FERC Acts on Cybersecurity Risks

FERC Acts on Cybersecurity Risks

On October 18, The Federal Energy Regulatory Commission (FERC) approved new mandatory reliability standards that are intended to address risks to cybersecurity. These new standards will augment the current Critical Infrastructure Protection (CIP) standards in order to mitigate the current risks to cybersecurity that are in the supply chain for grid-related systems.

The standards require transmission grid operators and electric utilities to create and implement plans that have security controls for supply chain management for industrial control systems, software, hardware, and services.

“Reliability of the bulk power system requires our attention to security issues as well as ensuring that the system serves consumers during peak-demand times,” FERC Chairman Joseph T. Kelliher said. “These proposed standards are intended to provide the adequate safeguards and training to help us do that.”

These standards have been in the works since September 2017, when they were first proposed by the North American Electric Reliability Corporation (NERC) as a response to a FERC directive that identified some possible threats to the utility center. NERC has a period of 18 months to implement the new standards; according to FERC the longer timeline to implement everything was justified because of the technical upgrades needed.

FERC also told NERC to implement the new standards into Electronic Access Control and Monitoring Systems (EACMS) associated medium and high Bulk Electric System Cyber Systems that fall under the supply chain risk management standards; they have 24 months to implement these changes. According to FERC, the EACMS can include authentication servers, intrusion detection systems, firewalls, and alerting systems. Once an EACMS has been compromised, the Bulk Electric System can be controlled.

The standard does not “require that every contract with a vendor include provisions for each of the listed items,” NERC said. The utilities would instead need to “ensure that these security items are an integrated part of procurement activities, such as a request for proposal or in the contract negotiation process.”

As part of a bigger security risk study, NERC will be giving FERC any cybersecurity risks they uncover in Physical Access Control Systems and Protected Cyber Assets, instead of developing new standards for those. These include things like electronic locks, motion sensors, networked printers, local area network switches, badge readers, and file transfer services.

In January 2018, FERC outlined the new standards in a Notice of Proposed Rulemaking, and this final ruling on the changes follows that notice closely. In FERC’s outline, they had initially given a 12-month timeline for implementation, even though NERC had requested 18 months, but they decided to allow for 18 months in the final rule.

FERC specified in Order No. 829, that the standards should focus on four security objectives: (1) software integrity and authenticity; (2) vendor remote access protections; (3) information system planning; (4) vendor risk management and procurement controls.

In March 2018, the American Public Power Association and other groups urged FERC to approve the proposal. At the same time, they requested that FERC wait to include EACMS in the new policies, which were given a longer timeline for implementation.

“The proposed standards fulfill Order No. 829’s directive and would mitigate supply chain cybersecurity risks to the BES while appropriately focusing on the systems and assets that are most critical to reliable operation of the BES,” the Association told FERC.

“While the standard is not a panacea, it is an important step forward to tackle a tough problem,” Commissioner Neil Chatterjee said. “It will be particularly important to revisit the standard after several years of experience to see what is working and what aspects could be improved. But again, today’s order is a good step in the right direction.”

The final rule will take effect 60 days after it is published in the Federal Register.

TariffShark CPUC Version 2 Now Available

TariffShark CPUC Version 2 Now Available

Links Technology Solutions, Inc. is excited to announce the release of TariffShark CPUC Version 2. This release is a major update to the software first introduced in November 2016 for California utilities managing tariffs and filing advice letters with the California Public Utility Commission. Initially built to streamline the management and filing of electric and gas tariffs, TariffShark CPUC v2 better handles the nuances of water utility tariffs.

If you currently use TariffShark CPUC, you are entitled to this software update for no additional fees. Our US-based Support Team is standing by to help you get started with the upgrade.

If you’re not yet using TariffShark CPUC to meet your CPUC tariff and advice letter obligations, we invite you to contact sales and ask for a software demonstration today.

What’s New in the Update?

Here are just a few of the new features and enhancements provided in the update.

  • Configurable business rules
  • Supports multiple, configurable Document Layouts and Header & Footer Templates
  • Multi-Sheet commands for viewing clean and marked content
  • Copy content from one Component to another
  • Publish multiple tariffs at once
  • Performance improvements throughout
  • And much, much more

TariffShark Updated with New Filing Types

For our enterprise TariffShark customers, software updates are available NOW for all TariffShark Hammerhead releases (4.1 and higher) and all TariffShark Tiger releases on TariffShark.com. This is a database-only update.

For our hosted customers, we will update your hosted servers in the next few days during the nightly server maintenance window. No action is required on your part.

Background and Details

On March 15, 2018, FERC took action to address changes in the income tax rates for the electric transmission and natural gas and oil pipeline companies that it regulates, stemming from the Tax Cuts and Jobs Act of 2017. The Commission’s news release provides an excellent summary of its actions with links to relevant notices, orders, and other resources.

In accordance with FERC’s recent actions, the following new Filing Types have been added to TariffShark:

TOFC (Code) Filing Title (Description) Filing Category Applies To
1430 FERC Form No. 501-G Report Compliance NGA Gas Pipelines
1440 Limited Sec 4 Tax Reduction Normal NGA Gas Pipelines
1450 Limited Tax Reduction Compliance Federal Power Act Electric (Traditional Cost of Service and Market Based Rates) Public Utilities

Today we are announcing the availability of TariffShark software releases that accommodate these Filing Type additions. Updated software, upgrade guides, and installation instructions are available NOW on the TariffShark website.

If you are currently running a recent TariffShark release, only your TariffShark database is affected by this update. Consult the TariffShark Releases page to assess the impact to your installation. If only your TariffShark database requires update, simply download and run the appropriate database installer to bring your TariffShark installation up to the latest release.

Please contact TariffShark Support at 847-252-1611 or at support@tariffshark.com if you have any questions or concerns.

eTariff RTF Document Compliance

TariffShark supports FERC’s recent notice regarding restricting the use of word processing software to include headers, footers, or footnotes when submitting eTariffs as RTF files. As a powerful and flexible tool, TariffShark offers filers various degrees of control over their tariff content and it allows them to stray from FERC’s guidance. This article discusses both TariffShark’s compliance with FERC’s notice and cautionary aspects depending on various filing situations.

Background and Details

On September 6, 2017, FERC issued a notice under Docket No. RM01-5-000 (Accession No. 20170906-3057) that tariff text posted in Rich Text Format (RTF) should not have footnotes, headers, or footers created programmatically using word processing software. This is because the Commission’s electronic tariff system (eTariff) does not reproduce this type of content in RTF on its website. If headers, footers, or footnotes are needed, filers should enter them separately in the body of the document on each page without using automated program features such as Insert Footnote or Insert Header or Insert Footer tools in word processors like Microsoft Word.

Let’s look at FERC’s guidance and discuss how to best use TariffShark in a compliant fashion.

Refer to Figure 1 below for a representation of a TRV as it would look if being edited in “TariffShark Microsoft Word” with a TariffShark Header and Footer; a Microsoft Word-style header and footer; and a Microsoft Word footnote. Then compare Figure 1 to each of the following scenarios and their Figures to see the RTF that TariffShark would generate.

FERC Guidance: Do NOT use Microsoft Word headers and footers when submitting RTF Files

TariffShark is mostly compliant with these restrictions; however, it does have limitations depending on how its users choose to file their tariffs and the options that they select.

Tariff Record Versions (TRVs) in Section-based or Sheet-based Record Formats…

With Document Layouts that include TariffShark Header and Footer Templates

If eTariffs are submitted via TariffShark in either Section-based or Sheet-based Record Formats, filers can choose to take advantage of Document Layouts that include TariffShark-generated headers and/or footers. This feature will inject TariffShark metadata on each page as TariffShark-generated headers and/or footers but will NOT include them in the resulting RTF (just as FERC requires).

In this scenario, TariffShark does NOT include the Microsoft Word-style header and footer in either the PDF (Figure 2) or the RTF (Figure 4).

With Document Layouts that omit TariffShark Header and Footer Templates

If a filer chooses to use Document Layouts without TariffShark-generated headers or footers, then they need to be careful of how they work in Microsoft Word. A filer has full control of all aspects of such TRVs’ tariff content, so they must not insert headers or footers in Microsoft Word.

Refer to Figure 3., and note that this RTF includes a Microsoft Word-style header and footer.

Without Document Layouts

Once again, if a filer chooses to NOT use Document Layouts, then they need to be careful of how they work in Microsoft Word. A filer has full control of all aspects of such TRVs’ tariff content, so they must not insert headers or footers in Microsoft Word.

Here TariffShark includes the Microsoft Word-style header and footer (Figure 3).

TRVs in Whole Document Record Format…

If eTariffs are prepared in TariffShark using Whole Document Record Format, users do not have the option to include Document Layouts thus TariffShark-generated headers and footers are also not available. As in the examples above, a filer has full control over all aspects of the tariff content. When filing in RTF format, they must take care to not insert headers or footers.

And TariffShark’s RTF rendering of the TRV again looks like Figure 3., with a Microsoft Word-style header and footer included.

FERC Guidance: Do NOT use Microsoft Word footnotes when submitting RTF files.

The Record Format selected for your Tariff (Section-based, Sheet-based, or Whole Document Record Formats) does NOT matter since TariffShark will include any footnotes inserted with the Microsoft Word footnote tool. Therefore, it is up to the filer to be careful not to violate this FERC notice by avoiding programmed footnotes when submitting eTariffs as RTF files.

We have purposely included a Microsoft Word footnote in all the scenarios discussed since no matter the TariffShark Record Format or Document Layout option, Microsoft Word footnotes will be rendered in the RTF (Figures 3 and 4).

Generalizations Regarding FERC’s eTariff system and compatibility with RTF files

In general, Microsoft Word is a very powerful word processor and can save all kinds of content in an RTF file. However, FERC has found that some types of content are not compatible with their systems and software.

  • Tariff filers have found that an RTF with an embedded image tends to be a VERY large file, often times too large to submit. In 2011, FERC staff guided that Microsoft Word 2007 saves such files as much smaller RTFs. If you’re running modern Microsoft Word software, RTFs submitted with embedded images should not be subject to this file size problem. Such RTFs even display fine in the eTariff Viewer.
  • FERC’s internal software for viewing and reviewing eTariff filings doesn’t contain the latest capabilities for viewing content. In 2011, FERC staff reported that it remains a bit of a struggle. When content doesn’t look “right”, FERC analysts have been instructed to look at the content in the eTariff Viewer and in eLibrary.
  • Advanced Word Features to Avoid
    • Avoid automatic content (paragraph numbering and footnotes are two examples).
    • Never use text boxes.
    • Avoid complex tables (fancy styling, cell merging and splitting, font orientation). Keep tables simple.
    • Keep Word styles simple. Use WordPad to view your RTF content to help identify potential issues.
    • Do not use drawing/diagramming objects. Instead, insert drawings as images.
    • Do not embed Excel worksheets (insert them as images).

Please contact TariffShark Support at 847-252-1611 or at support@tariffshark.com if you have any questions or concerns regarding this notice and ensuring that your FERC eTariff submissions through TariffShark comply with it.

Figures

Marked Word Doc
Figure 1 Editing TRV content in TariffShark Microsoft Word with a TariffShark Header and Footer and a Microsoft Word-style header and footer and a Microsoft Word footnote.

Clean PDF
Figure 2 TariffShark’s PDF rendering of Figure 1 for a Section-based TRV with Document Layout that includes TariffShark Header Template and Footer Template.

Clean RTF 2
Figure 3 TariffShark’s RTF rendering of Figure 1 for TRV with Document Layout that omits TariffShark Header Template and Footer Template. The same result is achieved for a TRV without a Document Layout and for a TRV in Whole Document Record Format.

Clean RTF
Figure 4 TariffShark’s RTF rendering of Figure 1 for TRV with Document Layout that includes TariffShark Header Template and Footer Template.