Cybersecurity, News

FERC grants NERC’s request to delay implementation of certain new cybersecurity rules

In response to an April 6 request by the North American Electric Reliability Corporation (NERC) to defer the implementation of several reliability standards that had effective dates or phased-in implementation dates for this summer, FERC said yes.

Some standards that were set to take effect on July 1 will now take effect October 1 and others are pushed out January 1, 2021 or even as far as April 1, 2021. You can read the full FERC order here.

NERC filed its motion to help ensure grid reliability amid the impacts posed by COVID-19 and noted that the Commission and NERC had already taken steps in recognition of the “critical importance of the reliability of the nation’s energy sector and the steps that registered entities are taking to maintain the health and safety of their workforce and communities.”

In order to comply with the new standards, NERC said that utilities would need to expend significant effort and resources in the coming months towards establishing and implementing processes and procedures, conducting the required coordination, and establishing documentation of compliance.

“[B]y providing for additional time and flexibility to establish compliance with new obligations, entities could continue to focus their immediate efforts and resources on maintaining the safety of their workforces and communities and ensuring the reliability of the grid during this public health emergency,” said NERC in the request.

Alex Santos, CEO of Fortress Information Security said in response to the order that his company fully supports the delay.

“Our nation’s power grid remains strong and secure, but this summer will require utilities of all types and sizes across the country to come together and collaborate to identify critical risks and protect the supply chain from emerging threats.”

In the order, FERC noted that Protect our Power, an organization that has held annual meetings at DISTRIBUTECH International for the past two years had lobbied for a shorter delay of only 30-days for the Reliability Standard CIP-013-1 because of the critical nature of the utility industry supply chain and that many or most utilities may already be prepared to comply by the current July 1 deadline.

Michael Mabee filed a protest asserting that a pandemic was not unexpected and “the industry should have been prepared.”