On May 23, 2024, FERC approved the North American Electric Reliability Corporation’s (“NERC”) proposed Critical Infrastructure Protection (“CIP”) Reliability Standard, CIP-012-2 (Cyber Security – Communications between Control Centers), which is intended to improve upon and expand existing reliability standards to mitigate risks posed by loss of availability of communication links and certain data transmitted between bulk electric system (“BES”) Control Centers. FERC also approved NERC’s associated implementation plan, violation risk factors and violation severity levels, and the retirement of Reliability Standard CIP-012-1.
In Order No. 866, FERC directed NERC to amend the CIP Reliability Standards to implement protections concerning the availability of communication links and sensitive data communicated between BES Control Centers. On January 31, 2024, NERC filed a petition seeking approval of proposed Reliability Standard CIP‑012-2, which adds two new provisions to Requirement R1 that require protections for the availability of data in transit and protections to initiate recovery of lost communication links between Control Centers. NERC also requested approval of the associated implementation plan, violation risk factors and violation severity levels, and the retirement of Reliability Standard CIP-012-1 immediately before the effective date of CIP-012-2.
FERC approved Reliability Standard CIP‑012-2 as consistent with the Commission’s directive in Order No. 866. Specifically, FERC found that Reliability Standard CIP-012-2 improves and expands the protections mandated by Reliability Standard CIP-012-1 by requiring responsible entities to mitigate the risk posed by loss of availability of communication links and Real-time Assessment and Real-time monitoring data transmitted between Control Centers. FERC also approved the associated implementation plan, acknowledging that it provides responsible entities with sufficient time to implement new controls and collaborate with other entities that own or operate Control Centers as required in Reliability Standard CIP-012-2. FERC also approved the retirement of the currently effective Reliability Standard CIP-012-1 immediately prior to the effective date of Reliability Standard CIP-012-2.
FERC’s order, issued in Docket No. RD24-3, can be found here.