As I’ve pointed out multiple times, including in my most recent post, the NERC 2023-09 “cloud CIP” Standards Drafting Team (SDT) is under tremendous pressure from NERC to finish drafting the approximately twelve new CIP standards – called the “100 series” standards – that the SDT has decided to develop, by the end of this year. When you consider there are effectively no more than 4-5 work weeks left in the year, this means the SDT is now under the gun to develop more than two new standards and almost two new definitions every week.
When you additionally consider that this SDT started work in the summer of 2024 and since that time has finalized exactly 0 new standards and 0 new definitions, it’s clear there’s no way this can happen IF the team is to fulfill what are supposed to be (used to be?) NERC’s expectations for quality standards development.
Why is NERC putting this pressure on the SDT? It’s because the clunky and inefficient NERC standards development process is going to be replaced by a shiny new process in 2027. This was developed by a task force called “Modernization of Standards Processes and Procedures” or MSPP; while I haven’t even read anywhere near all the changes that are being proposed, I agree the MSPP will bring about a big improvement over the current process.
Here is NERC’s ostensible reason for pressuring the SDT: Once the Rules of Procedure changes that will implement the MSPP recommendations have been fully implemented, the old process will be discontinued. Since this SDT was constituted and has operated so far under the current rules, if the SDT hasn’t developed the first draft of each new standard and definition, and submitted them all for the first ballot by NERC entities, before the MSPP rule changes come into effect, they’ll have to go back to the beginning of their project under the new rules. This will probably mean developing a Standards Initiation Request (SIR); this is the MSPP replacement for the current Standards Authorization Request (SAR). It is the first step in any project to develop a new NERC standard or revise an existing one.
Let’s set aside for the moment the question whether being forced to stop and rethink their whole project would be a bad or a good thing for the SDT; let’s assume it would be bad (this is clearly what both the SDT and NERC believe). Why is NERC saying the SDT needs to finish their work in December, come hell or high water? In other words, what will suddenly change on January 1, other than the fact that a lot of people unused to hard partying will wake up with bad headaches?
In talking with SDT members about this, I have received the impression (perhaps wrongly) that the MSPP will become the law of the land in NERCdom on January 1; that is, any project not finished by then will literally have to start over. However, the table on this page makes clear that nothing in particular will happen on January 1. The NERC Rules of Procedure (RoP) changes that will implement the MSPP passed a first ballot in October, and NERC has posted the comments that were received with that ballot (changes to the RoP are approved by roughly the same balloting process by which changes to the standards are approved).
NERC is now considering what the next step will be. They might decide that another ballot is needed. Alternatively, they might decide the MSPP changes to the RoP were approved in the first ballot, so they can be submitted to the Board of Trustees for approval at one of their quarterly meetings; let’s assume NERC decides this way. Since the Q4 meeting is on December 10, it’s not likely the changes can be approved at that meeting; perhaps they will be approved at the Q1 meeting, which is in mid-February.
If the Board approves the RoP changes in February, does that mean they’ll come into effect immediately? No, because the changes can’t come into effect until FERC has approved them. After the changes are approved at a Board meeting, NERC will prepare a filing with FERC, requesting their approval. Of course, the FERC commissioners will then need to discuss NERC’s request – as well as comments that have been submitted pro and con – in at least one of their closed internal meetings. Once the commissioners have reached their decision, it will be announced at one of their monthly “Sunshine Act” meetings, which are open to the public.
Given everything else that’s on FERC’s docket, it’s not likely that NERC’s request will jump to the head of the line and be approved in Q2. Instead, it’s much more likely that FERC won’t approve the MSPP changes until the second half of 2027. Once that happens, the RoP changes will come into effect. The last entry in the table linked above will occur in “Q3/Q4”; it is described as “Transfer existing standards development projects”.
Thus, rather than facing a cliff on January 1, the 2023-09 SDT will almost certainly not be forced to make any change at all until the second half of 2027. In fact, when I asked Google AI (which never lies 😊) when the MSPP changes will come into effect, it replied “Full implementation of NERC's Modernization of Standards Processes and Procedures (MSPP) is expected mid- to late-2027 at the earliest” (my emphasis). Thus, not only will nothing happen if the 2023-09 SDT hasn’t finished drafting their new standards and definitions by the end of 2026, but it’s quite possible that nothing will happen until 2028. Excuse me for not breaking into a cold sweat at the very thought that the SDT won’t finish their initial drafts this year.
Guess what, Project 2023-09 SDT! You don’t have to devote every waking moment for the remainder of the year (including through the holidays) to trying to finish all your first drafts before December 31. This is good, because one of your more prominent members stated in a meeting last week that for the rest of the year, “The SDT is too busy to listen to advice.” Maybe he can correct that statement soon before it becomes iconic (like the famous statement by a US officer in Vietnam that “We had to destroy the village in order to save it”, which came to symbolize the entire war). After all, there are politicians in Washington that “correct” their statements multiple times a day; this SDT member shouldn’t feel bad if he must correct his statement a week or two later.
Fortunately, since the MSPP changes won’t be in effect for at a minimum nine months and perhaps more than a year, there’s no need to have the first ballot in January. This idea was always just a fantasy, since I strongly doubt the required Quality Review by the NERC legal staff – which needs to be done before the draft standards and definitions are posted for ballot - won’t reveal the need for multiple changes to the standards. Some of these will likely be fundamental changes that will require rethinking everything the SDT has done so far (I can think of at least four or five of these “showstoppers”, which I hope to describe in a new post soon). The SDT will need to make the required changes, then resubmit the draft standards for a new QR. That in itself could easily be a 3-6 month project, since there has been no external review so far of what the SDT is developing.
However, the SDT shouldn’t wait for the QR to tell them everything that needs to be changed in their draft standards. In my last post, I listed four things that I believe the SDT needs to do before they finalize any of their draft standards and definitions and send them to QR:
Have current CIP auditors review the draft standards and point out problems that might impair auditability; the SDT needs to review these comments and incorporate suggested changes into the draft standards.
Post the draft standards and definitions for comment by all NERC entities, then determine which suggestions have merit and implement them.
Get an unofficial review of the standards by NERC Legal and incorporate any required changes into them.
(most importantly) Develop an Implementation Guidance (IG) document for every new standard they’re proposing. By NERC’s rules, CIP auditors are required to “give deference” to IG documents whenever one of them disagrees with a Responsible Entity regarding interpretation of a requirement. In other words, this is the only way to “break a tie” in such disagreements. If the standards and definitions are anything like the “example” standards and definitions that the SDT posted for comment in July, a lot of ties will need to be broken when the 100 series standards are implemented. IG documents are essential.
To be honest, even if the SDT accepts that they don’t need to be in such a big hurry, I’m almost sure they won’t want to commit to do number 4. Implementation Guidance has a special status because it must be voted on and approved with the standards themselves; this puts a bigger burden on the drafting team, since they need to produce not just draft standards that meet with the Ballot Body’s approval, but also IG documents.
This might mean that one or two more ballots will be needed before the required supermajorities of different classes of NERC entities are received. The last and only time that the CIP standards were rewritten from the ground up was CIP version 5, which was drafted starting in 2010 and was implemented in 2016. That required four ballots over one year. Given that the draft 100 series standards – whenever they’re completed – will propose an even more fundamental revision of CIP than version 5 did and that, unlike the v5 standards, they may be submitted for balloting without having had any external review, it’s likely that NERC’s approval of the 100 series will require more ballots and more time.
Fortunately, I think the SDT can count on having close to a year (and perhaps more) before the first ballot will need to take place. Therefore, they no longer have a valid excuse – as if they ever did – for not doing any of these four things before they submit the final documents for QR.
I suspect that at least some on the SDT won’t welcome the news that they will need to work hard for a year or two longer than they thought they would. However, that’s the case, assuming they want to submit draft standards and definitions that are likely to be approved by both NERC and FERC. Some SDT members have already spent 2 ½ years on this effort (of course, on top of what they do in their day jobs); they might feel they deserve to be at least let off the hook for preparing Implementation Guidance documents.
I sympathize with the SDT members, but to be honest I have more sympathy with the NERC entities. They may face years of uncertainty, plus the possibility of big fines, if they must figure out for themselves how to comply with the 100 series standards as well as pass audits, without the benefit of an agreed upon “Bible” from which they can quote chapter and verse to settle interpretation questions with auditors. Yea verily, the words of the Implementation Guidance are righteous, having been blessed by the NERC entities themselves.
But here’s the deal: Standards Drafting Team members have signed on for the duration. They can’t put a clearly imperfect set of standards on the approval path and then bail out if it looks like approval might not be as easy as they thought it would be. Therefore, the members of the 2023-09 SDT, since it turns out they have a lot more time to develop quality standards and definitions than they thought they had, need to do everything possible to ensure that the standards are approved, all the way up until FERC approves them (although the workload will drop significantly once NERC approval is secured). That includes doing all four of the items I listed above (other tasks may be required as well).
But let’s say the SDT decides they’ve put in enough time and need to go home. They’re certainly allowed to do that, but then they need to accept the fact that the standards won’t pass themselves; nobody will be eager to jump in to pick up the banner they’ve let fall. Most likely their departure will mark the unsuccessful end to Project 2023-09 – in other words, 2 ½ years of their and the NERC CIP community’s time will have been wasted.
Tom Alrich’s Blog, too is a reader-supported publication. You can view new posts for three months after they come out by becoming a free subscriber. You can also access all of my 1300 existing posts dating back to 2013, as well as support my work, by becoming a paid subscriber for $30 for one year (and if you feel so inclined, you can become a founding subscriber for $100). Whether free or paid, please subscribe. Of course, if you can’t afford the $30, please email me and I’ll give you a complimentary one-year full subscription (this offer doesn’t apply to bots).
If you would like to comment on what you have read here, I would love to hear from you. Please comment in my chat or email me at [email protected].