170 FERC ¶ 61,029

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

Before Commissioners: Neil Chatterjee, Chairman;

 Richard Glick and Bernard L. McNamee.

North American Electric Reliability Corporation Docket No. RR19-7-000

ORDER ON FIVE-YEAR PERFORMANCE ASSESSMENT

(Issued January 23, 2020)

On July 22, 2019, North American Electric Reliability Corporation (NERC) filed 

its Five-Year Electric Reliability Organization Performance Assessment Report 

(Performance Assessment) in accordance with the requirements of the Commission’s

regulations.1

 In the Performance Assessment NERC discusses whether and how it 

satisfies the criteria for Electric Reliability Organization (ERO) certification under 

18 C.F.R. § 39.3(b), evaluates the effectiveness of each Regional Entity in carrying out 

its delegated functions, and addresses stakeholder comments on NERC’s Performance 

Assessment. NERC highlights activities and accomplishments demonstrating how the 

ERO is improving the performance of, and mitigating risks to, the Bulk-Power System as 

related to avoidable outages. NERC also highlights how its compliance monitoring and 

enforcement program (CMEP) has matured to provide industry with greater consistency 

in actions, outcomes, and reliability consequences. 

In this order, we accept NERC’s Performance Assessment, find that NERC 

continues to satisfy the statutory and regulatory criteria for certification as the ERO, and 

find that the Regional Entities continue to satisfy applicable statutory and regulatory 

criteria. In addition, we find that NERC should take several actions to continue 

improving its performance as the ERO. Specifically, we direct NERC to submit a 

compliance filing within ninety (90) days of the date of this order providing additional 

information and a second compliance filing within 180 days revising its Rules of 

Procedure to address specific matters as discussed in this order. These action items 

provide practical steps to improve the effectiveness of the ERO and Regional Entity 

functions and programs, as well as the quality of NERC’s performance assessment 

process going forward. These action items address important areas of concern such as:

NERC’s oversight activities; guidance development process; Electricity Information 

 1 18 C.F.R. § 39.3(c) (2019).
Docket No. RR19-7-000 - 2 -

Sharing and Analysis Center (E-ISAC); accuracy in the ERO Rules of Procedure; and 

organization certification program.

I. Background

A. Section 215 of the Federal Power Act

Section 215 of the Federal Power Act (FPA) requires the Commission to issue 

regulations that, among other things, provide for certification of an entity as the ERO if it 

meets certain criteria.2

 Specifically, FPA section 215(c) establishes that an ERO 

candidate must have the ability to develop and enforce mandatory Reliability Standards 

that provide for an adequate level of reliability of the Bulk-Power System.3

 The statute 

also requires that an ERO candidate have established rules that: (1) assure independence, 

while assuring fair stakeholder representation and balanced decision-making; 

(2) equitably allocate reasonable dues, fees, and other charges; (3) provide fair and 

impartial procedures for enforcing Reliability Standards through imposition of penalties; 

(4) provide reasonable notice and opportunity for public comment, due process, and 

balance in developing Reliability Standards and otherwise exercising its duties; and 

(5) provide appropriate steps to gain recognition in Canada and Mexico.

Additionally, FPA section 215(e)(4) provides that the ERO may delegate authority 

to a Regional Entity for the purpose of proposing regional Reliability Standards and 

enforcing Reliability Standards. Regional Entities must meet the same statutory criteria 

as those required for Commission certification of an ERO, except that more flexibility is 

allowed in the composition of a Regional Entity board of directors. The Commission 

must approve a delegation agreement between the ERO and a Regional Entity, and the 

Commission is authorized to modify such delegation.

B. Order No. 672

On February 3, 2006, the Commission issued Order No. 672, which, among other 

things, amended the Commission’s regulations to implement the requirements of FPA 

section 215.4

 Order No. 672 sets forth the process for certifying a single independent 

 2 16 U.S.C. § 824o.

3 Id. § 824o(c).

4 Rules Concerning Certification of the Electric Reliability Organization; and 

Procedures for the Establishment, Approval, and Enforcement of Electric Reliability 

Standards, Order No. 672, 114 FERC ¶ 61,104, at P 186, order on reh’g, Order No. 672-

A, 114 FERC ¶ 61,328 (2006).
Docket No. RR19-7-000 - 3 -

ERO to oversee the reliability of the United States’ portion of the interconnected North 

American Bulk-Power System, subject to Commission oversight. Further, in Order 

No. 672, the Commission mandated that the ERO submit periodic assessments of its 

performance that require the ERO to “affirmatively demonstrate to the Commission that 

it satisfies the statutory and regulatory criteria for an ERO and is not only maintaining but 

improving the quality of its activities and those of the Regional Entities to which it has 

delegated such activities.”5

In Order No. 672, the Commission also stated that the performance assessments 

should employ regular and systematic measurement and reporting of the ERO’s 

performance, including information regarding: (1) the ERO’s ability to develop and 

enforce Reliability Standards providing for an adequate level of reliability of the BulkPower System; (2) how the ERO effectively enforced Reliability Standards, including 

statistical information on its investigations, findings, and assessments of penalties, on a 

regional and continent-wide basis; and (3) how the ERO provided for fair and impartial 

procedures for enforcement of Reliability Standards and provided for openness, due 

process, and balance of interests in developing Reliability Standards.6

The specific requirements for the performance assessments are set out in the 

Commission’s regulations at 18 C.F.R. § 39.3(c) and provide that the ERO file an 

assessment of its performance three years from the date of initial certification, and every 

five years thereafter. Each performance assessment filing must include the following: 

(1) an explanation of how the ERO satisfies the requirements of § 39.3(b); 

(2) recommendations by Regional Entities, users, owners, and operators of the BulkPower System, and other interested parties for improvement of the ERO’s operations,

activities, oversight and procedures, and the ERO’s response to such recommendations;

and (3) the ERO’s evaluation of the effectiveness of each Regional Entity,

recommendations by the ERO, users, owners, and operators of the Bulk-Power System,

and other interested parties for improvement of the Regional Entity’s performance of 

delegated functions, and the Regional Entity’s response to such evaluation and 

recommendations.7

 

Order No. 672 explains that the performance assessment is neither “recertification” nor re-application for ERO status.8

 Nevertheless, the specific requirements 

 5 Order No. 672, 114 FERC ¶ 61,104 at P 186.

6 Id. P 189.

7 18 C.F.R. § 39.3(c).

8 Order No. 672, 114 FERC ¶ 61,104 at PP 186-191.
Docket No. RR19-7-000 - 4 -

in section 39.3(c)(2) of the Commission’s regulations explain that the Commission will 

review the performance assessments and may require follow-up actions by the ERO to 

comply or improve compliance with the statutory and regulatory qualifications for the 

ERO if the Commission determines that the ERO has not satisfied specific criteria. 

Moreover, that subsection requires the Commission to assess the performance of each 

Regional Entity and issue an order addressing Regional Entity compliance.9

C. Certification of NERC as the ERO

On July 20, 2006, the Commission certified NERC as the ERO for the continental 

United States under FPA section 215(c).10 The Commission found that NERC satisfied 

the criteria to be the ERO responsible for developing and enforcing mandatory Reliability 

Standards for the United States.

In April 2007, in accordance with FPA section 215(e)(4) and the Commission’s 

regulations at 18 C.F.R. § 39.8, NERC entered into a separate delegation agreement with 

each of the Regional Entities11 by which NERC delegated to them certain authority.12 

Specifically, NERC delegated authority to the Regional Entities to audit, investigate, and 

enforce compliance with NERC’s mandatory Reliability Standards by Bulk-Power 

System users, owners, and operators, subject to ERO oversight.13 In addition, the 

delegation agreements address such matters as: (1) regional Reliability Standards 

development; (2) registration of entities that must comply with Reliability Standards; and 

 9 18 C.F.R § 39.3(c)(2); see also Order No. 672, 114 FERC ¶ 61,104 at PP 33, 

187.

10 North American Electric Reliability Corp., 116 FERC ¶ 61,062 (ERO 

Certification Order), order on reh’g and compliance, 117 FERC ¶ 61,126 (2006), order 

on compliance, 118 FERC ¶ 61,030, order on compliance, 118 FERC ¶ 61,190, order on 

reh’g, 119 FERC ¶ 61,046 (2007), aff’d sub nom. Alcoa Inc. v. FERC, 564 F.3d 1342 

(D.C. Cir. 2009).

11 There are currently six Regional Entities: Midwest Reliability Organization 

(MRO); Northeast Power Coordinating Council, Inc. (NPCC); ReliabilityFirst

Corporation (RFC); SERC Reliability Corporation (SERC); Texas Reliability Entity 

(TRE); and Western Electricity Coordinating Council (WECC).

12 See North American Electric Reliability Corp., 119 FERC ¶ 61,060 (2007), 

order on reh’g, 120 FERC ¶ 61,260 (2007).

13 See Order No. 672, 114 FERC ¶ 61,104 at P 654.
Docket No. RR19-7-000 - 5 -

(3) other services supporting NERC’s statutory reliability functions, including reliability 

assessments, event analysis, and training and education.

D. Previous NERC Performance Assessments

This Performance Assessment is the third such assessment filed by NERC as the 

ERO. On July 20, 2009, NERC filed its Initial Performance Assessment in accordance 

with the Commission’s regulations.14 On September 16, 2010, the Commission accepted 

NERC’s Initial Performance Assessment and found that NERC continued to satisfy the 

statutory and regulatory criteria for ERO certification, and that each of the Regional 

Entities met the relevant statutory and regulatory criteria.15 The Commission also 

directed NERC to submit an informational filing to address specific concerns discussed in 

the 2010 Performance Assessment Order.16 Among other things, the Commission 

explained that according to Order No. 672, the purpose of the ERO’s performance 

assessments is not only to determine whether the ERO is satisfying the statutory criteria 

for certification, but also to identify areas in which the ERO can improve its performance. 

The Commission also noted that it sees the performance assessments as an opportunity 

not only to demonstrate that the ERO has maintained, but also is improving, the quality 

of its activities and those of the Regional Entities.17

On July 21, 2014, NERC filed its second performance assessment18 and on 

November 20, 2014, the Commission accepted the 2014 Performance Assessment finding 

that NERC continued to satisfy the statutory and regulatory requirements set forth in 

section 215(c) of the FPA and section 39.3(b) of the Commission’s regulations. While 

acknowledging improvements that NERC and the Regional Entities had made, the 

Commission identified opportunities for additional improvement. Among other things, 

the Commission identified opportunities for additional improvement in the role of NERC 

 14 North American Electric Reliability Corp., Docket No. RR09-7-000 (filed 

July 20, 2009) (Initial Performance Assessment).

15 North American Electric Reliability Corp., 132 FERC ¶ 61,217, at P 35 (2010) 

(2010 Performance Assessment Order). 

16 Id. P 1 and Appendix A.

17 Id. P 5 (citing Order No. 672, 114 FERC ¶ 61,104 at PP 186-188).

18 North American Electric Reliability Corp., Docket No. RR14-5-000 (filed 

July 21, 2014) (2014 Performance Assessment).
Docket No. RR19-7-000 - 6 -

technical staff feedback for Reliability Standard drafting teams,19 directed NERC to 

develop metrics for Reliability Standard development and enforcement processing,20 and 

directed NERC to include the original comments from interested stakeholders in its future 

performance assessment filings.21

II. 2019 NERC Five-Year Performance Assessment

On July 22, 2019, NERC submitted its Performance Assessment as required by the 

Commission’s regulations. NERC states that the Performance Assessment describes 

NERC’s efforts to maintain and improve the quality of its activities as the ERO while 

highlighting activities and achievements for the performance assessment period. NERC 

explains how it continues to meet the criteria for ERO certification under 18 C.F.R. § 

39.3(b), evaluates the effectiveness of each Regional Entity in carrying out its delegated 

functions, and addresses stakeholder comments on NERC’s performance as the ERO.

NERC highlights several initiatives implemented during the performance 

assessment period, explaining how they “better protect against risks to the [Bulk-Power 

System].”22 NERC explains that these programs address existing and emerging risks to 

reliability and asserts they have led to “improved resilience, decreased protection system 

misoperations, and advanced risk management for the [Bulk-Power System].”23

NERC’s Performance Assessment includes attachments that provide additional 

information that address: (1) how NERC meets the ERO certification criteria (Exhibit 

A); (2) how the Regional Entities meet the statutory and regulatory criteria for delegation

(Exhibit B); and (3) stakeholder comments in response to the April 2019 posting of the 

draft Performance Assessment (Exhibit C).

III. Notice and Responsive Pleadings

Notice of NERC’s filing was published in the Federal Register, 84 Fed. Reg. 

36,909 (2019), with interventions and protests due on or before August 22, 2019. Timely 

motions to intervene were filed by the National Rural Electric Cooperative Association, 

 19 North American Electric Reliability Corporation, 149 FERC ¶ 61,141, at P 39

(2014 Performance Assessment Order).

20 Id. P 2.

21 Id. P 42.

22 Performance Assessment at 4.

23 Id. at 3.
Docket No. RR19-7-000 - 7 -

American Public Power Association, Cooperative Energy, and Public Citizen, Inc. No 

comments were filed.

IV. Procedural Matters

Pursuant to Rule 214 of the Commission’s Rules of Practice and Procedure, 

18 C.F.R. § 385.214 (2019), the timely, unopposed motions to intervene serve to make 

the entities that filed the motions parties to this proceeding.24

V. Discussion

Under section 215(c) of the FPA and section 39.3(b)(1) of the Commission’s 

regulations, the ERO must demonstrate that it has the ability to develop and enforce 

Reliability Standards that provide for an adequate level of Bulk-Power System 

reliability.25 In addition, the ERO must show that it has established rules that: (1) assure 

independence, while assuring fair stakeholder representation and balanced decisionmaking; (2) equitably allocate reasonable dues, fees, and other charges; (3) provide fair 

and impartial procedures for enforcing Reliability Standards through imposition of 

penalties; (4) provide reasonable notice and opportunity for public comment, due process, 

and balance in developing Reliability Standards and otherwise exercising its duties; and 

(5) provide appropriate steps to gain recognition in Canada and Mexico.26

The ERO is also required under section 39.3(c)(1)(ii) of the Commission’s 

regulations to provide a response to recommendations by the Regional Entities and users, 

owners, and operators of the Bulk-Power System for improvement in the ERO’s 

operations. In addition, under section 39.3(c)(1)(iii), the ERO is required to evaluate 

each Regional Entity’s effectiveness, including how the Regional Entity responded to 

recommendations for improvement as suggested by the ERO and by users, owners, and 

operators of the Bulk-Power System.

As discussed below, we accept NERC’s Performance Assessment, finding that

NERC continues to satisfy the statutory and regulatory criteria for certification as the 

ERO, and find that the Regional Entities continue to satisfy applicable statutory and 

regulatory criteria. In addition, we find that NERC should take several actions to 

continue improving its performance as the ERO. Below, we discuss: (A) NERC’s 

satisfaction of the criteria for ERO certification; (B) NERC’s evaluation of the Regional 

Entities; and (C) areas for improvement. The latter category addresses the following 

 24 18 C.F.R. § 385.214 (2019). 

25 18 C.F.R. § 39.3(b)(1).

26 Id. § 39.3(b)(2).
Docket No. RR19-7-000 - 8 -

topics: (1) periodic Regional Entity audits; (2) NERC guidance documents; (3) E-ISAC 

oversight transparency; (4) NERC Sanction Guidelines; and (5) the organization 

certification program.

A. NERC’s Satisfaction of the Criteria for Certification as the ERO

Performance Assessment

NERC describes in its Performance Assessment how it satisfies the statutory and 

regulatory requirements for certification on an ongoing basis.27 NERC explains that it 

has navigated rapid changes in the electric industry and faced new challenges to the 

reliability and security of the Bulk-Power System by effectively identifying, prioritizing, 

and mitigating risks.28 NERC identifies new risks through a variety of mechanisms, 

including by using tools and analyzing data, such as through its Situational Awareness for 

FERC, NERC and the Regional Entities (SAFNR), Generator Availability Data System 

(GADS), and Transmission Availability Data System (TADS). NERC then uses 

technical standing committees and the Reliability Issues Steering Committee to prioritize 

and identify mechanisms to address those risks.

As the ERO, NERC states that it has implemented several initiatives during the 

performance assessment period to protect against risks to the Bulk-Power System. These 

initiatives have included, among other things: (1) identifying and assessing emerging 

risks; (2) addressing planning, cyber security, and physical security risks through 

Reliability Standards; (3) enhancing the capability of the E-ISAC; and (4) improving its 

oversight of the Regional Entities through consolidation and realignment and 

implementing the ERO Enterprise Program Alignment Process. NERC also provides an 

evaluation of the Regional Entities’ effectiveness at performing their delegated functions, 

as required by the Commission’s regulations.29

a. Development of Reliability Standards under Section 

39.3(b)(1)

In its Performance Assessment, NERC addresses how it satisfies the requirements 

of section 39.3(b) of the Commission’s regulations regarding NERC’s ability to develop 

 27 See Performance Assessment, Attachment A at 20-34.

28 Id. at 4.

29 18 C.F.R. § 39.3. 
Docket No. RR19-7-000 - 9 -

Reliability Standards that provide for an adequate level of reliability.30 NERC also 

describes improvements to its Reliability Standards development program over the 

performance assessment period.

31 Specifically, NERC highlights efforts to refine its 

approach in addressing reliability risks and in drafting Reliability Standards. These 

efforts include revisions to certain Reliability Standards in response to Commission 

directives and a continuation of efforts from the previous assessment period, such as the 

comprehensive review of all Reliability Standards by the Independent Experts Review 

Panel and Project 2013-02 Paragraph 81.

32

NERC describes its periodic review of Reliability Standards using a tool that 

grades its standards through a stakeholder process. These grades are then included in the

Reliability Standards Development Plan it files annually with the Commission.

33 NERC 

also explains that it reviews Reliability Standards through the Standards Efficiency 

Review that began in 2017. This project identifies Reliability Standard Requirements 

that are deemed “unnecessary or redundant” and thus appropriate to retire or modify if 

those retirements or modifications would not harm reliability. NERC adds that the first 

phase of the project is completed and focused on Operations and Planning Reliability 

Standards. Similarly, the second phase is evaluating Critical Infrastructure Protection

(CIP) Reliability Standard Requirements.34

Section 39.3(b)(1) of the Commission’s regulations requires that the ERO be able

to develop and enforce Reliability Standards that provide for an adequate level of BulkPower System reliability. NERC states that during the assessment period, it addressed 

gaps in reliability through several Reliability Standards projects. Specifically, NERC 

cites to the development of Reliability Standard CIP-014, addressing physical attacks to 

critical facilities; Reliability Standard TPL-007, addressing potential impacts on reliable 

operations due to geomagnetic disturbance events; one new and two revised Reliability 

Standards addressing supply chain risk management; Reliability Standard CIP-008,

broadening the requirements for mandatory cyber incident reporting; and Reliability 

 30 Performance Assessment, Attachment A at 1-9.

31 Id. at 22-25. 

32 Id. at 23.

33 Id. at 24. 

34 Id.
Docket No. RR19-7-000 - 10 -

Standard TPL-001-5 requiring, among other things, the study of the potential impacts of 

Protection System single points of failure.

35 

NERC also discusses its launch of initiatives to enhance the Reliability Standards 

development process. Responding to the Commission’s directive in the 2014 

Performance Assessment Order, NERC launched a pilot project to track the completion 

times of Reliability Standard projects as compared to the time for completion estimated at 

the start of projects.

36 NERC explains it has shifted its focus from the Commission’s 

standard modification directives and subsequent orders towards refining the existing 

Reliability Standards through the use of a tool that prioritizes the review of its existing 

Reliability Standards that are currently enforceable or subject to enforcement for one year

to determine whether they should be reaffirmed, revised, or withdrawn. As mentioned 

previously, NERC also initiated the Standards Efficiency Review in 2017 to retire or 

modify unnecessary or redundant Reliability Standard Requirements.37 NERC states it is 

also evaluating possible improvements to its Reliability Standards such as standardizing 

evidence retention, creating prototype Reliability Standards, and developing a repeatable 

process to determine whether to address an identified risk through the development of a 

voluntary guideline or a mandatory Reliability Standard.

b. Coordinating Budget and Strategic Planning

NERC explains that during the performance assessment period, it sought to align 

the annual business plans and budgets, risks, and strategic planning process across the 

ERO and six regions. NERC and the Regional Entities collaborate on an “ERO 

Enterprise Long-Term Strategy” that addresses risks in a five to seven-year period. This 

strategy informs the “ERO Enterprise Operating Plan” that identifies the shared vision, 

mission, core principals, and goals of NERC and the Regional Entities. The operating 

plan then guides the allocation of resources through the NERC and Regional Entity 

business plans and budgets. Finally, NERC and the Regional Entities have identified 

“ERO Enterprise Metrics” that provide benchmarks for the activities included in the 

business plans and budgets.

c. Compliance and Enforcement

NERC states that during the assessment period, it enhanced its CMEP by: 

(1) researching and identifying noncompliance trends; (2) maintaining transparency over 

the final disposition of noncompliance; and (3) increasing procedural efficiencies. NERC 

 35 Id. at 21.

36 Id. at 22.

37 Id. at 24.
Docket No. RR19-7-000 - 11 -

explains its Alignment Process collects discrepancies in practices across the ERO 

Enterprise, which NERC then reviews, resolves, and tracks and reports publicly.

NERC discusses two trends it observed during the assessment period: (1) reduced 

repeat moderate and severe risk violations; and (2) continued progress in mitigating the 

ERO’s older caseload of noncompliance. NERC assessed repeat violations in response to 

a Commission directive from the 2014 Performance Assessment Order.38 NERC 

concludes that while some noncompliance with relevant underlying conduct may persist, 

there is a notable downward trend.39 NERC also conducted focused reviews in 2017 and 

2018 to identify whether deficiencies in mitigation contributed to noncompliance and to 

identify potential methods of further reducing repeat noncompliance. NERC states that it 

now tracks and reports on compliance history in its quarterly report on CMEP activities. 

Similarly, to maintain transparency, NERC publicly posts all final dispositions of 

noncompliance, taking efforts to safeguard confidential information.

To enhance procedural efficiencies, NERC explains it has worked with a 

stakeholder group to develop “ALIGN,” a computer system that manages compliance and 

registration data and enables easier communication between registered entities, Regional 

Entities, and NERC. NERC states it also incorporated a consolidated hearing process 

into its Rules of Procedure. The process provides an opt-in for Regional Entities for 

contested enforcement cases. While NERC explains that this process is optional, only 

Texas RE has not opted to participate. Finally, NERC discusses the NERC Board of 

Trustees’ acceptance and endorsement of the Compliance Guidance policy. This policy 

allows certain organizations or standards drafting teams to develop guidance documents

illustrating different methods for registered entities to comply with a given Reliability 

Standard, which is then reviewed for endorsement.

d. Certification Criteria under Section 39.3(b)(2)

i. Independence and Fair Stakeholder Representation

NERC summarizes its bylaws and Rules of Procedure that assure its independence 

from users, owners, and operators of the Bulk-Power System while also assuring fair 

stakeholder representation in the selection of its directors and balanced decision making 

in any ERO committee or subordinate organizational structure. NERC states that its 

 38 2014 Performance Assessment Order, 149 FERC ¶ 61,141 at P 39.

39 NERC states that it filed 111 moderate or serious risk violations with prior 

noncompliance with similar conduct in 2016; 48 in 2017; and 22 in 2018. Performance 

Assessment at 27.
Docket No. RR19-7-000 - 12 -

bylaws provide that NERC’s affairs are managed by an independent board of trustees 

plus the president of NERC, none of whom can be an officer, director, or employee of 

any entity “that would be perceived as having a direct financial interest in the outcome of 

board decisions, and may not have any other relationship that would interfere with the 

exercise of independent judgment in carrying out the responsibilities of a trustee.”40 

NERC’s trustees are nominated by a nominating committee comprised of independent 

trustees whose terms are not expiring and members of the Member Representatives

Committee.

ii. Equitable Allocation of Reasonable Dues, Fees, and 

Other Charges

NERC explains that its bylaws and Rules of Procedure provide for the process of 

determining the annual funding requirements for the statutory activities of NERC and the 

Regional Entities that, in turn, are allocated based on net energy for load.41 NERC 

explains further that the allocation of the annual assessments based on net energy for load 

is submitted to the Commission for approval in NERC’s annual business plans and 

budgets filing.

iii. Rules for Enforcing Reliability Standards Through 

Imposition of Penalties

NERC states that it has established rules in its Rules of Procedure and CMEP, and 

the individual Regional Entity CMEPs, that provide fair and impartial procedures for 

monitoring and enforcing compliance with Reliability Standards. NERC explains that the 

CMEP includes provisions allowing registered entities to participate in settlement 

discussions with NERC or the Regional Entity related to notices of alleged violations, 

proposed penalties or sanctions, and mitigation plans.42

NERC explains that the CMEP includes rules regarding the determination and 

imposition of monetary penalties on registered entities that have violated Reliability 

Standards. NERC states that penalties are to be commensurate to the reliability impact of 

the violation and to those levied for similar violations, but they still reflect any unique 

facts and circumstances related to the registered entity or specific violation. Regarding

the penalty determination, NERC explains that the Commission-approved Sanction 

Guidelines establish a base penalty amount fixed by the associated violation risk factor 

 40 Performance Assessment, Exhibit A at 17-18.

41 Performance Assessment, Exhibit A at 23-24.

42 Performance Assessment, Exhibit A at 25.
Docket No. RR19-7-000 - 13 -

and violation severity level. The base penalty amount can be adjusted based on factors 

such as a registered entity’s compliance history, the violation time horizon, entity size, 

the operating condition of the Bulk-Power System at the time of the violation, and any 

mitigating factors. NERC adds that a penalty amount includes the consideration of 

mitigating factors such as the quality of the registered entity’s internal compliance 

program, quality of cooperation in resolving the violation, and whether the registered 

entity self-reported the violation.43

iv. Rules that Provide Notice and Opportunity for 

Public Comment, Due Process, and Balance in 

Developing Reliability Standards

NERC states that it continues to maintain rules ensuring due process, openness, 

and balance of interests in developing Reliability Standards and that it remains accredited 

by the American National Standards Institute. NERC explains that during the 

performance assessment period, it revised its standard processes manual to improve the 

processes for conducting field tests for new and revised Reliability Standards, developing 

interpretations of Reliability Standards, and posting supporting technical documents for 

approved Reliability Standards.

v. Appropriate Steps to Gain Recognition in Canada 

and Mexico

NERC confirms that it saw continued Canadian dedication to a continent-wide 

regulatory framework for reliability and provided details on the compliance monitoring 

arrangements between NERC, the Regional Entities, and all Canadian provinces

connected to the North American Bulk-Power System.

NERC also confirms that Mexico is increasing its interaction with NERC to 

formalize its relationship with NERC as a resource and expert on electric reliability. 

NERC, Centro Nacional de Control de Energía, and the Comisión Reguladora de Energía 

executed a memorandum of understanding (MOU) in 2016. Through the MOU, the 

parties created a senior management steering group to oversee activity under the MOU 

and to finalize the funding framework for activities under the MOU. The parties also 

committed to explore opportunities for formal Mexican participation in the ERO. 

Pursuant to this MOU, NERC conducted a cyber risk preparedness assessment on 

Mexican utilities in 2016.

 43 See generally Performance Assessment, Exhibit A at 25-27.
Docket No. RR19-7-000 - 14 -

Commission Determination

We find that NERC’s Performance Assessment demonstrates that NERC 

continues to satisfy the statutory and regulatory requirements set forth in FPA section 

215(c) and section 39.3(b) of our regulations. As discussed above, NERC provides a 

detailed description of how it meets the statutory and regulatory requirements established 

for the Commission-approved ERO. We conclude that NERC demonstrated that it can 

develop and enforce Reliability Standards. In addition, the Performance Assessment 

reflects NERC’s evolution as the ERO in pinpointing areas of improvement. 

With regard to the equitable allocation of reasonable dues, fees and other charges,

we reaffirm our previous determinations that NERC’s allocation based on net energy for 

load is a reasonable and equitable allocation method.44 Likewise, except for a few 

specific areas discussed below, the Commission generally is satisfied with other features 

of NERC’s Rules of Procedure, including rules that provide fair and impartial procedures 

for enforcing Reliability Standards and rules that provide for broad participation, notice,

and opportunities for comment in developing Reliability Standards. Pursuant to FPA 

section 215(f), the Commission approved the initial submission of the NERC Rules of 

Procedure, as well as each subsequent revision. Thus, along with the individual findings 

that the NERC Rules of Procedure are just, reasonable, not unduly discriminatory or 

preferential, and in the public interest, we conclude that the NERC Rules of Procedure 

are fair and impartial and generally support the varied functions and programs of the 

ERO, although there are opportunities for additional improvement. Further, we recognize 

NERC’s efforts to gain and maintain recognition as the ERO in Canada and Mexico and 

urge NERC to continue its efforts to support the reliability of the North American BulkPower System through work with our international partners. 

B. NERC’s Evaluation of the Regional Entities

Performance Assessment

NERC is required to include in each performance assessment a discussion of the 

“effectiveness of each Regional Entity, recommendations by the Electric Reliability 

Organization, users, owners, and operators of the Bulk-Power System, and other 

interested parties for improvement of the Regional Entity’s performance of delegated 

functions, and the Regional Entity’s response to such evaluation and 

 44 See, e.g., Order No. 672, 114 FERC ¶ 61,104 at P 213; ERO Certification Order, 

116 FERC ¶ 61,062 at P 167.
Docket No. RR19-7-000 - 15 -

recommendations.”45 NERC states that it performed its assessment through oversight 

and audits conducted pursuant to Section 1207 and Appendix 4A of its Rules of 

Procedure.

NERC notes that while the Regional Entities may propose regional Reliability 

Standards to the ERO, they are instead focusing efforts on the development of continentwide Reliability Standards. The Regional Entities have initiated periodic reviews of the 

remaining regional Reliability Standards to revise or retire; and proposed no new regional 

Reliability Standards during the assessment period.

NERC explains that its most significant change to compliance monitoring has 

been the implementation of a risk-based approach that “right-sizes” compliance 

monitoring and enforcement activities based on several factors. NERC evaluates 

Regional Entity performance through metrics related to the CMEP. These include the 

development of compliance oversight plans, audit documentation, the coordinated 

oversight program, participation in training, and targeted compliance audits. NERC 

discusses that its oversight of the Regional Entity enforcement programs also consists of 

metrics and reviews, which it reports on a quarterly and annual basis.

NERC states that it reviewed Regional Entity adherence to the organization 

registration program—including the appeals process, functional mapping, and data 

management—and verified each Regional Entity was performing adequately. NERC also 

implemented a certification oversight plan in 2018.

NERC concludes that, based on the results of its oversight activities of the 

Regional Entities during the assessment period, each of the Regional Entities continued 

to meet the statutory and regulatory criteria to be delegated authority under the regional 

delegation agreements.

46

Commission Determination

We find that each Regional Entity continues to meet the statutory and regulatory 

criteria for delegated authority and that NERC and the Regional Entities responded to 

suggestions for improvement from users, owners, and operators of the Bulk-Power 

System and other interested parties as required by section 39.3(c) of our regulations. 

 45 18 C.F.R. § 39.3.

46 18 C.F.R. § 39.8. (2019).
Docket No. RR19-7-000 - 16 -

C. Areas for Improvement

1. Periodic Regional Entity Audits

Performance Assessment

NERC explains that during the performance assessment period, it launched a 

formal oversight program to identify oversight monitoring activities and performance 

metrics for the Regional Entities. NERC states that the program adheres to a staggered 

schedule with the first set of plans implemented in 2017. NERC adds that it issued 

performance reports in the first quarter of 2018 and performed “targeted audits” during 

the performance assessment period of: (1) confidentiality and conflict of interest; 

(2) event analysis; (3) compliance monitoring competency evaluation guide; and (4) 

section 215 accounting. NERC states that its oversight of the Regional Entity CMEPs 

also includes other reviews such as the annual Find, Fix, Track and Report and 

Compliance Exception joint reviews.47 NERC adds that the Compliance and 

Certification Committee, a stakeholder group that reports to the NERC Board of Trustees, 

has also performed certain stakeholder audits and spot checks of both NERC and the 

Regional Entities’ adherence to the Rules of Procedure.48 

Commission Determination

The Commission supports NERC’s goal of performing oversight in a risk-based 

manner. However, in Order No. 672, the Commission required the “ERO periodically to 

audit each Regional Entity’s ongoing compliance with relevant statutory and regulatory 

criteria and performance in enforcing Reliability Standards and report the results to the 

Commission.”49 Section 39.3(c)(1)(iii) of the Commission’s regulations also requires 

that the ERO include in its performance assessment an evaluation of the effectiveness of 

each Regional Entity in, among other things, enforcing Reliability Standards. To meet 

these requirements, NERC added section 402.1.3 and Appendix 4A to its Rules of 

Procedure and incorporated the same obligation into its regional delegation agreements. 

These various provisions require NERC to perform audits of the Regional Entities’ 

CMEPs at least once every five years to assess the Regional Entities’ implementation of 

the NERC CMEP. According to Appendix 4A, the scope of NERC’s audit of the 

Regional Entities should be comprehensive and include the Regional Entities’ 

compliance with: (1) the NERC CMEP; (2) related sections of the NERC Rules of 

Procedure; (3) the annual CMEP Implementation Plan as approved by NERC; and 

 47 Performance Assessment at 54.

48 Id. at 19.

49 Order No. 672, 114 FERC ¶ 61,104 at P 773.
Docket No. RR19-7-000 - 17 -

(4) additional directives provided by NERC for implementing the CMEP and related 

Rules of Procedure sections.

From NERC’s description of its oversight activities, it does not appear that NERC 

has fully met its five-year audit responsibility. In 2010, the Commission, concerned that 

at the time NERC had completed only five of eight audits, and that those five audits 

focused on process and not quality of output, directed NERC to submit a plan for auditing 

the Regional Entities.50 On December 23, 2010, NERC made an Informational Filing 

regarding NERC’s initial audits of the Regional Entities and its plan for future audits.51

In October 2011, the Commission issued an order on NERC’s filing directing NERC to 

submit a plan for timely auditing the Regional Entities that explains: (1) when it would

complete the first round of audits; and (2) when it would perform the second round of 

audits.52

On January 6, 2012, NERC made a filing declaring its intention to postpone its 

efforts to restructure the audit program until after the conclusion of the Commission audit

of NERC in Docket No. FA11-21-000. NERC asserted it would continue to perform 

“Key Reliability Standard Spot Checks” of the regions and conduct other “general 

oversight activities” in lieu of the audits.53 NERC also stated it initiated a second round 

of audits in the third quarter of 2011 and expected them to conclude by the end of 

calendar year 2016.54

On July 21, 2014, NERC submitted its second ERO performance assessment 

where NERC referred to its requirements to both conduct audits of the Regional Entities 

 50 North American Electric Reliability Corp., 133 FERC ¶ 61,061, at P 28 (2010) 

(October 2010 Order).

51 North American Electric Reliability Corp., Informational Filing of the North 

American Electric Reliability Corporation in Response to Paragraph 773 of Order 

No. 672 Regarding the Initial Three-Year Regional Entity Audits and Plan for Future 

Audits, Docket Nos. RR09-7-000 and RR10-11-000 (filed Dec. 23, 2010). 

52 North American Electric Reliability Corp., 137 FERC ¶ 61,028, at P 20 (2011) 

(October 2011 Order).

53 North American Electric Reliability Corp., Informational Filing regarding 

Paragraph 773 of Order No. 672, Docket Nos. RR09-7-000 and RR10-11-000, at 2 (filed 

Jan. 11, 2012).

54 Id.
Docket No. RR19-7-000 - 18 -

under its Rules of Procedure and provide its evaluations to the Commission to 

demonstrate the effectiveness of each Regional Entity’s CMEP in compliance monitoring 

and enforcement.

55 NERC did not discuss in either its 2014 or its most recent 

Performance Assessment whether it had completed any audits over the performance 

assessment periods. 

In 2015, NERC sought to remove from the regional delegation agreements 

references to its requirement to perform audits of the Regional Entities. In its 

November 2 Order56 on NERC’s regional delegation agreement filing, the Commission

directed that NERC, inter alia: (1) retain references to NERC’s responsibility to conduct 

audits of the Regional Entities every five years, as required by the NERC Rules of 

Procedure, in the revised regional delegation agreements; and (2) explicitly include audits 

and reviews in the non-public information to which the Commission must have full 

access.57 

Nevertheless, in 2016, an independent audit of NERC identified that NERC did 

not perform any comprehensive five-year audits of the Regional Entities’ CMEPs in 

accordance with its Rules of Procedure during the scope period.58 The auditor found that 

NERC performed limited oversight reviews in lieu of the required audits. The report also 

stated the auditor’s concern that, because NERC did not perform audits in accordance 

with all the requirements of Appendix 4A, there was a risk that Regional Entity 

compliance programs did not effectively meet the requirements under the NERC CMEP, 

the NERC Rules of Procedure, and the CMEP Implementation Plan.59

 55 North American Electric Reliability Corp., Five-Year Electric Reliability 

Organization Performance Assessment Report, Docket RR14-5-000, Attachment 1 at 16, 

(filed July 21, 2014).

56 North American Electric Reliability Corp., 153 FERC ¶ 61,135 (2015) 

(November 2 Order).

57 Id. PP 47-49.

58 Pursuant to Section 400, Paragraph 406 of NERC’s Rules of Procedure, NERC 

is required to conduct an independent evaluation of its CMEP at least once every three 

years. The independent auditor conducted a review of NERC’s compliance with the 

CMEP sections of the Rules of Procedure to cover the three-year period between 2013 

and 2015. NERC, Independent Evaluation of NERC’s CMEP and ORCP ROP

Requirements at 5 (October 18, 2016). 

59 Id.
Docket No. RR19-7-000 - 19 -

We continue to believe that performing a comprehensive audit of the Regional 

Entities’ compliance with the CMEP, as outlined in Appendix 4A, once every five years 

is necessary for NERC to confirm that the Regional Entities are performing their 

delegated responsibilities adequately. We are concerned that, from 2011 through the end 

of 2018, NERC may not have performed comprehensive audits of the Regional Entities to 

assess their conformance to the NERC CMEP, as required by both NERC’s Rules of 

Procedure and regional delegation agreements. We note that NERC’s Rules of Procedure

require NERC to provide the evaluations resulting from such comprehensive audits to the 

Commission.

60

We direct NERC to submit in a compliance filing within ninety (90) days of the 

date of this order: (1) a definitive statement of whether NERC has performed any audits 

of the Regional Entities during the performance assessment period covering the scope of 

Appendix 4A, and if so, provide its audit reports in compliance with its Rules of 

Procedure; and (2) if it has not performed such audits, provide a plan to perform those 

audits within the next 18 months and going forward. If NERC would like to implement 

an alternative oversight process for the Regional Entities that it believes is as efficient 

and effective as the comprehensive audits conducted every five years, then its compliance 

filing should include a detailed explanation of how its oversight process accomplishes the 

aims of Order No. 672.61 The Commission would then determine whether Appendix 4A 

and the regional delegation agreements should be amended to align with NERC’s 

oversight process. 

2. Assessment of NERC Guidance Document’s Effectiveness

Performance Assessment

NERC states that during the performance assessment period, it “continued to 

demonstrate its ability to develop Reliability Standards in support of a reliable and more 

secure grid,” citing standards development projects addressing physical security, 

geomagnetic disturbances, cybersecurity supply chain risk, enhanced cyber incident 

reporting, and transmission planning for single points of failure.62 NERC states that it 

 60 See NERC Rules of Procedure, section 402.1.3 (“[t]hese evaluations shall be 

provided to the Applicable Governmental Authorities to demonstrate the effectiveness of 

each Regional Entity”); and Appendix 4A (“[t]he final report, along with the Regional 

Entity’s response, are posted on the NERC web site after NERC presents the final report 

to the NERC Board of Trustees Compliance Committee”).

61 See e.g., Order No. 672, 114 FERC ¶ 61,104 at P 773.

62 Performance Assessment at 21-22.
Docket No. RR19-7-000 - 20 -

evaluates whether reliability or technical risks require modification to Reliability 

Standards or development of guidance and that guidelines are important tools it uses to 

address reliability risks. NERC explains that, although reliability guidelines are not 

monitored or enforced, it uses guidelines when it needs to investigate a risk to reliability 

more thoroughly or when a potential Reliability Standard needs additional consideration 

prior to starting the standards drafting process. NERC adds that it is developing a 

repeatable process to determine when a risk to the Bulk-Power System requires 

development of a reliability guideline or a Reliability Standard.63

Commission Determination

During the performance assessment period, NERC developed over twenty 

“Reliability and Security Guidelines” (compared to only two during the prior

performance assessment period) addressing reliability risks.

64 NERC also issued multiple 

lessons learned and alerts about newly-discovered risks in cyber security. Moreover, we 

understand that NERC is developing numerous additional guidelines relating to topics 

such as cyber security, natural gas fired generation fuel security, electromagnetic pulse, 

and inverter technology. 

Given NERC’s increased reliance on guidelines, we believe that transparency 

regarding the effectiveness of those guidelines is necessary. However, we are not aware 

of any formalized written process to steer the development and approval of guidelines or 

to provide feedback to the NERC standard development process on whether the guideline 

is effective. Moreover, unlike the transparent standards development process, in at least 

some cases guidelines are based on the input of a limited number of interested 

participants and NERC staff’s perspective is unknown.

65

We appreciate that, as NERC states in the Performance Assessment, guidelines 

and lessons learned reflect the collective experience, expertise, and judgment of industry 

to suggest approaches or behaviors in a given technical area for improving reliability and 

 63 Performance Assessment at 11.

64 The guidelines are available at https://www.nerc.com/comm/Pages/Reliabilityand-Security-Guidelines.aspx. Recent guidelines have addressed topics such as inverter 

resource performance, gas and electric operational coordination, generation loss of 

communications, distributed energy resource modeling, and physical security.

65 The NERC Operating Committee, Planning Committee, and Critical 

Infrastructure Protection Committee develop and approve reliability and security 

guidelines. These committees are made up of industry participants and a NERC staff 

coordinator.
Docket No. RR19-7-000 - 21 -

that new and emerging risks may require tools to address reliability risks outside of 

Reliability Standard development.

66 Nevertheless, NERC’s process and criteria for 

determining whether and when to develop mandatory Reliability Standards versus 

voluntary measures to comply with section 215, and how NERC uses information gained 

from the issuance of a guideline to improve or develop a new Reliability Standard, are 

unclear. Our concern is highlighted by the fact that, although guidelines may be 

precursors to Reliability Standards, NERC has not yet formalized a transparent process 

for evaluating when components or language found in a NERC guideline should be 

incorporated into the Reliability Standards. 

We direct NERC to explain in the ninety (90) day compliance filing: (1) its 

guidance development process; including how and when it evaluates the need to develop,

approve, and post a guideline document; (2) the methodology and metrics NERC 

proposes to use to determine if that guidance document is addressing the risks that led to 

its development; and (3) how and at what interval NERC will evaluate whether 

components of the guidance document should be incorporated into the Reliability 

Standards. 

3. E-ISAC Oversight Transparency

Performance Assessment

NERC explains that the E-ISAC is a division of NERC that acts as a “security 

communications channel for the electricity industry”67 and secures the Bulk-Power 

System through information sharing and analysis.68 NERC established the E-ISAC at the 

request of the Department of Energy in 1998 to serve as a focal point for voluntary 

information sharing within the electricity subsector. Its mission is to “[r]educe[] cyber 

and physical security risk to the electricity industry across North America . . ..”69 

According to NERC, the E-ISAC has also operated as the “program manager” for the 

Cyber Security Risk Information Sharing Program (CRISP) since 2014. CRISP is a 

“voluntary program to facilitate Real-time, computer-to-computer-data exchange 

 66 See NERC, Reliability and Security Guidelines, 

https://www.nerc.com/comm/Pages/Reliability-and-Security-Guidelines.aspx. 

67 Performance Assessment at 16.

68 Performance Assessment at 13. 

69 NERC, E-ISAC Long-Term Strategic Plan at 5 (Apr. 2017), 

https://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC%20LongTerm%20Strategic%20Plan.pdf. 
Docket No. RR19-7-000 - 22 -

involving potential security threats identified through monitoring participant utility 

networks.”70

NERC explains in the Performance Assessment that the E-ISAC is headed by 

NERC’s Vice President and Chief Security Officer who reports to the NERC President

and Chief Executive Officer (CEO).

71 NERC also explains that the NERC Board of 

Trustees oversees the E-ISAC through the NERC Board’s Technology and Security 

Committee.72 NERC states that the E-ISAC coordinates with the industry-led Electricity 

Subsector Coordinating Council (ESCC) through the ESCC’s Member Executive 

Committee (MEC). NERC states that “[t]he E-ISAC receives strategic oversight and 

guidance from the [MEC]” and that the MEC “provides industry leadership and strategic 

expertise to guide and support the E-ISAC.”73 NERC states that the MEC is comprised 

of 11 members appointed by the ESCC, one of whom is the NERC CEO. 

NERC provides that beginning in 2019, the E-ISAC developed, in consultation 

with the MEC and endorsed by the NERC Board of Trustees, a set of performance 

metrics as a tool to help measure the E-ISAC’s performance starting in 2020.74 NERC 

explains that the metrics measure the E-ISAC’s progress against its long-term strategic 

plan. NERC also states that the E-ISAC expects to review and update the metrics 

annually, and that the E-ISAC “provides quarterly metrics reports to the MEC and the 

NERC Corporate Governance and Human Resources Committee.”75 

In the Performance Assessment, NERC describes that in February 2012, to address 

its concerns that electric sector participants may be hesitant to share information with the 

E-ISAC out of fear that those matters would be referred to the NERC CMEP functions,

the NERC Board of Trustees adopted a policy to establish a clear separation between the 

 70 Performance Assessment at n.10.

71 Id. at 13.

72 Id. See also NERC, Board of Trustees Technology and Security Committee 

Mandate at 1 (Feb. 2018),

https://www.nerc.com/gov/bot/bottsc/Documents/Technology%20and%20Security%20C

ommittee%20Mandate_Board%20Approved_February_2018.pdf; (The purpose of the 

Committee is to “assist the Board by providing oversight to the ... E-ISAC”).

73 Performance Assessment at 14.

74 Id.

75 Id.
Docket No. RR19-7-000 - 23 -

E-ISAC and the CMEP.76 NERC explains that the policy, as revised in March 2013,

outlines the following principles: (1) the E-ISAC and E-ISAC personnel shall have no 

responsibilities for the NERC CMEP; (2) E-ISAC personnel shall not, directly or 

indirectly, report or convey information about possible violations of Reliability Standards 

to the CMEP or CMEP personnel; and (3) CMEP personnel shall not, directly or 

indirectly, obtain or seek to obtain information about possible violations of Reliability 

Standards from E-ISAC personnel.77

NERC adds that in May 2014, NERC management, in consultation with 

stakeholders, adopted the E-ISAC Code of Conduct to implement the policy. NERC goes 

on to describe the Code of Conduct for the E-ISAC, explaining:

Because of this Code of Conduct, much of the information the 

E-ISAC receives cannot be used across the ERO to inform the 

development of Reliability Standards or the CMEP. When the 

E-ISAC issues public reports that aggregate and anonymize 

data, however, NERC may use such information to inform its 

activities in other functions.78

Finally, NERC states that throughout the performance assessment period, the EISAC continued to enhance its membership “portal” by offering more granular security 

alerts and notifications, tools for industry peer-to-peer collaboration, and training 

materials.79

Commission Determination

When NERC first justified including the E-ISAC funding under FPA section 215, 

NERC explained that the E-ISAC would maintain real-time awareness of the Bulk-Power 

 76 Performance Assessment at 14-16.

77 NERC, Separation Protocol Applicable to E-ISAC and NERC, (approved Mar. 

2013, updated Feb. 2016), https://www.eisac.com/Documents/EISAC_Separation_Protocol(0).pdf. 

78 Performance Assessment at 16.

79 Id. at 17.
Docket No. RR19-7-000 - 24 -

System by coordinating electric industry activities.80 Specifically, NERC stated that the 

E-ISAC would “gather and communicate information about security-related threats 

within and among the sector, U.S. and Canadian governmental authorities, and other 

critical infrastructure sectors.”81 NERC explained that “promoting and planning for 

protection of the electric industry’s critical infrastructure is also critical to reliable 

operation of the bulk-power system.”82 Notably, NERC added that “this program will 

assist NERC in identifying areas for which new or revised [R]eliability [S]tandards may 

be required.”83 The Commission approved NERC’s proposed funding and inclusion of 

the E-ISAC under section 215 of the FPA.

84 The E-ISAC budget now represents 

approximately 28 percent of NERC’s 2020 budget (37.5 percent with the CRISP portion 

included).85 NERC projects that the budget increases for the E-ISAC over the successive 

2-year period (2021-2022) to “represent the vast majority of projected increases in the 

total NERC budget”.

86 

 80 North American Electric Reliability Corp., Request for Acceptance of its 2007 

Business Plan and Budget and the 2007 Business Plans and Budgets of Regional Entities 

and for Approval of Proposed Assessments to Fund Budgets, Docket No. RR06-3-000 at 

33 (filed Aug. 23, 2006).

81 Id.

82 Id.

83 Id.

84 North American Electric Reliability Corp., 117 FERC ¶ 61,091 (2006), order on 

reh’g, 119 FERC ¶ 61,059, at P 4 (2007).

85 The Commission approved NERC’s 2020 budget on October 17, 2019, which 

included $31.3 million in funding for the E-ISAC. See North American Electric 

Reliability Corp., 169 FERC ¶ 61,040 (2019). 

86 North American Electric Reliability Corp., Request of North American Electric 

Reliability Corporation for Acceptance of 2020 Business Plans and Budgets of NERC 

and Regional Entities and for Approval of Proposed Assessments to Fund Budgets, 

Docket No. RR19-8-000, Attachment 2 at 17, (filed Aug. 23, 2019). NERC projects a 

funding need for the E-ISAC, including CRISP, to be $34.6 million in 2020 and $37.4 

million in 2021.
Docket No. RR19-7-000 - 25 -

As noted above, NERC asserts in the Performance Assessment that due to the EISAC Code of Conduct87 much of the information the E-ISAC receives cannot be used 

across the ERO to inform the development of Reliability Standards or the CMEP.88 But

the E-ISAC Code of Conduct does not appear to prohibit the sharing of E-ISAC 

information for use in the development of Reliability Standards. Instead, the only 

explicit restriction on the sharing of E-ISAC information is in relation to the CMEP. 

Further, while we agree that certain information the E-ISAC receives (e.g., entityidentifying information) is neither appropriate nor useful to share with other NERC staff 

for the development of Reliability Standards, we are concerned that NERC believes that 

the only information it can use from the E-ISAC to inform Reliability Standards 

development is the information contained in the public reports. We observe that the EISAC issues its public reports on an irregular basis with typically high-level information,

such that the reports may be neither timely nor informative enough to assist the 

development of Reliability Standards. 

We direct NERC to submit in the ninety (90) day compliance filing additional 

information on: (1) how NERC receives information from the E-ISAC and how the EISAC determines what data to share with NERC; and (2) once NERC receives such 

information, what NERC does with the information and how NERC determines whether 

such information is used to develop or inform the development of Reliability Standards.

89

We emphasize that we are not seeking to obtain any specific information in the 

compliance filing that industry may submit to the E-ISAC. Instead, we seek, generally, a 

better understanding of how the E-ISAC informs the development of Reliability 

Standards. 

It also appears that over time NERC’s description of the relationship between the 

E-ISAC and the ESCC and the MEC has changed. For example, in NERC’s 2017 

business plan and budget filing NERC explains that the E-ISAC “coordinates” with the 

 87 Electricity Information Sharing and Analysis Center Code of Conduct, North 

American Electric Reliability Corp. (Mar. 11, 2015), 

https://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC_Code_of_Conduct.pdf.

88 Performance Assessment at 16.

89 We further ask NERC to clarify its processes regarding the development and 

issuance of All Points Bulletins. Cf. Order on Clarification, 120 FERC ¶ 61,239, at P 12 

(2007) (explaining that providing the Commission advance copies of “NERC alerts” 

would allow the Commission to determine whether action is warranted under FPA 

section 215). 
Docket No. RR19-7-000 - 26 -

ESCC and the MEC.90 But in the Performance Assessment, NERC describes the MEC as 

“providing strategic oversight and guidance” to the E-ISAC.91 More recently, in its 2020 

business plan and budget filing, NERC states that it was the MEC that approved the EISAC long-term strategic plan.92 Accordingly, NERC has variously described the 

relationship between the E-ISAC and the MEC as one of coordination, but also one in 

which the MEC provides the E-ISAC with strategic oversight, and where the MEC is 

responsible for approving aspects of the E-ISAC. Based on these differing descriptions 

and given the increasing size, scope, and importance of the E-ISAC, we believe 

additional information describing the relationship between the MEC and the E-ISAC is 

warranted and would help provide a better understanding of how the E-ISAC works to 

support NERC’s other statutory FPA section 215 functions. 

We direct NERC in the ninety (90) day compliance filing to further elaborate on 

the relationship between the E-ISAC and the MEC. In particular, NERC should describe

how the MEC provides “strategic oversight and guidance” to guide and support the EISAC, as noted in the Performance Assessment,93 as well as what other aspects of the EISAC, if any, the MEC is responsible for approving.

In addition, recognizing the important role that the E-ISAC plays, it is imperative 

that NERC consider the perspectives of those stakeholders that rely on E-ISAC services 

to develop and track metrics to assess the performance of the E-ISAC. Moreover, we 

believe that E-ISAC-specific metrics and goals used to assess the performance of the EISAC should be transparent and publicly available so that the stakeholders that rely on EISAC services can assess E-ISAC’s effectiveness and identify opportunities for 

improvement. 

We direct NERC to include in the ninety (90) day compliance filing the E-ISAC 

metrics for FY 2020 discussing: (1) the scope and basis used for developing those 

metrics; (2) how the metrics assist NERC in its oversight responsibility of the E-ISAC; 

 90 NERC, Petition, Docket No. RR16-6-000, Attachment 2 at 76 (filed Aug. 23, 

2016).

91 Performance Assessment at 14.

92 “At the request of the Board and under the guidance of the ESCC and MEC, 

executive leadership of the E-ISAC developed the E-ISAC Long-Term Strategic Plan, 

which was approved by the MEC on April 24, 2017.” NERC, Petition, Docket No. 

RR19-8-000, Attachment 2 at 10 (filed Aug. 23, 2019) (emphasis added). 

93 Performance Assessment at 14.
Docket No. RR19-7-000 - 27 -

(3) how the metrics were developed; and (4) how those metrics and goals are relevant to 

the E-ISAC’s mission.

Based on information provided by NERC in the Performance Assessment, it 

appears that there are inconsistencies in NERC’s Rules of Procedure related to the EISAC. For example, section 1003.1 of the NERC Rules or Procedure reference the 

“Electric Sector Information Sharing and Analysis Center (ESISAC)” (emphasis added), 

rather than the “Electricity Information Sharing and Analysis Center (E-ISAC).” 

Additionally, section 1003.1.5 of the NERC Rules of Procedure states, “NERC shall fill 

the role of the Electricity Sector Coordinating Council and coordinate with the 

Government Coordinating Council.” The Performance Assessment instead refers to the 

“industry-led Electricity Subsector Coordinating Council” or “ESCC,” but does not 

provide any information as to whether this is the same coordinating council referenced in 

the NERC Rules of Procedure. 

We direct NERC in the 180-days compliance filing to propose updates to section 

1003 of its Rules of Procedure to correct any inconsistencies, particularly regarding the 

ESCC, and to reflect current operational practices and oversight of the E-ISAC.

4. NERC Sanction Guidelines

Performance Assessment

NERC recognizes in the Performance Assessment that the Commission’s 

regulations require it to submit penalty guidelines for Commission approval and that the 

penalties imposed by the ERO or a Regional Entity be within the range set forth by the 

approved guidelines.94 NERC established, and the Commission approved, its Sanction 

Guidelines, Appendix 4B to its Rules of Procedure.95 According to the Sanction 

Guidelines, as described in the Performance Assessment, “penalties are to be 

commensurate to the reliability impact of the violation and to those levied for similar 

violations, while still reflecting unique facts and circumstances related to the violation or 

the violator. NERC is charged with ensuring ‘acceptable similarity’ in penalties for 

comparable violations.”96 The Sanction Guidelines state that “any provisions within a 

settlement regarding Penalties or sanctions can supersede any corresponding Penalties or 

 94 Performance Assessment, Exhibit A at 26. 

95 North American Electric Reliability Corp., 141 FERC ¶ 61,241 (2012).

96 Performance Assessment, Exhibit A at 26. 
Docket No. RR19-7-000 - 28 -

sanctions that would otherwise be determined pursuant to these Sanction Guidelines.”97 

NERC asserts that even with this flexibility, it evaluates each settlement within a “range 

of reasonableness that displays consistency.”98

In the Performance Assessment, NERC describes how it begins the calculation of 

a monetary penalty with a base penalty amount from the violation risk factor/violation 

severity level matrix and then uses multipliers for aggravating factors and credits for 

mitigating factors.99 In addition to the text of the guidelines, NERC states in the 

Performance Assessment that it provides training on penalty calculations/determinations 

to Regional Entity staff.100 The Regional Entities confirm they strive for consistency, 

with at least one Regional Entity referring to its use of a “penalty calculator tool” as a 

part of its penalty determinations.101

Commission Determination

Section 215(c)(2)(C) requires the ERO to establish rules to “provide fair and 

impartial procedures for enforcing Reliability Standards through imposition of penalties.” 

In addition, the Commission has stated that the Sanction Guidelines are not intended to 

establish fixed penalty amounts but are to provide flexible guidance in establishing an 

appropriate amount within the range of applicable penalties.102

In the Certification Order approving NERC as the ERO and approving the initial 

version of the Sanction Guidelines, the Commission determined that “the ERO or 

Regional Entity must list each of the Final Adjustment Factors that it believes to be 

appropriate, as well as any other factors that are not specifically listed in the Sanction 

Guidelines, and explain how the application of these factors to the relevant facts relating 

to a violation contributes to the final penalty determination. Such an explanation of how 

the ERO or a Regional Entity arrived at a penalty amount is central to demonstrate on 

 97 Sanction Guidelines Sec. 2.1.

98 Performance Assessment, Exhibit A at 26.

99Id., Exhibit A at 27.

100 Performance Assessment at 46-47.

101 See e.g., Performance Assessment, Attachment B at 8 (“With respect to 

penalties, NPCC consistently uses the NERC provided penalty calculator tool for 

consistency in penalty calculation determinations”).

102 Order No. 672, 114 FERC ¶ 61,104 at P 451.
Docket No. RR19-7-000 - 29 -

Commission review that the assessed penalty bears a reasonable relation to the 

seriousness of the violation.”103 

The Commission previously directed NERC to provide any tools, such as the 

“penalty tool,” to the Commission for review prior to implementation.104 In its response, 

NERC clarified that it had not yet developed tools or mathematical formulae to apply the 

Sanction Guidelines, but it may do so in the future.105 In the Order on Compliance 

Filing, the Commission held, “we believe that NERC’s filing is sufficiently clear that 

NERC has not developed tools or formulae at this time, but may do so in the future. If 

NERC chooses to develop such tools or formulae in the future, they must be submitted 

for Commission review.”106

When we originally approved the NERC Sanction Guidelines, we agreed with 

NERC that they “are not intended to establish fixed penalty amounts; they instead 

provide flexible guidance as establishing an appropriate amount within the range of 

applicable penalties.”107 We continue to support the understanding that the Sanction 

Guidelines should provide NERC and the Regional Entities “flexibility in fashioning an 

appropriate response to a violation.”108 However, the ERO’s approach to enforcement 

has since evolved to a risk-focused methodology without a corresponding update to its 

Sanction Guidelines.109 We have identified certain potential areas of improvement within 

the Sanction Guidelines to ensure that NERC and the Regional Entities continue to 

 103 ERO Certification Order, 116 FERC ¶ 61,062 at P 454, order on reh’g and 

compliance, 117 FERC ¶ 61,126, order on compliance, 118 FERC ¶ 61,030, order on 

compliance, 118 FERC ¶ 61,190, order on reh’g, 119 FERC ¶ 61,046, aff’d sub nom. 

Alcoa Inc. v. FERC, 564 F.3d 1342.

104 North American Electric Reliability Corp., 118 FERC ¶ 61,030 at P 132.

105 North American Electric Reliability Corp., Compliance Filing in Response to 

January 18, 2007 Order and March 9, 2007 Order, Docket No. RR06-1-003, at 36-37 

(May 3, 2007).

106 North American Electric Reliability Corp., 118 FERC ¶ 61,030 at P 136.

107 Order No. 672, 114 FERC ¶ 61,104 at P 451.

108 Id. P 136.

109 NERC last revised its Sanction Guidelines in 2012. North American Electric 

Reliability Corp., 141 FERC ¶ 61,241 at P 95.
Docket No. RR19-7-000 - 30 -

implement the risk-based CMEP in a reasonable and transparent manner, and that the 

Commission will maintain a meaningful oversight role.

We direct NERC to amend its Sanction Guidelines in the 180-day compliance 

filing to provide more transparency in those guidelines as to how NERC and the Regional 

Entities apply the Base Penalty, Adjustment Factors and Non-Monetary Sanctions, and to 

submit for Commission review any “tools or formulae” used to implement the Sanction 

Guidelines. 

NERC should ensure that its revised Sanction Guidelines reflect how NERC and 

the Regional Entities currently apply the various factors when determining penalties. 

First, the revisions should explain how NERC and the Regional Entities choose the base 

penalty amount within the range based on violation risk factor and violation severity level 

(i.e., section 3.1 and 3.2 of the Sanction Guidelines). Second, the revised guidelines 

should detail the potential range for aggravating factors applied to the base penalty 

amount for: (1) risk; (2) duration of violations; (3) size of the entity; (4) management 

involvement; (5) repetitive violations; and (6) any other factors applied to increase the 

base penalty amount. NERC should ensure the revised guidelines similarly detail the 

potential range of mitigating factors applied to reduce the resulting penalty amount for: 

(1) settlement; (2) self-reporting; (3) admission; (4) internal compliance program; (5) 

cooperation; and (6) any other credits used to decrease the base penalty amount. Finally, 

the revised guidelines should address: (1) whether and/or how non-monetary sanctions 

will be considered in reaching the final penalty amount; (2) how NERC and the Regional 

Entities will assess a penalty which bears a reasonable relation to the seriousness of the 

violation and the size of the violator when dealing with multiple subsidiaries of a parent 

corporation that commit the same violations; (3) how NERC and the Regional Entities 

will calculate a single penalty for multiple violations by a single entity; and (4) how 

NERC and the Regional Entities consider “the violator’s financial ability to pay the 

Penalty,” so that “no Penalty is inconsequential to the violator to whom it is assessed,” as 

provided in section 2.6 of the current Sanction Guidelines.110

5. NERC’s Certification Process

Performance Assessment

Through the NERC Organization Certification Program, NERC and the Regional 

Entities ensure that organizations that apply to register or are registered to perform 

 110 We note that in the Certification Order, we directed NERC and the Regional 

Entities to “justify,” for each specific penalty amount, how it “would not lead a violator 

to consider the imposition of a penalty as simply an economic choice or a cost of doing 

business.” ERO Certification Order, 116 FERC ¶ 61,062 at P 446.
Docket No. RR19-7-000 - 31 -

certain reliability functions (i.e., reliability coordinator, balancing authority, and 

transmission operator) are capable of meeting their reliability functions.

111 NERC states 

that starting in 2018, it began implementing a formal certification oversight plan but not a 

fully documented process.112 NERC performs oversight of certifications through direct 

participation in all certification engagements and on biweekly calls with Regional 

Entities. NERC states it also tracked program metrics. Most of its certification-related 

activities during the assessment period focused on revising training for certification team 

members.113 For example, NERC explains that it and the Regional Entities hold two 

sessions a year on audit team leadership skills to ensure audit and certification team 

leaders possess the requisite skills to lead their teams. NERC also describes the results of 

its first year of implementing a formal certification oversight plan. During this year, one

certification of a new balancing authority and 12 certification reviews of other registered 

functions were completed.

Commission Determination

As NERC only began implementing a formal certification oversight program in 

2018, the information on the quality of the certification process during the assessment 

period is limited. The recent certifications of the California Independent System 

Operator Reliability Coordinator West (RC West) and Southwest Power Pool (SPP)

underscore the importance of NERC’s certification process. Section IV of the NERC 

Organization Registration and Certification Manual provides broad guidance for 

completing the certification process; however, we believe it is necessary to provide more 

specific guidance on the tools and skills needed to perform the registered function.

We also note that NERC’s existing certification process does not envision the 

failure of an entity to be certified within required deadlines. The RC West and SPP 

certification processes revealed a potential scenario where a reliability coordinator may 

not pass certification in time to perform its functions by the date another reliability 

 111 Performance Assessment, Exhibit A at 10-11.

112 While NERC has overseen certification in the past, until 2018 it had no formal 

methodology for doing so. For example, its CMEP quarterly and annual reports include 

metrics showing completed certification reviews. Its 2017 CMEP Annual Report 

explains that consistency was determined using processes “in the ERO Certification and 

Review Procedure, guidelines, and templates” and that the project underwent a review in 

2017 to identify revisions for improvement. 2017 CMEP Annual Report at 20.

113 Performance Assessment at 66. 
Docket No. RR19-7-000 - 32 -

coordinator ceases operations.114 The certification process does not include a review or 

approval of the certification schedule115 and there is no requirement to develop 

contingency plans for such failures. For example, if either RC West or SPP had failed to 

meet certification requirements, there would be a period during which no entity is 

certified as the reliability coordinator responsible for performing critical reliability 

functions. 

We direct NERC to revise its Rules of Procedure pertaining to the certification 

process and submit the revisions in a compliance filing due within 180 days of the date of 

this order. In the revised Rules of Procedure, NERC must enhance its Organization 

Registration and Certification Program. NERC should include in the certification 

process: (1) an updated scope section covering the tools and skills needed to perform the 

registered function; (2) the minimum criteria for certification, including verification that 

the entity’s tools, personnel, facilities, and processes can fully support the function; and 

(3) a mechanism to reject the request for certification if the entity does not meet the 

requirements for certification. NERC should also consider whether it should permit a 

conditional approval of an entity that does not meet the requirements for certification if it 

includes an approved mitigation plan. 

We also direct NERC to establish minimum requirements for the certification 

team that includes necessary diversity in technical training and experience of team 

members specific to the function being certified or re-certified, e.g., operations 

engineering, information technology, modeling, planning, forecasting and systems. Such 

requirements will better ensure an effective review of certifications. NERC should also 

augment the certification program to include a review and approval of the proposed 

schedule for completing a certification. Finally, NERC should establish provisions to 

address the risk of an entity failing to be certified or to be certified when needed, and to 

provide a process to work with the impacted entities to mitigate the risk. While we do 

not direct the inclusion of specific language in the revised provisions, they could require, 

as an example, that the proposed registrant include a plan with its certification application 

that discusses how it would mitigate delayed or failed registration certification so that no 

gaps in reliability occur. This plan could detail potential impacts both to the applicant 

 114 For example, Peak Reliability announced in July 2018 that it would cease 

operation at the end of 2019—including no contingency plan if there were no certified 

reliability coordinator to take its place. See e.g., American Public Power Association,

Western reliability coordinator to cease operation at end of 2019, (Jul. 18, 2018),

https://www.publicpower.org/periodical/article/western-reliability-coordinator-ceaseoperation-end-2019. 

115 See e.g., WECC, RC Certification Timeline, 

https://www.wecc.org/EventAnalysisSituationalAwareness/Pages/Certification.aspx. 
Docket No. RR19-7-000 - 33 -

and to any affected entities and discuss how those impacts would be mitigated, how it 

would ensure its required functions are served, and how other affected entities within its 

prospective footprint would meet their compliance responsibilities if the certification is 

failed or delayed.

The Commission orders:

(A) The Commission hereby accepts NERC’s Performance Assessment and 

finds that NERC continues to meet the statutory and regulatory requirements for ERO 

certification set forth in section 215(c) of the FPA and section 39.3(b) of our regulations, 

as discussed in the body of this order.

(B) The Commission hereby finds that the Regional Entities continue to meet 

the statutory and regulatory requirements set forth in section 215(e) of the FPA and 

section 39.3(c) of our regulations, as discussed in the body of this order.

(C) NERC is hereby directed to submit a compliance filing within ninety (90)

days of the date of this order, as discussed in the body of this order.

(D) NERC is hereby directed to submit a compliance filing within 180 days 

proposing changes to its Rules of Procedure, as discussed in the body of this order.

By the Commission.

( S E A L )

Kimberly D. Bose,

Secretary.