On January 20, 2011, the Federal Energy Regulatory Commission (“FERC” or the “Commission”) conditionally approved the Violation Risk Factors (“VRF”) and Violations Severity Levels (“VSL”) for version 2 and 3 of the Critical Infrastructure Protection (“CIP”) reliability standards. The CIP standards encompass many security concerns including sabotage reporting and cyber security. The VRF represents pre-violation potential risk to the bulk power system a standard would pose if violated. A VSL is a post-violation measure of the severity of the violation. The VSL and VRF are combined to help NERC establish base penalty ranges for particular violations.
The North American Electric Reliability Corporation (“NERC), as the certified Electric Reliability Organization, filed version 2 CIP standards on May 22, 2009. In that filing, NERC stated it would submit revised VRFs and VSLs by the end of the year as part of a plan to revise CIP reliability standards. On December 18, 2009, NERC submitted proposed VRFs and VSLs to address version 2 CIP-002-2 through CIP-009-2. Version 2 included twenty-six VRFs and thirty-six VSLs for consideration.
In addition, in an effort to address an earlier compliance filing, NERC submitted version 3 of CIP reliability standards; however, version 1 VSLs were not approved by FERC until March 18, 2010. The version 3 submittal included eight proposed VRFs. Three of those VRFs significantly modified their version 2 counterparts, and added two new sub-parts to two requirements. NERC also submitted thirty-six sets of VSLs to correspond with VRFs.
FERC approved version 2 VRFs, with the exception of a modification to CIP-003-2, and assigned the VRFs an effective date of April 1, 2010, the same date that the version 2 CIP standards became effective. The version 2 VSLs were also assigned the same effective date, but FERC ordered modifications where the version 2 VSLs had almost identical language to version 1. FERC then directed modifications to specific standards in order to conform with previously issued FERC guidelines on VSLs.
Version 3 will have the effective date of October 1, 2010, the date that the version 3 CIP standards became effective. Version 3 VSLs were also given an effective date of October 1, 2010. Also, FERC granted a NERC request to carry forward some version 2 requirements, but the Commission did also direct NERC to revise VSLs to account for newly created CIP-006-3 R1.6.1. and R1.6.2.