All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.
My post on the CIP Version 5 NOPR has had well over 600 page views in the month it has been available. So it was with a little dismay that I just noticed a mistake in one of the footnotes.
The footnote had to do with Distribution Providers. DPs are one of the NERC entity types listed as being subject to CIP Version 5 in Section 4.1 of CIP-002-5; however, they are only subject to V5 if they own one of four specific types of BES facilities listed in that section. Section 4.2 then indicates which BES Facilities owned (or operated) by each type of entity subject to Version 5 are actually in scope for V5 (as at least a Low impact facility).
I hadn’t read Section 4.2 carefully enough when I wrote the NOPR post, and I assumed that DP’s were like all of the other entities listed in 4.1: every BES Facility they own (operate) is subject to V5. However, in going back over CIP-002-5 much more carefully while writing subsequent posts, I have come to realize this is wrong. For DPs, the only facilities that are in scope are the four specific types listed in section 4.1 (and also in 4.2).
Of course, if an entity has multiple registrations including DP and one of those other registrations makes it subject to V5, then this doesn’t matter. Because of those other registrations, the entity will still have to comply for all of their BES Facilities. This only matters for pure DPs.
I apologize for this mistake. I hope it hasn’t caused unnecessary heartburn in DPs.
It turns out that I have to make another correction to the NOPR post, and it hasn't been 24 hours since I posted this! Here is a comment I just made on the NOPR post:
ReplyDeleteA consultant pointed out to me today that I misread FERC's intent on the "Identify, Assess and Correct" language in Version 5. They aren't so much saying they will require it be taken out as saying that they want NERC to justify it. They say "Therefore, we seek comment on the meaning of this language and on how it will be implemented and enforced. Depending on the comments and explanations received, we may determine that it is appropriate to direct NERC to develop modifications."
I totally agree with this consultant - I did miss the boat here, and I thank her for bringing this to my attention. Of course, NERC might fail to justify this and FERC will then require the language be taken out of V5. But they clearly want to give "Identify, Assess and Correct" a chance - which makes sense, given how much NERC is relying on this approach as the wave of the future for many of the standards, not just CIP.
I imagine that NERC will especially have to address the auditability issue, since I believe that is the big one with FERC It certainly is in the Stephen Flanagan paper discussed in my February post: http://tomalrichblog.blogspot.com/2013/02/is-cip-version-5-un-auditable.html
The consultant referred to above has given me permission to mention her name. She is Katherine Tourigny, who has been working for several years on implementing the CIP standards in the province of Alberta.
ReplyDelete