Introduction to NPCC

Scott NiedNPCC Fall 2017 Compliance and Standards WorkshopHartford, CTNovember 7, 2017

10/30/2017 1

Agenda• Overview of NPCC and NERC • CMEP Implementation Plans• Risk Assessment• Compliance Monitoring• Big Picture Review

10/30/2017 2

About NPCC• 501 (c) (6) NFP• 8 BOD Sectors (x2)

– 7 Stakeholder, 1 Independent• 220 Registered Entities• The Members of NPCC

– 35 General, 64 Full– Advantage of being a Member

• Funding: • Statutory (NERC collects from LSE on MWH basis)• Non Statutory (Full Member BA collects on Full Member basis)

10/30/2017 3

NPCC• 20% of EI load• NEL NPCC: 46% US and 54% Canadian

sources• 70% of Canadian NEL is within NPCC• 1.2 million square miles• Population of 55 million

10/30/2017 4

Role of NPCCThe NPCC mission is to enhance the reliability of and to promote the reliable and efficient operation of the international, interconnected bulk power system in Northeastern North America.• Statutory Activity (NERC related)• Non-statutory Activity (NPCC Criteria related)

10/30/2017 5

10/30/2017 6

NERC Regions

Western Electricity

Coordinating Council

Texas Reliability EntitySouthwest

PowerPool RE

Florida Reliability Coordinating Council

SERC Reliability Corporation

ReliabilityFirst Organization

Northeast Power Coordinating Council

Midwest Reliability Organization

North American Interconnections

10/30/2017 8

Interconnection Data• Eastern: 575 GW peak, 650 GW of Nameplate

– NPCC 110 GW Winter peak, 165 GW Installed Capacity

• WECC: 147 GW peak, 284 GW • Quebec: 38 GW peak, 46 GW• ERCOT: 68 GW peak, 77 GW(Data is approximate)

10/30/2017 9

10/30/2017 10

Key Aspects of NERC

10/30/2017 11

NERC Oversight of NPCC• Rules of Procedure and Appendices

– Applicable to all Regions, owners/operators, users– Standards Development Process– CMEP– Registration and Certification– Business plan and budgets (LSE basis through the BA)– Regional entity oversight– Training and education– Confidential Information – Requests for Data– Regional Delegation Agreements

10/30/2017 12

Statutory Role – Regional Entity Division (NERC Related)

• Monitor and Enforce National and Regional Reliability Stds• Participate in National Standard Development Process• Develop Regional Stds via the RRSDP using common

attributes• Organization Registration and Certification• Assess Reliability and Performance• Coordinate System Planning, Design, and Operation• Training/Education, Situation Awareness, Event Analysis

10/30/2017 13

Zoom In: Assess Reliability and Performance

• Seasonal Assessments, Resource Adequacy• Distributed Energy Resources

– NERC TF, DERs play into NERC LTRA• MMWG – Eastern Inter Base Cases• Task Force Support through Volunteer Army• SP-7 Misoperations• Governor Response• Essential Reliability Services (ERS)

10/30/2017 14

Non-Statutory Role - Criteria Services Division (Not NERC Related)

• Develop More Stringent Regional Criteria• Criteria Compliance And Enforcement Program (CCEP)

- Reporting Full Members Self Certify to a subset (non-monetary sanctions)

• Different Obligations for:– Full Members– General Members– Non-Members– 35 General, 64 Full

10/30/2017 15

Criteria Application• Who? Full Members must meet NPCC Criteria

– Aspects of Design, Operation, Planning, and Protection of the BPS

• What? – Generation and transmission facilities on which faults or

disturbances can have a significant adverse impact outside of the local area and which are identified utilizing a reliability impact-based methodology.

• Article IV - Amended and Restated Bylaws• U.S. and Canadian Entities

10/30/2017 16

Reliability Based Impact MethodologyNPCC Criteria Document A10

– Classification of Bulk Power System Elements– Bus Basis: Transient Stability and Steady State Stability tests for 3

phase faults– Goal: Determine if there is a “significant adverse impact” outside of

the “local area”– Loss of synchronism of gen, tripping due to power swings, SPS

operating when not required, voltage levels, thermal loading– Pass the test: Everything connected to Bus must meet Criteria– Result: The A10 List of BPS Facilities (a list of busses)

10/30/2017 17

Criteria - Bottom Up Approach• Criteria define the principles to be followed• Task Forces and Working Groups develop• Reviewed by Committees• Posted for comments• Members approve• Members are bound

10/30/2017 18

Key Dates in History 1965 - NE Blackout 1966 - NPCC Formed1968 - NERC Established1977 - NYC Blackout 2003 - NE Blackout 2005 - Energy Policy Act of 20052012 – The RAI concept is born2016 – Risk Based Concepts for CMEP Fully Implemented

10/30/2017 19

Spotlight- EPA of 2005• Amends the FPA in Section 215• FERC given electric reliability oversight• Mandated a self-regulating ERO• Mandatory Rel Stds subject to FERC review• Urged agreements with Canada and Mexico• Laid out RDA framework for the ERO• New Section 216 of FPA added to impose $

penalties

10/30/2017 20

NPCC Risk Based Path

• ERO and NPCC CMEP Implementation Plans– NERC Plan

• 2018 ERO Plan– NPCC Plan – not posted yet

• 8 steps in the path

10/30/2017 21

1st Step: Develop Plans

1. NERC CMEP Implementation Plan is posted every November – Provides background for the coming year– Major compliance initiatives for the year– ERO Risk Elements and corresponding focus requirements– 2017 ERO CMEP Implementation Plan

2. NPCC Regional CMEP Implementation Plan is an appendix to the NERC Plan

10/30/2017 22

Risk Based Oversight Plan Framework

10/30/2017 23

2017 Risk Elements in ERO CMEP IP

10/30/2017 24

Table 1: Critical Comparison of 2015, 2016, and 2017 Risk Elements2015 Risk Elements 2016 Risk Elements 2017 Risk Elements

Cyber security Critical Infrastructure Protection Critical Infrastructure ProtectionExtreme Physical Events Extreme Physical Events Extreme Physical Events

Infrastructure Maintenance Maintenance and Management of BPS Assets

Maintenance and Management of BPS Assets

Monitoring and Situational Awareness

Monitoring and Situational Awareness

Monitoring and Situational Awareness

Protection System Misoperations

Protection System Failures Protection System FailuresUncoordinated Protection Systems

Long-Term Planning and System Analysis

Event Response/Recovery Event Response/Recovery

Planning and System Analysis Planning and System AnalysisHuman Error Human Performance Human PerformanceWorkforce Capability (N/A for 2016) (N/A for 2017)

Monitoring and Situational Awareness (NERC IP 2017 Zoom In)

Table 5: Monitoring and Situational AwarenessStandard Requirements Inactive/Enforcement

Date (if applicable)Entities for Attention

IRO-005-3.1a R1, R2 03/31/2017 Reliability CoordinatorIRO-002-4* R3, R4 04/01/2017 Reliability Coordinator*Replaces IRO-005-3.1a per dates noted

TOP-006-2 R1, R2, R7 03/31/2017Balancing Authority Reliability Coordinator Transmission Operator

TOP-001-3* R10, R11 04/01/2017 Balancing Authority Transmission Operator

*Replaces TOP-006-2 per dates noted

10/30/2017 25

NPCC Regional IP• Outlines NPCC Activities for the year• NPCC SME’s add requirements to the NERC

Risk Elements• Add requirements to NPCC specific Risk

Elements– None for 2018

10/30/2017 26

Monitoring and Situational Awareness (NPCC 2017 - Expanded ERO)

10/30/2017 27

Use of IP’s in Scoping• The starting pool of R’s for 2018: NERC IP + NPCC IP• Transparency• The IP’s are the basis of the NPCC Compliance Oversight

Plans for the coming year that are developed on an entity basis

10/30/2017 28

Entity Risk Assessment – 2 Ways1. Inherent Risk Assessments (IRA)…2nd Step

• ERO Enterprise Guide for Compliance Monitoring• IRA on O&P only• 2016: ERO vs. NPCC goals

2. Internal Control Evaluations (ICE)…6th Step• ERO Enterprise Guide For Internal Controls• Voluntary• CIP V5 ICE being developed

10/30/2017 29

2nd Step - Performing the IRA• “ERO Enterprise Guide for CM”• Contains 18 Risk Factors. NPCC uses 13.• ERO Enterprise Guide to Compliance Monitoring

• NERC has subsequently mapped each Risk Factor to every requirement that applies

10/30/2017 30

BA Size Largest Generator Facility

Load Monitoring and Situational Awareness Tools

Critical Transmission Total Generation CapacityRAS Transmission PortfolioSystem Restoration Planned FacilitiesUFLS Equipment ICCP ConnectivityUFLS Development and Coordination

UVLS

Workforce Capability Variable GenerationPlanned Facilities CIP Impact Rating Criteria

NPCC Assesses• Risk Factor Criteria – High, Medium, Low• NPCC compares the entity’s attributes to the

NERC Criteria to get an HML for each Risk Factor.– Function, IROL, Blackstart, System Restoration,

UFLS, Critical Transmission, Load– Yes, this can be a bit…

10/30/2017 31

10/30/2017 32

3rd Step…Determining Scope from HML’s

• Remember…NERC has mapped all requirements to the Risk Factor that applies

• Now, we compare each HML from your assessment to the VRF of each of the risk-based pool requirements that match your function.

• Iterative process.• NPCC uses a scoping determination matrix

10/30/2017 33

4th Step – Performance Considerations

• Org Characteristics… Compl History, Functions, CFR/JRO

• Events/Sys Rest… IROLs, SOLs, Sys Rest Involvement

• External Inputs…NERC, Working Groups, NERC Alerts, etc.

10/30/2017 34

Risk Based Oversight Plan Framework

10/30/2017 35

5th Step - IRA Summary Report Contains two tables:• A table with your HML assessment results for the 13 Risk

Factors• A table of audit requirements which is a composite of 1) your

risk assessment vs. VRF of each of the IP requirements and 2) entity specific performance considerations.

• This is the pre-ICE audit scope

10/30/2017 36

6th Step- Internal Control Evaluation - ICE• Before the engagement• Voluntary (beng@npcc.org)• ICE Can Only Help You!• Kickoff Webinar• Onsite ICE review…not an Audit!• Who, What, Where, Why, When, and How• Not a guarantee to remove requirements• Assists you to look forward to remain compliant• Best of all…

10/30/2017 37

ICE Invitation

10/30/2017 38

Benefits of ICE

10/30/2017 39

7th Step - ICE Summary Report

• Detailed results• Reasoning and recommendations for audit removal

(and/or remaining in scope)• Some may choose to ICE more or less than the scope

shown in the IRA Summary Report!

10/30/2017 40

8th Step – Monitoring Tools• Offsite• Onsite• Guided Self Certification • Spot Check• The band is narrow here in tool selection

10/30/2017 41

Note on Compliance Oversight Plans• In NPCC….

– Initial IRA are all done– Annual update to internal assessments based on the 3/6 yr cycle

• From an NPCC perspective, the COP for an entity can come from 2 places for a given year…

1. Public: The provided audit scope from the internal risk assessment based on the current Imp Plan (Public exists only if you are being audited that year)2. Non-Public: The Quarterly GSC R’s if the entity is one of the subset of entities on the internal GSC schedule.

• R’s are risk-based and/or for trending• Selected entities could be just a “sample”• Based on Regional and ERO trends and/or issues

• Deviate? From assessment cycle if reliability needs dictate.• Change management

10/30/2017 42

Audit Scope is…

1. Either the risk assessment results by itselfOR

2. The difference between risk assessment results and ICE removals– Scope goes into Attachment 1 in Audit Notification Letter

10/30/2017 43

Audit Process• 90 days prior - NPCC sends formal audit notification package

w/milestones for entity response• Applicable standards/requirements• Product: Formal report(s) with findings• Note: 6 Months in advance >>> NPCC will inquire about

voluntary ICE

10/30/2017 44

Audit Preparation by EntityPrepare RSAWs and list supporting proof/documents

– Procedures, reports, logs, recordings– The more information you supply to satisfy the auditor

requests, the more time he has to review – Pre-Audit - A lot of work is done by entity and NPCC prior

to the onsite visit or offsite phone call.– Evidence Tracking Sheet

10/30/2017 45

Notes for 2017• Issue found after ANL is sent, but before evidence due

date…can still self-report into CDAA, just let Audit team know. • “Controls” are being assessed during the engagement.

– NERC expectation– Will address in Areas of Concerns, Recommendations, or Positive

Observances.

10/30/2017 46

Enforcement Process• NERC Compliance Monitoring and

Enforcement Program• NERC Appendix 4C

10/30/2017 47

The Enforcement QueueLeading methods of discovery• Self Reports• Audit Findings• Self Certifications• 70% Self-Identified

10/30/2017 48

Disposition Methods• Dismissal• Compliance Exception

– Minimal Risk, $0, minimal paperwork– Not considered a “possible violation”; instead “potential non-compliance”

• FFT– Moderate risk, $0 penalty still– FFT Opt Out, Affidavit– Still efficient and focuses resources, a bit more paperwork– Not considered a “confirmed violation”; but still a “possible violation” is sent

• SNOP – Short Settlement Form– Short NOCV Form

• Full NOP– Long Settlement– Regular NOCV

10/30/2017 49

Preliminary Screen – Determination1. Notice of Prelim Screen is sent2. We assess the facts/circumstances to determine

the potential and actual risk to BES– Dismiss?– Compliance Exception?– FFT (and above)? - Notice of Possible Violation

– Identifies the NERC Standard and Requirement(s) involved– Instructs to retain and preserve all data and records– Brief statement on MP or mitigating activities and entering into

settlement

10/30/2017 50

What helps determine Risk?• Well written Self Reports• Well written audit reports, completed RSAWs• SR: Step by step description of the issue• SR: Explanation of steps taken to mitigate• SR: Explanation of compensating measures• RAI Self Report User Guide• NERC RAI Page Link

10/30/2017 51

Why does RISK matter?• Lesser Risk violations qualify for less serious

enforcement paths• Smaller penalties or no penalties• Quicker turnaround for NPCC Staff, NERC,

and FERC, and the entity.• Less paperwork, Quicker Disposition for

Entity• More reliable BES

10/30/2017 52

RAI: Focus on Compliance Exception• Starting in 2015, Outside of “Enforcement” Process• Minimal Risk Issues• All entities are eligible• NOPV is not issued to entity (Notice of CE)• Provided in spreadsheet monthly for NERC/FERC

review.• Non-CIP CE’s are posted.• CIP posted with entity names and CEI redacted

10/30/2017 53

RAI: Focus on Self Logging• Selected Entities, voluntary• Allows an understanding of the entity’s IAC

management practices• Document minimal risk issues• Provide to Region quarterly• Identified issues will be treated as Compliance

Exceptions• Better use of entity and region resources/Reduced

administrative burdens• 14 NPCC entities participate

10/30/2017 54

Self Logging Eligibility

10/30/2017 55

Find, Fix, and Track• FFT process will be considered for:

– Moderate risk to BES• Requirements

– NPCC needs a solid understanding of mitigating actions taken– A Mitigation Plan is not required through CDAA

• Criteria Recently Adjusted– Issues that have Mitigating Activities not completed are eligible (1 year)– Moderate risk to BES. – Underlying facts and circumstances, mitigating factors during the non-compliance that resulted

in a lower risk to BPS, robust ICP and culture of compliance, entity compliance history supports

• Traits– Zero dollar penalty always– NOPV is issued to the entity– Considered an “issue” that is tracked, but does not require the full process– Does not become a “confirmed violation”

10/30/2017 56

Settlement• Registered Entities may request settlement negotiations at any

time up to the point of NERC filing a “Notice of Penalty”• Settlement Process provides for negotiation opportunity.• Emphasis for settlement is on reliability of the bulk power

system.

10/30/2017 57

Notice of Alleged Violation and Penalty or Sanction

• NAVAPS - Tool to Move the Process Along– Date and time– Facts– Proposed penalty or sanction

– Gives notice for 30 day response. • Why would NPCC send?

10/30/2017 58

NAVAPSRegistered Entity response options within 30 days:

• Agree with the Alleged Violation, the proposed Penalty or sanction, to send a Mitigation Plan

• Agree with Alleged Violation and agree to submit and implement a Mitigation Plan, but contest the proposed Penalty or sanction.

• Contest both the Alleged Violation and proposed Penalty or sanction.

10/30/2017 59

Mitigation Plan– Identify the cause of violation.– Entity’s action plan to correct and avoid recurrence

of the issue while ensuring BPS reliability– A timetable for completion w/ milestones no more

than 3 months apart.– Must be signed by an officer, employee, attorney

or other authorized representative of the Entity– RAI Mitigation Plan User Guide– NERC RAI Page Link

10/30/2017 60

Mitigation Plan (cont.) • Enforcement Review

– Within 30 day of receipt– Accepted

• Notify Entity and submit to NERC– Rejected

• Revised mitigation plan approval or rejection within 10 business days.

• Quarterly updates by registered Entity• Entity provides Certification of Completion via CDAA• Evidence review• NPCC verifies the mitigation activities• Issues Verification of Mitigation Plan Completion

10/30/2017 61

The End of the Enforcement Process• NERC files CE, FFT, SNOP, Full NOP with FERC• FERC - 30 day review period for SNOP or NOPs• Entity is invoiced• Entity has 30 days to submit penalty payment• NPCC will send: Notice of Completion of

Enforcement Action

10/30/2017 62