Workshop on Supply Chain Risk Management Reliability Standards

Docket No. RM24-4-000

The workshop will focus on the “assessment” aspect of supply chain risk management (SCRM). Specifically, the workshop panels will discuss the proposed directive in the Commission’s September 19, 2024 Notice of Proposed Rulemaking[1] to require that entities establish steps in SCRM plans to validate the completeness and accuracy of information received from vendors during the procurement process to better inform the identification and assessment of supply chain risks associated with vendors’ software, hardware, or services.

Attendee Registration

The workshop will take place in a hybrid format, with panelists participating in person and attendees allowed in person or virtually. The conference will be open for the public to attend, and there is no fee for attendance.

All in-person attendees must register here

Virtual attendance does not require registration.

Please join the Q&A sessions of the Workshop by clicking the link below:

https://lionaenterprises.zoom.us/j/87549130695?pwd=0NTuZDNYb9M2vJLaWo9guV7mi6hJF4.1

Meeting ID: 875 4913 0695

Passcode: 030120

Accessibility

This workshop will be accessible under section 508 of the Rehabilitation Act of 1973. For accessibility accommodations please send an email to [email protected] or call toll free (866) 208-3372 (voice) or (202) 502-8659 (TTY), or send a fax to (202) 208-2106 with the required accommodations.

Comments

Attached to this Supplemental Notice is an agenda for the workshop, which includes additional information on the discussions. Participation in the discussions will be limited to invited panelists and staff members from the Commission and NERC. However, interested parties are encouraged to listen to and observe the discussions. During the Q&A sessions, in-person attendees may ask live questions and virtual attendees may submit written questions online. The conference will also be transcribed. Transcripts will be available for a fee from Ace Reporting, (202) 347-3700. The Commission will accept comments following the workshop in Docket No. RM24-4-000, with a deadline of March 28, 2025.

Contact

For more information about this workshop, please contact Alan Herd at [email protected], Jamie Calderon at [email protected], or Michaelson Buchanan at [email protected].

[1] Supply Chain Risk Management Reliability Standards Revisions, Notice of Proposed Rulemaking, 188 FERC ¶ 61,174 (2024).

Agenda

Introduction and Background

On September 19, 2024, the Commission issued a Notice of Proposed Rulemaking (NOPR) that identified certain reliability gaps in the requirements of the Critical Infrastructure Protection (CIP) Reliability Standards that pertain to supply chain risk management (SCRM) and proposed to direct that the North American Electric Reliability Corporation (NERC) develop new or modified Reliability Standards to address those gaps.[1] The workshop will discuss the proposed NOPR directive that NERC develop new or modified Reliability Standards that would require an entity to establish steps in its SCRM plans to validate the completeness and accuracy of information received from vendors during the procurement process to better inform the identification and assessment of supply chain risks associated with vendors’ software, hardware, or services.  

The NOPR provided two specific examples for NERC’s consideration that could satisfy the Commission’s proposed directive: (1) a self-attestation with supporting documentation or (2) a third-party certification of assessment.[2] The NOPR also sought comment on what other types of steps an entity could take to validate the data provided by vendors and how burdensome those steps might be.

[1] Supply Chain Risk Management Reliability Standards Revisions, Notice of Proposed Rulemaking, 188 FERC ¶ 61,174 (2024).

[2] Id. at 36.

Supply Chain Risk Management Reliability Standards Revisions Workshop Docket No. RM24-4-000 March 20, 2025 \| 1:00 p.m. – 5:00 p.m. EDT Agenda
1:00pm – 1:15pm	Welcome and Opening Remarks
1:15pm – 2:30pm	Roundtable 1: Validation of Vendor Information Roundtable 1 will discuss the pros and cons associated with the two approaches to validation outlined in the NOPR, as well as explore other approaches for validating the completeness and accuracy of vendor information to best inform risk decisions. Moderated by: Alan Herd, Deputy Director, Division of Cyber Security, Office of Electric Reliability, FERC
2:30pm – 2:55pm	Q&A
2:55pm – 3:15pm	Break
3:15pm – 4:30pm	Roundtable 2: Implementation of Vendor Assessments Roundtable 2 will discuss the implementation aspects of the different approaches to vendor evaluations, including the potential burdens and challenges; and how to overcome those challenges to ensure a rigorous risk assessment is performed. Moderated by: Lonnie Ratliff, Director of Compliance Assurance, and Certification, NERC
4:30pm – 4:55pm	Q&A
4:55pm – 5:00pm	Closing Remarks

Event Details

Date and Time

Thursday, Mar 20, 2025 , 1:00 - 5:00 pm EDT
Add to Google Calendar , Outlook , iCal

Location

In person or virtually.
The Federal Energy Regulatory Commission,
888 First Street, NE,
Washington, DC 20426

Recent News

Summaries | April 2025 Commission Meeting

FERC.gov Website Update Features Consumer Power Costs and Grid Reliability

FERC, NERC Issue Report on System Performance During the January 2025 Arctic Weather

Upcoming Events