FERC Approves Moving the CIP V5 Compliance Date!

Today, FERC approved moving the compliance date for NERC CIP version 5 back by three months, from April 1 to July 1. This allows both v5 and v6 (aka “CIP v5 Revisions”) to take effect on the same day.

For those of you who haven’t been keeping score at home:

1. On Feb. 4, I reported that NERC was being lobbied by the trade associations to move the CIP v5 compliance date back. I assumed NERC would want to see this happen, and suggested they could make this happen either by going the “full Monty” route of petitioning FERC, or by the more subtle (but perhaps less effective) route of issuing auditing guidance that would effectively move the date back. I assumed the only question was which route NERC would choose. I also pointed out, as I have before, that I didn’t think CIP v5 would effectively be enforceable until 6-12 months after April 1 (and more likely 12 months).
2. The next day, I reported that the Trades had gone ahead and petitioned FERC on their own. I must have written that post very quickly, since I didn’t really consider the implications of this action (i.e. going ahead without NERC), and I didn’t question the reasoning that was provided to FERC. I did bet that FERC would approve the petition (although I didn’t put any money on it! I’ve looked all over the Internet for a FERC betting site, but I have yet to find one. My guess is this is because betting on what FERC will do is no better than betting on the next random number to come up).
3. On Feb. 6, I actually thought about what the Trades’ petition meant. First, I was surprised that they had petitioned FERC without NERC being on their side; I speculated this was because NERC wasn’t in agreement with them. Then I went on to look more closely at the Trades’ stated reason for petitioning FERC: that NERC entities would have to spend a lot of money and time putting in place a v5 compliance program, only to have to do the same thing for v6 three months later. I pointed out why this argument didn’t have much merit. I then stated the main reason why I thought the date should be pushed back (and why I’ve been saying that for more than a year, although I’ve been advocating the date be pushed back at least a year, not just three months): there has been so much confusion over the meaning of the v5 requirements, and NERC has pursued so many different aborted strategies to fix that confusion, that many entities never felt comfortable starting their v5 compliance programs until last year.
4. My most recent post on this topic was on Monday, Feb. 8, when I pointed out that NERC had – seemingly inexplicably – filed comments disputing what the Trades had asserted. I wasn’t surprised to see NERC had fairly easily refuted the trades’ argument.[i] But I reiterated that I thought the date should be moved back, and I added two new arguments: 1) the rush to comply on 4/1 was taking a huge toll on some organizations, for no particularly good reason (since CIP v5 won’t be effectively enforceable for 6-12 months from 4/1, regardless of whether the date is moved or not); and 2) if the v4 date stands, many entities would have to devote a huge amount of time to self-reporting non-compliance for the next three months, and not as much to actually becoming compliant.

So what happens next? Will entities use the extra three months wisely and become compliant on July 1? I think they will use the time wisely, but I’m fairly sure the majority of entities will still be a good way from fully compliant on July 1. They just won’t be as non-compliant as they would have been on April 1. But I’m not going to make the argument now that FERC should push the date back another six months, even though I believe that’s what they should do. Ya gotta know when to fold ‘em.

There’s one more issue: I know some of the NERC regions were also against moving the compliance date back, because it plays havoc with their audit schedules. They really can’t do CIP audits from April through June of this year, so what becomes of those audits? Audits are scheduled at least a couple years out, meaning it will be very hard to squeeze these back into the schedule before say 2018 or 2019.

While I have sympathy for the auditors, I do feel their inconvenience doesn’t outweigh the greater “inconvenience” the entities would feel if the date weren’t moved back.

The views and opinions expressed here are my own and don’t necessarily represent the views or opinions of Deloitte Advisory.

---

[i] The Trades did file counter-arguments to NERC’s, but they weren’t terribly more impressive than the arguments from their first filing, which NERC refuted.