“The nature of cyber security threats to our nation’s grid require constant monitoring and vigilance. One year after we proposed this rule at my first meeting as a Commissioner, we are finalizing this rule in my first meeting as Chairman, and taking a major step to better secure the reliability of our nation’s bulk power system.”

Willie L. Phillips, FERC Chairman

Protecting the Grid

Cyberattacks & Internal Network Security Monitoring 

• Final Rule on Internal Network Security Monitoring for High and Medium Impact Bulk Electric System Cyber Systems, issued January 19, 2023  (Order No. 887, Docket No. RM22-3-000. 
• Final Rule directs NERC to develop and submit within 15 months of the effective date new or modified Reliability Standards that require internal network security monitoring for all high impact bulk electric system BES Cyber Systems with and without external routable connectivity and medium impact BES Cyber Systems with external routable connectivity.
• Final Rule directs NERC to perform a study of all low impact BES Cyber Systems with and without external routable connectivity.

Supply Chain Revisions for Low-Impact Cyber Systems 

• On March 16, 2023, the Commission approved Reliability Standard CIP-003-9 (Cyber Security – Security Management Controls).  Docket No. RD23-3-000.
• Requires entities with bulk electric system facilities whose assets are designated low impact to have methods for determining and disabling vendor remote access. Expands existing security controls to provide greater visibility into electronic communication between low impact bulk electric system cyber systems and vendors. Will allow detection and the ability to disable vendor remote access in the event of a known or suspected malicious communication.
• CIP-003-9 becomes effective on April 1, 2026

Incentive Rate Treatment for Cybersecurity Investments

• Issued April 21, 2023: Order No. 893, a final rule providing incentive-based rate treatment for utilities making certain voluntary cybersecurity investments in Docket No. RM22-19
• Establishes incentive-based rate treatments to encourage utilities to invest in advanced cybersecurity technology and participate in cybersecurity threat information sharing programs to benefit consumers.
• Expenditures must materially improve a utility's cybersecurity posture.
• Cybersecurity investments eligible for incentives include:
  • Those on the pre-qualified list; and
  • Those determined to be eligible by the Commission on a case by case basis, including early compliance with cybersecurity Reliability Standards

Physical Attacks on the Grid

• On April 20, 2023, Jim Robb, President and CEO of NERC, presented NERC’s evaluation of the Physical Security Reliability Standard in light of recent physical attacks on the BPS
• At Chairman’s direction, a Joint Technical Conference Regarding  Physical Security of the Bulk-Power System was held on August 10, 2023, in Docket RD23-2 hosted by NERC
• Recommended by NERC Physical Security Report 
  • Part 1: Effectiveness of Reliability Standard CIP-014-3
  • Part 2: Solutions Beyond CIP-014-3

Preparing for Extreme Weather

Key findings and recommendations on FERC-NERC Joint Inquiry into Winter Storm Elliott

At the September 15 Commission Meeting, FERC, NERC and RE Joint Team provided key findings and recommendations.  The presentation highlighted several key facts about the December 2022 event, including:

• Unprecedented unplanned generating unit losses, with nearly 90,000 megawatts out at the same time.
• Nearly 80 percent of the generating units failed to perform at temperatures above their own documented minimum operating temperatures.
• Several electric grid operators had to shed firm load to maintain system reliability.
• Natural gas pipeline pressures dropped largely because of freeze-related production as well as other natural gas infrastructure freeze- and equipment-related problems.
• Consolidated Edison Inc faced reliability-threatening low pressures on its delivery pipelines, forcing it to declare an emergency and use its own liquefied natural gas facility to maintain service.
• November 9, 2023 | FERC Staff issues final Winter Storm Elliott Report

FERC-NERC-Regional Entity Joint Blackstart and Next-Start Resource Availability Study in the Texas Interconnection

At the December 19 Commission Meeting, FERC, NERC and RE Joint Team provided key findings and recommendations.  The presentation highlighted recommendation 26 from the 2021 Winter Storm Uri report:

• Presentation & Report | FERC-NERC-Regional Entity Joint Blackstart and Next-Start Resource Availability Study in the Texas Interconnection

• December 19, 2023 | Blackstart Study Recommends Collaboration, Planning for Resilience

FERC Approved Extreme Weather Final Rules

• Order No. 896, Transmission System Planning Performance Requirements for Extreme Weather.  Docket No. RM22-10 issued June 15, 2023.
• NERC must submit the new or revised reliability standards by December 23, 2024.
• Order No. 897, One Time Reports on Extreme Weather Vulnerability Assessments.  Docket Nos. RM22-16 and AD21-13 issued June 15, 2023.  
• Directs transmission providers to file one-time informational reports describing how they conduct extreme weather vulnerability assessments, if at all
• One-time informational report is due by October 25, 2023.

Ensuring Reliability as the Resource Mix Changes

FERC Approved NERC's IBR Registration Work Plan

As directed by FERC,NERC filed an IBR Registration Work Plan that sets forth NERC's three-phased approach to identify and register certain unregistered IBRs

On May 18, 2023, the Commission approved NERC’s IBR Registration Work Plan in Docket No. RD22-4-001.  

• First quarterly Work Plan update was due on August 14, 2023.

FERC Issues IBR Final Rule

The Commission approved new reliability standards for inverter-based resources to make sure promising new clean energy technologies can enhance, not weaken, reliability of the grid as the nation makes the transition to clean energy resources.