Media Statements & Speeches
Statement on FERC/NERC Staff White Paper on CIP Standards Notices of Penalties
Today, staff at the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) issued a joint White Paper to address NERCís submission, and the Commissionís processing, of Notices of Penalty (NOPs) for violations of Critical Infrastructure Protection (CIP) Reliability Standards. As I mentioned at our Reliability Technical Conference in June, the handling and confidentiality of these NOPs has been an issue of growing controversy. As I advocated then, I think it is essential that FERC and NERC conduct public process to consider the appropriate balance between transparency and security in these instances. I am very pleased that such a process is being instituted today.
The procedures that NERC and FERC have followed in processing NOPs for CIP violations has been in place since before I joined FERC and has not been changed in the past decade, as outlined in the attached White Paper. I think it is highly appropriate that we consider changes to the process at this time. As I discussed at the technical conference, it is important that we handle NOPs so as to avoid subjecting the bulk electric system to risk of a cyber attack once a vulnerability is identified. At the same time, I believe state regulators, members of the public, and others have a legitimate interest in such violations, and we should seek to achieve as much transparency as we can consistent with protecting legitimate security interests.
I believe the FERC and NERC staff have put forth one proposal worthy of consideration for a way to handle these NOPs differently. I hope that we receive a wide range of comments on the White Paper, including any suggestions for alternative processes, which will allow FERC and NERC to move forward on this issue.
|View Printable PDF Version|