Project Cyber Security Order 706 Version 5 CIP Standards Potential to Adversely Impact ERCOT Black Start Capability

CIP Cyber Security — BES Cyber Asset and BES Cyber System Categorization Provides “bright-line” criteria to categorize BES Cyber Systems and BES Cyber Assets based on their impact on real-time operation of the Bulk Electric System (BES). – Classified as High, Medium or Low Impact Rating CIP-003 through CIP-011 use these categories to designate applicability to specific requirements. – A majority of the requirements are applicable to High and Medium Impact categories

2. Medium Impact Rating (M) Each BES Cyber Asset or BES Cyber System, not included in Section 1, above, that if rendered unavailable, degraded, or misused would, within 15 minutes adversely impact one or more BES Reliability Operating Services for: 2.1. Generation with an aggregate highest rated net Real Power capability of the preceding 12 calendar months equal to or exceeding 1500 MW in a single Interconnection An aggregate net Reactive Power nameplate rating of 1000 MVAR or greater (excluding those at generation Facilities) Each generation Facility that its Planning Coordinator or Transmission Planner designates and informs the Generator Owner or Generator Operator as necessary to avoid BES Adverse Reliability Impacts in the long-term planning horizon Each Blackstart Resource identified in its Transmission Operator's restoration plan.

Impact to ERCOT All Black Start units will be classified as Medium Impact. – CIP Version 5 removed the provision excluding Cyber Assets that did not have dial-up access or use a routable protocol to communicate outside the Electronic Security Perimeter. ERCOT can expect to pay for some or all CIP- required upgrades for Black Start units through the bidding process – Black start units will need to be CIP compliant, meaning probable significant initial costs and some level of ongoing cost

Impact to ERCOT Generation Owners will likely be dis-incentivized from offering units for Black Start – Initial and ongoing cost is exorbitant Logical and Physical Security Staffing, contracts and/or systems to develop and maintain processes, procedures, and required documentation – Ongoing costs will remain even though there is no guarantee of repeated selection as a Black Start unit – Increased risk associated with ensuring continued compliance to CIP standards – Administrative burden potential distraction from operating and maintaining unit – No guarantee new CIP standards won’t be developed that adds cost or burden in the foreseeable future (Version 6?)

Impact to ERCOT Reliability of the ERCOT system may be adversely impacted – Units that have been updated to meet CIP Standards but not selected for Black Start could be forced into mothball or retirement due to economics Many of these units are small, have small staffs and low capacity factors, do not run much during the year and may be running on the margin. –Inadequate Black Start ability due to Generation Owners not offering units in to bid process

Recommendation We need to address the concern with the draft Standard to provide a REASONABLE level of reliability to ERCOT. Registered entities should provide comments to the Standard(s) prior to January 6 th. – Texas RE MRC and NSRS to submit comments For Black Start units with no external connectivity, the risk is low; therefore, they should be moved to the Low Impact category.

CIP Attachment 1 Section 2, Medium Impact Rating 2.4Each Blackstart Resource with External Connectivity identified in its Transmission Operator's restoration plan Comment on CIP Cyber Security — BES Cyber Asset and BES Cyber System Categorization

Rationale Adding “with External Connectivity” would allow those Black Start units engineered with NO external connectivity to be in the Low Impact category. The Low Impact category has requirements for controls to restrict physical access and some minimal cyber security requirements (e.g. firewall). External Access Point could be added if not present under CIP version 3 today.

Questions?

2. Medium Impact Rating (M) Each BES Cyber Asset or BES Cyber System, not included in Section 1, above, that if rendered unavailable, degraded, or misused would, within 15 minutes adversely impact one or more BES Reliability Operating Services for: 2.5. The Facilities comprising the Cranking Paths and meeting the initial switching requirements from the Blackstart Resource Up to and including the first interconnection point of the generation unit(s) to be started, or up to the point on the Cranking Path where two or more path options exist and including any single failure points in the Cranking Path to and including the first interconnection point of the generation unit(s) to be started, or up to and including the point on the Cranking Path where two or more path options exist to two or more independent generation unit(s) to be started as identified in its Transmission Operator's restoration plan.

Cranking Path

Impact to ERCOT “Owners” of the Cranking Path won’t know they have CIP Black Start-related requirements until the Black Start units have been awarded. – Adequate time will be required to become CIP compliant – Companies will need to be able to finance the changes