Commissioner Richard Glick Statement
August 29, 2019
Docket No. NP19-4-000
Today’s Notice denies the motions to intervene from multiple parties who have requested that the Commission name the unidentified registered entity (URE) that is the subject of the Notice of Penalty (NOP). Although I agree with the decision to deny the motions to intervene, the parties seeking intervention raised important issues concerning the lack of transparency associated with the North American Electric Reliability Corporation (NERC) NOP process.1
It is essential that we sufficiently incent entities to comply with the Critical Infrastructure Protection (CIP) standards. Certainly these entities would be encouraged to comply in order to avoid substantial fines. But it is also important that those entities that violate CIP standards, especially entities responsible for numerous and significant violations, be publicly identified in order to provide an additional deterrent. Such transparency would encourage management to take appropriate actions to avoid the attention that comes with being publicly identified as having significantly violated CIP standards.
The current NOP process makes it difficult for the Commission to provide for a necessary level of transparency because the Commission must also ensure that we are not inadvertently providing information useful to someone seeking to attack critical electric infrastructure. Under the current approach, it is possible that identifying an offending party in an NOP might also reveal weaknesses in the entity’s process for protecting critical infrastructure, inadvertently exposing the bulk power system. I am pleased that the Commission and NERC staff earlier this week released a White Paper 2
proposing a path forward to better balance the need for confidentiality to protect system security with the benefits associated with transparency. This White Paper proposes that generally NOPs will identify the offending party but omit sensitive information that could expose their systems to exploitation. I encourage interested parties, including those that sought to intervene in this NOP proceeding, to participate in the White Paper docket as the Commission works to address ongoing concerns regarding transparency and security of the NERC NOP process.
For these reasons, I respectfully concur.
- 11 Commission regulations only contemplate interventions in response to an application for review of the NOP by the entity that is the subject of the penalty. In this instance, the URE did not submit an application for review of the NOP.
- 22 Joint Staff White Paper on Notices of Penalty Pertaining to Violations of Critical Infrastructure Protection Reliability Standards, Docket No. AD19-18-000 (issued Aug. 27, 2019), https://www.ferc.gov/media/news-releases/2019/2019-3/AD19-18-000-Joint-White-Paper-NoFR.pdf .