CIP Version 4 The Basics

CIP Version 4- Background Centers around expanded criteria for Critical Assets – FERC thought Risk Based Methodologies used by entities were not uniformly applied- order 706 – Used Bright Line Criteria to have more high level assets identified as Critical – Kiss my Risk Based Methodology good bye

CIP Version 4- Background Criteria developed for the 3 major facility classes – Generation – Transmission – Control Centers Criteria in CIP Attachment 1 is the basis of the changes in version 4.

CIP Attachment 1* Criteria used to determine Critical Assets * Also refer to document: CIP Cyber Security- Critical Cyber Asset Identification Rationale and Implementation reference Document

1.1 Generation >= 1500MWs Group of units at a single location with a total of 1500MWs Net Real Power† (i.e. 1500MWs deliverable to the interconnection) – Single location In a defined physical footprint (as evident by) – Common fence – Common entry point – Shared common facilities – Common management organization – Similar naming convention (plant name - #) Connected to a single Interconnection* * the three major electric system networks in North America: Eastern, Western, and ERCOT. NERC Glossary- definition used when capitalized † where multiple net Real Power Capability can be used the highest value is judged against the Bright line criteria. Includes Nukes

1.1 Generation >= 1500MWs (Cont.) Why 1500MWs? – Taken from Contingency Reserve requirements of BAL-002 Makes sure BA has enough Contingency Reserves to return Interconnection frequency back to limits following a “Reportable Disturbance” The BA or Reserve Sharing Group must maintain enough Contingency Reserve to cover the single most severe contingency MWs was derived from various BAs in the all regions as the most significant Contingency reserves. Figure could be verified through MOD- 024, Verification of Generator Gross and Net Real Power Capability which has to be given to SPP Model Development Group

1.1 Generation >= 1500MWs (Cont.) Critical Cyber Assets – Intent is to identify common mode vulnerabilities Identify all cyber assets that collectively control/ impact the 1500MWs of generation. – Cyber Assets- Programmable electronic devices and communication networks that use a routable protocol. Includes Hardware, Software and data. Need to consider all facilities and systems up to the point where interconnected to the transmission system. – Has to be able to impact Bulk Electric System within 15 minutes

1.1 Generation >= 1500MWs (Cont.) Critical Cyber Assets (Cont.) – Cyber Asset has to be able to impact Bulk Electric System Operation within 15 minutes to be Critical More than 15 minutes should give enough time to detect and remediate – Example of Cyber Assets controlling the coal fuel supply for a coal plant. May have enough time to correct situation before it affects real time condition.

1.2 Reactive Resource >= 1000MVARs Single or Group of units at a single location with a total of 1000MVARs – Excludes Generators – Net Reactive Power Nameplate Rating – Single Location evident by Common fence Common entry point Shared common facilities Common management organization Similar naming convention (name - #)

1.3 Designated Generator Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES – Within Long-term planning horizon Time Horizon described in NERC’s “Time Horizons” – Defines long term planning horizon as one year or longer – Planning Coordinator (if none designated then Trans. Planner) Identifies generator as a “Reliability Must Run” unit – Must Run for reliability beyond the local area – Not generators for Voltage Support within local area Not apart of generators designated as “Must Run” for market – Examples are: Category C3 in TPL-003

1.3 Designated Generator (Cont.) Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES – Examples are: Category C3 in TPL-003 – Loss of two or more elements – Single Line to Ground (SLG) or 3 Phase Fault with Normal Clearing of » Generator, Transmission Circuit, Transformer or Single Pole (dc) Line – Manual System Adjustment – Followed by another SLG or 3Φ fault with Normal Clearing of » Generator, Transmission Circuit, or Transformer – System Stable; Voltage/Thermal Limits within range – Can shed load or curtail Firm Transfers – No Cascading Outages

1.3 Designated Generator (Cont.) Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES – Another Example given: Category D in TPL-004 – Loss of two or more elements or Cascading out of service – 3 Phase Fault with Delayed Clearing (stuck breaker or protection system) » Generator, Transmission Circuit, Transformer or Bus Section – 3 Phase Fault with Normal Clearing » Breaker (failure or internal fault) – Loss of tower with 3 or more circuits – All Transmission lines in a common ROW – Loss of substation (1 voltage level and transformers) – Loss of all generation at one station – Loss of major load or major load center – Special Protection System or remedial action scheme » Failure to operate when required » Operation, partial operation or misoperation not intended to operate – Disturbances in another Region » Impact of power swings » Oscillations Evaluate for Cascading outages, Substantial Customer Demand or generation loss in a widespread area.

1.3 Designated Generator (Cont.) Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES – Definitions within categories Normal Clearing – Normal clearing is when the protection system operates as designed and the Fault is cleared in the time normally expected with proper functioning of the installed protection systems. Delayed clearing of a Fault is due to failure of any protection system component such as a relay, circuit breaker, or current transformer, and not because of an intentional design delay. Planned or controlled loss of demand or curtailed Firm transfers – Depending on system design and expected system impacts, the controlled interruption of electric supply to customers (load shedding), the planned removal from service of certain generators, and/or the curtailment of contracted Firm (nonrecallable reserved) electric power transfers may be necessary to maintain the overall reliability of the interconnected transmission systems. Category D Extreme Events – A number of extreme contingencies that are listed under Category D and judged to be critical by the transmission planning entity(ies) will be selected for evaluation. It is not expected that all possible facility outages under each listed contingency of Category D will be evaluated.

1.4 Restoration plan BlackStart resource -Black Start Units -Listed in restoration plans of EOP-005-2

1.5 BlackStart Cranking Path BlackStart Cranking Path – Facilities from initial switching of BlackStart unit to 1 st interconnection point of 1 st generator to be started Where two or more path options exits in restoration plan Black Start Unit 1 st Generator Cranking Path Black Start Unit Substation Cranking Path Generator Substation Path 1 Path 2

1.6 Transmission Facilities >= 500KV Any Transmission Facility – At a substation – Operated at 500KV or greater Discussion on Collector bus‡ Collector bus at a Non-Critical Asset Generation plant – i.e. not aggregate of 1500MWs as in 1.1 – Operated at 500KV or greater – Bus is considered a generation facility not transmission – Collector bus would not be considered a Critical Asset ‡Collector bus is the low voltage side of a step-up Xfrmr connected to a generator where real & real reactive power is collected

1.7 Transmission Facilities >= 300KV Transmission Facilities operated within a substation Substation interconnected at >= 300KV to 3 or more substations – Ensures that level of impact is deemed appropriate Critical Asset Note: 300KV facilities

1.8 IROL Substation Transmission Facilities Designated by Reliability Coordinator (SPP), Planning Authority, Transmission Planner – Transmission Facilities deemed critical to derive IROLs & Associated Contingencies The region and member planners determine the contingencies and conditions that bring the system to the edge of reliable operations and then gather the values from the model runs. What’s an IROL? – Interconnection Reliability Operating Limit The value (e.g. MW, MVAR, Hz, etc.) derived from/ subset of the System Operating limits* such if exceeded could lead to wide spread Bulk Electric System instability, cascading outages, or uncontrolled separation. *SOL (System Operating Limits) – Values by which the Bulk Electric System can be reliably operated. Criteria/Methodologies are established to determine these limits both pre and post contingency. Bottom Line-> Beyond these limits the BES can’t be counted on to deliver power in a reliable manner

1.9 Flexible AC Transmission Systems (FACTS) System composed of static equipment – Used in the transmission of electrical energy – Enhances controllability and increase power transfer capability – Power Electronics based system Reliability Coordinator, Planning Authority, or Transmission Planning has to designate them as a Critical Asset. – Must be critical to the deviation of an IROL – Or associated contingencies

1.10 Transmission Facilities for Gen interconnection Transmission Facilities for which if “something happened”* would prevent Critical Generation from connecting to the Transmission System – Applicable to generation at a single location >= 1500MWs (1.1) – Generation designated by Planning Coordinator or Transmission Planner to avoid BES adverse reliability Impacts in the long-term planning horizon. (one year or more) (1.3) – Ensures that Critical Generation can connect to Transmission System *something happened- destroyed, degraded, misused, or otherwise rendered unavailable.. Yada yada > 1500MWs Interconnecting Substation Line Unit 1 Unit 2 Unit 3 Or any Critically deemed generation

1.11 Transmission Facilities that interconnect Nuclear Plants Transmission Facilities identified as necessary to meet Nuclear Plant Interface Requirements (NPIR) Based on Standard NUC-001 – Ensures the reliability of the NPIR by the coordination between the generator owner/operator and the transmission provider

1.12 Systems that control IROL(s) Special Protection System(SPS), Remedial Action Scheme (RAS), or Automated Switching System () That operates Bulk Electric System Elements that if something happened* – Cause one or more element to exceed an IROL  due to a failure to operate as designed » It operated outside of design parameters » Didn’t provide the function in the proper time frame – Compromise of these systems would have Wide Area impacts – Want to ensure that BES operates with the IROL * something happened- destroyed, degraded, misused, or otherwise rendered unavailable.. Yada yada  Interconnection Reliability Operation Limit- Value limit that a Critical System element may operate while maintaining system reliability.

1.13 Automatic Load Shedding Systems Any System or Facility Performs automatic load shedding without human initiation, even if it requires a human to arm it >= 300MWs as required by regional load shedding program – Under Voltage Load Shedding (UVLS) – Under Frequency Load Shedding (UFLS) – Those 300MW systems which require human arming to operate automatically should be considered as Critical Why is this level lower than 1500MWs? – The UVLS and UFLS conditions represent the last ditch efforts to save the Bulk Electric System

Control Centers- a few words Control Centers perform control functions for multiple BES (Bulk Electric System) elements – These facilities are deemed to be Control Centers Facilities that perform control functions for a single BES element – Considered to be apart of that asset Example – Control room for a single Generation plant or Transmission Substation – Not considered to be a Control Center Control Centers that delegate functional obligations to another location – Are also considered to be a Control Center. (A Control Center’s functional control center) Note that Data Centers not located with a control center may be considered as essential to it operations and hence a Critical Asset

1.14 Control Centers perform functions of RC Each Control and Back-up Control Center – Performs functional obligations of the Reliability Coordinator (RC)

1.15 Control Centers for Critical Generation Assets Each Control and Back-up Control Center – Used to control generation at multiple locations – Generation Control Centers that control generation assets identified in criteria 1.1, 1.3 or 1.4 (1.1) Generation at a single location, connected to a single Interconnection, and has a total Net Real Power >= 1500MWs (1.3) Designated Generator: Planning Coordinator or Transmission Planner deems this unit as one whose operation is necessary to the reliable operation of the BES (1.4) Black Start units

1.16 Transmission Operations Control Centers Each Control and Back-up Control Center – Used to carry out obligations of Transmission Operator – Transmission Control Centers that control at least one Transmission asset identified in criteria 1.2, 1.5 – 1.12 (1.2) Reactive Resources >= 1000MVARs (1.5) Black Start Cranking Paths (1.6) Transmission Facilities >= 500KV (1.7) Transmission Facilities >= 300KV connected to 3 or more >= 300KV Transmission Substations (1.8) IROL Transmission Substations (1.9) Flexible AC Transmission Systems (FACTS) (1.10) Transmission Facilities that interconnect Gen >= 1500MWs (1.11) Transmission Facilities that interconnect Nuke Plants (1.12) Systems controlling IROLs. SPS, RAS, Automatic Switching

1.17 Balancing Authority Control Centers Each Control and Back-up Control Center – Used to carry out obligations of the Balancing Authority Balancing Authority with >=1500MWs in a single Interconnection – Consistent with 1.1 – Balancing Authority Control Centers that control at least one asset identified in criteria 1.1, 1.3, 1.4 or 1.13 (1.1) Generation at a single location, connected to a single Interconnection, and has a total Net Real Power >= 1500MWs (1.3) Designated Generator: Planning Coordinator or Transmission Planner deems this unit as one whose operation is necessary to the reliable operation of the BES (1.4) Black Start units (1.13) Automatic Load Shedding Systems >= 300MWs

QUESTIONS?