Given the significance of technical feasibility exceptions,
the Commission believes that initial audits of technical feasibility
exceptions should be expedited, i.e., performed earlier than otherwise,
including moving the audit to an earlier year. Also, in general,
responsible entities claiming such exceptions should receive higher
priority when determining which entities to audit, and the more
exceptions an entity has, the higher the priority for audit should be.
Further, NERC may provide an appeals process for the review of
technical feasibility exceptions, if it determines that this is
appropriate.
    216. However, the Commission notes that the audit process is a
Regional Entity and ERO process, and audit team findings regarding
exceptions are subject to Regional Entity and ERO review. The
Commission believes that the audit report should form the basis for ERO
or Regional Entity approval of individual exceptions. Approval thus
represents a determination on compliance with the applicable CIP
Reliability Standards, and we disagree with the ISO/RTO Council that
approval of technical feasibility exceptions raises any conflict of
interest or due process concerns. The proposed procedures raise no
special issues in this respect.
    217. We agree with EEI and others that approvals and potential
appeals should not be allowed to delay implementation, but we believe
our revised proposal resolves this problem. We also agree with APPA/
LPPC that responsible entities should be able to rely on a technical
feasibility exception prior to formal approval. However, we disagree
with Northern Indiana that penalties should be waived within the time
when an approved remediation plan is being implemented, as proper
implementation of the plan itself constitutes a necessary element of
compliance.
    218. In summary, on the issues pertaining to external approval of a
responsible entity's use of the technical feasibility exception, rather
than a pre-approval process, we direct the ERO to design and conduct an
approval process through the Regional Entities and the compliance audit
process. This process should require the ERO or a Regional Entity to
approve any technical feasibility exception, taking into account
whether the technical feasibility exception is needed and whether the
mitigation and remediation steps are adequate to the circumstance.
    219. We agree with comments emphasizing the importance of
protecting sensitive information relating to technical feasibility
exceptions. We agree with SPP and others that CEII treatment should be
available for any such information. In response to Bonneville, we agree
that a governmental entity subject to FOIA requirements should not be
required to submit sensitive information about critical assets or
critical cyber assets that could be deemed a waiver of FOIA protection
that is otherwise available. Nonetheless, a governmental entity's
decision to rely on a technical feasibility exception should also be
subject to appropriate oversight and accountability. Thus, we direct
NERC, in developing the accountability structure for the technical
feasibility exception, to include appropriate provisions to assure that
governmental entities that are subject to Reliability Standards as
users, owners or operators of the Bulk-Power System can safeguard
sensitive information.
    220. As stated in the CIP NOPR, the Commission believes that it is
important that the ERO, Regional Entities and the Commission understand
the circumstances and manner in which responsible entities invoke the
technical feasibility exception.\73\ Accordingly, we direct the ERO to
submit an annual report to the Commission that provides a wide-area
analysis regarding use of the technical feasibility exception and the
effect on Bulk-Power System reliability. The annual report must
address, at a minimum, the frequency of the use of such provisions, the
circumstances or justifications that prompt their use, the interim
mitigation measures used to address vulnerabilities, and efforts to
eliminate future reliance on the exception.\74\
---------------------------------------------------------------------------

    \73\ CIP NOPR at P 80.
    \74\ Responsible entities must cooperate with the ERO and the
Regional Entities in providing information deemed necessary for the
ERO to fulfill its reporting obligation to the Commission.
---------------------------------------------------------------------------

    221. While we agree with commenters that the compilation of data
for the annual report must not compromise the security of the Bulk-
Power System, we disagree that this is a reason not to require the
report. Rather, as we indicated in the CIP NOPR, the report should not
provide a level of detail that divulges CEII data. Rather, the report
should contain aggregated data with sufficient detail for the
Commission to understand the frequency with which specific provisions
are being invoked as well as high level data regarding mitigation and
remediation plans over time and by region. Further, we direct the ERO
to control and protect the data analysis to the extent necessary to
ensure that sensitive information is not jeopardized by the act of
submitting the report to the Commission.
e. Conclusion
    222. In conclusion, pursuant to section 215(d)(5) of the FPA, we
direct the ERO to develop a set of criteria to provide accountability
when a responsible entity relies on the technical feasibility
exceptions in specific Requirements of the CIP Reliability Standards.
As discussed above, structural elements of this framework include
mitigation steps, a remediation plan, a timeline for eliminating use of
the technical feasibility exception unless appropriate justification
otherwise is provided, regular review of whether it continues to be
necessary to invoke the exception, internal approval by the senior
manager, wide-area approval through the ERO's audit process, and
cooperation with the ERO to provide the Commission with high-level,
wide-area analysis regarding the effects the technical feasibility
exception on the reliability of the Bulk-Power System. We direct the
ERO to develop appropriate modifications, as discussed above.

G. Use of National Institute of Standards and Technology (NIST)
Standards in Developing Future Revisions to the CIP Reliability
Standards

1. NOPR Proposal
    223. In the CIP NOPR, the Commission stated that it expects NERC

to monitor the development and implementation of the NIST standards to
determine if they contain provisions that will better protect the Bulk-
Power System.\75\ The CIP NOPR also stated that it expects the ERO to
consult with federal entities that are subject to both the CIP
Reliability Standards and NIST standards on the effectiveness of the
latter. While the Commission declined to propose that NERC incorporate
specific provisions of NIST into the CIP Reliability Standards, it
indicated that it may revisit the issue in the future.
---------------------------------------------------------------------------

    \75\ CIP NOPR at P 88.
---------------------------------------------------------------------------

2. Comments
    224. Congressional Representatives filed comments expressing their
support for the Commission's efforts to require NERC to develop
modifications to the CIP Reliability Standards. However, they believe
that Bulk-Power System reliability will be better protected by cyber
security standards that incorporate the security measures set forth in
NIST Special Publication (SP) 800-53 as applied to industrial control
systems. Congressional Representatives state that NIST research
prepared a technical report comparing the proposed CIP Reliability
Standards with SP 800-53. This technical report found that an
organization conforming to the baseline set of security controls in SP
800-53 will also comply with the management, operational and technical
security requirements of the CIP Reliability Standards, though the
converse may not be true. The technical report concluded that the CIP
Reliability Standards are both ``inadequate for protecting critical
national infrastructure,'' and ``inadequate for all electric energy
systems when the impact of regional and national power outages is
considered.'' \76\
---------------------------------------------------------------------------

    \76\ Congressional Representatives comments at 9, citing
Marshall D. Abrams, ``Addressing Industrial Control Systems in NIST
Special Publication 800-53,'' MITRE Technical Report (March 2007).
---------------------------------------------------------------------------

    225. Further, Congressional Representatives point out that federal
government-owned elements of the Bulk-Power System must comply with
both CIP Reliability Standards and NIST SP 800-53, while privately
owned elements must comply only with the former. They express concern
that ``inconsistent regulatory structures create weak links and
potential vulnerabilities in the entire system.'' \77\ Congressional
Representatives, therefore, urge the Commission to modify the CIP
Reliability Standards to incorporate aspects of SP 800-53 and the
related NIST standards.
---------------------------------------------------------------------------

    \77\ Id. at 9.
---------------------------------------------------------------------------

    226. NIST itself compliments the Commission for proposing a
derivative of the CIP Reliability Standards that is an improvement over
the original NERC CIP Reliability Standards. However, according to
NIST, the CIP NOPR proposal still falls short of meeting the federal
mandatory minimum security measures set forth in NIST Special
Publication (SP) 800-53 as applied to industrial control systems. In
NIST's view, the CIP Reliability Standards, if modified pursuant to the
proposals in the CIP NOPR, will leave information systems that support
private sector bulk electric power systems less protected than
comparable federal information systems. NIST suggests that the
Commission consider strengthening the minimum controls currently
required by the CIP Reliability Standards.
    227. NIST recommends that the Commission adopt the CIP Reliability
Standards with the enhancements proposed by the Commission as an
interim measure. Additionally, NIST advocates that the Commission
prescribe plans for a two to three year transition to cyber security
Reliability Standards that are identical to, consistent with, or based
on SP 800-53 and related NIST standards and guidelines. NIST argues
that this approach would strengthen the CIP Reliability Standards.
    228. Although Entergy states that it generally disagrees with the
Commission's approach of dictating specific revisions that the ERO must
adopt, if the Commission determines that the CIP Reliability Standards
require further development, Entergy argues that the Commission should
modify its approach to the NIST Framework and require the ERO to
consider it as a resource in developing revisions to the CIP
Reliability Standards. Entergy argues that the industry needs
immediate, clear direction and there already exists guidance that the
Commission can rely on to provide such direction. Entergy notes that
the NIST ``Security Risk Management Framework'' has been developed over
many years by the U.S. Department of Commerce. The NIST Framework is
devoid of conflicts of interest and has been broadly vetted, both
domestically and internationally.
    229. SDG&E states that, while it welcomes the use of industry
standards in NERC CIP compliance, it cautions that NIST standards
provide many controls that are considered best practices. It also
explains that NIST was developed for government and some NIST standards
that work well for government may be cost-prohibitive in the private
sector.
    230. Bonneville understands the Commission's directive that NERC
consider NIST standards in the further development of the CIP
Reliability Standards to apply to CIP-003-1. Bonneville suggests that
existing guidelines, such as the NIST Special Publications, should be
incorporated to the extent practicable. Bonneville argues that creating
another set of directives describing how the standards are to be met
without incorporating, or at least considering, existing guidelines
could create considerable confusion and conflict.
    231. Applied Control Solutions urges the immediate adoption of the
NIST ``Security Risk Management'' framework in place of the CIP
Reliability Standards. It explains that the NIST framework provides a
hierarchical three-tiered set of countermeasure and controls
requirement-sets for application as appropriate and related guidance
documents. According to Applied Control Solutions, the NIST framework
has been broadly vetted, is not onerous, provides guidance on how to
address older in-service cyber assets, and allows flexibility for
organizations to tune their cyber security programs for their specific
operating scenarios. It also contends that NIST addresses the major
concerns raised by the Commission regarding the CIP Reliability
Standards, for example, by providing additional granularity and
requiring compensating measures where technical feasibility becomes an
issue. Applied Control Solutions also comments that the ISA-99
standards process has expertise, and NERC should be directed to work
with ISA in revising the CIP Reliability Standards.
3. Commission Determination
    232. As proposed in the CIP NOPR, the Commission will not at this
time direct NERC to incorporate specific provisions of the NIST
standards into the CIP Reliability Standards. While commenters provide
compelling information that suggests that the NIST standards may
provide superior measures for cyber security protection, the Commission
is concerned that the immediate adoption of the NIST standards would
result in unacceptable delays in having any mandatory and enforceable
Reliability Standards that relate to cyber security.
    233. The Commission continues to believe--and is further persuaded
by the comments--that NERC should monitor the development and
implementation of the NIST standards to determine if they contain
provisions that will protect the Bulk-Power System better than the CIP
Reliability Standards. Moreover, we

direct the ERO to consult with federal entities that are required to
comply with both CIP Reliability Standards and NIST standards on the
effectiveness of the NIST standards and on implementation issues and
report these findings to the Commission. Consistent with the CIP NOPR,
any provisions that will better protect the Bulk-Power System should be
addressed in NERC's Reliability Standards development process. The
Commission may revisit this issue in future proceedings as part of an
evaluation of existing Reliability Standards or the need for new CIP
Reliability Standards, or as part of an assessment of NERC's
performance of its responsibilities as the ERO.\78\
---------------------------------------------------------------------------

    \78\ See Order No. 672 at P 186-91.
---------------------------------------------------------------------------

H. Discussion of Each CIP Reliability Standard

1. CIP-002-1--Critical Cyber Asset Identification
    234. Reliability Standard CIP-002-1 deals with the identification
of critical cyber assets. The NERC Glossary defines ``cyber assets'' as
``programmable electronic devices and communication networks including
hardware, software, and data.'' It defines ``critical cyber assets'' as
``cyber assets essential to the reliable operation of critical
assets.'' NERC defines ``critical assets'' as ``facilities, systems,
and equipment which, if destroyed, degraded, or otherwise rendered
unavailable, would affect the reliability or operability of the Bulk
Electric System.'' \79\ The accurate identification of critical assets
and critical cyber assets pursuant to CIP-002-1 is the cornerstone of
the CIP Reliability Standards because it acts as a filter, determining
whether a responsible entity must comply with the remaining CIP
requirements in CIP-003-1 through CIP-009-1.
---------------------------------------------------------------------------

    \79\ ``The term `Reliable Operation' means operating the
elements of the Bulk-Power System within equipment and electric
system thermal, voltage, and stability limits so that instability,
uncontrolled separation, or cascading failures of such system will
not occur as a result of a suddent disturbance, including a cyber
security incident, or unanticipated failure of system elements.'' 16
U.S.C. 824o(a)(4).
---------------------------------------------------------------------------

    235. As the first step in identifying critical cyber assets, CIP-
002-1 requires each responsible entity to develop a risk-based
assessment methodology to use in identifying its critical assets.
Requirement R1 specifies certain types of assets that an assessment
must consider for critical asset status and also allows the
consideration of additional assets that the responsible entity deems
appropriate. Requirement R2 requires the responsible entity to develop
a list of critical assets based on an annual application of the risk-
based assessment methodology. Requirement R3 provides that the
responsible entity must use the list of critical assets to develop a
list of associated critical cyber assets that are essential to the
operation of the critical assets. CIP-002-1 requires an annual re-
evaluation and approval by senior management of the lists of critical
assets and critical cyber assets.
    236. Pursuant to section 215 of the FPA, the Commission approves
Standard CIP-002-1 as mandatory and enforceable. In addition, pursuant
to section 215(d)(5) of the FPA, the Commission directs the ERO to
develop modifications to Standard CIP-002-1. The required modifications
are discussed below in the following topics regarding CIP-002-1: (1)
Need for ERO guidance regarding the risk-based assessment methodology;
(2) scope of critical assets and critical cyber assets; (3) internal,
management, approval of the risk-based assessment; (4) external review
of critical assets identification; and (5) interdependency analysis.
a. Guidance on Risk-Based Assessment Methodology
    237. Requirement R1 of CIP-002-1 requires each responsible entity
to develop a risk-based assessment methodology to identify critical
assets. A responsible entity must maintain documentation describing its
methodology that includes procedures and evaluation criteria.
Requirement R1 identifies specific assets that the methodology must
``consider,'' including control centers, facilities critical to system
restoration and automatic load shedding, and substations and generation
resources that support reliable operation of the Bulk-Power System--as
well as any other assets that support reliable operations and the
responsible entity deems appropriate to include in its assessment.
i. NOPR Proposal
    238. In the CIP NOPR, the Commission expressed concern that
responsible entities have enough guidance to devise an assessment
methodology that is adequate to identify the types of assets necessary
to protect Bulk-Power System reliability.\80\ The Commission stated
that responsible entities would benefit from NERC providing some common
understanding regarding the scope, purpose and basic direction of the
assessment methodology. As an example, the Commission indicated that a
proper methodology should examine (1) the consequences of the loss of
the asset to the Bulk-Power System and (2) the consequences to the
Bulk-Power System if an adversary gains control of the asset for
intentional misuse. Accordingly, the Commission proposed to direct the
ERO to develop modifications to provide additional guidance as to the
features and functionality of an adequate risk-based assessment
methodology.
---------------------------------------------------------------------------

    \80\ See CIP NOPR at P 100-05.
---------------------------------------------------------------------------

    239. The CIP NOPR also noted that smaller entities may have
difficulty in determining whether a particular asset is ``critical''
since the impact of the asset may be dependent on their connection with
a transmission owner or operator. Thus, the Commission proposed that
the ERO and Regional Entities provide reasonable technical support to
relatively smaller registered entities to assist them in determining
whether their assets are critical to the Bulk-Power System.
ii. Comments
(a) Need for Additional Guidance
    240. Many commenters, including NERC, agree with the Commission
that there is a need for further guidance regarding the risk-based
assessment methodology. Other commenters do not oppose the development
of general guidance on what would constitute an acceptable risk-based
assessment methodology, provided that this guidance does not rule out
other approaches. Commenters also identify specific concerns that they
believe would benefit from further guidance.
    241. While first reiterating that the CIP Reliability Standards
contain the appropriate specificity as performance based standards,
NERC agrees that it could provide further guidance in the form of a
``supplemental guideline'' on performing risk-based assessments to be
used to determine critical assets. NERC states that its Critical
Infrastructure Protection Committee's Risk Assessment Working Group has
begun development of such a guideline. NERC asserts that this
guideline, when completed, will address the Commission's fundamental
concern by providing guidance to responsible entities on how to perform
the required risk-based assessments.
    242. Numerous commenters agree that additional guidance is needed
regarding a risk-based assessment methodology.\81\ For example, Energy
Producers and California Cogeneration comment that, without such
guidance, responsible entities will not know whether they are

complying with the Requirement until they are audited. Arizona Public
Service is also concerned that CIP-002-1 lacks sufficient detail and
needs to provide further guidance so that responsible entities are not
placed in the position of not knowing whether their risk-based
methodologies will adequately identify all critical assets in a way
that fully satisfies NERC's requirements. Arkansas Electric comments
that without needed guidance, a responsible entity could invest large
amounts of effort into the assessment, only to be found non-compliant
later. Reliant comments that ERO guidance would benefit users of the
Bulk-Power System, such as generators, that may not have sufficient
information to properly determine whether their assets are critical.
---------------------------------------------------------------------------

    \81\ E.g., California Cogeneration California Commission,
Congressional Representatives, Duke, Energy Producers, FirstEnergy,
ISA99 Team, KCPL, MidAmerican, National Grid, ReliabilityFirst,
Reliant, SDG&E and U.S. Power.
---------------------------------------------------------------------------

    243. While EEI opposes any modification to Requirement R1 of CIP-
002-1 to provide additional specificity regarding the assessment
methodology, it agrees that responsible entities would benefit from
``some basic guidance'' provided that it is non-prescriptive.\82\ EEI
supports guidance regarding the common understanding of the scope,
purpose and basic direction of the methodology. EEI also urges that the
process for developing this guidance should be open and transparent.
Similarly, APPA/LPPC comment that they do not object to the proposal
that NERC provide some basic guidance on the content of the
methodology, provided that it allows needed flexibility to take account
of the individual circumstances of a responsible entity.
---------------------------------------------------------------------------

    \82\ See also Alliant, Arizona Public Service, ISO/RTO Council,
Luminant, Northern California, OGE, Portland General and Southern.
---------------------------------------------------------------------------

    244. A number of commenters identify specific topics that would
benefit from further guidance. For example, NRC comments that the risk-
based assessment should identify transmission lines, substations and
generators that are relied on to operate or shut down nuclear
generating stations as critical assets. U.S. Power maintains that
additional guidance is needed as to when generating facilities and
their related systems will be deemed ``critical'' to the Bulk Electric
System. U.S. Power explains that, given the built-in reserve margin for
generation in New England, absent a known local reliability need, any
generator in New England could logically assume that none of its
individual generating assets would be regarded ``critical.'' U.S. Power
states that without additional guidance as to what the Commission and
NERC intend, however, there is no way of knowing if this is an
appropriate assumption. Further, it seeks additional guidance regarding
blackstart units, noting that a generating unit that has blackstart
capability but is not part of a system restoration plan may not be
deemed critical to Bulk-Power System reliability.
    245. Luminant comments that significant regional differences, such
as geography, climate, demographics, electric system structure and
demands, affect the identification of critical cyber assets and how the
particular asset would be protected.
    246. Several commenters agree with the Commission's statement that
a risk-based assessment methodology should examine the consequences of
the loss of the asset to the Bulk-Power System as well as the
consequences if an adversary gains control of the asset. For example,
Applied Control Solutions states that a proper risk-based assessment
methodology should examine the consequences of the loss or improper
operation of the assets to the Bulk-Power System. It also comments that
the methodology should define ``risk'' as a formula (i.e.,
risk=frequency multiplied by consequence). Because there is
insufficient data available to determine frequency, it should be
assumed that an event will occur. Luminant also states that the risk-
based assessment methodology should focus on the consequences of an
outage, not the likelihood of an outage.
    247. ISA99 Team suggests that the guidance to be developed by NERC
should be written in a manner that assures that a larger portion of
critical infrastructure assets, and associated cyber assets are
included within the scope of the standards. In this regard, ISA99 Team
states that the results of the current requirements, which are based on
an unspecified ``risk-based'' approach, and which place no limits on
what constitutes an acceptable risk, may or may not include sufficient
assets to provide adequate protection for the bulk power grid. Thus,
ISA99 Team argues that a more definitive means of assuring adequate
scope needs to be established.
    248. A number of entities commented on the Commission's proposal
that the ERO and Regional Entities provide reasonable technical support
to relatively smaller entities that may have difficulty determining
whether a particular asset is critical because, for example, the impact
of the facility may be dependent on their connection with a
transmission owner or operator. NERC and ReliabilityFirst oppose this
proposal, stating that such a ``consulting service'' would place an
undue burden on the ERO and Regional Entities.\83\ NERC and
ReliabilityFirst believe that this creates a serious conflict to
impartially assess compliance with the standards and suggest that, if
such an external assistance is deemed necessary, it should be the
obligation of the responsible entity's reliability coordinator or
regional transmission organization. According to NERC, its reliability
readiness program is in an ideal position to assess the effectiveness
of an entity's risk-based assessment methodology, thus, no additional
consulting role by NERC is needed.
---------------------------------------------------------------------------

    \83\ See also Entergy and ISO/RTO Council.
---------------------------------------------------------------------------

    249. In contrast, FirstEnergy agrees that NERC should provide
guidance to entities without a wide-area view, such as a generation
owner or a partial generation owner, on how to approach a risk-based
assessment. Likewise, Northern California suggests that NERC establish
a process for informal, case-by-case consultations with responsible
entities that need assistance in complying with CIP-002-1. In addition,
as part of the re-examination of CIP-002-1, Northern California
encourages the incorporation of a formalized ``feedback loop'' to
assist the industry in developing policies and procedures.
    250. Xcel seeks clarification of CIP-002-1, Requirement R1.2.4,
which provides that a risk-based assessment methodology consider
``systems and facilities critical to system restoration, including
blackstart generators and substations in the electrical path of
transmission lines used for initial system restoration.'' Xcel asks
that either the Commission clarify or direct NERC to clarify the
meaning of the phrase ``used for initial system restoration'' and
specify whether it refers to facilities on the primary transmission
restoration path or on all potential alternative transmission
restoration paths.
    251. MidAmerican seeks Commission clarification of the
appropriateness of an N minus 1 criterion when applying a risk-based
assessment methodology to critical assets. It states that NERC's CIP
Reliability Standards require all affected entities to withstand the
loss of one element without affecting the reliability of the Bulk-Power
System. Yet, MidAmerican notes, the Commission's discussion uses the
singular term ``asset'' in the first sentence when describing what a
proper risk-based assessment methodology should examine. MidAmerican is
concerned that this implies that a risk-based assessment methodology
should be based on the loss of a single critical asset (transformer,
line or generating

unit) one at a time. MidAmerican submits that the term ``asset'' should
be revised to make clear that a broad-based cyber attack should
essentially be assumed to affect several of an entity's critical
facilities simultaneously.
    252. Entergy suggests, as an alternative approach to critical asset
identification, that the ERO provide a Design-Basis Threat (DBT)--a
profile of the type, composition, and capabilities of an adversary--
that would assist the industry as a technical baseline against which to
establish the proper designs, controls and processes. Entergy claims
that a DBT approach would address many of the Commission's concerns
regarding the risk-based methodology. For example, a DBT would focus
the appropriate emphasis on the potential consequences from an outage
of a critical asset. In addition, a DBT would address the Commission's
concern that responsible entities will not have enough guidance in
developing a risk-based methodology and not know how to identify a
``critical asset.'' Entergy contends that a DBT approach would provide
the industry with more certainty in implementing the CIP Reliability
Standards.
iii. Commission Determination
    253. The Commission believes that the comments affirm that
responsible entities need additional guidance on the development of a
risk-based assessment methodology to identify critical assets. While we
adopt our CIP NOPR proposal, we recognize that the ERO has already
initiated a process to develop such guidance. The CIP NOPR proposed to
direct that NERC modify CIP-002-1 to incorporate the guidance. However,
we are persuaded by commenters that stress the need for flexibility and
the need to take account of the individual circumstances of a
responsible entity. Thus, we modify our original proposal and in this
Final Order leave to the ERO's discretion whether to incorporate such
guidance into the CIP Reliability Standard, develop it as a separate
guidance document, or some combination of the two. A responsible
entity, however, remains responsible to identify the critical assets on
its system.
    254. Commenters raise a number of topics that they believe should
be addressed in the NERC guidance, such as how to assess whether a
generator or a blackstart unit is ``critical'' to Bulk-Power System
reliability, the proper quantification of risk and frequency,
facilities that are relied on to operate or shut down nuclear
generating stations, and the consequences of asset failure and asset
misuse by an adversary. We believe these are all appropriate topics to
be addressed and direct the ERO to consider these commenter concerns
when developing the guidance.
    255. The Commission proposed in the CIP NOPR that the ERO and
Regional Entities provide reasonable technical support to relatively
smaller entities that may have difficulty determining whether a
particular asset is critical because, for example, the impact of the
facility may be dependent on their connection with a transmission owner
or operator. While we believe that there is a need to assist entities
that lack a wide-area view, we are mindful of the ERO's concern that it
would place an undue burden on it and the Regional Entities. If the ERO
believes that it and the Regional Entities do not have sufficient
resources to take on this responsibility, it should designate another
type of entity with a wide-area view, such as a reliability
coordinator, to provide needed assistance. This approach is consistent
with our determination (discussed later in this Final Rule) regarding
the external review of critical asset lists. Accordingly, we direct
either the ERO or its designees to provide reasonable technical support
to assist entities in determining whether their assets are critical to
the Bulk-Power System.
    256. Regarding MidAmerican's comments on use of the N minus 1
criterion when applying a risk-based assessment methodology to the
identification of critical assets, we agree with MidAmerican that an N
minus 1 criterion is not an appropriate risk-based assessment
methodology for identifying critical assets. While the N minus 1
criterion may be appropriate in transmission planning, use of an N
minus 1 criterion for the risk-based assessment in CIP-002-1 would
result in the nonsensical result that no substations or generating
plants need to be protected from cyber events. A cyber attack can
strike multiple assets simultaneously, and a cyber attack can cause
damage to an asset for such a time period that other asset outages may
occur before the damaged asset can be returned to service. Thus, the
fact that the system was developed to withstand the loss of any single
asset should not be the basis for not protecting that asset. Also, we
note that the definition of ``critical assets'' is focused on the
criticality of the asset, not the likelihood of an outage. Based on
this reasoning, in response to U.S. Power, we clarify that a generator
should not assume that none of its individual generating assets would
be regarded ``critical'' to the Bulk-Power System.\84\
---------------------------------------------------------------------------

    \84\ Further, Requirement R.1.2.3 provides that the risk-based
assessment must consider ``generation resources that support the
reliable operation'' of the Bulk-Power System. This language
indicates that certain generation facilities, and presumably some
facilities within a region identified as critical, must be
considered in an assessment. Beyond this, we leave it to the ERO to
provide sufficient guidelines to inform generation owners and
operators on how to determine whether it should identify a facility
as a critical asset. As discussed later in the Final Rule, the
Commission will monitor and evaluate the outcome of this endeavor--
the list of critical assets.
---------------------------------------------------------------------------

    257. With regard to Xcel's request for clarification regarding the
meaning of the phrase ``used for initial system restoration,'' in CIP-
002-1, Requirement R1.2.4, we direct the ERO to consider this
clarification in its Reliability Standards development process.
    258. As to Entergy's suggestion that the ERO provide a DBT profile
of potential adversaries, the ERO should consider this issue in the
Reliability Standards development process. Likewise, the ERO should
consider Northern California's suggestion that the ERO establish a
formal ``feedback loop'' to assist the industry in developing policies
and procedures.\85\
---------------------------------------------------------------------------

    \85\ Consistent with our approach in Order No. 693, the ERO
should address NOPR comments suggesting specific new improvements to
the CIP Reliability Standards. The Commission, however, does not
direct any outcome other than that the comments receive
consideration. See Order No. 693 at P 188.
---------------------------------------------------------------------------

b. Scope of Critical Assets and Critical Cyber Assets
i. Data as a Critical Asset
(a) NOPR Proposal
    259. In the CIP NOPR, the Commission noted that NERC's definition
of ``cyber assets'' includes ``data.'' The Commission stated that
``marketing or other data essential to the proper operation of a
critical asset, and possibly the computer systems that produce or
process the data, would be considered critical cyber assets'' subject
to the CIP Reliability Standards.\86\ The Commission proposed to direct
the ERO to develop guidance on the steps that would be required to
apply the CIP Reliability Standards to such data and to include
computer systems that produce the data.
---------------------------------------------------------------------------

    \86\ CIP NOPR at P 114.
---------------------------------------------------------------------------

(b) Comments
    260. NERC agrees with the Commission that critical cyber assets
include ``data,'' as specified in the definition. NERC then states that
the ``data'' provision only refers to data associated with the reliable
operation of the Bulk-Power System, thereby excluding ``marketing and
other data'' as

well as data market systems that support the market function. NERC
suggests that the Final Rule remove references to marketing and other
data and supports referring, instead to ``reliability data.'' NERC adds
that it is not arguing that these systems do not need protection, but
merely that they are beyond the scope of the CIP Reliability Standards.
NERC states that, only in cases where reliability functions and market
functions are implemented within the same system, or are implemented on
systems located within the electronic security perimeter, should they
be protected by the CIP Reliability Standards, and then only as cyber
assets located within the same electronic security perimeter as
critical cyber assets.
    261. Numerous other commenters contend that the Commission is
mistaken to consider ``marketing and other data'' as a critical cyber
asset. For example, NRECA comments that marketing data seldom performs
a reliability-related function. Northeast Utilities states that only
data pertaining to design or operating specifications necessary for the
operation of cyber assets should be included in the definition of cyber
assets. PG&E states that the Commission's proposal to include
``marketing and other data'' is unnecessary because the CIP Reliability
Standards already apply to data that are housed and maintained within
critical cyber assets and information about critical cyber assets. PG&E
asserts that Requirement R4 of CIP-003-1 specifically protects critical
cyber asset information, so no additional modifications are needed.\87\
---------------------------------------------------------------------------

    \87\ See also Alliant, EEI, ISO-NE, ISO/RTO Council, Luminant,
National Grid, Ontario Power, ReliabilityFirst, SDG&E, SPP and WAPA.
---------------------------------------------------------------------------

    262. Bonneville requests clarification whether the Commission's
reference to marketing data and system data are intended to apply to
data and systems related to power transactions to be delivered
physically about which data are sent to grid operators (e.g., systems
that generate E-tags) or all marketing data and systems even if the
transactions are settled financially and never get to physical
delivery.
    263. MidAmerican agrees with the Commission on the need for
additional guidance regarding the definition of ``data'' as critical
cyber assets. It recommends deletion of the term ``data'' from the NERC
definition of a ``critical cyber asset'' and, instead, its inclusion in
the information protection standard. MidAmerican contends that access
to data is of secondary importance when compared to access to a
physical critical cyber asset and, thus, data should be protected as
any other critical asset information would be protected.
    264. ISO/RTO Council and Ontario Power argue that, although the
computers and other devices that contain data may use a routable
protocol or may be dial-up accessible, the data itself does not use a
routable protocol, nor is it, in its own right, dial-up accessible.
Therefore, they submit that Reliability Standard CIP-002-1 does not
require that ``data'' be considered a critical cyber asset. In
addition, ISO/RTO Council argues that, since every responsible entity's
definitive list of critical cyber assets is developed pursuant to
Reliability Standard CIP-002-1, Requirement R3, the ``further
qualified'' reference in Requirement R3 applies to the use of the term
``critical cyber asset'' wherever the term is used in the CIP
Reliability Standards. ISO/RTO Council believes that including data as
a critical cyber asset would go beyond the scope and intent of any of
the Reliability Standards.
    265. ISO-NE and SPP agree with ISO/RTO Council that data by itself
does not meet the definition of a critical cyber asset. ISO-NE states
that the Commission is further viewing data as a potential critical
asset. ISO-NE agrees with this view in concept, but believes that
consideration of reliability data is already intrinsic to the process
of evaluating assets to determine their criticality. Such reliability
data are ``real-time data'' and are highly transient as they pass
through, and are presented by, such supporting critical cyber assets.
Given that protection of critical cyber assets is already addressed,
the protection of the data component of a cyber asset during its
instance of viability as useful reliability data is satisfied. To
address a broader focus of data protection would expand the scope of
the current CIP Reliability Standards. Such a focus deserves
considerable review and discussion. If the Commission continues to have
concern regarding data protection from a broader view, ISO-NE
recommends this be considered in a future proceeding.
    266. SoCalEdison is concerned that applying the CIP Reliability
Standards to data that are essential to the proper operation of a
critical asset and including computer systems that produce the data
might greatly increase the scope of CIP-002-1 and will have a major
impact on the industry's ability to meet the standards requirements
schedule. SoCalEdison argues that, if the Commission directs these
modifications to the standard, they should be handled through the NERC
Reliability Standards development process which should consider any
impact to the implementation schedule.
    267. OGE also is concerned that a definition of ``critical cyber
assets'' that could include computer systems that produce or process
such sensitive data may encompass network servers and devices. If
network servers and devices are considered critical cyber assets, OGE
argues that additional controls will be necessary to isolate and
protect these network servers and devices. These additional controls
will provide only a minor increase in protection to the bulk electric
system.
    268. Idaho Power supports the protection of data that defines
location, network topography, device descriptions, and similar
information; however, Idaho Power cannot support the position that data
originating or used in an Energy Management System, for instance,
should be treated as ``critical'' after the fact. In Idaho Power's
view, the actual data, upon transfer to data historian servers, fails
to meet any definition of ``critical.''
    269. Juniper recommends that other enterprise databases, such as
human resources data, be considered part of the critical assets.
Juniper states that its concern applies to any data that can enable a
hacker to gain access to cyber assets. Juniper comments that any
essential data that could allow an attacker to weaken or defeat any
cyber or physical security must be considered a critical cyber asset.
(c) Commission Determination
    270. As discussed above, commenters that address the subject
uniformly oppose the CIP NOPR statement that ``marketing or other data
essential to the proper operation of a critical asset, and possibly the
computer systems that produce or process the data, would be considered
critical cyber assets'' subject to the CIP Reliability Standards. These
commenters contend that marketing data typically does not qualify as a
critical cyber asset and the Commission's proposal is beyond the
current scope of the CIP Reliability Standards. Moreover, several
commenters suggest that some data and support systems may fit the
definition of critical asset and, thus, supporting critical cyber
assets must comply with CIP-002-1.
    271. The Commission remains concerned that, while not all marketing
data or other data may be considered a critical cyber asset essential
to the proper operation of a critical asset, there may be times where
it is properly classified as such. For example, if a critical asset is
configured such that it cannot operate and support the

reliability and operability of the Bulk-Power System without a real-
time stream of data, that data fits the definition of a critical cyber
asset, and should be protected. Once a particular piece of data is no
longer needed by the critical asset, it is no longer a critical cyber
asset. On this point, we agree with commenters that there is a temporal
characteristic to data as a critical asset.
    272. Based on the range of comments received on this topic, the
Commission is convinced that the consideration and designation of
various types of data as a critical asset or critical cyber asset
pursuant to CIP-002-1 is an area that could benefit from greater
clarity and guidance from the ERO. Accordingly, the Commission directs
the ERO, in developing the guidance discussed above regarding the
identification of critical assets, to consider the designation of
various types of data as a critical asset or critical cyber asset. In
doing so, the ERO should consider Juniper's comments. Further, the
Commission directs the ERO to develop guidance on the steps that would
be required to apply the CIP Reliability Standards to such data and to
consider whether this also covers the computer systems that produce the
data.
    273. The Commission also agrees with ISO-NE that experience in the
implementation of the CIP Reliability Standards may indicate a need to
further address this topic in a future proceeding.
ii. Control Systems
    274. In the CIP NOPR, the Commission expressed concern that
sufficient rigor is applied in examining whether control systems are
determined to be critical assets.\88\ The Commission stated that, while
it seems obvious that an evaluation of a control system for critical
asset status would consider the potential loss of operability, the
Commission also believes that such an evaluation should examine any
misuse of the control system and the impact this misuse could have on
any electric facilities that the responsible entity controls, and the
combined impact of such facilities.
---------------------------------------------------------------------------

    \88\ CIP NOPR at P 115.
---------------------------------------------------------------------------

(a) Comments
    275. NERC and ReliabilityFirst comment that the Commission appears
to have incorrectly concluded that ``control systems'' are critical
assets. They explain that, in context, the control center, substations
or power plant could be a critical asset. The ``control system,''
however, would be a critical cyber asset.
    276. SPP concurs with the Commission's assertion that consideration
of misuse of control systems should be part of the risk-based
assessment. Compromise and misuse of a cyber asset often pose greater
risks to the reliability of the Bulk-Power System than an induced total
failure of the cyber asset. SPP comments that both insider and external
threats should be considered as part of the risk-based assessment. In
contrast, Entergy opposes the Commission's proposal to require an
evaluation of the misuse of control systems.
    277. Applied Control Solutions comments that there should be a
formally accepted method for identifying critical cyber assets,
explaining that existing methods are often reliability-based, not
cyber-based, resulting in entities reporting too few assets.
    278. ISA99 Team objects to the exclusion of communications links
from CIP-002-1 and non-routable protocols from critical cyber assets,
arguing that both are key elements of associated control systems,
essential to proper operation of the critical cyber assets, and have
been shown to be vulnerable--by testing and experience. In contrast,
Energy Producers notes that CIP-002-1 as proposed by NERC provides that
a critical cyber asset must have either routable protocols or a dial-up
connection. Energy Producers states that this is a useful, objective
criterion which will assist in the unambiguous identification of such
assets and therefore should be retained.
(b) Commission Determination
    279. The Commission accepts the explanation of the ERO and
ReliabilityFirst that a control system could be a critical cyber asset,
but not a critical asset.\89\
---------------------------------------------------------------------------

    \89\ As was stated in the CIP Assessment, a ``control system''
is a device or set of devices to manage, command, direct or regulate
the behavior of other devices or systems. It is typically a
specialized computer system or programmable logic controller that
manages, commands, directs or regulates the behavior of other
devices or systems in a physical environment, e.g., open or close
switches or relays, start or stop motors, or control motor speed. In
the case of the Bulk-Power System, control systems consist primarily
of sophisticated computer hardware and software designed to process
the mass of real-time data associated with the Bulk-Power System and
enable its reliable operation by, among other things, monitoring the
grid through remote sensors, sounding alarms when grid conditions
warrant, and operating equipment in field locations.
---------------------------------------------------------------------------

    280. The Commission has two concerns regarding the misuse of
facilities, and clarifies those concerns here. First, Requirement
R1.2.1 requires responsible entities to consider control centers and
backup control centers as potential critical assets. In determining
whether those control centers should be critical assets, we believe
that responsible entities should examine the impact on reliability if
the control centers are unavailable, due for example to power or
communications failures, or denial of service attacks. Responsible
entities should also examine the impact that misuse of those control
centers could have on the electric facilities they control and what the
combined impact of those electric facilities could be on the
reliability of the Bulk-Power System. The Commission recognizes that,
when these matters are taken into account, it is difficult to envision
a scenario in which a reliability coordinator, transmission operator or
transmission owner control center or backup control center would not
properly be identified as a critical asset.
    281. Second, the Commission is concerned about the misuse of a
control system that controls more than one asset. The assets could be
multiple generating units, multiple transmission breakers, or perhaps
even multiple substations. All of the controlled assets could be taken
out of service simultaneously due to a failure or misuse of the control
system. Individually, perhaps none of the controlled assets would be
considered as a critical asset. However, with a simultaneous outage due
to the single point of control, the controlled assets might affect the
reliability or operability of the Bulk-Power System and, therefore,
should be considered as critical assets. In that case, the common
control system should be considered a critical cyber asset.
    282. Therefore, consistent with the discussion above, the
Commission directs the ERO, through the Reliability Standards
development process, to specifically require the consideration of
misuse of control centers and control systems in the determination of
critical assets. The clarification of our concern over misuse of
control systems addresses Entergy's comment on this issue as well.
    283. The Commission concurs with SPP that both insider and external
threats should be considered as part of a risk-based assessment.
    284. We share Applied Control Solutions' concern that too few
assets may be identified as critical cyber assets. However, there is no
evidence that will be the case, and there is no formally accepted
method for identifying critical cyber assets before us at this time.
Therefore, we decline to direct that such a method be incorporated into
the CIP Reliability

Standards at this time. The Commission may revisit this circumstance in
a future proceeding.
    285. As to the conflicting comments of ISA99 Team and Energy
Producers, Requirement R2 of CIP-002-1 provides that a critical cyber
asset must either have routable protocols or dial-up access. Energy
Producers argues that Requirement R2 should be retained, while ISA99
Team argues that devices that use non-routable protocols should also be
considered as possible critical cyber assets. We do not find sufficient
justification to remove this provision at this time. However, we direct
the ERO to consider the comment from ISA99 Team. We also do not find
sufficient justification to order the inclusion of communication links
in CIP-002-1 at this time.
iii. Explanation Why an Asset Chosen or Not Chosen as Critical
    286. In the CIP NOPR, at P 115, the Commission expressed concern
that all critical assets be identified. To further this goal, the
Commission interpreted the phrase, ``[t]he risk-based assessment shall
consider the following assets * * *'' in Requirement R1.2 to mean that
a responsible entity must be able to show why, based on the risk-based
methodology, specific assets were chosen or not chosen. The Commission
proposed to direct that the ERO modify Requirement R1.2 to make this
obligation explicit.
(a) Comments
    287. Most commenters addressing the subject oppose the Commission's
proposal.\90\ For example, MidAmerican comments that a requirement that
a responsible entity provide reasons for selecting or not selecting a
particular asset as critical is unreasonably burdensome and unnecessary
because this should be adequately addressed when more direction is
given for the assessment methodology and selection criteria for
critical assets. Likewise, EEI and Entergy oppose the Commission's
proposal as unnecessary, contending that responsible entities will
identify critical assets based on the risk-based assessment methodology
required by CIP-002-1, which will be subject to audit. EEI questions
what further explanation an entity could provide beyond the assessment
methodology. Entergy notes that many entities operate hundreds of
substations and thousands of pieces of field equipment, and a
requirement to defend the exclusion of specific equipment would be
onerous.\91\
---------------------------------------------------------------------------

    \90\ E.g., Alliant, EEI, ISO/RTO Council, KCPL, MidAmerican,
National Grid, OGE and Tampa Electric.
    \91\ See also ISO/RTO Council, National Grid, PG &E and Tampa
Electric.
---------------------------------------------------------------------------

(b) Commission Determination
    288. To clarify, the Commission did not propose to direct that the
ERO develop a requirement for responsible entities to document why each
specific asset was identified or not identified as ``critical.''
Rather, the Commission's intent was that a responsible entity must be
able to explain such determinations, for example upon inquiry by an
auditor, to confirm compliance with the Reliability Standard.
Nonetheless, we are persuaded by the commenters that the documentation
of a responsible entity's risk-based assessment methodology pursuant to
Requirement R1.1 and the results of its annual application of the
methodology pursuant to Requirement R2 should suffice to explain a
responsible entity's asset determinations. Accordingly, the Commission
will not direct the ERO to develop a modification to address this
concern. However, if experience shows that responsible entities are
failing to consider in their assessments specific types of assets that
the Commission, ERO or others believe should be included in an
assessment and therefore not in compliance with the Reliability
Standard, there may be a need to revisit this matter in the future.
c. Internal Approval of Risk-Based Assessment
i. NOPR Proposal
    289. Requirement R4 of CIP-002-1 requires that a senior manager
``or delegate(s)'' must approve annually the list of critical assets
and critical cyber assets. In the CIP NOPR, the Commission proposed to
direct that the ERO develop a modification to CIP-002-1 to include a
requirement that a senior manager annually review and approve the risk-
based assessment methodology.\92\ The Commission stated that senior
management approval of the risk-based assessment methodology helps to
implement Blackout Report Recommendation 43, which calls for
establishing clear authority and ownership for physical and cyber
security.\93\
---------------------------------------------------------------------------

    \92\ See CIP NOPR at P 106-08 for the Commission's discussion
and proposal on this topic.
    \93\ See U.S.-Canada Power System Blackout Task Force, Final
Report on the August 14, 2003 Blackout in the United States and
Canada: Causes and Recommendations (April 2004) (Blackout Report).
The Blackout Report is available on the Internet at http://www.ferc.gov/industries/electric/indus-act/blackout.asp
.

---------------------------------------------------------------------------

ii. Comments
    290. Alliant, APPA/LPPC, Congressional Representatives, EEI, KCPL
and Luminant agree with the Commission that it is important that there
is internal oversight of the responsible entity's activities. EEI adds
that, although senior manager review of the risk-based assessment
methodology is implicit in the current CIP Reliability Standards, such
a provision should be made explicit through the Reliability Standards
development process to establish the ``clear authority'' recommended by
the Blackout Report. Luminant adds that such a provision would provide
a degree of certainty for a responsible entity's senior management to
approve the risk-based assessment methodology the responsible entity
adopts. KCPL also supports NERC's development of an ``explicit''
requirement that senior management review and approve a responsible
entity's risk-based assessment methodology.
    291. METC-ITC believe that the Commission can further strengthen
the CIP Reliability Standards by raising the apparent level of
responsibility of CIP compliance to a corporate officer level,
replacing ``senior manager'' with ``officer'' in such instances
throughout the CIP Reliability Standards. In contrast, Northern Indiana
claims that senior management might not be the most knowledgeable about
cyber security issues and urges the Commission to continue to allow a
responsible entity to delegate this review to knowledgeable personnel.
    292. ISO/RTO Council argues that the requirement for internal
oversight already is an implicit requirement under the CIP Reliability
Standards. In ISO/RTO Council's view, it is abundantly clear that the
senior manager is fully accountable for both the thoroughness of the
methodology used to establish the critical asset list as well as the
completeness of the list itself.
    293. Bonneville seeks clarification whether the intent of the
Commission's proposal is to make senior managers personally accountable
for a responsible entity's violation of the CIP Reliability Standards
so that the senior manager is subject to civil penalties. Bonneville
comments that, if this is the intended purpose or result, then the
extent of such personal liability must be made clear so that affected
senior managers can take necessary precautions, such as obtaining
additional insurance coverage. NRECA raises similar concerns regarding
a senior manager's penalty liability.

iii. Commission Determination
    294. The Commission adopts its CIP NOPR proposal and directs the
ERO to develop, pursuant to its Reliability Standards development
process, a modification to CIP-002-1 to explicitly require that a
senior manager annually review and approve the risk-based assessment
methodology. This determination is consistent with the Blackout
Report's recommendation to establish clear authority and ownership for
physical and cyber security. Further, regardless of whether the current
Requirements implicitly require senior manager review of the assessment
methodology, we believe the matter is too important to rely on
inference. Accordingly, the Commission directs the ERO to develop a
modification to CIP-002-1 to explicitly require that a senior manager
annually review and approve the risk-based assessment methodology.
    295. With regard to Northern Indiana's concerns, we are not
directing a revision to the current language of Requirement R4 which
provides for ``the senior manager or delegate(s)'s approval'' of the
list of critical assets and list of critical cyber assets. As we
understand the provision, the senior manager still retains ultimate
responsibility for the determinations of his or her delegate(s).
Otherwise, senior management could avoid responsibility by `delegating
downward.'
    296. With regard to METC-ITC's comment, the ERO should consider in
its Reliability Standards development process the suggestion that the
CIP Reliability Standards require oversight by a corporate officer (or
the equivalent, since some entities do not have corporate officers)
rather than by a ``senior manager.''
    297. In response to comments by Bonneville and NRECA, the
Commission clarifies that we do not intend that an individual employee
of a user, owner or operator of the Bulk-Power System will be subject
to a penalty pursuant to section 215 of the FPA because a responsible
entity violates a CIP Reliability Standard. This matter is addressed in
more detail in our discussion of CIP-003-1.
d. External Oversight of Critical Assets Identification To Provide
Regional Perspective
i. NOPR Proposal
    298. The CIP NOPR emphasized that the responsibility for
identifying critical assets should be placed on the individual
responsible entity as the asset owner or operator, and not shifted to
Regional Entities or another organization.\94\ In addition, the
Commission expressed its belief that a systematic approach to external
oversight of the identification of critical assets would assure a wide-
area view and thereby better ensure that responsible entities are
identifying appropriate assets as ``critical.'' The Commission
explained that, without external oversight using a wide-area view,
trends or deviations may not be identified prior to an incident or
audit. The CIP NOPR also noted that a wide-area view would help to
ensure that assets that have regional importance, such as for reactive
power supply, are included as critical assets. Therefore, the
Commission proposed that the ERO develop a modification to CIP-002-1 to
include a mechanism for the external review and approval of critical
asset lists based on a regional perspective by the Regional Entities,
possibly among others. The Commission stated that, while proposing that
the Regional Entities perform this review function, it did not exclude
the possibility of a critical asset review process that allows for the
participation of other organizations, such as transmission planners and
reliability coordinators.
---------------------------------------------------------------------------

    \94\ See CIP NOPR at P 111-13.
---------------------------------------------------------------------------

ii. Comments
(a) Responsible Entity for Identifying Critical Assets
    299. Several commenters, including ISO/RTO Council, EEI,
FirstEnergy, National Grid and Northeast Utilities, agree with the
Commission that responsibility for identifying critical assets should
not be placed on the Regional Entities or any organization other than
the categories of applicable entities currently identified in CIP-002-
1. They believe that this responsibility rightfully rests with the
asset owner or operator, and the Regional Entities would be
overburdened by such a task.
    300. In contrast, AMP Ohio advocates the revision of CIP-002-1 to
make Regional Entities responsible for the identification of critical
assets because they have an area-wide view of the grid--as opposed to
small generation owners, generation operators and load serving entities
that have a limited view of the Bulk-Power System. AMP Ohio also argues
that making small generation owners, generation operators and load
serving entities responsible for asset identification would place a
burden on these small entities that they are ill-positioned to bear.
AMP Ohio explains that it is not proposing that responsible entities
abdicate responsibility but, rather, suggests that the Regional Entity
take the first step to identify critical assets. The asset owner or
operator, as a responsible entity, must then ensure that the critical
cyber assets associated with the critical asset are identified and
protected. AMP Ohio suggests that, if responsible entities remain
responsible for identifying assets, the CIP Reliability Standard should
include a safe harbor provision for good faith compliance, even if
subsequent events demonstrate that critical assets may have been
overlooked.
    301. SPP and ReliabilityFirst suggest a modification to CIP-002-1
that would allow an entity to rely on the assessment of another entity
with interest in the matter. For example, a merchant generator may
through a legitimate assessment determine that its plant is not
critical whereas the balancing authority's assessment indicates that it
is. They suggest that in such a situation the merchant generator would
accept the risk-based assessment of the balancing authority as a
substitute for performing its own assessment with limited data.
(b) Need for External Review and Alternatives
    302. While some commenters agree with the Commission that there is
a need for external review and approval of a responsible entity's
critical asset list, others believe that such a requirement is
unnecessary.
    303. Arkansas Electric, Juniper, MidAmerican, National Grid,
Ontario IESO, and U.S. Power agree with the Commission that a process
for regional review of an entity's critical asset list by either the
ERO or the Regional Entity would be beneficial. According to Arkansas
Electric, this would provide an entity with the opportunity for a
review of its critical asset list prior to a full CIP audit. Arkansas
Electric is concerned that, without such a review, entities could be
subject to sanctions based on a critical asset list later deemed
deficient by an auditor. MidAmerican finds that a regional perspective
could add consistency to the critical asset determination. U.S. Power
maintains that, in organized markets where a generator does not
typically possess a ``regional perspective'' to objectively determine
the criticality of an individual asset, external review could be
helpful in assuring that a regionally consistent approach is followed;
and that such determinations are based on the most relevant, available
information.
    304. FirstEnergy agrees with the Commission that a formal or
systematic approach to external oversight of the identification of
critical assets would

better ensure that responsible entities are identifying similar assets.
FirstEnergy comments that external review is crucial to the
comprehensive application of the CIP Reliability Standards and such
review should be conducted by an entity with a wide-area view.
    305. National Grid comments that it would support the development
of an appropriate mechanism for Regional Entities to collection
documentation of each responsible entity's assessment methodology and
list of critical assets. However, National Grid would not support a
requirement for Regional Entity pre-approval of the methodology or list
because the Regional Entity lacks the necessary expertise and
resources. Similarly, Northern Indiana supports external review,
particularly where lists of cyber security assets will not be shared
and responsible entities must determine their asset lists based on
mutual distrust. However, Northern Indiana opposes requiring approval
of a responsible entity's list of critical assets by the entity
conducting the external review. It also opposes granting Regional
Entities or reliability coordinators the ability to supplement a
critical asset list. This concern would be removed, however, if the
regional entity approved the risk-based assessment methodology, rather
than the list of critical assets.
    306. In contrast, NERC and others oppose modifying CIP-002-1 to
require external review and approval of critical asset lists.\95\ NERC
requests that the Commission allow the current oversight framework--
which includes audits, readiness reviews and self-certification--to
work without imposing new or different requirements from the current
CIP Reliability Standards. Similarly, EEI comments that, while it
understands the Commission's view that external oversight may have
potential value by providing a wide-area view, it believes that NERC's
Uniform Compliance Monitoring and Enforcement Program already provides
effective tools that may provide such oversight. EEI does not, however,
oppose voluntary random spot checking as a means to provide an ``area-
wide view'' before the ``auditably compliant'' stage.
---------------------------------------------------------------------------

    \95\ E.g., Alliant, Mr. Brown, Duke, EEI, Entergy, Idaho Power,
Luminant, OGE, Ontario Power, Puget Sound, SERC-CIPC and Southern.
---------------------------------------------------------------------------

    307. Alliant objects to external approval of a critical asset list
because the ERO auditing regime provides a ``wide-area view'' and
external approval would require an appeals process that would delay
implementation without accruing reasonable benefits. Duke claims that
the ERO's guidance document should result in adequate consistency in
the development of critical asset lists and suggests that any external
review should be optional. Southern contends that a responsible entity
is generally in the best position to determine which assets are
critical to the Bulk-Power System and, if needed, industry experience
can be shared through existing forums and through the voluntary
exchange of information. Puget Sound and others propose that industry
forums could be used to promote a wide-area view in developing critical
asset lists. Idaho Power insists that regional concerns should be
addressed before an entity develops its critical asset list.
    308. Many of the commenters that oppose an external review and
approval process believe that the Commission's objectives can be
accomplished through a Regional Entity audit process.\96\ SERC CIPC
claims that the regions, if presented with a raw list of asset names,
will have no basis on which to state whether the list is sufficient or
not. According to SERC CIPC, during the audit process, the audit team
will review the risk-based assessment methodology.
---------------------------------------------------------------------------

    \96\ E.g., Duke, EEI, Entergy, National Grid, OGE and SERC-CIPC.
---------------------------------------------------------------------------

(c) Appropriate Organization to Conduct External Review
    309. Among the commenters that support the need for external
oversight, some prefer that an organization other than a Regional
Entity be made responsible for external oversight. For example, ISO/RTO
Council believes that the reliability coordinator is in the best
position to provide such oversight because it has a wide-area view that
is focused on grid operation. ISO/RTO Council believes that Regional
Entities need to remain independent to enforce the CIP Reliability
Standards and should not be involved in CIP Reliability Standard
implementation; and likewise, considers that transmission planners are
not sufficiently focused on the operational aspects of the grid where
cyber security is most critical. Further, ISO/RTO Council suggests that
reliability coordinator oversight be limited to a review of the
methodologies used to identify critical assets, since reliability
coordinators have no special expertise in identifying critical cyber
assets.
    310. By contrast, Ontario IESO, Reliant, ReliabilityFirst and SPP
advocate that reliability coordinators, not Regional Entities, should
provide oversight of critical asset identification. Ontario IESO and
SPP believe that the reliability coordinators are most suited for this
task because they are directly involved in the daily activities of
ensuring Bulk-Power System reliability. They comment that the
reliability coordinators currently perform a wide-area function that
includes studying power system dynamics and interrelationship of assets
as well as coordination among neighboring systems. Reliant urges that
the Commission require the reliability coordinator to play a major role
in the external review of critical asset lists because it possesses a
broad array of operating and system data.
    311. Ontario IESO comments that, because Regional Entities perform
a critical CIP Reliability Standards development and compliance role,
Regional Entity approval of an entity's critical asset list creates a
conflict of interest in the situation where a Regional Entity is
required to investigate and enforce non-compliance of a CIP Reliability
Standard. The Regional Entity may have approved the critical asset list
and thus may be reluctant to subsequently find a deficiency in the list
discovered during the course of a compliance investigation. Ontario
IESO also respectfully suggests that Regional Entities lack the
technical expertise and intimate knowledge of their members' power
system equipment and behaviors to provide the necessary oversight in
the determination of critical asset lists.
    312. Ontario IESO suggests that, in the event an asset owner and
the reliability coordinator disagree as to whether an asset should be
listed as critical, the latter should prevail. APPA/LPPC ask that the
Commission direct NERC to develop written procedures for a responsible
entity to challenge an external, third-party decision to alter a
responsible entity's list of critical assets. APPA/LPPC argue that,
regardless of the reviewer, an appellate process akin to the process
described in Rule 410 of the NERC Rules of Procedure, providing for
appeals to the Commission, is needed. EEI and Alliant also believe that
an appeal process would be needed if regional oversight occurs.
(d) Confidentiality Concerns
    313. Many of the commenters that oppose an external review and
approval process are concerned that an external review process will
create new issues regarding the protection of sensitive information
that inevitably is included

in the critical asset lists.\97\ These commenters believe that the
review of critical asset lists during on-site audits would better
protect this highly-sensitive information.
---------------------------------------------------------------------------

    \97\ E.g., Duke, EEI, Entergy, Manitoba Hydro, National Grid and
SERC-CIPC.
---------------------------------------------------------------------------

    314. EEI and Manitoba Hydro express concern that off-site, third
party review of a critical asset list may conflict with an entity's
responsibility to protect information such as a critical asset list in
CIP-003-1, Requirement R4.1. EEI urges that the Final Rule clarify that
this information should only be divulged in on-the-premise audits.
    315. CEA is also concerned that the Commission's proposal to
include a mechanism for the external review and approval of critical
assets lists would involve the submission of sensitive information. CEA
and Manitoba Hydro maintain that some Canadian utilities are prohibited
from sharing security information with U.S. authorities. In addition,
some utilities regard sharing sensitive security information externally
or with a foreign entity as a security risk. Currently, sensitive
information is kept on site and shared with external audit teams during
visits and the information remains on-site following the audit. The
Commission's proposed changes would require sensitive material to be
shared on a regular basis and stored externally and perhaps in a
foreign jurisdiction. Given the impact on Canadian utilities from such
changes to the CIP Reliability Standards, CEA requests that the
Commission exercise caution with respect to this issue.
    316. Xcel asks, in a situation where an entity's risk-based
assessment identifies a critical asset owned by another entity, how
should this information properly be communicated while maintaining
confidentiality? Xcel recommends that the Regional Entities develop
confidentiality protocols to address such situations.
    317. SDG&E requests clarification that information associated with
the CIP Reliability Standards will be treated with confidentiality.
Tampa Electric and SoCal Edison also urge that steps be taken to
protect confidentiality if information is released to accomplish
external reviews. SoCal Edison is concerned with the risks associated
with storing critical information in a common place.
    318. Bonneville agrees with the Commission's goal of providing a
mechanism for the external review and approval of responsible entities'
critical asset lists based on a regional perspective; however, it is
concerned that the Commission's proposal could result in FOIA concerns
for Bonneville and other federal entities. Under FOIA, the release of
information to an external party generally waives any privileges
against disclosure with respect to subsequent requests to the federal
agency for that same information. Bonneville is concerned that
submission of critical asset information to the Regional Entity,
particularly disclosure of the vulnerability-related rationales for
including and documentation of why it chose to exclude particular
facilities from inclusion on the critical asset list, may act as such a
waiver. In addition, Bonneville notes that external reviewers of
critical federal security information may need to obtain federal
security clearances before federal entities can allow such review.
iii. Commission Determination
(a) Responsible Entity for Identifying Critical Assets
    319. The Commission affirms its CIP NOPR determination that
responsibility for identifying critical assets should not be shifted to
the Regional Entity or another organization instead of the applicable
responsible entities identified in the current CIP Reliability
Standards. As we stated in the CIP NOPR,\98\ and confirmed by
commenters, such a shift would not improve the identification of
critical assets, but would likely overburden the Regional Entities.
While we are sympathetic to AMP Ohio's concerns regarding small