Will April 1 be Postponed?

The above title is my homage to the great catcher Yogi Berra, who is known for his short quotations that don’t literally make sense but usually express a more profound meaning – such as “The future ain’t what it used to be.” In the same spirit, I realize the title doesn’t make sense; I can assure you that April 1 won’t be postponed! But will the CIP v5 compliance date, currently set for April 1, be postponed?

I’ve just heard that NERC is being lobbied by some organizations to move the v5 compliance date back to July 1. The ostensive reason for doing this is that it would avoid a funny three-month period during which the 17 CIP v5 requirements with the “Identify, Assess and Correct” language would be in force, even though that language will go away once v6 comes into effect. This is due to the fact that the seven CIP v6 standards won’t come into effect until July 1, rather than April 1 as originally planned.

Of course, the reason v6 implementation is delayed is because FERC didn’t approve CIP v6 in December; but that may have been inevitable. After FERC issued their NOPR last July, which said they intended to approve v6 but asked for comment on other questions, I wrote a post pointing out that they hadn’t left themselves much time to make a decision on these other questions, since the v6 compliance date would automatically move back if they didn’t approve those standards at the end of 2015 (comments were due in late September and were clearly going to be voluminous. Late December was really the earliest that FERC could have issued their Order, and even that would have been lightning-fast in FERC terms. It turns out they approved v6 on January 21).

I further speculated in the post that this might have been FERC’s intention – that is, to delay the v6 implementation schedule. You may ask why FERC would want to do that. I also speculated that they, like a lot of others, may have been concerned that the April 1 date for v5 implementation was too ambitious, due to the huge uncertainty over the meaning of some of the most important requirements and concepts in v5. Since just delaying the “Identify, Assess and Correct” language wouldn’t have made any difference for anybody’s actions (because no region or entity I know of believed that would be enforced anyway, even if v6 had never come into effect), FERC’s real intention may have been to get v5 moved back as well as v6.[i] And now it seems this may happen.

Of course, I’ve said for a while (most recently in this post) that I believe the effective enforcement date for CIP v5 will not be April 1. I speculated that it will be about one year from that date (i.e. around April, 2017) before auditors feel confident enough in their understanding of CIP v5 that they’ll be comfortable issuing PVs for anything other than egregious non-compliance.

So if the official date for v5 is pushed back to July 1, this means the awkward one-year interregnum will be reduced to nine months. Ideally, it would be reduced even further (I’d like to see it reduced to zero, meaning the v5/v6 compliance date would be officially pushed back a whole year to April 1, 2017), but three months is certainly substantial. The big effect of this is that NERC entities that aren’t close to being fully compliant on April 1 will have another three months to get their house in order before they have to start self-reporting violations. Since I believe there are a lot of entities that fall into this classification, pushing the date back will constitute an act of mercy by NERC.

How can NERC push the v5 date back? I suppose they can go the “full Monty” route, where they petition FERC to do this. But I would think there could simply be a general announcement by NERC and/or the regions saying that, due to the v6 enforcement delay, it really makes sense to delay v5 enforcement for three months as well.

Of course, we all know the real reason the date should be pushed back is that very little guidance has been made available on the many interpretation issues of CIP v5.[ii] But I’m fine if NERC wants to point to FERC’s delay as the reason this needs to be done. Any port in a storm is a good one.

The views and opinions expressed here are my own and don’t necessarily represent the views or opinions of Deloitte Advisory.

---

[i] In the post, I was thinking FERC might delay approving v6 for more than a quarter, which would have led to an enforcement date of October 1 or even later. But even a three-month delay will be significant.

[ii] In my opinion, there was no way NERC could have provided real guidance, absent rewriting certain key parts of the v5 standards; it’s unfortunate they had to go down so many blind alleys until they came to that realization (although I admit that for a while I allowed myself to become hopeful they could pull this off). Of course, they are now ordering some rewriting to be done, but I’m almost certain the rewriting won’t be thorough enough to make CIP v5/6/7 fully enforceable, in the sense that a fine issued by FERC would be upheld if challenged in court – more on this topic soon. Even though the rewritten standards (which will be CIP v7) will be helpful, I believe it will be at least three to four years before they will be in force. I had hoped that FERC would order NERC to rewrite CIP-002 as part of their Order approving v5 (which was issued November 22, 2013). Had they done that, we would be at least two years closer to having a more usable set of CIP standards.