Welcome [www.npcc.org]

1 WelcomeNPCC Spring 2018 WorkshopScott NiedWhite Plains, NYMay 23 24, 20185/22/181 Welcome before We BeginGo to enter NPCC2018 ORGet the slidoapp on yourPhone and enter NPCC2018 We will explain in a minute!Get ready for a 23 Classroom Tracks2:00 pm, 3:00 pm, 4:00 pmA: Entity Risk Assessment Team (Larchmont 1&2, Lower Level)B: Compliance Monitoring Team (Briarcliff 1&2, Lower Level)C: Mitigation/Enforcement Team (Main Ballroom)5/22/183 Thursday We are offering a box lunch (slidopoll) We are having a raffle for those who attend5/22/184 Compliance Solutions Proven Compliance Solutions SOS Intl Assurx Cooper Compliance SigmaFlow, LLC FoxGuardSolutions, Inc. AESI Polls White Plains famous person First time attendees 5/22/186 ERO Push for Collaboration Recent NERC ERO CMEP workshop RAPA, Planning, Operating Emerging issues, OC, PC, CIPC NERC and FERC Battlefield5/22/187 Two Results Stakeholders viewpoint Stronger ERO5/22/188 NPCC Intent Play nice in the sandbox Make progress through influence Represent who?

2 5/22/189 ERO Challenges Industry Expectations Demand Side/DER growing Invertor proliferation Human Perf levels of awareness Cyber Threat Matrix5/22/1810 May 9 NERC and Resilience Current programs support resilience concept Reliability Standards process Reliability Assessments Events Analysis Situational Awareness, E-ISAC, BPSA In the four timeframes Pre-Event, Transient immedafter during automatic operations, Operator response, restoration and recovery to sustainable state Which matches the aspects of the NIAC construct Robustness, Resourcefulness, Rapid Recovery, Adaptability5/22/1811 Questions? Send comments/questions through slido Javier is monitoring them He will vet them for the UPDATENPCC 2018 Spring Compliance and Standards WorkshopMay 23, 2018 Sal BuffamanteAVP Compliance2017 Compliance Program Final Numbers-Conducted 30 off-site Operations & Planning (O&P) audits, 8 on-site O&P audits, 4 off-site O&P spot checks, 11 off-site CIP audits, and 11 on-site CIP audits;-Participated on two MRRE audits as the LRE for 5 entities; observed FERC-led CIP audit of one entity-Performed 40 Inherent Risk Assessment Updates (IRA)-Performed 10 Internal Control Evaluations (8 O&P, 2 CIP)-Processed 9 new Technical Feasibility Exception (TFE) submittals from 7 registered entities:, 9 Material Change Reports(MCRs) and 7 TFE Terminations;-Closed 107 Violations (24 dismissed, 3 FFTs, 47 CEs, 33 Canadian Filings);-Accepted 4 Mitigation Plans;-Accepted 188 Mitigation Activities.

3 -Processed 13 new entity registrations, 14 entity delisting s,2 function deactivations, 2 entity name changes, 4 added functions, 4 DP to DPUF changes and 0 certification Compliance Program NERC Oversight and Updates ERO Enterprise Future Issue: ResiliencyRemainder of Workshop NPCCE ntityRiskAssessmentBetter practices, Lessons Learned, and Industry Look Ahead NPCC Compliance Monitoring Audit Preparation for CIP and O&P Audits NPCCM itigation/EnforcementTrendsandAdvice NPCCC yberandPhysicalSecurityOutreach CDAAE nhancementsandtheCMEPT echnologyTo o lNERC OversightAsoutlinedintheRulesofProcedure , : AnnualreviewsoftheRegionalEntityimplemen tationplans; Oversightauditsofselectregisteredentitya udits; AnnualassessmentsofselectNERCR eliabilityStandardsforconsistencyofappro achthroughtheKeyReliabilityStandardSpotC heck(KRSSC)program; ComplianceMonitoringandEnforcementProgra m(CMEP) UpdatesExamples:NERC posed the following ERO Enterprise-Endorsed Implementation Guidance documents: , R1 - Shared Ownership of BES Facilities CIP-010-3 Software Integrity and Authenticity CIP-014-2 R4 Evaluating Potential Physical Security Attack CIP-014-2 R5 - Developing and Implementing Physical Security Plans NERC also posed the following Proposed Implementation Guidance documents: PRC-024-2 R2 - Generator Voltage Protective Relay Settings PRC-023-4, R1 -Determination of Practical Transmission Relaying LoadabilitySettings R1 - Voice Communications in a CIP Environment NERC posed three new Reliability Standard Audit Worksheets (RSAWs).

4 TOP-001-4 rise in the frequency and magnitude of major weather events, as well as increasing threats such as cyber and physical attacks against the grid, make it necessary to think not only about the reliability, but the resilience of the grid and its ability to withstand and recover from intense shocks to the infrastructure. Reliability and resiliency are intertwined and often confused. NERC, defines reliability as a combination of sufficient resources to meet demand (adequacy) and the ability to withstand disturbances (security). NERC and the Regional Entities monitor the ability of Reliability Coordinators and other registered entities to respond to generation or transmission outages. Security is harder to measure because it reflects preparedness to withstand uncertain external forces. Modeling and simulator exercises help, but the impacts of low-probability, high-impact events remain difficult to predict. The ERO promotes cybersecurity, emergency preparedness, and physical security outreach to ensure grid operators and utilities are prepared for attacks or is a more expansive concept than reliability, encompassing consequences to the electricity system and other critical infrastructure from increasingly likely high-impact external events.

5 Resilience is a grid attribute that improves the response to such ERO as well as regulators and policymakers across the world are pushing for new structures that can properly value and promote the redundancy and resilience capabilities the grid needs to such as microgridsand distributed energy resources and wide-area situational awareness are a few practices, Lessons Learned, and Industry Look AheadNPCC Compliance Monitoring Audit Preparation for CIP and O&P Audits NPCCM itigation/EnforcementTrendsandAdviceNPCC C yberandPhysicalSecurityOutreach5/22/189 QUESTIONS ?Spring NPCC Compliance and Standards WorkshopMay 23-24, 2018 Reliability Standards OutlookGuy V. Zito NPCC AVP - Standards5/22/181 Discussion Items: Overview of Standards Development RSDP Standards Efficiency Review Cost Effectiveness Guidelines and Technical Basis Steady State and Periodic Reviews Standards Process Manual Revisions RISC and Emerging Risks Resilience5/22/182 Discussion Items cont. : Process and Stakeholder tools Compliance Policy Guidance Request for Interpretations Feedback Loops Approach to addressing DER BES Impact NPCC Regional Standards and Directories FERC Legal Process for Standards NPCC Regional Standards Committee Future of Standards and Criteria5/22/183 NERC Standards Development Overview-NERC Reliability Standards Development Plan (RSDP) 2018-2020, NERC Board of Trustees (BOT) Approved Periodic Reviews Project 2017-04 Interchange Scheduling and Coordination Standards (INT-004, 006, 009, 010) Project 2017-05 NUC-001 Project 2017-03 FAC-008 Periodic Review Projects Scheduled and continuing through 2018 Modifications to CIP Standards cont.

6 Project 2015-10 Single Points of Failure - TPL-001 Project 2017-06 Modification to BAL-002-2 Project 2017-01 Modifications to the Project 2015-09 Establish and Communicate System Operating Limits-FAC-010, FAC-011, FAC-014 2017-07 Standards Alignment with Registration 2018-01 Canadian-specific Revisions to TPL-007-2 5/22/184 NERC Standards Development Additional Considerations Reliability Issues Steering Committee (RISC) Essential Reliability Services Task Force (ERSTF) recommendations Industry Feedback Loops ( Events Analysis, Compliance, R A PA) IEEE 1547 and VER Modeling Standards Efficiency Review Standards Grading DOE Report and NOPR to FERC (Resiliency concerns) High Impact Low Frequency events5/22/185 Standards Efficiency Review Review the entire set of approved standards with a focus on retiring Work is underway on Phase 1 O&P- to be completed mid-2018 Work on Phase 2 (CIP) later this year Pre-standard development acitivity Open and transparent process-not documented Not a Standards Grading exercise5/22/186 Cost Effectiveness Cost Effectiveness Analysis Process CEAP Pilots conducted 2013 and 2014-analysis of different approaches and costs to meet a standard s objective Proved burdensome- no resources Cost Effectiveness Analysis of the Risk being reduced Cost associated with reducing that risk Cost associated with not reducing the risk (reliability and societal) Standards Drafting Teams and Periodic Review Teams Teams asked to develop alternatives Add question(s) to the Comment forms Application to all Standards projects 5/22/187 Technical Rationale for Reliability Standards Technical Rationale Transition Plan Track 1 and 2 (CGP?)

7 Remove from Reliability Standards (supporting documentation) Guidelines and Technical Basis Technical Rationale Implementation Guidance FERC Approved parts of the Standard (mandatory and enforceable) Applicability Requirements Implementation Plan Effective Date VRFs and VSLs May contain Compliance Guidance but not processed through the CGP Supporting Documents Section 11 of the SPM To be located with Standards to which they apply but as separate documents All standards going forward GTB Teams will begin the process of review of supporting documentation from the State and Enhanced Periodic Review Steady State Core set of Results-based Standards All previous FERC Directives addressed Independent Expert Review Panel recommendations considered Meets Ten Benchmarks of Excellence All Paragraph 81 identified issues addressed Periodic Reviews Cross Functional Team of NERC Standing Committee Chairs, Staff, Regional Entities, and others to review standards All enforceable standards in effect for a year or more Subject Matter Expert Teams as required Expedited, efficient and effective period review of standards Regional Standards-Variances?

8 Retirements? Costs 5/22/189 Steady State and Periodic Review Grading currently underway in 2018- 53 Requirements CIP-014-2 Physical Security COM-002-4 Operating Personnel Communications Protocols FAC-003-4 Transmission Vegetation Management FAC-013-2 Assessment of Transfer Capability for the Near-Te r m Transmission Planning Horizon IRO-006-5 Reliability Coordination Transmission Loading Relief (TLR) MOD-020-0 Providing Interruptible Demands and Direct Control Load Management Data to System Operators and Reliability Coordinators MOD-025-2 Verification and Data Reporting of Generator Real and Reactive Power Capability and Synchronous Condenser Reactive Power Capability MOD-026-1 Verification of Models and Data for Generator Excitation Control System or Plant Volt/VarControl Functions MOD-027-1 Verification of Models and Data for Turbine/Governor and Load Control or Active Power/Frequency Control Functions MOD-028-2 Area Interchange Methodology 2017 Final grades 2018-2020 Reliability Standards Development Plan5/22/1810 Standards Process Manual Revisions Sections with substantive revision: Section 6 Process for Conducting Field Tests Section 7 Process for Developing an Interpretation Section 11 Process for Approving Supporting Documents Sections with minor revisions.

9 Section Definition of a Reliability Standard Section Governmental Authorities Section 8 Process for Appealing an Action or Inaction 5/22/1811 Reliability Issues Steering Committee (RISC) and Emerging Risks ERO Reliability Risk Priorities, 2017 Report - 8 Risks Identified and a potential framework for Resilience Risk Profile #1: Changing Resource Mix (High) Risk Profile #2: Bulk-Power System Planning (High) Risk Profile #3: Resource Adequacy and Performance (High) Risk Profile #4: Increasing Complexity in Protection and Control Systems and Asset Management (Moderate) Risk Profile #5: Human Performance and Skilled Workforce (Low) Risk Profile #6: Loss of Situational Awareness (Moderate) Risk Profile #7: Extreme Natural Events (Moderate) Risk Profile #8: Physical Security Vulnerabilities (Moderate) Risk Profile #9: Cybersecurity Vulnerabilities (High)5/22/1812 Resilience The ability to withstand and reduce the magnitude and/or duration of disruptive events, which includes the capability to anticipate, absorb, adapt to, and/or rapidly recoverfrom such an event.

10 Ken McIntyre FERC Chairman- Top priority of the Commission address concerns- DOE Staff Report and NOPR FERC terminated the DOE NOPR proceedings and developed a NOPR ORDER TERMINATING RULEMAKING PROCEEDING, INITIATING NEW PROCEEDING, AND ESTABLISHING ADDITIONAL PROCEDURES Issued January 8th, 2018. FERC NOPR what resilience of the bulk power system means and requires; understand how each RTO and ISO assesses resilience in its geographic footprint; and use this information to evaluate whether additional Commission action regarding resilience is appropriate at this and HILFE lectromagnetic Pulse (High Altitude HEMP ) Three components of a HEMP E1, E2, and E3 The E2 and E3 generally well understood; E2 similar to lightning and E3 similar to GMD. Starfish Prime studies in 1962. E3 understanding resulted in revision to TPL-007 and supplemental analysis-increase in the studied electric field. The E1 component is a very brief but intense electromagnetic field that can quickly induce very high voltages in electrical conductors.