FERC Security Program 

Requirements and Cyber Brief

March 14, 2018

1
FERC Security Program 

Requirements and Cyber Brief

***Presentation to begin at 1:35***

2
Introduction

• D2SI Security Team

– Nadim Kaade, Liza Velez, and Justin Smith

• Cyber Security Specialist

– Barry Kuehnle

• DHS Special Guests

3
Discussion Points • Ground rules

• DHS NCCIC Brief

• Documentation Labeling Guidelines 

• Annual Security Compliance Certification Letter Template 

• Field Documents – (Request for Additional Info)

• Revision 3A/3B

• Lessons Learned - 2017 Season

• Cyber Security (Barry)

• Licensee Expectation – 2018 Season

• 2018 DHS Information Sharing Drill

• Homeland Security Information Network (HSIN)

• Suspicious Activity Reporting (SARs)

• UAS at Critical Infrastructure 

• Good Physical Security Practices

• Regional Office Security SMEs 

• Final Thoughts

4
Ground Rules

• DHS ICS-CERT – 1-hr including Q&A

• FERC – 30mins with time for Q&A 

• Type questions into WebEx at presentation’s end

5
6

Department of Homeland Security

National Cyber Security and Communications 

Integration Center
Documentation Labelling 

• Guidelines for the Protection of Sensitive Information

• CEII documents should be labeled on each page as:

– Header only: CUI//CEII

• Privileged documents should be labeled on each page as:

– Header only: CUI//PRIV

• Security Documents (SP, VA/SA, IERRR) should be labeled as: 

– Header: CUI//CEII/PRIV

– Footer: Security Sensitive Material

• Cybersecurity Documents should be labeled as: 

– Header: CUI//CEII/PRIV

– Footer: Security Sensitive Material

7
Annual Security Compliance Certification Letter Template

8

DO NOT E-FILE!

DO NOT E-FILE!

DO NOT E-FILE!
Field Documents

1. Complete Security Checklists (physical and cyber) 

2. Provide physical security checklists to engineer

3. Provide cyber asset spreadsheet, if necessary

4. Have VA, SA, SP, IERRR, Cyber Security Checklist 

available for review

5. Provide 2017 Annual Certification letter for review

9
Revision 3A/3B Changes

• March 2018 – New document labelling in effect –

Guidelines for Protection of Sensitive Information

• New Sec. Cert. Letter Template (due 12/31 – do not 

e-File)

• Request for additional information 

(checklist/spreadsheet)

10
Reminder

11

• Group 1, 2 dams:

– National Terrorism Advisory System (Normal, Elevated, Imminent)

– SP requirements (annual update – revision sheet)

• Group 1 dams:

– VA requirements (5 year re-evaluation/reprint, annual update)

– Evaluate 5 DBT for each critical asset 

• Group 2 dams:

– SA requirements (10 year re-evaluation/reprint, annual update)

– Use of generic threat to baseline assess security

Physical Security
Reminder

12

• “Baseline” or “Enhanced” cyber security measures 

implemented.

• Request for Extension was due by June 2017.

• Review annually for changes in connectivity.

• Keep your inventory up-to-date!

Cyber Security
Updated Cyber Asset Designation 

Flowchart – Rev 3B

13

*Use this flowchart to determine whether or not you have cyber assets at your facility.
• Security Documentation – Should be Prescriptive rather than 

Descriptive

• Complete Cyber Checklists and Cyber Asset Spreadsheet 

• If NERC, Cyber Assets must be NERC regulated, not NERC 

criteria (unless medium/high impact criteria)

• Interconnected Facilities (Group 1, 2, and 3)

• DHS Protective Security Advisor (PSA) assessments would 

still need to fulfill FERC requirements

• Describe rationale for NC/Operational/Critical

14

Lessons Learned – 2017 Season
• https://www.ferc.gov/media/news-releases/2017/2017-4/10-06-17.asp

15

OER Public Report 

(Barry Kuehnle)
• Baseline/Enhanced Cyber Security Measures Fully 

Implemented 

• FERC Hydro Security Checklist (v5)

- Continue to complete and provide checklist (hard copy) to 

FERC Inspector

• NERC/D2SI assets 

- Have NERC documents and audit results/recommendations 

available for review

• Updated Security Documentation for Current Year

16

Licensee Expectation – 2018 Season
• Date: February 6 – 7, 2018, Hot Wash February 8, 2018

• Participation through HSIN and FERC

• Good number of Participation – 37 Licensees

• Strengths – Realistic (scenarios, delivery time, number of 

injects were appropriate, good response back from licensees) 

• Weaknesses – System malfunction (HSIN, video clips), 

emergency teleconferences should’ve been conducted earlier

• Group 1 dams to gain credit – state on annual security 

compliance certification letter 

17

2018 DHS Information Sharing Drill
Suspicious Activity Report (SAR)

• Report All Suspicious Activities (physical and cyber) to Local, State, and 

Federal Law Enforcement

• Evaluate physical protection of cyber systems, also

• Complete FERC SAR form and email to your Project Engineer 

http://www.ferc.gov/industries/hydropower/safety/guidelines/security/secur

ity.pdf (pages 58 - 61)

• Keep track of all SARs (track history and trend)

• Report to HSIN (account required – optional, FERC can report for you)

18
HSIN Account Request

• Send email request to damsportal@hq.dhs.gov

• DHS will send instructions with application form

• Once approved, gain access to:

– Free online training 

– Free security guidelines (physical and cyber)

– Access to all SARs

– Access to Threat Bulletins

– Access to Information Sharing Drill 

19

Suspicious Activity Report (SAR)
20

UAS at Critical Infrastructure
21

UAS at Critical Infrastructure

https://www.dhs.gov/sites/default/files/publications/uas-ci-drone-pocket-card-112017-508.pdf 
 At the perimeter

 Fence line minimum 6 ft. w/1 ft. top guard facing 45 degrees outward (industry standard)

 No large gaps you can slip through

 Tension wire is present & intact 

 No trees overhang or are growing into fence

 Foliage is 10’ offset on both sides of fence

 Gate openings can’t be pushed to create gap

 Fence hardware intact (tact welded, etc.)

 Around the powerhouse

 Cracked doors, windows, & roll-up bays should be protected (summer heat)

 PLCs should have pass code or physically protected

 Hinges inside or tack welds are best

 Cameras/sensors inside and out

 Roof access should be protected (locked) from inside

 All wires should be in conduits and junction boxes locked

 No gap to pick lock/deadbolt (susceptible to shimming, jimmying, prying, etc.) 

22

Good Physical Security Practices
 At the spillway gates

 Controls to motors locked

 Power source protected

 Maintenance hatch locked

 At all access points (e.g. road leading to dam)

 Access Control (e.g. gates, locks, card readers, turnstiles, escorted access, etc.) 

 Cameras and/or sensors

 Controlled access for ATVs, dirt bikes, etc.

 Additional measures to be deployed at increased threat levels (e.g. jersey barriers, 

armed guards, law enforcement, etc.)

 Pedestrian vs. vehicular traffic controlled

 Waterside of the dam (and PH) – almost always the most vulnerable

 Boat barriers – public safety & line of demarcation

 Controlled access to spillway/intake gate or powerhouse 

23

Good Physical Security Practices
Final Thoughts

• Licensee Expectations 

– Baseline/Enhanced Measures Implemented by Dec 2017

– Complete Physical Security Checklist 

– Complete Cyber Asset Designation Spreadsheet, if necessary

– Security Documents to be more prescriptive (DO NOT E-FILE)

• HSIN Accounts 

– Report Suspicious activity to local, state, and federal law enforcement agencies

• Document Labelling

– CUI//CEII, CUI//PRIV, CUI//CEII/PRIV (alphabetical order)

• Group 1 participants in DHS exercise

– State on annual security compliance

– Remove any security info from an EAP exercise submittal 24
Questions?

25
Please complete the Survey!

26

(end of presentation)