Unofficial Comment Form for Critical Infrastructure Protection

Reliability Standards, Version 4 Survey

Please DO NOT use this form to submit comments. Please use the electronic comment form located at the link below to submit responses to the Critical Infrastructure Protection Reliability Standards, Version 4 Survey. The electronicsurvey must be completed by 5:00 p.m. PDT on June1, 2011.If you have questions please contact Howard Gugel at r by telephone at 609-651-2269.

Background Information

On February 10, 2011, NERC filed a petition with the Federal Energy Regulatory Commission (“FERC”) requesting approval of NERC’s proposed CIP Version 4 Reliability Standards (“February 10 Petition”). The February 10 Petition included proposed changes to the CIP-002 through CIP-009 Reliability Standards that were approved by the NERC Board of Trustees on January 24, 2011. On April 12, 2011, NERC received a request from FERC’s Office of Electric Reliability requesting additional information in response to NERC’s February 10 Petition (“FERC April 12 Data Request”). NERC’s CIP Version 4 Survey is based on the questions included in FERC’s April 12 Data Request.

NERC’s February 10 Petition presents a revised CIP-002-4 standard that provides a cyber security framework for the identification and protection of Critical Cyber Assets to support the reliable operation of the bulk power system. The proposed CIP-002-4 standard specifically requires the identification and documentation of the Critical Cyber Assets associated with the Critical Assets that support the reliable operation of Bulk Electric System. Critical Assets will be identified through the application of the “bright-line” criteria contained in Attachment 1 – Critical Asset Criteria of the CIP-002-4 standard.

FERC’s April 12 Data Request requests information from NERC regarding how the proposed bright-line criteria, when applied to NERC registered entities’ facilities, will affect the number of Critical Assets under the proposed CIP-002-4 Reliability Standard. FERC is requesting this information for various types of facilities (i.e., U.S. System Control Centers, U.S. Blackstart Resources, U.S. Transmission Substations, Generation Units by size), to be provided on a Regional Entity footprint basis. FERC is also requesting the data based on size of transmission and generation facilities.

Given the significance of the CIP-002-4 standard on the reliability of the bulk power system, NERC believes it is exceedingly important to provide the data FERC is requesting in order to help facilitate FERC’s approval of the February 10 Petition. However, NERC does not possess the information necessary to provide an adequate response to FERC without input from the industry. Several of FERC’s questions in the April 12 Data Request that are included in NERC’s CIP Version 4 Survey specifically request data that can only be provided by NERC registered entities. NERC believes that providing an adequate response to FERC will help facilitate FERC’s approval of NERC’s February 10 Petition, and will better inform NERC’s ongoing CIP Reliability Standards development efforts.

The questions that appear in NERC’s CIP Version 4 Survey are part of a larger set of questions that FERC requested NERC’s response to in the April 12 Data Request. NERC must file responses to a number of the questions in the April 12 Data Request by May 27, 2011 (i.e., questions 1, 2, 8, 10, 11, and 12). NERC requested and received a 45-day extension of time to submit responses to Questions 3, 4, 5, 6, 7, and 9 of the April 12 Data Request. These responses are due no later than July 11, 2011. However, at the same time FERC staff granted the extension, FERC staff encouraged NERC to respond to the remaining questions as much in advance of the July 11, 2011 deadline as possible. Given the importance of FERC’s approval of the CIP Version 4 standards in as timely manner as possible, NERC is requesting registered entities to submit responses to this survey within 30 days. Based on the data received, NERC’s target date to submit a response to FERC’s April 12 Data Request is June 15, 2011.

The questions used to develop this NERC CIP Version 4 Survey were based on FERC’s April 12 Data Request to NERC. NERC will create a high-level summary of the information received in response to this survey, presenting the data only in aggregate, by function, and on a Regional Entity footprint basis. Entity-specific responses will not be included in NERC’s response to FERC.

NERC and the Regional Entities do not intend to use the data received in response to this request as a basis for determining compliance with the currently enforceable CIP-002 through CIP-009 Reliability Standards.

Instructions:

Terms defined in the NERC glossary are signified by capital letters. For any part of questions 5, 6, 7, 8, and 9 that you cannot provide a numeric response, please use the comment box in the question to provide an explanation. Please note that in Question #4 we are asking for entities to provide their NCR number. The purpose for this is to assist NERC in eliminating duplicate entries (e.g. in the instance that more than one person from an entity responds to the survey, or the instance that the same person fills out surveys for multiple registered entities). The NCR information will not be used for any other purpose, and will not be provided in any analysis of the survey.

Question 1: Please provide the name of the Registered Entity for which this survey is being submitted.

Question 2: Please provide a contact person for the survey responses, in the event that clarifying information is needed for any response.

Question 3: Please provide an email address for the contact person identified in Question 2, in the event that clarifying information is needed for any response.

Question 4: Please provide the NERC Compliance Registry (NCR) number of the Registered Entity for which this survey is being submitted. Please submit only one survey response per NCR number.

Question 5: Please provide the requested control center information delineated by Regional Entity. The number of control centers you expect to identify should include all control centers that you have currently identified as Critical Assets that meet the CIP-002-4 Attachment 1 criteria as well as those you expect to identify as Critical Assets at the effective date of CIP-002-4. (Please refer to the FERC Data Request question 3)

Question 6: Since EOP-005-2 is not effective until July 1, 2013, please provide the requested information for Blackstart Resources that the Registered Entity expects to be identified when EOP-005-2 is effective, delineated by Regional Entity. The number of Blackstart Resources you expect to identify should include all Blackstart Resources that you have currently identified as Critical Assets that meet the CIP-002-4 Attachment 1 criteria as well as those you expect to identify as Critical Assets at the effective date of CIP-002-4. (Please refer to the FERC Data Request question 4)

Question 7: Please provide the requested Transmission substation information delineated by Regional Entity. The number of Transmission substations you expect to identify should include all Transmission substations that you have currently identified as Critical Assets that meet the CIP-002-4 Attachment 1 criteria as well as those you expect to identify as Critical Assets at the effective date of CIP-002-4. (Please refer to the FERC Data Request question 5)

Question 8: Please provide the requested generation information delineated by Regional Entity. The number of generation units you expect to identify should include all generation units (excluding Blackstart Resources and nuclear generation) that you have currently identified as Critical Assets that meet the CIP-002-4 Attachment 1 criteria as well as those generation units (excluding Blackstart Resources and nuclear generation) you expect to identify as Critical Assets at the effective date of CIP-002-4. (Please refer to the FERC Data Request question 6)

Question 9: Please provide the requested generation information delineated by Regional Entity. The number of generation units you expect to identify using Criterion 1.1 should include all generation units that you have currently identified as Critical Assets that meet the CIP-002-4 Attachment 1 Criterion 1.1 as well as those generation units you expect to identify as Critical Assets using CIP-002-4 Attachment 1 Criterion 1.1 at the effective date of CIP-002-4. For responses that are requesting amount of generation capacity (in MW), please use the highest rated net Real Power capability of the preceding 12 months. For example, if an entity has three generation units at a plant site in TRE that have an aggregate highest rated net Real Power capability of the preceding 12 months of 1679MW, and no other generation units that meet Criterion 1.1, they would enter 1679 in the column for TRE and 0 in all of the other columns for the third line. A generation plant location refers to a group of one or more generating units occupying a defined physical footprint, often but not always, these units are surrounded by a common fence, have a common entry point, share common facilities such as warehouses, water plants and cooling sources, follow a similar naming convention (plant name - unit number) and fall under a common management organization. (Please refer to the FERC Data Request question 7)

Question 10: Please provide the requested Transmission substation information delineated by Regional Entity. (Please refer to the FERC Data Request question 9)

  1. Registered Entity name:
  2. Registered Entity contact name:
  3. Registered Entity contact email:
  4. Registered Entity NERC Compliance Registry (NCR) number:
  1. Please provide, by Regional Entity, the following information concerning your control centers located in the U.S. controlling Transmission and/or generation Facilities of 100kV or more under the NERC approved Version 4 CIP Reliability Standards:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
5.1 Number of control centers you expect to identify as Critical Assets (CAs) with Critical Cyber Assets (CCAs)
5.2 Number of control centers you expect to identify as Critical Assets (CAs) without Critical Cyber Assets (CCAs)
5.3 Number of control centers you expect to not identify as Critical Assets
5.4 Comments
  1. Please provide, by Regional Entity, the following information concerning your Blackstart Resources located in the U.S. under the NERC approved Version 4 CIP Reliability Standards:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
6.1 Number of Blackstart Resources you expect to identify as Critical Assets with Critical Cyber Assets (CCAs)
6.2 Number of Blackstart Resources you expect to identify as Critical Assets without Critical Cyber Assets (CCAs)
6.3 Number of Blackstart Resources you expect to not be identified as Critical Assets (if this answer is non-zero, please provide an explanation in the comment box)
6.4 Comments
  1. For transmission facilities 100kV or above, please provide, by Regional Entity, the following information concerning Transmission substations located in the U.S. under the NERC approved Version 4 CIP Reliability Standards:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
7.1 Number of Transmission substations containing elements that operate at 100-299kV
7.2 Number of Transmission substations containing elements that operate at 100-299kV you expect to identify as Critical Assets or include elements identified as Critical Assets
7.3 Number of Transmission substations containing elements that operate at 100-299kV you expect to identify as Critical Assets or include elements identified as Critical Assets that you expect to have associated CCAs
7.4 Number of Transmission substations containing elements that operate at 300-499kV
7.5 Number of Transmission substations containing elements that operate at 300-499kV you expect to identify as Critical Assets or include elements identified as Critical Assets
7.6 Number of Transmission substations containing elements that operate at 300-499kV you expect to identify as Critical Assets or include elements identified as Critical Assets that you expect to have associated CCAs
7.7 Number of Transmission substations containing elements that operate at 500kV or above
7.8 Number of Transmission substations containing elements that operate at 500kV or above you expect to have associated CCAs
7.9 Comments
  1. Excluding Blackstart Resources and nuclear generation units, please provide, by Regional Entity and by size (0-299MVA, 300-499MVA, 500-999MVA, 1000+ MVA), the following information concerning generation units located in the U.S. under the proposed Version 4 CIP Reliability Standards:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
8.1 Number of generation units (0-299MVA) you expect to identify as Critical Assets with CCAs
8.2 Number of generation units (0-299MVA) you expect to identify as Critical Assets without CCAs
8.3 Number of generation units (0-299MVA) you expect to not identify as a Critical Asset under the proposed Version 4 CIP Reliability Standards
8.4 Number of generation units (300-499MVA) you expect to identify as Critical Assets with CCAs
8.5 Number of generation units (300-499MVA) you expect to identify as Critical Assets without CCAs
8.6 Number of generation units (300-499MVA) you expect to not identify as a Critical Asset under the proposed Version 4 CIP Reliability Standards
8.7 Number of generation units (500-999MVA) you expect to identify as Critical Assets with CCAs
8.8 Number of generation units (500-999MVA) you expect to identify as Critical Assets without CCAs
8.9 Number of generation units (500-999MVA) you expect to not identify as a Critical Asset under the proposed Version 4 CIP Reliability Standards
8.10 Number of generation units (1000+MVA) you expect to identify as Critical Assets with CCAs
8.11 Number of generation units (1000+MVA) you expect to identify as Critical Assets without CCAs
8.12 Number of generation units (1000+MVA) you expect to not identify as a Critical Asset under the proposed Version 4 CIP Reliability Standards
8.13 Comments
  1. Please provide the following information about generation units and generation plant locations captured by Criterion 1.1 of CIP-002-4 Attachment 1 by Regional Entity for generation units and generation plant locations located in the U.S.:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
9.1 Number of generation units you expect to identify as Critical Assets by Criterion 1.1
9.2 Number of generation units you expect to not identify as Critical Assets by Criterion 1.1
9.3 Total amount of generation capacity (in MW) of the generation units you expect to identify as Critical Assets by Criterion 1.1
9.4 Total amount of installed generation capacity (in MW)
9.5 Number of generation plant locations for generation units you expect to identify as Critical Assets by Criterion 1.1
9.6 Total number of generation plant locations
9.7 Comments
  1. Criterion 1.7 provides that “Transmission Facilities operated at 300 kV or higher at stations or substations interconnected at 300 kV or higher with three or more other transmission stations or substations” shall be considered Critical Assets. Please identify the number of substations that will be captured by Criterion 1.7:

FRCC / MRO / NPCC / RFC / SERC / SPP / TRE / WECC
10.1 Number of Transmission substations that meet Criterion 1.7
10.2 Comments

1