WECC COMPLIANCE 101 Webinar

1. WECC COMPLIANCE 101 Webinar Thursday, October 9, 2014

2. Agenda

3. Overview of WECC and Regulatory Structure Constance White Vice President of Compliance and Acting Regional Manager

4. COMPLIANCE 101 Overview of WECC And Regulatory Structure

5. The Western Electricity Coordinating Council (WECC) is a non-profit corporation that exists to assure a reliable bulk electric system in the geographic area of the Western Interconnection. This area includes all or parts of the 14 western United States, two Canadian provinces, and the northern portion of Baja California, Mexico. WECC Profile

6. Incorporated in 2002 Predecessor, WSCC formed in 1967 Largest geographic area of the eight Regional Entities Entire Western Interconnection (1.8 million square miles) - includes all or part of 14 U.S. states, 2 Canadian provinces and a portion of Baja California Norte, Mexico Non-Governmental Industry participants join together to promote system reliability Bifurcation in February 2014 changed functions WECC History

7. WECC Coverage Service Area 1.8 million square miles 126,285 miles of transmission Population of 78 million

9. WECC Organization • Independent Board of Directors • 9 members • Committees • Members Advisory Committee • Members • Grid owners, operators, users • Stakeholders • State and Provincial

10. Peak Reliability assumed responsibility for Reliability Coordination Operate two Reliability Coordination Offices (Vancouver WA and Loveland CO) that provide situational awareness and real-time supervision of the entire Western Interconnection Bifurcation

11. Transmission expansion planning Management of a comprehensive planning database Provide coordination of sub-regional planning processes Analyses and modeling Studies Model the system and perform studies under a variety of scenarios to set operating policies and limits WECCServices

12. Loads and Resources Assessments Perform annual assessment of 10-year loads and resources Maintain 10-year coordinated plan of system growth Provide information to NERC for summer and winter assessments of the reliability and adequacy of the bulk-power system Operator Training Provide training sessions for operators, schedulers and dispatchers WREGIS Hosts the Western Renewable Energy Generation Information System, which creates and tracks renewable energy certificates WECC Services

13. Delegation Agreement Perform functions delegated to WECC as a Regional Entity under Delegation Agreement with NERC, including regulating entities subject to mandatory Reliability Standards WECC Services

14. Northeast Blackout of 2003 • 10 Million people in Ontario, Canada • 45 million people in eight U.S. states Mandatory Reliability Regulation

17. Final report of the U.S.- Canada Power System Outage Task Force on the 2003 blackout concluded: the single most important recommendation for preventing future blackouts, and reducing the scope of those that occur, is for the U.S. government to make reliability standards mandatory and enforceable. Task Force Report

18. Task Force Findings

19. Congressional Action • Energy Policy Act of 2005 • On August 8, 2005, the Energy Policy Act of 2005 (EPAct 2005) was signed into law. • “Section 215” • Section 215 of the EPAct 2005 directed FERC to certify an Electric Reliability Organization (ERO) and develop procedures for establishing, approving and enforcing electric reliability standards.

20. FERC Order 672 (Implementing Rule 18 CFR 39) • Responsibility and oversight assigned to FERC • FERC designated NERC as Electric Reliability Organization • NERC has delegation agreement with WECC and seven other regions Authority for Compliance Monitoring

21. Implementing Section 215

22. Development of Mandatory Reliability Standards

23. Order 693 (Operations and Planning) includes: • Resource and Demand Balancing (BAL) • Emergency Preparedness & Operations (EOP) • Facilities Design, Connection & Mtnce. (FAC) • Protection and Control (PRC) • Order 706 (CIP) includes: • Critical Cyber Asset Identification • Personnel & Training • Electronic Security Perimeters Order 693 & Order 706 Standards

24. Recommends Registrations for Entities Register users, owners, operators according to function Monitors Compliance with Standards Monitor compliance by users, owners and operators of the bulk power system in the United States Enforces Compliance Violation mitigation and settlement negotiation Representation of WECC in any hearing or appeal process Administration Audit coordination Reporting systems webCDMS and EFT WECC Compliance

25. In summary…

26. Authority CMEP Reliability Standards Delegation Agreement Federal Power Act 2005

27. Registration Registration Authority

28. Monitoring Other Self Certifications Registration Self Reports Audits Authority

29. Enforcement Mitigation Actions Settlement Monitoring Registration Due Process Risk Assessments Authority

30. Education/Outreach Education/Outreach Monitoring Enforcement Registration Authority

31. Compliance Monitoring and Enforcement Program (CMEP) & WECC’s annual plan Delegation Agreement Rules of Procedure NERC Standards and WECC Regional Standards NERC Guidance, Bulletins, Directives and Compliance Application Notices (CANs) FERC Orders Reference Documents

32. Notice of Audit Stacia Ellis Compliance Program Coordinator

33. Notice of Audit Letter Compliance Monitoring Authority Letter Audit Team Biographies Confidentiality Agreements Notice of Compliance Audit Packet

34. Certification Letter Pre-Audit Data Requests Pre-Audit Survey Audit Scope and WECC RSAWs Notice of Compliance Audit Packet

35. 90-Day Notice of Audit Letter • Details of your specific Audit • Dates of Audit • Audit Scope • Due Dates • Audit Team Composition, observers (if applicable) • Observers can include FERC/NERC • Date/time of proposed Pre-Audit Conference Call • Opening Presentation Suggestions Notice of Compliance Audit Letter

36. Audit Team Composition • Primary Audit Team • Individuals expected to participate in the Audit • Alternate Audit Team • Individuals available to act as backup or replacements for Primary Team members Notice of Compliance Audit Letter

37. Attachment A • Informational; Explanation of Compliance Monitoring Authority • Attachment B • Short Biographies of the WECC Audit Staff • Attachment C • Signed Confidentiality Agreements of the WECC Audit Staff Attachments A, B and C

38. Attachment D • Audit Scope • RSAWs (Reliability Standard Audit Worksheets) • Customized for your Entity and your audit • Based on your Registered Functions and Audit Scope • Attachment E • Certification Letter • Must be printed on your company letterhead and signed by an Authorized Officer • Certifies that the information being provided for the Audit is accurate Attachments D and E

39. Attachment F • Pre-Audit Survey • Verify contact information • Audit Logistics • List any delegation agreements • Signed by Authorized Officer • Please complete all applicable fields Attachment F

40. Attachment G • Pre-Audit Data Requests • Why are we doing this to you?!? • Clarifications for data submittals • Specifying types of evidence to remove some of the guesswork Attachment G

41. Some evidence may apply to more than one Standard • One copy is sufficient, but document inventories or “roadmaps” are appreciated • Single Line Diagram • Requested for the majority of Audits Att G – Operations & Planning (O&P) Data

42. CIP-004 – CIP-009 may not be applicable based upon the Critical Asset/Critical Cyber Asset determination • Determined by CIP-002-3 Requirements 2 & 3 • Complete RSAWs indicating absence of CA/CCA identification • 2015 CIP audits will include CIP v5 outreach If you have any questions please contact Brent Castagnetto at bcastagnetto@wecc.bizor 801-819-7627 Att G – Cyber Security (CIP) Data

43. Attachment H • Audit Feedback • Now sending with initial package • Feedback is encouraged for all phases of audit. Attachment H

44. Audit Periods, for O&P and CIP, are clearly defined in Attachment G for both: • Operations and Planning (O&P) • Cyber Security (CIP) Audit Periods Defined

45. 3 year cycle Entities registered as a: • Balancing Authority (BA) • Transmission Operator (TOP) or • Reliability Coordinator (RC) • All others • Generally a 6 year cycle. Subject to flexibility in the future as part of NERC’s Reliability Assurance Initiative (RAI). Audit Frequency

46. “Howdy Call” • A few days after Notice of Audit Packet is uploaded to the EFT Server. Outreach

47. Know the Reliability Standards • Use the RSAWs as guides • Ask questions • Participate in Outreach (CUG/CIPUG) • We are here for you… • Questions • Comments • Concerns Recommendations

48. Audit Approach and Best Evidence William Fletcher Senior Compliance Auditor, Operations and Planning

49. Primary difference is: • Location of audit conduct • Scope is typically smaller for off site. • On-Site – Required for RC, BA, TOP functions • Per NERC Rules of Procedure 403.11.2 Compliance Audit (on-site vs. off-site)

50. On-Site • Documentation sent to WECC before audit for preliminary review • The audit team reviews evidence during off-site week or the first week of the audit and completes its review during the second week or on-site week • Data Requests or DRs • In-person interviews for clarification • Off-Site • Documentation sent to WECC before audit for preliminary review • Data Requests or DRs • Entity may be present at audit if desired • Telephone interviews for clarification Compliance Audit (on-site vs. off-site)