When Will CIP Version 5 Come into Effect?

All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.

Nov. 8: I have recently put out a new post that replaces this one; this is only good for historical reasons - but I don't want to delete it for fear of being accused of artifically cleaning up my forecasting record to make it appear perfect.  

July 25: I have revised this post to reflect information I've received since it was originally written. My best estimate for the compliance date is about the same as it was a few months ago - but I'm arriving at it differently now, and I'm trying to make you aware of what the different contingencies are that could change that.  I have also revised the companion post, which describes the different steps that need to happen before a new CIP version comes into effect, as well as why I believe the next version NERC entities have to comply with will be V6, not V5.  You should read that first; it's short.


If you have read some of my other posts, you will know the question in this title is a trick one: I don't believe CIP Version 5 will ever come into effect.  I believe it will be superseded by CIP Version 6, which will be developed to comply with the order that FERC will enter when they approve Version 5.  For more on that convoluted story, see this post.

Given this, what is the likely date that CIP Version 6 will come into effect?  Consider the following:

• I think it is likely FERC will issue the order approving Version 5 late this year or at the latest in Q1 of 2014; we know they will approve it by 4/1/2014, since if they don't, CIP V4 will come into effect, and FERC said in their NOPR they don't intend for this to happen.  However, I've heard that people at NERC believe V5 will be approved by FERC at their September Open Meeting, and I will use that date in this post since I'm assuming people at NERC know more about FERC's intentions than I do.
• The Version 5 implementation plan has V5 coming into effect two years after FERC approval for High and Medium impact BES Facilities (of course, we're talking the US here.  For Canadian entities, it depends on the province).  Specifically, the date is the first day of the ninth quarter after FERC approval.  However, FERC "approval" could be interpreted as either the day of their Order approving V5 or its effective, date, which is 60 days after its publication in the Federal Register (which usually happens within a few days of the Order).  If we use the Order date for approval, then the V5 compliance date for Highs and Mediums will be Oct. 1, 2015.  If we use the effective date (i.e. November 2013), then the compliance date will be Jan. 1, 2015.
• But here's one catch: As I discussed in the companion post to this one, I believe it is likely that FERC will, when they approve V5, at the same time require that NERC come back with a compliance filing.  This will be CIP Version 6.  If I am right about this, then the above compliance dates are meaningless, since V6 will be the next version NERC entities have to comply with, not V5.  I also estimated in that post that FERC will give NERC six months to come back with the compliance filing.
• This means that, if FERC approves V5 in September 2013 and orders a compliance filing, V6 will be presented to them in March of 2014.  Since V6 will presumably be what FERC wanted (it will include what FERC ordered, and nothing more), it shouldn't take them long to approve V6. Let's say they'll do this by the end of Q2 2014.
• If they do this, then the High/Medium compliance date range I listed above will get shifted back by nine months.  So the High/Medium date will either be July 1 or October 1, 2016, with Lows a year later.
• But I'm leaving something important out of this analysis so far: FERC hinted broadly in their NOPR that they are going to require the implementation times be shortened in Version 6.  As I said in the companion post, I don't believe they will try to push up the date for Lows (so they'll leave it at three years).  But they may push up the High/Medium date, using the rationale that most High/Medium assets would have been Critical Assets under Versions 1-3, and thus shouldn't have to make a huge jump to comply with V6 (unlike the Lows).
• So let's assume Version 6 gives just one year for Highs and Mediums to come into compliance, but three years for Lows.  And let's also assume the effective date of V6 is about 60 days after my putative V6 approval date of end Q2 2014.  This means the compliance dates for CIP Version 6 would be October 1, 2016 for High/Mediums and October 1, 2018 for Lows.  
• Of course, given the amount of uncertainty described above, you certainly can't plan on having to comply on these exact dates.  You should put a confidence band around them - maybe three months either way, maybe six months.

If you haven't signed up for the joint Honeywell / EnergySec webinar on CIP Version 5 on August 21 - "Covering your Assets in CIP Version 5" - I recommend you do it today!  Seats are going fast, and you might end up sitting behind a pole if you wait too long.  Remember, even if you can't make that date, you should still sign up, so you'll receive the link to the recording when it's available a couple days after the webinar.  You can sign up here.