Early approval of CIP V5 is very unlikely

All opinions expressed below are mine, not necessarily those of Honeywell International, Inc.

(May 8: Well, I guess this is my "Dewey Beats Truman" post.  Of course, I could delete it and spare myself some embarrassment.  But as Richard Nixon famously said on one of his tapes, "That would be wrong."  If you'd like to see my analysis of where I went wrong, see this post - Tom)

There is a general expectation – including among many at NERC – that CIP Version 5 will be approved by FERC in time for CIP Version 4 not to come into effect.   While I certainly would like to see this happen, this seems to me to be extremely wishful thinking.  Here’s why:

Just think about the timeframe.  It really doesn't do any good for V5 to be approved the day before V4 comes into effect on 4/1/2014 - everyone will have already done the V4 compliance work by that time.  FERC really needs to approve V5 at least 6-9 months before that date, meaning by July or October of this year. 

And to say the Commission will approve V5 means they have to have made up their minds.  For the Commissioners to make up their minds, the staff needs to first complete their analysis, then the Commissioners need to take some time to decide whether there’s a good enough chance that they will approve V5 that they should issue a NOPR.  Then they have to issue the NOPR, get comments and analyze them.  I don’t think any of these steps can be avoided.

In fact, if you just think about the NOPR, that almost seals the argument.  FERC issued the V4 NOPR in mid-September 2011 and approved V4 in mid-April 2012; there were seven months between those dates.  This means that, for FERC to approve V4 by October 1 of this year (as I’ve said they really have to do), they have to issue the NOPR in three weeks (if they’re going to take the same seven months).  I’m sure their staff won’t even have their analysis done for them for a couple more months (a FERC staff member speaking at MRO’s compliance meeting last December said it takes a month just to assign a case number).

 However, there are other things I think FERC may need to do as well, including:

• Holding workshops, as they did with CIP Version 1.  V5 is a huge change in CIP, and they’re likely to seek a lot of discussion.  These workshops alone should add 2-3 months to the approval process.
• Ordering NERC to conduct a new survey of assets, as they did in 2010.  There are a lot of questions about how many facilities are covered in V5, and at what level; in order to judge the bright line criteria in V5, I think FERC will require a survey.  The survey took three months in 2010.
• Considering any serious objections from their staff, such as Stephen Flanagan’s (and I am sure there are other staff objections as well).
• I also think it is likely FERC will send V5 back to NERC and require changes (such as the ones discussed in this post); FERC can’t simply change the standard on its own.  This will be at least a 90-day process, and more if they require significant changes in V5. 

Remember, FERC approved V4 fourteen months after NERC submitted it to them.  There are exactly 14 months from when NERC submitted V5 (end of January) through April 1, 2014, when V4 goes into effect.  V4 was exactly the same as V3 except for CIP-002; V5 is a radical revision of everything in CIP.  Does it stand to reason that FERC would even approve V5 in the same amount of time as they did V4, let alone shave 5 or 6 months off of that?

I’m not saying FERC couldn’t move heaven and earth and get V5 approved early if they really wanted to.  And they could decide to move the V4 compliance date back, if – say – this summer they decided that approval did look likely enough that they didn’t want to see the industry spend any more time or money on V4.  But should entities bet on this?  I’m told the regional auditors are gearing up to audit full compliance with Version 4 starting next April; if an entity waits ‘til next fall to start their V4 compliance work, is it really likely they’ll be compliant by that date? 

 I’ve separately recommended that the compliance date for V4 be pushed back simply because of all this uncertainty: http://tomalrichblog.blogspot.com/2013/01/why-cip-version-4-compliance-date-needs.html  But for some reason, NERC and FERC don’t just jump whenever I suggest they do something.  So I’m certainly not betting that this will happen either. 

The moral of the story: If you’re not already working on CIP V4 compliance, you should start right away – at least assess what you will need to do to come into compliance.