•
– FERC thought Risk Based Methodologies used by entities were not uniformly applied- order 706
– Used Bright Line Criteria to have more high level assets identified as Critical
– Kiss my Risk Based Methodology good bye

•
– Generation
– Transmission
– Control Centers
•

CIP-002-4 Attachment 1*
Criteria used to determine Critical Assets
* Also refer to document: CIP-002-4- Cyber Security- Critical Cyber Asset Identification Rationale and Implementation reference Document

•
(i.e. 1500MWs deliverable to the interconnection)
– Single location
• In a defined physical footprint (as evident by)
– Common fence
– Common entry point
– Shared common facilities
– Common management organization
– Similar naming convention (plant name - #)
Includes Nukes
• Connected to a single Interconnection*
* the three major electric system networks in North America: Eastern,
Western, and ERCOT. NERC Glossary- definition used when capitalized
† where multiple net Real Power Capability can be used the highest value is judged against the Bright line criteria.

– Taken from Contingency Reserve requirements of
BAL-002
• Makes sure BA has enough Contingency Reserves to return
Interconnection frequency back to limits following a
“Reportable Disturbance”
• The BA or Reserve Sharing Group must maintain enough
Contingency Reserve to cover the single most severe contingency.
• 1500 MWs was derived from various BAs in the all regions as the most significant Contingency reserves.
• Figure could be verified through MOD- 024, Verification of
Generator Gross and Net Real Power Capability which has to be given to SPP Model Development Group

•
– Intent is to identify common mode vulnerabilities
• Identify all cyber assets that collectively control/ impact the 1500MWs of generation.
– Cyber Assets- Programmable electronic devices and communication networks that use a routable protocol.
Includes Hardware, Software and data.
• Need to consider all facilities and systems up to the point where interconnected to the transmission system.
– Has to be able to impact Bulk Electric System within 15 minutes

•
– Cyber Asset has to be able to impact Bulk Electric
System Operation within 15 minutes to be Critical
• More than 15 minutes should give enough time to detect and remediate
– Example of Cyber Assets controlling the coal fuel supply for a coal plant. May have enough time to correct situation before it affects real time condition.

•
– Excludes Generators
– Net Reactive Power Nameplate Rating
– Single Location evident by
• Common fence
• Common entry point
• Shared common facilities
• Common management organization
• Similar naming convention (name - #)

– Within Long-term planning horizon
• Time Horizon described in NERC’s “Time Horizons”
– Defines long term planning horizon as one year or longer
– Planning Coordinator (if none designated then Trans. Planner)
• Identifies generator as a “Reliability Must Run” unit
– Must Run for reliability beyond the local area
– Not generators for Voltage Support within local area
• Not apart of generators designated as “Must Run” for market
– Examples are:
• Category C3 in TPL-003

• Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES
– Examples are:
• Category C3 in TPL-003 – Loss of two or more elements
– Single Line to Ground (SLG) or 3 Phase Fault with Normal
Clearing of
» Generator, Transmission Circuit, Transformer or Single
Pole (dc) Line
– Manual System Adjustment
– Followed by another SLG or 3Φ fault with Normal Clearing of
» Generator, Transmission Circuit, or Transformer
– System Stable; Voltage/Thermal Limits within range
– Can shed load or curtail Firm Transfers
– No Cascading Outages

• Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES
– Another Example given:
• Category D in TPL-004 – Loss of two or more elements or Cascading out of service
– 3 Phase Fault with Delayed Clearing (stuck breaker or protection system)
» Generator, Transmission Circuit, Transformer or Bus Section
– 3 Phase Fault with Normal Clearing
» Breaker (failure or internal fault)
– Loss of tower with 3 or more circuits
– All Transmission lines in a common ROW
– Loss of substation (1 voltage level and transformers)
– Loss of all generation at one station
– Loss of major load or major load center
– Special Protection System or remedial action scheme
» Failure to operate when required
» Operation, partial operation or misoperation not intended to operate
– Disturbances in another Region
» Impact of power swings
» Oscillations
• Evaluate for Cascading outages, Substantial Customer Demand or generation loss in a widespread area.

• Planning Coordinator or Transmission Planner designates as providing an adverse impact to BES
– Definitions within categories
• Normal Clearing
– Normal clearing is when the protection system operates as designed and the Fault is cleared in the time normally expected with proper functioning of the installed protection systems.
Delayed clearing of a Fault is due to failure of any protection system component such as a relay, circuit breaker, or current transformer, and not because of an intentional design delay.
• Planned or controlled loss of demand or curtailed Firm transfers
– Depending on system design and expected system impacts, the controlled interruption of electric supply to customers (load shedding), the planned removal from service of certain generators, and/or the curtailment of contracted Firm (nonrecallable reserved) electric power transfers may be necessary to maintain the overall reliability of the interconnected transmission systems.
• Category D Extreme Events
– A number of extreme contingencies that are listed under Category D and judged to be critical by the transmission planning entity(ies) will be selected for evaluation. It is not expected that all possible facility outages under each listed contingency of Category D will be evaluated.

- Black Start Units
- Listed in restoration plans of EOP-005-2

• BlackStart Cranking Path
– Facilities from initial switching of BlackStart unit to
• 1 st interconnection point of 1 st generator to be started
• Where two or more path options exits in restoration plan
Generator
Path 1
Substation
Path 2
1 st
Generator
Cranking Path Black Start
Unit
Substation
Cranking Path Black Start
Unit

• Any Transmission Facility
– At a substation
– Operated at 500KV or greater
Discussion on Collector bus ‡
• Collector bus at a Non-Critical Asset Generation plant
– i.e. not aggregate of 1500MWs as in 1.1
– Operated at 500KV or greater
– Bus is considered a generation facility not transmission
– Collector bus would not be considered a Critical Asset
‡Collector bus is the low voltage side of a step-up Xfrmr connected to a generator where real & real reactive power is collected

• Transmission Facilities operated within a substation
• Substation interconnected at >= 300KV to
• 3 or more substations
– Ensures that level of impact is deemed appropriate
Note: 300KV facilities
Critical
Asset

• Designated by Reliability Coordinator (SPP), Planning
Authority, Transmission Planner
– Transmission Facilities deemed critical to derive IROLs & Associated
Contingencies
• The region and member planners determine the contingencies and conditions that bring the system to the edge of reliable operations and then gather the values from the model runs.
• What’s an IROL?
– Interconnection Reliability Operating Limit
• The value (e.g. MW, MVAR, Hz, etc.) derived from/ subset of the System Operating limits* such if exceeded could lead to wide spread Bulk Electric System instability, cascading outages, or uncontrolled separation.
* SOL (System Operating Limits) – Values by which the Bulk Electric System can be reliably operated. Criteria/Methodologies are established to determine these limits both pre and post contingency.
Bottom Line-> Beyond these limits the BES can’t be counted on to deliver power in a reliable manner

• System composed of static equipment
– Used in the transmission of electrical energy
– Enhances controllability and increase power transfer capability
– Power Electronics based system
• Reliability Coordinator, Planning Authority, or Transmission
Planning has to designate them as a Critical Asset.
– Must be critical to the deviation of an IROL
– Or associated contingencies

Transmission Facilities for Gen interconnection
• Transmission Facilities for which if “ something happened ”* would prevent
Critical Generation from connecting to the Transmission System
– Applicable to generation at a single location >= 1500MWs (1.1)
– Generation designated by Planning Coordinator or Transmission
Planner to avoid BES adverse reliability Impacts in the long-term planning horizon. (one year or more) (1.3)
– Ensures that Critical Generation can connect to Transmission System
Or any Critically deemed generation
Line
Interconnecting
Substation
Line
Line
Unit 3
Unit 2
Unit 1
> 1500MWs
Line
* something happened- destroyed, degraded, misused, or otherwise rendered unavailable .
. Yada yada

1.11 Transmission Facilities that interconnect Nuclear Plants
• Transmission Facilities identified as necessary to meet Nuclear
Plant Interface Requirements (NPIR)
• Based on Standard NUC-001
– Ensures the reliability of the NPIR by the coordination between the generator owner/operator and the transmission provider

• Special Protection System(SPS), Remedial Action Scheme
(RAS), or Automated Switching System ()
• That operates Bulk Electric System Elements that if something happened *
– Cause one or more element to exceed an IROL  due to a failure to operate as designed
» It operated outside of design parameters
» Didn’t provide the function in the proper time frame
– Compromise of these systems would have Wide Area impacts
– Want to ensure that BES operates with the IROL
 Interconnection Reliability Operation Limit- Value limit that a Critical
System element may operate while maintaining system reliability.
* something happened- destroyed, degraded, misused, or otherwise rendered unavailable .
. Yada yada

• Any System or Facility
• Performs automatic load shedding without human initiation, even if it requires a human to arm it
• >= 300MWs as required by regional load shedding program
– Under Voltage Load Shedding (UVLS)
– Under Frequency Load Shedding (UFLS)
– Those 300MW systems which require human arming to operate automatically should be considered as Critical
• Why is this level lower than 1500MWs?
– The UVLS and UFLS conditions represent the last ditch efforts to save the
Bulk Electric System

• Control Centers perform control functions for multiple BES
(Bulk Electric System) elements
– These facilities are deemed to be Control Centers
• Facilities that perform control functions for a single BES element
– Considered to be apart of that asset
• Example
– Control room for a single Generation plant or Transmission
Substation
– Not considered to be a Control Center
• Control Centers that delegate functional obligations to another location
– Are also considered to be a Control Center. (A Control Center’s functional control center)
• Note that Data Centers not located with a control center may be considered as essential to it operations and hence a Critical Asset

• Each Control and Back-up Control Center
– Performs functional obligations of the Reliability Coordinator (RC)

• Each Control and Back-up Control Center
– Used to control generation at multiple locations
– Generation Control Centers that control generation assets identified in criteria 1.1, 1.3 or 1.4
• (1.1) Generation at a single location, connected to a single
Interconnection, and has a total Net Real Power >= 1500MWs
• (1.3) Designated Generator: Planning Coordinator or Transmission
Planner deems this unit as one whose operation is necessary to the reliable operation of the BES
• (1.4) Black Start units

• Each Control and Back-up Control Center
– Used to carry out obligations of Transmission Operator
– Transmission Control Centers that control at least one
Transmission asset identified in criteria 1.2, 1.5 – 1.12
• (1.2) Reactive Resources >= 1000MVARs
• (1.5) Black Start Cranking Paths
• (1.6) Transmission Facilities >= 500KV
• (1.7) Transmission Facilities >= 300KV connected to 3 or more >=
300KV Transmission Substations
• (1.8) IROL Transmission Substations
• (1.9) Flexible AC Transmission Systems (FACTS)
• (1.10) Transmission Facilities that interconnect Gen >= 1500MWs
• (1.11) Transmission Facilities that interconnect Nuke Plants
• (1.12) Systems controlling IROLs. SPS, RAS, Automatic Switching

• Each Control and Back-up Control Center
– Used to carry out obligations of the Balancing Authority
• Balancing Authority with >=1500MWs in a single Interconnection
– Consistent with 1.1
– Balancing Authority Control Centers that control at least one asset identified in criteria 1.1, 1.3, 1.4 or 1.13
• (1.1) Generation at a single location, connected to a single
Interconnection, and has a total Net Real Power >= 1500MWs
• (1.3) Designated Generator: Planning Coordinator or Transmission
Planner deems this unit as one whose operation is necessary to the reliable operation of the BES
• (1.4) Black Start units
• (1.13) Automatic Load Shedding Systems >= 300MWs