WECC COMPLIANCE 101 Webinar

1. WECC COMPLIANCE 101 Webinar Thursday, October 17, 2013 2:00 pm MDT

2. Agenda • Introductions L. Scholl • Overview of WECC and Regulatory Structure C. White • Audit – What to Expect P. O’Donnell and C. Bakk • Enforcement R. Ferrin, B. Christensen, E. Brereton - Self-Disclosed Violations - Mitigation Plans - Case Processing • webCDMS Overview M. Dalebout, T. Allred, K. Israelsson

3. COMPLIANCE 101 Module One

4. Module 1: WECC History & Roles

5. WECC Profile The Western Electricity Coordinating Council (WECC) is a non-profit corporation that exists to assure a reliable bulk electric system in the geographic area of the Western Interconnection. This area includes all or parts of the 14 western United States, two Canadian provinces, and the northern portion of Baja California, Mexico.

6. WECC History • Incorporated in 2002 • Predecessor, WSCC formed in 1967 • Largest geographic area of the eight Regional Entities • Entire Western Interconnection (1.8 million square miles) - includes all or part of 14 U.S. states, 2 Canadian provinces and a portion of Baja California Norte, Mexico • Non-Governmental • Industry participants join together to promote system reliability • Member-driven (401 members divided into 7 membership classes)

7. WECC Coverage Service Area 1.8 million square miles 126,285 miles of transmission Population of 78 million

9. WECC Organization • Members • 401 • Grid owners, operators, users • Stakeholders • State and Provincial • Board of Directors • 32 members • Committees • Board • Member

10. WECC Services • Reliability coordination • Operate two Reliability Coordination Offices (Vancouver Wa. and Loveland Co.) that provide situational awareness and real-time supervision of the entire Western Interconnection

11. WECCServices • Transmission expansion planning • Management of a comprehensive planning database • Provide coordination of sub-regional planning processes • Analyses and modeling • Studies • Model the system and perform studies under a variety of scenarios to set operating policies and limits • Market-operations interface • Ensure that competitive power markets do not negatively impact reliability

12. WECC Services • Loads and Resources Assessments • Perform annual assessment of 10-year loads and resources • Maintain 10-year coordinated plan of system growth • Provide information to NERC for summer and winter assessments of the reliability and adequacy of the bulk-power system • Operator training • Provide training sessions for operators, schedulers and dispatchers • WREGIS • Hosts the Western Renewable Energy Generation Information System, which creates and tracks renewable energy certificates

13. WECC Services • Delegation Agreement • Perform functions delegated to WECC as a Regional Entity under Delegation Agreement with NERC, including regulating entities subject to mandatory Reliability Standards

14. Mandatory Reliability Regulation • Northeast Blackout of 2003 • 10 Million people in Ontario, Canada • 45 million people in eight U.S. states

17. Task Force Report • Final report of the U.S.-Canada Power System Outage Task Force on the 2003 blackout concluded: the single most important recommendation for preventing future blackouts, and reducing the scope of those that occur, is for the U.S. government to make reliability standards mandatory and enforceable.

18. Task Force Findings

19. Congressional Action • Energy Policy Act of 2005 • On August 8, 2005, the Energy Policy Act of 2005 (EPAct 2005) was signed into law. • “Section 215” • Section 215 of the EPAct 2005 directed FERC to certify an Electric Reliability Organization (ERO) and develop procedures for establishing, approving and enforcing electric reliability standards.

20. Authority for Compliance Monitoring ●FERC Order 672 (Implementing Rule 18 CFR 39) • Responsibility and oversight assigned to FERC • FERC designated NERC as Electric Reliability Organization • NERC has delegation agreement with WECC and seven other regions

21. Implementing Section 215

22. Development of Mandatory Reliability Standards

23. Order 693 & Order 706 Standards • Order 693 (Operations and Planning) includes: • Resource and Demand Balancing (BAL) • Emergency Preparedness & Operations (EOP) • Facilities Design, Connection & Mtnce. (FAC) • Protection and Control (PRC) • Order 706 (CIP) includes: • Critical Cyber Asset Identification • Personnel & Training • Electronic Security Perimeters

24. WECC Compliance • Registers Entities • Register users, owners, operators according to function • Monitors Compliancewith Standards • Monitor compliance by users, owners and operators of the bulk power system in the United States • Enforces Compliance • Violation mitigation and settlement negotiation • Representation of WECC in any hearing or appeal process • Administration • Audit coordination • Reporting systems

25. NERC Registration & Certification

26. Registration • Registered Functions determine applicable standards

27. Compliance Monitoring Activities • Onsite Audit • Offsite Audit • Self Reports • Self Certifications • Spot Checks • Compliance Violation Investigations • Complaints

28. Enforcement Activities • If a violation is identified, due process includes • Notice of Alleged Violation and Penalty or Sanction • Registered Entity Response • Request for Settlement or Hearing • NERC Approval • FERC Approval

29. Enforcement Activities • Mitigation of Violations • Prompt mitigation of violations and of risk to BES is important • Mitigation is not an “admission of guilt” • WECC reviews mitigation plans and accepts, rejects or requests revisions • WECC reviews completion of mitigation activities

30. Outreach • Compliance User Groups/ Critical Infrastructure Compliance User Groups • Open WebEX - Monthly • Targeted Training • CIP 101 • WebCDMS and EFT • E-learning Modules • Compliance 101

31. Reference Documents • Compliance Monitoring and Enforcement Program (CMEP) & WECC’s annual plan • Delegation Agreement • Rules of Procedure • NERC Standards and WECC Regional Standards • NERC Guidance, Bulletins, Directives and Compliance Application Notices (CANs) • FERC Orders

32. Constance B. White Vice President of Compliance cwhite@wecc.biz Questions?

33. Cathy BakkSupervisor, Compliance Program Coordinators Notice of Audit October 17, 2013 Compliance 101 Webinar

34. Notice of Compliance Audit Packet • Notice of Audit Letter • Compliance Monitoring Authority Letter • Audit Team Biographies • Confidentiality Agreements

35. Notice of Compliance Audit Packet • Certification Letter • Pre-Audit Data Requests • Pre-Audit Survey • WECC RSAWs

36. Notice of Compliance Audit Letter • 90-Day Notice of Audit Letter • Details of your specific Audit • Dates of Audit • Audit Scope • Due Dates • Audit Team Composition, observers (if applicable) Observers can include FERC/NERC • Date/time of proposed Pre-Audit Conference Call • Opening Presentation Suggestions

37. Notice of Compliance Audit Letter • Audit Team Composition • Primary Audit Team • Individuals expected to participate in the Audit • Alternate Audit Team • Individuals available to act as backup or replacements for Primary Team members

38. Attachments A, B, & C • Attachment A • Informational; Explanation of Compliance Monitoring Authority • Attachment B • Short Biographies of the WECC Audit Staff • Attachment C • Signed Confidentiality Agreements of the WECC Audit Staff

39. Attachments D & E • Attachment D • RSAWs (Reliability Standard Audit Worksheets) • Customized for your Entity and your audit Based on your Registered Functions and AML • Attachment E • Certification Letter • Must be printed on your company letterhead and signed by an Authorized Officer • Certifies that the information being provided for the Audit is accurate

40. Attachment F • Attachment F • Pre-Audit Survey • Verify contact information • Audit Logistics • List any delegation agreements • Signed by Authorized Officer • Please complete all applicable fields

41. Attachment G • Attachment G • Pre-Audit Data Requests • Why are we doing this to you?!? Clarifications for data submittals Specifying types of evidence to remove some of the guesswork

42. Att G – Operations & Planning (O&P) Data • Some evidence may apply to more than one Standard • One copy is sufficient, but document inventories or “roadmaps” are appreciated • Single Line Diagram • Requested for the majority of Audits

43. Att G – Cyber Security (CIP) Data • CIP-004 – CIP-009 may not be applicable base upon the Critical Asset/Critical Cyber Asset determination • Determined by CIP-002-3 Requirements 2 & 3 • Complete RSAWs indicating absence of CA/CCA identification

44. Audit Periods Defined • Audit Periods, for O&P and CIP, are defined in Attachment G • O&P • Date of Registration – last day of Audit OR • Day after previous Audit Closing – date of Notice • CIP (Version 3) • October 1, 2010 – last day of Audit OR • Day after previous Audit Closing – date of Notice

45. Audit Frequency • 3 year cycle • Entities registered as a Balancing Authority (BA) or Transmission Operator (TOP) • All others – 6 year cycle

46. Recommendations • Know the Reliability Standards • Use the RSAWs as guides • Ask questions • Participate in Outreach (CUG/CIPUG) • We are here for you… • Questions • Comments • Concerns

47. Phil O’DonnellManager, Operations and Planning Audit Team Audit Approach and Best Evidence October 17, 2013 Compliance 101 Webinar

48. Compliance Audit (on-site vs. off-site) • Primary difference is: • Location of audit conduct • Scope is typically smaller for off site. • On Site – Required for BA, TOP functions • Per NERC Rules of Procedure 403.11.2

49. Compliance Audit (on-site vs. off-site) • On-Site • Documentation sent to WECC before audit for preliminary review • The audit team reviews evidence during off-site week or the first week of the audit and completes its review during the second week or on-site week • Data Requests or DRs • In-person interviews for clarification • Off-Site • Documentation sent to WECC before audit for preliminary review • Data Requests or DRs • Entity may be present at audit if desired • Telephone interviews for clarification

50. Audit Approaches • We audit to the Requirements of the Standards. • General Approaches included in RSAW • RSAW may ask specific questions • Always includes the section: “Describe, in narrative form, how you meet compliance with this requirement.”