It was a busy week for NERC CIP last week, where comments in the Notice of Proposed Rulemaking (NOPR) from FERC indicate that CIP Version 5 will be approved. CIPv5, and the potential successive versions suggested by NOPR language, are going to have a heavy impact on generators.
But before I hop into what CIPv5 means for Generation, I want to spotlight Tom Alrich and his excellent coverage of the NERC CIP development process. Tom is an active participant in both the CIP development efforts, and in some regional efforts. Since discovering his blog, I have a better understanding of not only what direction the regulations are taking, but also why they are taking that direction. He is candid, and he is thorough, and he is, what I would term, a compliance geek. Points I expand on in this post specifically for generation, Tom has made in his posts for electric power in general. Now, for some generation geekery of my own…
Major comments in the NOPR indicate that FERC wants some very specific changes to the NOPR. The big ones that will affect generation are:
- Technical Cyber Security Controls for Low Impact
- ‘Temporary’ Cyber Assets, i.e. those that are connected for 30 days or less and connect to an ESP network
- Clarification on what a Generation Control Center is