FERC Intends to Approve CIP Version 5

All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.

Note: The day after I wrote this, I published a long analysis of the NOPR itself, which identifies a number of surprising points not made at all in the initial press release and Commissioner statements.  You can read that here.

On April 18 at about 10:30 Eastern time, FERC surprised a great many people – certainly including me – by announcing they intended to approve CIP Version 5 sometime after a 60-day comment period.  This is good news for the industry, since having to comply with two versions of CIP during a two- to three-year period was never a good idea.  You can read the press release here and Commissioner LaFleur’s well-written statement here.

They haven’t released the text of the NOPR (Notice of Proposed Rulemaking) yet, so one needs to be careful about commenting.  However, there are a couple important points you need to keep in mind:

1. Commissioner LaFleur says they are looking for comments on two areas of concern.  The first is that “language requiring entities to ‘identify, assess, and correct’ deficiencies may result in requirements that are unclear and difficult to audit or enforce.”  This is exactly the concern raised by Stephen Flanagan of FERC, which I discussed in this post.   This is a serious concern, since addressing it will require a substantial rewrite of about half of the requirements in CIP Version 5.
2. The second area of concern is “whether the two-year implementation period for Medium and High Impact assets and the three-year implementation period for Low Impact assets are necessary, or can be accomplished more quickly.”   This obviously is an indication they think the implementation timeframe should be moved forward.  And since the industry won’t have to comply with Version 4 first, I think this should be something that would be doable.

 So without having read the NOPR, it seems likely that:

1. FERC will probably require some changes in V5 – meaning they will approve V5 and also require a new version to address their changes (so CIP Version 6 will probably be the next version the industry has to comply with!). 
2. The implementation date for V5 will be substantially advanced.

 I’ll have a new post when the NOPR is released and I’ve had time to digest it.

Postscript:

It occurred to me that it might not be a coincidence that FERC did this exactly a week after NERC released their Version 4 transition plan.  Here's the logic:

1. The transition plan makes the asset coverage about the same between V4 and V5, since blackstart facilities are now "out" of both versions.  This is important because the only reason that FERC would have wanted V4 over V5 was that it covered blackstarts.  That reason is now gone.
2. V5 is overall a much better version of CIP than V4, as Commissioner LaFleur made clear.
3. FERC would like to see a new version take effect as soon as possible.  Why not move up the V5 compliance date (as suggested by Ms. LaFleur), so that it's maybe 3 years away from today, in exchange for not requiring V4 compliance?  I don't think most NERC entities will object to this tradeoff (of course, it's not clear how much FERC wants to move up the date).