Assigned to the WEQ OASIS and BPS Subcommittees 2019 Annual Plan Items Assigned to the WEQ OASIS and BPS Subcommittees 10/15/2019

Posting of additional curtailment information on OASIS (Joint BPS/OS) 2019 Annual Plan Item 2a Posting of additional curtailment information on OASIS (Joint BPS/OS) 10/15/2019

API 2a FERC Initiated in Order 890 P. 1627 We agree with suggestions for the posting of additional curtailment information on OASIS and, therefore, require transmission providers, working through NAESB, to develop a detailed template for the posting of additional information on OASIS regarding firm transmission curtailments. Transmission providers need not implement this new OASIS functionality and any related business practices until NAESB develops appropriate standards. These postings must include all circumstances and events contributing to the need for a firm service curtailment, specific services and customers curtailed (including the transmission provider’s own retail loads), and the duration of the curtailment. 10/15/2019

WEQ API 2a Posting of Curtailment Information Focus on interconnection-wide curtailments (IDC for the Eastern Interconnection) Whenever scheduled transactions are impacted on the TP’s system, the TP must ensure that all actions issued under the procedure are provided, even if they are on other systems. Subcommittees have drafted business practice standards Standards require RC to provide requisite information for the OASIS posting. Draft is out for informal comments – due 3/18/19 Action pending outcome of BPS PFV initiative 10/15/2019

API 2a Current Work Effort BPS/OS Challenges on 2019 API 2a No current commitment from EI (EIDSN) Primary focus on PFV initiative Western RC is in flux (CAISO, SPP, et al) Western RC function expected to stand up by end of 2019 Timing of submitting recommendation Joint BPS/OS work on 2019 API 2a to resume following disposition of PFV initiative and clarification of West RC roles. 10/15/2019

Assigned to the WEQ OASIS Subcommittee 2019 Annual Plan Items Assigned to the WEQ OASIS Subcommittee 10/15/2019

Requirements for OASIS to Use Data in the Electric Industry Registry 2019 Annual Plan Item 3a Requirements for OASIS to Use Data in the Electric Industry Registry OS recommendation presented at October 2019 EC meeting 10/15/2019

2019 Annual Plan Item 3c 3c: Review the NAESB Network Integration Transmission Service (NITS) Business and Technical Standards for needed modifications based on implementation and operational experiences since their adoption 10/15/2019

2019 Annual Plan Item 3c API 3c main points: Corrections and clarifications of existing standards NITS application pending request handling NITS Application timing modifications Addition of NITS Query Variables per List Enhanced Scheduling Rights handling Fractional MW handling DNR listing (NITSDNR) returned in NITS Application Query Technical data corrections/clarifications 10/15/2019

2019 Annual Plan Item 3c OS recommendation for 2019 API 3c completed in September 2019 Minor corrections, technical issues Recommendation voted out for formal comments and forwarding to the EC for approval at 10/3/2019 OS meeting Comments due 11/4/2019 10/15/2019

2019 Annual Plan Item 3d 3d: Evaluate the need for new OASIS Business Practice Standards and/or mechanisms to allow documentation for coordination of partial path reservations to demonstrate the complete path associated with long-term firm interchange OS recommendation presented at October 2019 EC meeting 10/15/2019

2019 Annual Plan Item 3e Development of industry Business Practice Standards to define the eligibility and treatment of Rollover Rights for Network Integration Transmission Service (NITS) Work on 3019 API 3c suspended for work on SNL Surety report evaluation and standards development Anticipate completion of API 3e in 2020 10/15/2019

Assigned to the WEQ OASIS and CSS Subcommittees 2019 Annual Plan Items Assigned to the WEQ OASIS and CSS Subcommittees 10/15/2019

2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii Recommendation incorporates changes to the OASIS Business Practice Standards as recommended by the Board Critical Infrastructure Committee based on the findings reported by Sandia National Laboratories as part of their surety assessment. 10/15/2019

Recommendation Highlights 2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii Recommendation Highlights Removed references to SSL, updated references to current version of TLS Reviewed data retention requirements in light of CFR 18 Replaced references of “HTTP” with “HTTPS” where appropriate 10/15/2019

Implementation and Performance Guidelines 2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii Implementation and Performance Guidelines TSIPs shall apply industry-recognized “best practices” in their implementation and maintenance of OASIS Nodes and supporting infrastructure, including but not limited to: Use of cryptographic security modules conforming to National Institute of Standards and Technology Federal Information Processing Standards Publication 140-3 (NIST FIPS PUB 140-3 Incorporation of firewalls, intrusion detection and intrusion prevention systems. Ensure OASIS applications are secure against common industry recognized vulnerabilities 10/15/2019

Implementation and Performance Guidelines (con’td) 2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii Implementation and Performance Guidelines (con’td) Implement guidelines for user passwords and authentication as recommended in NIST Special Publication 800-63B or newer revisions. Timely application of latest software patches and updates Performing vulnerability scans and penetration testing of OASIS applications at least quarterly. Conducting business continuity and disaster recovery exercises at least annually. Conducting a review of the OASIS Node implementation to incorporate any needed changes based on updated industry-recognized “best practices” at least annually. 10/15/2019

2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii WEQ-OS and CSS met to review guidelines for standard development and proposed recommendation. OASIS Subcommittee also reviewed and removed reference to outdated or legacy protocols that are no longer needed in support of the OASIS technical requirements. 10/15/2019

2019 Annual Plan Items related to SNL Surety Assessment 2019 API 6a, 6bii, and 6cii Joint OS/CSS recommendation for 2019 API 6a, 6bii, and 6cii completed in September 2019 Recommendation voted out for formal comments and forwarding to the EC for approval at the joint 10/3/2019 OS/CSS meeting Formal comments due 11/4/2019 10/15/2019

2019 Annual Plan Item Summary API # Assignment Description Target Completion 2a BPS/OS OASIS posting of curtailment data 2020 3a OS Data sharing between EIR and OASIS Completed (Oct 2019 EC) 3b/3f Dynamic Notification (PTP)/HTTP retirement and generic dynamic notification methodology Completed (March 2019 EC) 3c NITS Phase 1 clean-up and NITS Renewal approach Completed (In formal comment period) 3d Partial Path coordination 10/15/2019

2019 Annual Plan Item Summary API # Assignment Description Target Completion 3e OS Renewal Rights for Network Integrated Transmission Service In process 3g Next Hour Market (NHM) Business Standard modification Completed (March 2019 EC) 6a, 6bii, 6cii CSS/OS Develop or modify NAESB Business Practice Standards as need to address Security Issues identified by Sandi National Laboratories Completed (In formal comment period) 10/15/2019

2019 Annual Plan Items Questions and/or guidance from the Executive Committee? 10/15/2019