When will CIP Version 5 Come into Effect?

Nov. 8: It is very likely FERC will approve CIP Version 5 before Thanksgiving, most likely at their meeting on Nov. 21.  Of course, what will be important is the Order they issue with V5.  When that is issued, your reporter will sequester himself until he has figured out what it means, and will post that as soon as possible thereafter.

(I set out to revise the original post by this name from May.  Then I decided I should just post it anew so people can be aware of it without having to discover it in the musty archives.  I used to work for an economic forecasting firm whose informal motto was, "If you can't forecast right, forecast often."  I have taken that to heart)

If you have read some of my other posts, you will know the question in this title is a trick one: I don't believe CIP Version 5 will ever come into effect.  I believe it will be superseded by CIP Version 6, which will be developed to comply with the order that FERC will enter when they approve Version 5.  For more on that convoluted story, see this post.

Given this, what is the likely date that CIP Version 6 will come into effect?  Consider the following:

• I think it is likely FERC will issue the order approving Version 5 in Nov. or Dec. of this year. 
• The Version 5 implementation plan has V5 coming into effect two years after FERC approval for High and Medium impact BES Facilities (of course, we're talking the US here.  For Canadian entities, it depends on the province).  Specifically, the date is the first day of the ninth quarter after FERC approval.  However, FERC "approval" could be interpreted as either the day of their Order approving V5 or its effective date, which is 60 days after its publication in the Federal Register (which usually happens within a few days of the Order). If we use the Order date for approval and FERC issues their order in November, then the V5 compliance date for Highs and Mediums will be Jan. 1, 2016.  If we use the effective date (i.e. January 2014), then the compliance date will be April 1, 2016.  Lows will have to comply a year later than either of these two dates.
• But here's one catch: As I have discussed in various posts, I believe it is likely that FERC will, when they approve V5, at the same time require that NERC come back with a compliance filing.  This will be CIP Version 6.  If I am right about this, then the above compliance dates are meaningless, since V6 will be the next version NERC entities have to comply with, not V5.  I also estimate that FERC will give NERC about 9 months to come back with the compliance filing.
• This means that, if FERC approves V5 in November 2013 and orders a compliance filing, V6 will be presented to them by Q3 of 2014.  Since V6 will presumably be what FERC wanted (it will include what FERC ordered, and nothing more), it shouldn't take them long to approve it. Let's say they'll do this by the end of Q4 2014.
• If they do this, then the V6 compliance dates get shifted back exactly a year from the V5 ones.  So the High/Medium date will either be January 1 or April 1 2017, with Lows a year after.
• But I'm leaving something important out of this analysis so far: FERC hinted broadly in their NOPR that they are going to require the implementation times be shortened in Version 6. I'm guessing FERC will reason that their approval order in 2013 will end uncertainty about the contents of the next CIP version, since V6 will be based on V5 plus exactly what FERC orders in changes.  I'm thinking FERC may order the compliance dates for V6 to be shortened by a year, so that effectively they're the same as if FERC had simply approved V5 in 2013 (since FERC will approve V6 about a year after they approve V5).
• So if Version 6 gives just one year for Highs and Mediums to come into compliance, but two years for Lows, then the dates are the same - given these other assumptions - as what I just listed for Version 5 by itself: either Jan. or April 1 2016 for High/Mediums, and a year later for Lows.  
• Of course, given the amount of uncertainty described above, you certainly can't plan on having to comply on these exact dates.  You should put a confidence band around them - maybe three months either way, maybe six months.  And there's also the possibility (small, to be sure) that I don't know what the h___ I'm talking about, so the dates could be completely different.  What can I say?  This is a tough business.

All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.

Note: Honeywell has developed three white papers on CIP Version 5 – what’s in it and what you need to do to comply with it.  They haven’t been posted yet, but if you would like me to send them to you, email me at tom.alrich@honeywell.com.