Some Regional Entities are issuing notices of revocation to entities with Low Impact Control Centers (LICC) who had previously received letters that exempted their Control Center as Medium Impact under CIP-002-5.1a, Impact Rating Criterion 2.12.

What is and isn’t a control center has been an issue for some time. Initially when Criterion 2.12 was written, smaller entities were surprised to find they were suddenly included in the full scope of Critical Infrastructure Protection as Medium Impact Entities. NERC staff quickly issued guidance as to how many miles of transmission was controlled to determine who was Medium Impact and who wasn't.

NERC Beta Criteria:

• Does the TO control facility operate at least two geographically separate Transmission Facilities?
• Do any of the transmission Facilities operated by the Transmission Owner’s Control Centers operate at or greater than 200 kV?
• Does the Transmission Owner Control 1500 MVA or more of transmission capacity at BES transmission Facilities?
• Does the Transmission Owner operate 200 miles or more of transmission line?
• Has the Transmission Owner been notified by its RC, PC, or TP as having a Facility, controlled by the Transmission Owner’s Control Centers that is critical to the derivation of Interconnection Reliability Operating Limits (IROLs) and their associated contingencies?

Proposed CIP-002-6 Criteria 2.12 (applicability).

Each Control Center or backup Control Center, not included in the High Impact Rating, used to perform the reliability tasks of a Transmission Operator in real-time to monitor and control BES Transmission Lines with an "aggregate weighted value" exceeding 6000 according to the table at the right. The "aggregate weighted value" for a Control Center or backup Control Center is determined by summing the "weight value per line" shown in the table at the right for each BES Transmission Line monitored and controlled by the Control Center or backup Control Center.

CIP-002-6 was withdrawn by NERC from FERC approval to revisit the standard in the light of the recent cyber-attacks and other security concerns. The canceling of previous exemptions are an example of revisiting those security concerns.

If a Registered Entity with an existing exemption letter regarding its control center and its Low Impact classification receives a notice proposing to revoke that exemption, one of two things should happen:

• The Registered Entity should carefully review the existing criteria for both Low Impact operations and the approved definition of Control Center. The exemption letter may be irrelevant and may not have been needed in the first place. The Low ​​​​Impact classification may still be valid with or without the exemption.
• Prepare to transition to the requirements of a Medium Impact entity with its associated planning, budget, procedure, and training requirements.

A two-year transition period has been proposed which seems about right. That gives the new Medium Impact entity two years for all processes, procedures, and training to be budgeted, drafted, approved, tested, and implemented. For some, two years might be tight.

I'd love to hear your thoughts on the changes and timeframe!