March (pdf) - New York Power Authority

March 29, 2011
8. NERC Reliability Standards Compliance Security Upgrades –
Capital Expenditure Authorization Request
SUMMARY
The President and Chief Executive Officer submitted the following report:
“The Trustees are requested to authorize a Capital Expenditure Authorization Request (‘CEAR’) in the
amount of $8.4 million for the North American Electric Reliability Corporation (‘NERC’) Reliability Standards
Compliance security upgrades at various Authority facilities over the next three years.
BACKGROUND
“In accordance with the Authority’s Expenditure Authorization Procedures, Trustees’ approval is required
for capital expenditures in excess of $3 million.
“NERC is the Electric Reliability Organization certified by the Federal Energy Regulatory Commission
(‘FERC’) to establish and enforce reliability standards to ensure the reliability of the bulk-power system in North
America. NERC Reliability Standards are mandatory for users, owners and operators of the bulk-power system.
The Authority is registered as a Generation Owner, Generation Operator, Transmission Owner, Purchasing and
Selling Entity and Load Serving Entity with NERC and, therefore, must comply with the applicable NERC
Reliability Standards.
“NERC’s Critical Infrastructure Protection (‘CIP’) reliability standards are a subset of the NERC
Reliability Standards which define the requirements for protecting critical assets and critical cyber assets used in the
bulk-power system and the systems that support those assets. NERC CIP consists of nine standards covering security
of electronic perimeters, physical security of cyber assets, disaster recovery, personnel and training and security
management.
“One of NERC’s statutory roles is to conduct periodic, independent assessments of the reliability and
adequacy of the bulk-power system in North America. NERC has a rigorous program of monitoring, audits and
investigations and the imposition of financial penalties and other enforcement actions for non-compliance with its
Reliability Standards. Fines and civil penalties can be up to $1 million dollars per day, per violation. NERC also
issues recommendations that require specific actions be taken by registered entities.
“This CEAR is for security upgrades to implement the NERC CIP Reliability Standard requirements, as
well as electronic and physical security mitigation measures at various Authority facilities over the next three years
as part of Phase I.
“Other NERC mandates are being evaluated separately with O&M funding. Remediation of concerns
encountered subsequent to the evaluation will require additional funding. Any future NERC mandates will also
require additional funding.
DISCUSSION
“NERC Reliability Standards, including the NERC CIP Standards, apply to entities that are owners,
operators and users of any portion of the bulk-power system that materially impact the reliability of the system. As
a registered generator owner, generator operator, and transmission owner, the Authority must comply with the
applicable NERC Reliability Standards.
“The Authority has performed a review of existing critical assets, critical cyber assets and Information
Technology (‘IT’) infrastructure at its generation and transmission facilities to identify a number of security
upgrades (both physical and cyber) that are required for the Authority to be compliant with applicable NERC CIP
Standards. The review resulted in a need for the following NERC CIP related upgrades:
63