GOP and QSE Relationship Jeff Whitmer Manager, Compliance Assessments Talk with Texas RE June 25, 2012

2 Objective ●Ensure there is no reliability gap.  CIP-001 Sabotage Reporting  CIP-002 Critical Cyber Asset Identification Talk with Texas RE June 25, 2012

3 Responsibility ●You are a Generator Operator but another entity performs QSE functions ●The Registered Entity:  is responsible for all the functions performed by contractors or agents.  is responsible for providing all evidence including procedures and records of work performed by contractors or agents. QSE = Contractor or Agent Talk with Texas RE June 25, 2012

4 NERC Functional Model – Generator Operator ●Definition:  The functional entity that operates generating unit(s) and performs the functions of supplying energy and reliability related services. ●Relationships  Ahead of Time Provides generation commitment plans to the Balancing Authority. Provides Balancing Authority and Transmission Operators with requested amount of reliability-related services. Provides operating and availability status of generating units to Balancing Authority and Transmission Operators for reliability analysis. Talk with Texas RE June 25, 2012

5 NERC Functional Model – Generator Operator  Ahead of Time Reports status of automatic voltage or frequency regulating equipment to Transmission Operators. Provides operational data to Reliability Coordinator. Receives reliability analyses from Reliability Coordinator. Receives notice from Purchasing-Selling Entity if Arranged Interchange approved or denied. Receives reliability alerts from Reliability Coordinator. Receives notification of transmission system problems from Transmission Operators. Talk with Texas RE June 25, 2012

6 NERC Functional Model – Generator Operator  Real Time Provides Real-time operating information to the Transmission Operators and the required Balancing Authority. Adjusts real and reactive power as directed by the Balancing Authority and Transmission Operators. ●Link:  Talk with Texas RE June 25, 2012

7 CIP-001 – Sabotage Reporting ●R1. …Generator Operator…shall have procedures for the recognition of and for making their operating personnel aware of sabotage events on its facilities and multi-site sabotage affecting larger portions of the Interconnection. ●R2. …Generator Operator…shall have procedures for the communication of information concerning sabotage events to appropriate parties in the Interconnection. ●R3. …Generator Operator…shall provide its operating personnel with sabotage response guidelines, including personnel to contact, for reporting disturbances due to sabotage events. ●R4. …Generator Operator…shall establish communications contacts, as applicable, with local Federal Bureau of Investigation (FBI)…and develop reporting procedures as appropriate to their circumstances. Talk with Texas RE June 25, 2012

8 Showing Compliance ●Many QSEs have in place:  Sabotage reporting procedures.  Personnel contact lists.  Training records. ●The GOP can provide the QSE the GOP’s sabotage recognition procedure and personnel contact list.  Don’t forget to provide proof of training of the QSE operating personnel. ●The GOP must show the procedure was made available to operating personnel by the first day of the audit period. Talk with Texas RE June 25, 2012

9 CIP Critical Cyber Asset Identification ●R1.2. The risk-based assessment shall consider the following assets:  R Control centers and backup control centers performing the functions of the entities listed in the Applicability section of this standard.  R1.2.7 Any additional assets that support the reliable operation of the Bulk Electric System that the Responsible Entity deems appropriate to include in its assessment. Talk with Texas RE June 25, 2012

10 Showing Compliance ●Provide documentation that your risk-based assessment methodology considered the QSE. Talk with Texas RE June 25, 2012

Questions Contact Information (512) Talk with Texas RE June 25, 2012