170 FERC ¶ 61,110

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

[Docket No. RM20-8-000]

Virtualization and Cloud Computing Services

(February 20, 2020)

AGENCY: Federal Energy Regulatory Commission.

ACTION: Notice of inquiry.

SUMMARY: The Federal Energy Regulatory Commission (Commission) seeks 

comments regarding the potential benefits and risks associated with the use of 

virtualization and cloud computing services in association with bulk electric system 

operations, as well as whether barriers exist in the Commission-approved Critical 

Infrastructure Protection Reliability Standards that impede the voluntary adoption of 

virtualization or cloud computing services.

DATES: Initial Comments are due [Insert Date 60 days after date of publication 

in the FEDERAL REGISTER], and Reply Comments are due [Insert Date 90 days 

after date of publication in the FEDERAL REGISTER].

ADDRESSES: Comments, identified by docket number, may be filed in the following 

ways:

• Electronic Filing through http://www.ferc.gov. Documents created electronically 

using word processing software should be filed in native applications or print-toPDF format and not in a scanned format.

• Mail/Hand Delivery: Those unable to file electronically may mail or hand-deliver 
Docket No. RM20-8-000 ii

comments to: Federal Energy Regulatory Commission, Secretary of the 

Commission, 888 First Street NE, Washington, DC 20426.

• Instructions: For detailed instructions on submitting comments, see the Comment 

Procedures Section of this document.

FOR FURTHER INFORMATION CONTACT:

Patricia Ephraim Eke (Technical Information)

Office of Electric Reliability

Federal Energy Regulatory Commission

888 First Street, NE

Washington, DC 20426

(202) 502-8388

Patricia.Eke@ferc.gov

Kevin Ryan (Legal Information)

Office of the General Counsel

Federal Energy Regulatory Commission

888 First Street, NE

Washington, DC 20426

(202) 502-6840

Kevin.Ryan@ferc.gov

SUPPLEMENTARY INFORMATION: 
170 FERC ¶ 61,110

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

Virtualization and Cloud Computing Services Docket No. RM20-8-000

NOTICE OF INQUIRY

(February 20, 2020)

1. In this Notice of Inquiry (NOI), the Commission seeks comments on the potential 

benefits and risks associated with the use of virtualization and cloud computing services

in association with bulk electric system operations. In addition, the Commission seeks 

comment on whether barriers exist in the Critical Infrastructure Protection (CIP)

Reliability Standards, which are developed by the North American Electric Reliability 

Corporation (NERC) and approved by the Commission, that impede the voluntary 

adoption of virtualization or cloud computing services. 

2. This NOI is an outgrowth of discussions concerning the potential benefits and 

risks associated with the adoption of virtualization and cloud computing services for bulk 

electric system operations at the Commission’s June 27, 2019 Reliability Technical 

Conference and the March 28, 2019 Commission/Department of Energy (DOE) Security 

Investments for Energy Infrastructure Technical Conference.1

 

 1 The records of the June 27, 2019 Reliability Technical Conference and 

March 28, 2019 Commission/DOE conference are available on the Commission’s 

eLibrary document retrieval system in Docket Nos. AD19-13-000 and AD19-12-000, 

respectively.
Docket No. RM20-8-000 - 2 -

3. The Commission intends to use the record developed in this proceeding to 

determine whether it would be appropriate, pursuant to section 215(d)(5) of the Federal 

Power Act, to direct that NERC develop modifications to the CIP Reliability Standards 

to facilitate the voluntary adoption of virtualization and cloud computing services by 

registered entities.2

I. Background 

A. Virtualization

4. Virtualization is the process of creating virtual, as opposed to physical, versions 

of computer hardware to minimize the amount of physical computer hardware resources 

required to perform various functions.3 Virtualization is commonly used in business 

applications and is managed through centralized software, referred to as a hypervisor, 

that manages multiple virtual computer resources that can be used by different processes, 

customers, clients, and users. A virtual environment can be a single program and the 

operating system on which it executes; a combination of multiple programs and 

associated operating systems, networks, computing environments, storage devices, or 

other such digital environments.

5. Virtualization can be used on a stand-alone basis in a bulk electric system control 

center environment to reduce capital and operating costs, increase the efficiency of 

 2 16 U.S.C. 824o(d)(5).

3 See National Institute of Standards and Technology, Guide to Security for 

Full Virtualization Technologies, Special Publication 800-125 (Jan. 2011), 

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-125.pdf.
Docket No. RM20-8-000 - 3 -

existing computing assets, and improve incident recovery, among other reasons. 

Virtualization offers the potential for cost savings in asset management, including 

minimizing the need for physical assets, which require building space and procuring and 

maintaining physical computer hardware. A virtualized system can also be more quickly 

recovered than physical systems in the event of a malfunction or compromise.

6. Virtualization is a necessary technical enabler if the functions of BES Cyber 

Systems are to be moved to a cloud computing environment since a customer choosing 

to migrate one or more on-premise systems to the cloud will need to virtualize those 

systems for use in the cloud.4 

B. Cloud Computing

7. The National Institute of Standards and Technology (NIST) Information 

Technology Laboratory Computer Security Resource Center defines cloud computing 

as a “model for enabling convenient, on-demand network access to a shared pool of 

configurable computing resources (e.g., networks, servers, storage, applications, and 

services) that can be rapidly provisioned and released with minimal management effort or 

service provider interaction.”5 

 4 BES Cyber System is defined as “[o]ne or more BES Cyber Assets logically 

grouped by a responsible entity to perform one or more reliability tasks for a functional 

entity.” Glossary of Terms Used in NERC Reliability Standards, 

http://www.nerc.com/files/glossary_of_terms.pdf. The acronym BES refers to the bulk 

electric system.

5 NIST, The NIST Definition of Cloud Computing, Special Publication 800-145 

(Sept. 2011), https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-

145.pdf.
Docket No. RM20-8-000 - 4 -

8. The primary cloud service models include Infrastructure as a Service (IaaS), 

Platform as a Service (PaaS), and Software as a Service (SaaS). These three cloud 

service models provide different levels of flexibility and control to organizations 

choosing to use cloud computing services. Entities may use cloud computing services for 

the simple storage of data or, as discussed above, to host and operate virtual systems used 

for bulk electric system operations. As a general matter, cloud computing enables 

entities to focus resources on providing core services, such as transmission or generation

of electric energy, while outsourcing the IT infrastructure required to support them. 

9. Leveraging cloud computing services in technology and business processes

provides entities the opportunity to realize benefits in their IT operations, including 

greater scalability, greater flexibility and lower capital investment. Cloud computing 

services provide computing power and storage at a lower cost than maintaining in-house 

IT infrastructure while providing the capability for almost instantaneous expansion of 

services. Other potential benefits from the adoption of cloud computing services include

enhanced access to data and applications due to the inherent redundancy and multiple 

pathways used to access cloud computing services. 

C. Commission Technical Conferences

10. On June 27, 2019, the Commission held its annual Reliability Technical 

Conference to discuss four fundamental topics, including the impact of cloud-based
Docket No. RM20-8-000 - 5 -

services and virtualization on bulk electric system operations, planning and security.6 

The technical conference addressed, among other things: (1) evolution of cloud 

computing and virtualization of cloud computing and virtualization technologies; 

(2) outsourcing risk; (3) Reliability Standards modifications; (4) appropriate systems 

for a cloud environment; and (5) security and non-security related benefits. 

11. In general, panelists at the Reliability Technical Conference acknowledged the 

emergence of virtualization and cloud computing services and indicated that the 

Commission should take some action to address the use of these technologies for bulk 

electric system data management. Midcontinent Independent System Operator (MISO)

recommended that the Commission further engage industry and cloud service providers

in one or more technical conferences to clarify issues and direct timely industry action 

to establish a way forward with changes to CIP Reliability Standards specifically to 

accommodate the use of cloud computing services.7

 MISO explained that the benefits of 

virtualization include enhanced system recovery. In particular, MISO noted that during 

the past year it was able to recover virtual assets quicker than traditional computing assets

when testing backup and recovery processes. American Public Power Association and 

Large Public Power Council, moreover, stated that if done with care, cloud computing 

 6 FERC, Notice Inviting Post-Technical Conference Comments, Docket 

No. AD19-13-000 (Jul. 23, 2019).

7 See Reliability Technical Conference, Docket No. AD19-13-000, Tr. 118:6-12 

(Rosenthal).
Docket No. RM20-8-000 - 6 -

solutions can reduce risk, increase flexibility and improve the security posture of the bulk 

electric system.

8

 

12. During the Commission/DOE Security Investments for Energy Infrastructure 

Technical Conference on March 28, 2019, Southwest Power Pool (SPP) urged more 

flexibility regarding the use of cloud computing. SPP stated that it evaluated a number of 

products that would enable it to do a better job of protecting system data. SPP asserted 

the view that the currently-effective CIP Reliability Standards do not allow cloud-based 

technologies despite the fact that the vast majority of new products from many of its 

vendors are cloud-based. As an example, SPP stated that it:

believes that it cannot deploy the required CIP controls for 

certain system information were it to be stored on externallyhosted servers (i.e., “the cloud”). Yet, we are finding that 

more and more vendors have flagship products that require all 

or a portion of CIP system information to be stored offpremises. This was a driving factor in our recent replacement 

of our service management software and has also been a 

complicating factor in the evaluation of vulnerability 

scanning and vulnerability management solutions. Hence, 

SPP has given weight to solutions that are more expensive or 

do not provide as much value as some cloud alternatives. The 

standards should not be so prescriptive as to force SPP to 

avoid industry trends that have proven to be secure, but not 

necessarily compliant.9

 

 8 Tr. 114:12-14 (Jacobs).

9 See Nick Brown, Prepared Statement for Commission/DOE Security Investments 

for Energy Infrastructure Technical Conference, Docket No. AD19-12-000, at 3 (filed 

Apr. 2, 2019)
Docket No. RM20-8-000 - 7 -

13. The concerns reflected in the comments from the two recent technical conferences 

have prompted the issuance of this NOI to seek additional comments on the benefits and 

risks associated with the use of virtualization and cloud computing services in association 

with bulk electric system operations. Further, to the extent that there are barriers in the 

currently-effective CIP Reliability Standards to their use, the Commission seeks 

comment on whether it is appropriate for the Commission to direct action to facilitate the 

voluntary adoption of virtualization and cloud computing services.

II. Request for Comments 

14. In this proceeding, the Commission seeks comments on the potential benefits and 

risks associated with the use of virtualization and cloud computing services, as well as

whether barriers may exist in the CIP Reliability Standards that impede the adoption of

virtualization or cloud computing. Specifically, the Commission seeks comments on four 

general topics as part of this inquiry: (A) scope of potential use of virtualization and

cloud computing services; (B) potential benefits and risks associated with virtualization 

and cloud computing services; (C) potential impediments to adopting virtualization and

cloud computing services; and (D) potential use of new and emerging technologies in the 

current CIP standards framework.

15. In the following sections, we pose questions that commenters should address in 

their submissions. However, commenters need not address every topic or answer every 

question identified below.
Docket No. RM20-8-000 - 8 -

A. Scope of Potential Use of Virtualization and Cloud Computing Services 

16. As discussed above, virtualization and cloud computing services offer a wide 

variety of potential uses in the context of users, owners and operators of the bulk electric 

system. Some entities may choose to utilize the cloud simply for data storage. Other 

entities may rely on virtualization and cloud storage to operate systems that control one 

or more core functions. Potential uses may include one or more of the BES reliability 

operating services described in the Guidelines and Technical Basis section of Reliability 

Standard CIP-002-5.1a (Cyber Security — BES Cyber System Categorization).

10 

Specifically, it is possible that either virtualization or cloud computing services could be 

leveraged for the following reliability operating services: 

 Dynamic Response to BES conditions

 Balancing Load and Generation

 Controlling Frequency (Real Power)

 Controlling Voltage (Reactive Power)

 Managing Constraints

 Monitoring & Control

 Restoration of BES

 Situational Awareness

 Inter-Entity Real-Time Coordination and Communication

17. Using BES reliability operating services as a point of reference to distinguish 

among possible applications of virtualization and cloud computing services in bulk 

electric system operations:

A1. Identify and discuss which BES reliability operating services referenced 

above could be implemented in a virtualized environment.

 10 See Reliability Standard CIP-002-5.1a (Cyber Security — BES Cyber System 

Categorization), Guidelines and Technical Basis at 17-18.
Docket No. RM20-8-000 - 9 -

A2. Identify and discuss which BES reliability operating services referenced 

above could be implemented in a cloud computing environment.

A3. Identify and discuss any other BES reliability operating or support services 

that could be implemented in a virtualized environment.

A4. Identify and discuss any other BES reliability operating, data storage or 

support services that could be implemented in a cloud computing environment.

B. Potential Benefits and Risks Associated with Virtualization and Cloud 

Computing Services

18. The Commission seeks comment on the potential benefits and risks associated 

with virtualization and cloud computing services:

B1. What are the potential benefits associated with adopting virtualization for 

the BES reliability operating services identified in response to Questions A1 and 

A3?

B2. Are there risks associated with adopting virtualization for the BES 

reliability operating services identified in response to Questions A1 and A3? If 

risks exist, discuss whether these risks can be effectively mitigated by a 

responsibility entity.

B3. What are the potential benefits associated with adopting cloud computing 

services for the BES reliability operating services, data storage and support 

services identified in response to Questions A2 and A4?

B4. Are there risks associated with adopting cloud computing services for the 

BES reliability operating services data storage and support services identified in 

response to Questions A2 and A4? If risks exist, discuss whether these risks can 

be effectively mitigated by a responsible entity.

B5. What are the potential benefits of relying on third-party assessments to 

ensure the secure use of virtualization and cloud computing services for BES 

reliability operations and support services?

B6. Discuss any risks associated with relying on third party assessments to 

ensure the secure use of virtualization and cloud computing services for BES 

reliability operations and support services and potential solutions to mitigate those 

risks.
Docket No. RM20-8-000 - 10 -

C. Potential Impediments to Adopting Virtualization and Cloud 

Computing Services

19. As discussed above, during the Commission’s 2019 annual Reliability Technical 

Conference, several commenters alluded to the fact that cloud-based offerings continue to 

increase as vendors are moving more of their services to the cloud.11 Commenters further 

asserted that there is uncertainty on how virtualization and cloud computing services can 

be leveraged within the existing CIP framework. Similarly, at the March 2019

Commission/DOE Security Investments for Energy Infrastructure Technical Conference, 

a panelist asserted that there is uncertainty among registered entities on whether the CIP 

Reliability Standards allow cloud-based technologies “despite the fact that the majority of 

new products from many vendors are cloud-based.”12

20. In light of the concerns expressed at these technical conferences, the Commission 

seeks comment on potential challenges with how the implementation of virtualization and 

cloud computing technologies will fit into the framework of the CIP Reliability

Standards, and possible solutions to those challenges:

C1. Provide comment on the validity of the panelists’ concern discussed above 

and discuss the extent to which the trend toward cloud-based services could affect 

reliable and secure bulk electric system operations. 

C2. Are there any technical challenges in implementing virtualization 

technology for the BES reliability operating services identified in response to 

 11 See June 27, 2019 annual Reliability Technical Conference, Transcript pages

113 and 115-116.

12 See March 28, 2019, Commission/DOE Security Investments for Energy 

Infrastructure Technical Conference, Transcript page 128. 
Docket No. RM20-8-000 - 11 -

Question A1 that result from the current CIP Reliability Standards? Discuss how 

the CIP Reliability Standards could be augmented to address these challenges.

C3. Are there any challenges in implementing virtualization technology for the 

BES reliability operating services identified in response to Question A1 that result 

from compliance obligations associated with the CIP Reliability Standards?

Discuss how the CIP Reliability Standards could be augmented to address these 

challenges.

C4. Are there any technical challenges in implementing cloud computing 

technology for the BES reliability operating services identified in response to 

Question A2 that result from the current CIP Reliability Standards? Discuss how 

the CIP Reliability Standards could be augmented to address these challenges.

C5. Are there any challenges in implementing cloud computing technology for 

the BES reliability operating services identified in response to Question A2 that 

result from compliance obligations associated with the CIP Reliability Standards? 

Discuss how the CIP Reliability Standards could be augmented to address these 

challenges.

D. Potential Use of New and Emerging Technologies in the current CIP 

Standards Framework

21. The Commission seeks comment on potential new and emerging technologies 

beyond virtualization and cloud computing that responsible entities may be interested in 

adopting for the BES reliability operating services and if the CIP Reliability Standards 

would allow these technologies to be adopted.

D1. In addition to virtualization and clouding computing, discuss whether the 

CIP Reliability Standards limit the ability to take full advantage of new and 

emerging technologies for BES reliability operating services. Explain the types 

of new technologies, the potential benefits and how the CIP Reliability Standards 

may limit their use.

III. Comment Procedures

22. The Commission invites interested persons to submit comments on the matters 

and issues proposed in this notice, including any related matters or alternative 
Docket No. RM20-8-000 - 12 -

proposals that commenters may wish to discuss. Comments are due [Insert SERT Date 

60 days after date of publication in the FEDERAL REGISTER], and Reply 

Comments are due [Insert Date 90 days after date of publication in the 

FEDERAL REGISTER]. Comments must refer to Docket No. RM20-8-000, and must 

include the commenter’s name, the organization they represent, if applicable, and their 

address.

23. The Commission encourages comments to be filed electronically via the eFiling 

link on the Commission’s web site at http://www.ferc.gov. The Commission accepts 

most standard word-processing formats. Documents created electronically using wordprocessing software should be filed in native applications or print-to-PDF format and 

not in a scanned format. Commenters filing electronically do not need to make a paper 

filing.

24. Commenters that are not able to file comments electronically must send an 

original of their comments to: Federal Energy Regulatory Commission, Secretary of 

the Commission, 888 First Street NE, Washington, DC 20426.

25. All comments will be placed in the Commission’s public files and may be viewed, 

printed, or downloaded remotely as described in the Document Availability section 

below. Commenters on this proposal are not required to serve copies of their comments 

on other commenters.

IV. Document Availability

26. In addition to publishing the full text of this document in the Federal Register, 

the Commission provides all interested persons an opportunity to view and/or print the 
Docket No. RM20-8-000 - 13 -

contents of this document via the Internet through the Commission’s Home Page 

(http://www.ferc.gov) and in the Commission’s Public Reference Room during normal 

business hours (8:30 a.m. to 5:00 p.m. eastern time) at 888 First Street NE, Room 2A, 

Washington, DC 20426.

27. From the Commission’s Home Page on the Internet, this information is available 

on eLibrary. The full text of this document is available on eLibrary in PDF and 

Microsoft Word format for viewing, printing, and/or downloading. To access this 

document in eLibrary, type the docket number excluding the last three digits of this 

document in the docket number field.

28. User assistance is available for eLibrary and the Commission’s website during 

normal business hours from the Commission’s Online Support at (202) 502-6652 (toll 

free at 1-866-208-3676) or email at ferconlinesupport@ferc.gov, or the Public Reference
Docket No. RM20-8-000 - 14 -

Room at (202) 502-8371, TTY (202) 502-8659. E-mail the Public Reference Room 

at public.referenceroom@ferc.gov.

By direction of the Commission.

( S E A L )

Nathaniel J. Davis, Sr.,

Deputy Secretary.