NERC Case Notes: Reliability Standard CIP-001-1

 

AES Cayuga, LLC, FERC Docket No. NP10-10-000 (November 13, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: NPCC conducted a compliance audit of AES Cayuga and determined that it might have violated R1 and R2 inasmuch as it failed to have a written procedure in place for dealing with sabotage events which included: (i) steps for recognizing and making the appropriate personnel aware of sabotage events; (ii) communicating sabotage events to the appropriate Interconnection personnel; and (iii) steps on how to deal with a bomb threat called into the plant.

Finding: NPCC assessed a penalty of $10,000 based on its findings that: (i) the alleged violations were AES Cayuga's first violations; (ii) AES Cayuga was cooperative during the investigation; (iii) AES Cayuga agreed to resolve the violations and investigation in an expeditious manner; and (iv) AES Cayuga agreed to implement safeguards to protect against future violations. NPCC also concluded that the actual impact on the reliability of the bulk power system was minimal since the violations were merely documentation issues. Since NPCC found that AES Cayuga did not have procedures in place for the communication of a sabotage event, however, NPCC recommended a penalty of $10,000. NERC approved the penalty of $10,000, and, in addition to factors considered by NPCC, also gave consideration to the following factors: (i) AES Cayuga mitigated the violation of CIP-001-1 R1 before the audit began; and (ii) AES Cayuga mitigated the violation of CIP-001-1 R2 before the audit was completed.

Penalty: $10,000

FERC Order: Issued December 11, 2009 (no further review)

AES Greenidge, LLC, FERC Docket No. NP10-11-000 (November 13, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: NPCC auditors determined that AES Greenidge may have violated CIP-001-1 R1 through R4 since it did not have a documented sabotage procedure in place on June 21, 2007; rather the document was dated February 13, 2008, several months after AES Greenidge became a registered entity on June 21, 2007. NPCC found that AES Greenidge violated CIP-001-1 R1, R2 and R4 from June 21, 2007 through February 13, 2008. NPCC further found that AES Greenidge violated CIP-001-1 R3 for a longer time period. Specifically, NPCC found that the February 13, 2008 sabotage procedure documentation did not provide its operators with sabotage response guidelines, including a list of the appropriate personnel contacts. NPCC found that AES Greenidge violated CIP-001-1 R3 from June 21, 2007 through April 8, 2008.

Finding: NPCC assessed a $10,000 penalty for the violations of CIP-001-1 R1 through R4 based upon the following factors: (i) AES Greenidge had no prior violations; (ii) AES Greenidge was cooperative during the investigation and did not misrepresent or conceal facts; (iii) AES Greenidge agreed to an expeditious resolution of the issue; and (iv) AES Greenidge implemented safeguards to protect against future violations of the requirements. NPCC further concluded that the impact on the bulk power system reliability was minimal since the violations were a documentation issue rather than a failure to perform and since AES Greenidge had an Emergency Action Plan in place on June 21, 2007. NERC approved the $10,000 penalty. In addition to the factors considered by NPCC, NERC also considered the following factors: (i) AES Greenidge mitigated its violations of CIP-001-1, R1, R2 and R4 before the audit began; and (ii) AES Greenidge mitigated its violation of CIP-001-1, R3 before the audit was completed.

Penalty: $10,000

FERC Order: Issued December 11, 2009 (no further review)

AES Somerset, LLC, FERC Docket No. NP10-12-000 (November 13, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: NPCC audited AES Somerset and identified possible violations of CIP-001-1 R1 and R2 inasmuch as it failed to have a written procedure in place on June 21, 2007 for dealing with sabotage events which included: (i) steps for recognizing and making the appropriate personnel aware of sabotage events; (ii) communicating sabotage events to the appropriate Interconnection personnel; and (iii) steps on how to deal with a bomb threat called into the plant. AES Somerset's Sabotage Reporting Procedure document was dated February 13, 2008 and was not in place on June 21, 2007, when AES Somerset became a registered entity.

Finding: NPCC assessed a penalty of $10,000 based on its findings that: (i) the alleged violations were AES Somerset's first violations; (ii) AES Somerset was cooperative during the investigation; (iii) AES Somerset agreed to resolve the violations and investigation in an expeditious manner; and (iv) AES Somerset agreed to implement safeguards to protect against future violations. NPCC also concluded that the actual impact on the reliability of the bulk power system was minimal since the violations were merely documentation issues. Since NPCC found that AES Somerset did not have procedures in place for the communication of a sabotage event, however, NPCC recommended a penalty of $10,000. NERC approved the penalty of $10,000, and, in addition to factors considered by NPCC, also gave consideration to the following factors: (i) AES Somerset mitigated the violation of CIP-001-1 R1 before the audit began; and (ii) AES Somerset mitigated the violation of CIP-001-1 R2 before the audit was completed.

Penalty: $10,000

FERC Order: Issued December 11, 2009 (no further review)

AES Westover, FERC Docket No. NP10-13-000 (November 13, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: NPCC conducted an audit of AES Westover and identified several possible violations of CIP-001-1 R1 through R4 based on AES Westover's failure to have in place a procedure for dealing with sabotage events which included: (i) recognizing and making operating personnel aware of sabotage events; (ii) communication of sabotage events; (iii) response guidelines for operating personnel; and (iv) communication contact lists. AES Westover provided to the NPCC auditors a Sabotage Reporting Procedure document dated February 10, 2008; which was several months after AES Westover became a registered entity (on June 21, 2007). NPCC therefore determined that the violations of R1, R2 and R4 lasted from June 21, 2007 through February 10, 2008. NPCC further found that AES Westover violated CIP-001-1 R3 for a longer time period. Specifically, NPCC found that the February 13, 2008 sabotage procedure documentation did not provide its operators with sabotage response guidelines, including a list of the appropriate personnel contacts. NPCC found that AES Westover violated CIP-001-1 R.3 from June 21, 2007 through April 6, 2008.

Finding: NPCC assessed a $10,000 penalty for the violations of CIP-001-1 R1 through R4 based upon the following factors: (i) AES Westover had no prior violations; (ii) AES Westover was cooperative during the investigation and did not misrepresent or conceal facts; (iii) AES Westover agreed to an expeditious resolution of the issue; and (iv) AES Westover implemented safeguards to protect against future violations of the requirements. NPCC further concluded that the impact on the bulk power system reliability was minimal since the violations were a documentation issue rather than a failure to perform, and since AES Westover had an Emergency Action Plan in place on June 21, 2007. NERC approved the $10,000 penalty. In addition to the factors considered by NPCC, NERC also considered the following factors: (i) AES Westover mitigated its violations of CIP-001-1, R1, R2 and R4 before the audit began; and (ii) AES Westover mitigated its violation of CIP-001-1, R3 before the audit was completed.

Penalty: $10,000

FERC Order: Issued December 11, 2009 (no further review)

Alameda Municipal Power, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Alameda Municipal Power ("AMP") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violation was from August 23, 2007 through December 31, 2008.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was AMP's first violation of this standard, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system due to AMP's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Ashburnham Municipal Light Plant, FERC Docket No. NP09-34-000 (July 31, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: During a compliance audit, NPCC found that AMLP violated CIP-001-1, R1 through R4 because it failed to have a written procedure for dealing with possible sabotage events which includes procedures for recognizing and communicating about sabotage events, response guidelines for operating personnel and communication contact lists. NPCC noted that AMLP was notified of its inclusion on the NERC compliance registry on June 21, 2007, but that it did not implement an executed sabotage reporting procedure until December 5, 2007. AMLP was therefore deemed to be in violation of CIP-001-1, R1 through R4 from June 21, 2007 until December 5, 2007.

Finding: NPCC declined to impose penalties for AMLP's violations based on its consideration of the following facts: (i) AMLP's status as a small LSE serving a peak load of only 7 MW means that it could only minimally impact the bulk power system; (ii) AMLP cooperated during the investigation; (iii) the violations had a minimal impact on the bulk power system; (iv) the violations occurred during the 2007 transition period; (v) AMLP corrected its non-compliance with CIP-001-1, R1 through R4 by December 5, 2007; and (vi) the violations were not repetitive, there was no evidence that AMLP attempted to conceal the violations or that the violations were intentional, and AMLP did not have any relevant negative compliance history. For these reasons, NERC affirmed NPCC's recommendation not to impose any penalties for AMLP's violations.

Penalty: $0

FERC Order: Issued August 26, 2009 (no further review)

BASF Corp., FERC Docket No. NP11-115-000 (February 23, 2011)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: TRE

Issue: As a result of an audit in February 2010, TRE discovered that BASF Corp. (BASF), functioning as a Generator Operator, did not possess appropriate documentation showing that procedures existed to communicate information to all appropriate parties in the Interconnection about sabotage events.

Finding: BASF agreed to pay a penalty of $11,000 and to undertake other mitigation measures to resolve the violation. TRE found that the violation constituted only a minimal risk to bulk power system reliability since the personnel at BASF's Utilities Operations were aware of the appropriate parties in the Interconnection that they needed to contact in the event of a sabotage incident (even though the required information was not documented in BASF's Emergency Plan). The duration of the violation was from June 28, 2007 through February 4, 2010. In approving the penalty amount, NERC found that this violation was BASF's first violation of this Reliability Standard; BASF was cooperative during the enforcement process and did not conceal the violation; BASF has a compliance program in place when the violation occurred (which was evaluated as a mitigating factor); and there were no additional mitigating or aggravating factors.

Penalty: $11,000

FERC Order: Issued March 25, 2011 (no further review)

Black Hills Power, Inc., FERC Docket No. NP11-14-000 (November 5, 2010)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: High

Region: WECC

Issue: Black Hills did not provide its sabotage response guidelines to field personnel because it misinterpreted the term "operating personnel."

Finding: It was determined by WECC that the violation did not constitute a serious or substantial risk to the bulk power system because Black Hills operating personnel have knowledge of sabotage recognition due to extensive training. The duration of violation was from June 18, 2007 through July 31, 2009.

Penalty: $12,000 (aggregate for multiple violations)

FERC Order: Issued December 3, 2010 (no further review)

Boralex Stratton Energy, LP, FERC Docket No. NP11-253-000 (July 29, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: NPCC

Issue: During an off-site compliance audit, NPCC determined that Boralex Stratton Energy, LP (Boralex) could not provide evidence of the following: a documented procedure for the recognition of and making its operating personnel aware of sabotage events at two of its generating facilities in violation of R1; a documented procedure for communicating information concerning sabotage events to appropriate parties in violation of R2; sabotage response guidelines, including personnel to contact, in violation of R3; and established communications contacts with local FBI officials and documented reporting procedures in violation of R4.

Finding: NPCC assessed a $5,000 penalty for these violations. NPCC determined that the violations posed a minimal risk but did not pose a serious or substantial risk to the reliability of the bulk power system (BPS) because the two generating facilities at issue were only 55 MW and 44 MW, there was no actual impact to the BPS, and there was not a relevant event on the ISO NE system. NERC approved the settlement in an Administrative Citation Notice of Penalty.

Penalty: $5,000 (aggregate for 2 violations)

FERC Order: Issued August 29, 2011 (no further review)

BTU QSE Services, Inc., FERC Docket No. NP09-30-000 (July 10, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R3

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: TRE

Issue: TRE found that BTU QSE Services, Inc. (BTU) did not have a written sabotage reporting procedure in place prior to October 3, 2007, that the procedure was not included in the BTU operator procedures manual, and that the procedure was not available to personnel prior to or during TRE's audit.

Finding: TRE found BTU violated CIP-001-1 R1 and R3, and the parties entered into a settlement agreement in which TRE assessed an aggregate penalty of $5,000 for these violations. TRE based its determination on the following facts: (i) the violations were deemed documentation issues since BTU had ERCOT procedures in place, (ii) BTU hired a consultant to expedite its compliance with NERC Reliability Standards, (iii) BTU corrected its failure to have an adequate sabotage reporting procedure in place during the course of the audit, (iv) BTU cooperated during the audit, (v) BTU had alternate procedures in place to notify appropriate parties in the event of a sabotage event, (vi) BTU has a culture of compliance, (vii) the violations were not deemed to be violations that would put the bulk power system reliability at a serious or substantial risk, and (viii) BTU is a governmental agency that did not act willfully to violate any standard. NERC approved the settlement for these reasons, and also based on its findings that: (i) BTU did not contest the alleged violations, (ii) BTU agreed to the settlement in order to avoid extended litigation and to resolve the violations, and (iii) BTU did not have repeated violations.

Penalty: $5,000

FERC Order: Issued August 7, 2009 (no further review)

Buckeye Power, Inc., FERC Docket No. NP11-104-000 (February 1, 2011)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Lower

Region: RFC

Issue: Buckeye Power self-reported that for approximately three months in 2007 it did not have a documented FBI contact in violation of CIP-001-1 R4.

Finding: RFC determined the violation posed minimal risk to the reliability of the bulk power system because Buckeye Power maintained a documented emergency response plan which included an extensive contact list, including a general FBI contact, as well as fire, police and Homeland Security contact numbers, as well as applicable reporting procedures.

Penalty: $0

FERC Order: Issued March 3, 2011 (no further review)

Central Electric Power Cooperative, Inc., FERC Docket No. NP11-199-000 (May 26, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (R1, R2, R3, R4)

Violation Severity Level: Severe (R1, R2, R3, R4)

Region: SERC

Issue: During an audit, SERC determined that Central Electric Power Cooperative, Inc. (CEPCI) did not possess appropriate procedures: (a) to recognize and make operating personnel aware of sabotage events on its facilities as well as multi-site sabotage events affecting larger parts of the Interconnection (R1), (b) to communicate relevant information about sabotage events to the appropriate parties in the Interconnection (R2), and (c) for reporting disturbances from sabotage events (R3). In addition, CEPCI had not developed the appropriate communication contacts with the local FBI office (R4).

Finding: CEPCI agreed to pay a penalty of $5,000 and to undertake other mitigation measures to resolve the violations. SERC found that the violations posed only a minimal risk to bulk power system reliability since CEPCI did have a Rural Utility Service-approved Emergency Response Plan that provided guidelines to the operating personnel on responding to emergency situations. In addition, CEPCI's system is only connected to the bulk power system through radial connections, and if there were a problem on CEPCI's system, those entities to which it is connection have the appropriate Protection System facilities in place that would serve to protect the bulk power system. The duration of the violations was from June 18, 2007 through March 21, 2011 (R1 and R3), September 20, 2007 (R4) and September 21, 2007 (R2).

Penalty: $5,000 (aggregate for 4 penalties)

FERC Order: Issued June 24, 2011 (no further review)

Central Lincoln People's Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Central Lincoln People's Utility District ("CLPD") did not have in place sabotage response guidelines for its personnel. Duration of the violation was from June 18, 2007 when the standard became enforceable through March 31, 2008.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was CLPD's first violation of this standard, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Bartow, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: FRCC

Issue: City of Bartow ("Bartow") did not have a procedure for the recognition of, and making its operating personnel aware of, sabotage events or communicating information to appropriate parties in the Interconnection concerning sabotage events. It also did not establish the required contacts with local authorities and did not provide its operating personnel with the required sabotage response guidelines. Duration of the violation was from June 18, 2007 when the standard became enforceable through April 7, 2008.

Finding: Penalty was deemed appropriate because this was Bartow's first violation of this standard, the violation was self-reported and the violation did not pose a serious or substantial threat to the reliability of the bulk power system because while Bartow did not have the required procedures in place, it had trained its employees with respect to certain emergency information.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Batavia Municipal Electric Utility, FERC Docket No. NP11-219-000 (June 29, 2011)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: RFC

Issue: RFC found that Batavia Municipal Electric Utility (Batavia), a Load-Serving Entity, did not possess sufficient documentation showing that, prior to September 3, 2008, it had procedures in place to recognize and make its operating personnel aware of sabotage events.

Finding: RFC and Batavia entered into a settlement agreement to resolve multiple violations, whereby Batavia agreed to pay a penalty of $10,000 and to undertake other mitigation measures. RFC found that the CIP-001-1 violation did not constitute a serious or substantial risk to bulk power system reliability since Batavia was performing weekly inspections of its substation for equipment condition and security at that time and Batavia’s facilities are only connected to the bulk power system through radial lines. In addition, Batavia’s substations are monitored by a SCADA system, which monitors equipment operations, protective device failures, as well as unauthorized access to the control building. The duration of the CIP-001-1 violation was from September 17, 2007 through September 3, 2008. In approving the settlement agreement, NERC found that these were Batavia’s first violations of the relevant Reliability Standards; Batavia was cooperative during the enforcement process and did not conceal the violations; Batavia had a compliance program in place (which was evaluated as a mitigating factor); and there were no additional aggravating or mitigating factors.

Penalty: $10,000 (aggregate for 3 violations)

FERC Order: Issued July 29, 2011 (no further review)

City of Burbank Water and Power, FERC Docket No. NP10-107-000 (June 2, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: LNC – Level 1 (R1, R2, R4); LNC – Level 3

Region: WECC

Issue: The City of Burbank Water and Power (BURB) failed to establish (i) procedures to recognize and make its operating personnel aware of sabotage events on its facilities and multi-site sabotage affecting larger portions of the Interconnection; (ii) a procedure to communicate information regarding sabotage events to appropriate parties; (iii) sabotage response guidelines to report disturbances resulting from sabotage events and (iv) a contact at the FBI or a reporting procedure.

Finding: The duration of the alleged violations of CIP-001-1 R1 through R3 was from June 18, 2007, the date the Standards became enforceable, until January 18, 2008, when BURB had complete procedures including the required elements of R1 through R3. The duration of the violation of CIP-001-1 R4 was from June 18, 2007, the date the Standard became enforceable, until March 12, 2008, when BURB established communications contacts with the local FBI. WECC assessed a penalty of $44,500 for these and other alleged violations. In assessing this penalty, WECC considered these factors: (1) the alleged violations were BURB's first occurrence of non-compliance with these NERC Reliability Standards; (2) the alleged violations of CIP-001-1 R1 through R4 and other NERC Reliability Standards were self-reported after notification of upcoming off-site compliance audits; (3) BURB cooperated during the compliance enforcement process; (4) there was no attempt to conceal a violation or evidence of intent to do so; and (5) the violations did not pose a serious or substantial risk to the reliability of the bulk power system.

Penalty: $44,500 (aggregate for multiple violations)

FERC Order: Issued July 2, 2010 (no further review)

City of Camden, FERC Docket No. NP11-266-000 (August 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: SERC determined through an on-site audit that City of Camden (Camden) violated R1 because it failed to have procedures for the recognition of and making its operating personnel aware of sabotage events on its facilities and multi-site sabotage. SERC further determined that Camden violated R2 because it did not have procedures in place for the communication of information concerning sabotage events to appropriate parties in the Interconnection.

Finding: SERC found that the violations did not constitute a serious or substantial risk to the bulk power system (BPS) because Camden is a small utility of 52 MW serving a small number of residential and commercial customers with about 650 miles of 12 kV distribution lines, and does not own any BPS facilities; and the interconnecting Transmission Owner/Transmission Operator has procedures in place such that sabotage events affecting the BPS would be recognized and reported by that entity. Duration of violation was June 18, 2007 through August 13, 2010.

Penalty: $0

FERC Order: Issued September 30, 2011 (no further review)

City of Clarksdale, Mississippi, Clarksdale Public Utilities Commission, FERC Docket No. NP11-62-000 (December 22, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SPP

Issue: The City of Clarksdale, Mississippi, Clarksdale Public Utilities Commission (Clarksdale), as a Generator Operator and Load Serving Entity, failed to (1) have written procedures for the recognition of sabotage events and for making its operating personnel aware of sabotage events on its facilities or multi-site sabotage affecting larger portions of the Interconnection as required by R1; (2) have written procedures for the communication of information concerning sabotage events to appropriate parties within the Interconnection as required by R2; (3) provide its operating personnel with sabotage response guidelines and/or a list of personnel to contact for reporting disturbances due to sabotage events as required by R3; and (4) establish communication contacts with local FBI officials or develop associated reporting procedures as required by R4.

Finding: The NERC Board of Trustees Compliance Committee (NERC BOTCC) approved a $5,000 penalty for these and other Reliability Standards violations. In assessing the penalty, the NERC BOTCC considered the following facts: this was Clarksdale's first violation of the subject NERC Reliability Standard; the violations were self-reported; Clarksdale cooperated during the compliance enforcement process; Clarksdale did not attempt to conceal the violations or intend to do so; the violations did not create a serious or substantial risk to the bulk power system and there were no other mitigating or aggravating factors or extenuating circumstances.

Penalty: $5,000 (aggregate for multiple violations)

FERC Order: Issued January 21, 2011 (no further review)

City of Healdsburg, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: City of Healdsburg ("Healdsburg") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violation was from August 10, 2007 through October 9, 2007.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was Healdsburg's first violation of this standard, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system due to Healdsburg's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Holyoke Gas and Electric Department, FERC Docket No. NP08-11-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NPCC

Issue: The City of Holyoke Gas and Electric Department self-reported that while it had an Emergency Operations Plan in place, it did not conform with the requirements because it did not include sabotage reporting procedures.

Finding: No penalty assessed because the violations were self-reported and quickly remedied, occurred prior to the standard becoming mandatory, and the violations were deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that these violations constituted the City's first.

Total Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

City of Minden, FERC Docket No. NP11-71-000 (December 22, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SPP

Issue: City of Minden (Minden) violated CIP-001-1 R1 because its sabotage reporting procedures did not have a procedure for making its operating personnel aware of sabotage events. Minden violated R2 and R3 because, prior to June 13, 2008, its sabotage reporting procedures failed to (1) provide for the communication of relevant information regarding sabotage events to appropriate parties in the Interconnection, and (2) provide operating personnel with response guidelines. Minden violated R4 because, prior to August 25, 2008, it had not established an FBI contact as required.

Finding: It was determined by SPP that the violations did not constitute a serious or substantial threat to the bulk power system because Minden is a small entity, and while its procedures were deficient, it did have procedures in place, and there were no sabotage events during the duration of the violations. The duration of the violations was from June 18, 2007, when the Reliability Standard became enforceable, through May 10, 2010 (R1), June 13, 2008 (R2 and R3), and August 25, 2008 (R4).

Penalty: $3,000

FERC Order: Issued January 21, 2011 (no further review)

City of Orangeburg Department of Public Utilities, FERC Docket No. NP08-30-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: The City of Orangeburg Department of Public Utilities ("Orangeburg") self-certified to SERC that it did not (i) have procedures for the recognition of and for making its operating personnel aware of sabotage events on its facilities; (ii) have procedures for the communication of sabotage events to appropriate parties in the Interconnection; (iii) provide its operating personnel with sabotage response guidelines; and (iv) establish communication contacts with local FBI officials or develop appropriate reporting procedures. At the time of the self-certification, Orangeburg stated that it was in the process of completing such procedures. SERC found that Orangeburg was in violation of CIP-001-1, R1 through R4.

Finding: SERC declined to assess penalties for the violations because the violations (i) occurred during the transition period to mandatory standards and (ii) did not put the bulk power system reliability at a serious or substantial risk. In affirming SERC's conclusions, NERC also noted that the violations were the first incidences of violation by Orangeburg and that Orangeburg acted immediately to mitigate and/or correct the violations.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

City of Palo Alto, FERC Docket No. NP10-67-000 (March 1, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Palo Alto's procedures for communicating information about sabotage events did not contain specific procedures for personnel to follow in order to recognize and report sabotage events to Palo Alto operating personnel, did not include its transmission operator among entities required to be notified of sabotage events, and did not include the names of personnel to contact for reporting disturbances due to sabotage events. The duration of violations was from June 18, 2007 when the standard became effective through December 16, 2008.

Finding: The violations did not create a serious or substantial risk to the bulk power system because while deficient, Palo Alto did have a procedure in place. Palo Alto received credit for being a small entity, cooperation with the investigation and having no prior history of violations.

Penalty: $24,500 (aggregate for multiple violations)

FERC Order: Issued March 31, 2010 (no further action)

City of Pasadena Water and Power, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: City of Pasadena Water and Power ("Pasadena") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violation was from June 18, 2007 when the standard became enforceable through July 25, 2007.

Finding: Penalty was deemed appropriate because these were Pasadena's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Pasadena's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Roseville, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: City of Roseville ("Roseville") did not have in place final plans and procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violation was from June 18, 2007 when the standard became enforceable through August 30, 2007.

Finding: Penalty was deemed appropriate because the violations were self-reported, this was Roseville's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Roseville's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Santa Clara d/b/a Silicon Valley Power, FERC Docket No. NP11-130-000 (February 28, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High (R1, R2, R4); Moderate (R3)

Region: WECC

Issue: During an off-site compliance audit, Silicon Valley Power (SVP) failed to provide (1) a documented procedure for the recognition of sabotage events and making its operating personnel aware of the same in violation of R1; (2) a documented procedure for communicating information about sabotage events to required parties in violation of R2; (3) documentation of sabotage response guidelines in violation of R3; and (4) documented evidence that it had established communications with local FBI officials in violation of R4. However, subsequent to the audit, SVP provided evidence that it had written procedures in compliance with R2 and R3 that were in place at the time of the audit. Duration of violation was June 18, 2007, when the Standard became enforceable, through September 15, 2008, when the violations were mitigated.

Finding: WECC Enforcement determined that the violation of R1, R2 and R3 posed a moderate risk to the bulk power system because SVP's failure to have a documented sabotage procedure could result in damage to the system due to SVP's location and high-voltage connections to Pacific Gas and Electric Company's system and because SVP could not produce the documents required by R2 and R3 at the time of the audit. The violation of R4 was determined not to pose a serious or substantial risk to the bulk power system because it was only a documentation issue. Further, the NERC BOTCC concluded the penalty appropriate because this was WECC's first violation of the Standard, about half of the aggregate violations found were documentation issues, and SVP was cooperative during the investigation.

Penalty: $94,000 (aggregate for multiple violations)

FERC Order: Issued March 25, 2011 (no further review)

City of Shasta Lake, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: City of Shasta Lake ("Shasta") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violation was from June 18, 2007 when the standard became enforceable through April 10, 2008.

Finding: Penalty was deemed appropriate because these were Shasta's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Shasta's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

City of Ukiah, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: City of Ukiah ("Ukiah") had an emergency procedure, but it did not include the required procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and Ukiah did not establish the required contacts with local governments. Duration of the violations was from August 10, 2007 through June 17, 2008.

Finding: Penalty was deemed appropriate because the violations were self-reported, these were Ukiah's first violations of this standard, Ukiah had in place an emergency procedure, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Ukiah's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Claiborne Electric Cooperative, Inc. FERC Docket No. NP11-46-000 (November 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: Claiborne Electric Cooperative, Inc. ("CEC") self-reported its failure to have sabotage procedures per CIP-001-1.

Finding: The Abbreviated Notice of Penalty stated this was CEC's first violation, CEC self-reported the violation after being contacted by SERC staff following the submission of a Self-Certification, CEC was cooperative, there was no evidence of an attempt or intention to conceal a violation. In addition, the violation did not pose a serious or substantial threat to reliability of the bulk power system because CEC only operates a total of six miles of radial 115 kV transmission lines and another transmission owner owns and operates the interconnection points where CEC receives its electrical service, which would help limit the impact of a sabotage event.

Penalty: $5,000

FERC Order: Issued December 30, 2010 (no further review)

Clallam County PUD No. 1, FERC Docket No. NP11-30-000 (November 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R3

Violation Risk Factor: Medium

Violation Severity Level: High

Region: WECC

Issue: In January 2009, Clallam County PUD No. 1 (CCPD) self-reported that it did not have procedures in place to make its operating personnel aware of sabotage events and that it did not make available to its operating personnel the sabotage reporting guidelines for reporting disturbances.

Finding: WECC and CCPD entered into a settlement agreement, whereby CCPD agreed to pay a penalty of $15,000 and to undertake other mitigation measures to resolve multiple violations. WECC found that the violations of CIP-001-1 did not constitute a serious or substantial risk to bulk power system reliability since the effects of any sabotage event would be localized to CCPD's area due to the nature and location of CCPD's facilities. But, WECC did find that the violations of CIP-001-1 caused a moderate risk to the bulk power system since the lack of adequate sabotage procedures in place could have damaged both CCPD's system and the bulk power system, as CCPD's operating personnel would have been unable to take appropriate measures to protect bulk power system reliability. The duration of the CIP-001-1 violations was from June 18, 2007 through March 1, 2009. In approving the settlement agreement, WECC considered the fact these were CCPD's first violations of the relevant Reliability Standards; the violations were self-reported; CCPD was cooperative during the enforcement process and did not attempt to conceal the violations; and there were no additional mitigating or aggravating factors.

Penalty: $15,000 (aggregate for multiple violations)

FERC Order: Issued December 30, 2010 (no further review)

Clatskanie People's Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Clatskanie People's Utility District ("CPUD") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violations was from June 18, 2007 when the standard became enforceable through August 1, 2008.

Finding: Penalty was deemed appropriate because these were CPUD's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to CPUD's size and location.

Total Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Cleco Corporation, FERC Docket No. NP11-265-000 (August 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SPP

Issue: During a compliance audit, SPP found that Cleco Corporation (Cleco), as a Balancing Authority, Generator Operator, Load Serving Entity and Transmission Operator, did not have Sabotage Reporting Procedures that properly incorporated procedures to make operating personnel aware of sabotage events on Cleco's facilities or of multi-site sabotage events that affect large parts of the Interconnection.

Finding: SPP and Cleco entered into a settlement agreement to resolve multiple violations, whereby Cleco agreed to pay a penalty of $27,000 and to undertake other mitigation measures. SPP found that the CIP-001-1 violation only constituted a minimal risk to bulk power system reliability. Cleco's Sabotage Reporting Procedures did provide instructions on recognizing and reporting sabotage events on Cleco's facilities, including having personnel report a sabotage event to their supervisor who would then report the event to the manager or supervisor of transmission. The duration of the CIP-001-1 violation was from June 18, 2007 through December 30, 2010. In approving the settlement agreement, NERC found that these were Cleco's first violations of the relevant Reliability Standards; Cleco was cooperative during the enforcement process and did not conceal the violations; Cleco had a compliance program in place (which was evaluated as a mitigating factor); and there were no additional aggravating or mitigating factors or other extenuating circumstances.

Penalty: $27,000 (aggregate for 6 violations)

FERC Order: Issued September 30, 2011 (no further review)

Cloverland Electric Cooperative, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: RFC

Issue: Cloverland Electric Cooperative ("Cloverland") self-reported that it did not have a procedure for the recognition of sabotage events or communicating information to appropriate parties in the Interconnection concerning sabotage events. It also did not establish the required contacts with local authorities, and did not provide its operating personnel with the required sabotage response guidelines. Duration of the violations was from June 18, 2007 when the standard became enforceable through December 17, 2007.

Finding: Penalty was deemed appropriate because these were Cloverland's first violations of this standard, the violations were self-reported and the violations did not pose a serious or substantial threat to the reliability of the bulk power system because no sabotage events occurred during the non-compliance period, and while Cloverland did not have the required procedures in place, it had similar procedures that covered similar information.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Colorado River Commission of Nevada, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Colorado River Commission of Nevada ("CRCN") had a safety plan, but it did not include the required procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and CRCN did not establish the required contacts with local governments. Duration of the violations was from June 18, 2007 when the standard became enforceable through December 22, 2007.

Finding: Penalty was deemed appropriate because the violations were self-reported, these were CRCN's first violations of this standard, CRCN had in place a safety plan, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to CRCN's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Coos-Curry Electric Cooperative, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Coos-Curry Electric Cooperative, Inc. ("Coos-Curry") did not provide its personnel with sabotage response guidelines, including whom to contact in the event of a sabotage event. Duration of the violation was from June 18, 2007 when the standard became enforceable through June 5, 2008.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was Coos-Curry's first violation of this standard, Coos-Curry had a plan in place, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system because it was a documentation issue.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Covanta York Renewable Energy, LLC, FERC Docket No. NP10-125-000 (July 6, 2010)

Reliability Standard: CIP-001-1

Requirement: R2, R3, R4

Violation Risk Factor: Medium (R2, R3, R4)

Violation Severity Level: Level 4 (R2, R3, R4)

Region: RFC

Issue: During a spot check in February 2009, RFC found that Covanta York Renewable Energy, LLC (Covanta York), as the successor in interest of Veolia ES York, LLC (Veolia York), had potential violations of CIP-001-1. While reviewing Veolia ES York Safety Program SP 4 Preparedness, Prevention and Contingency Plan, Revision No. 4, 12/19/2007, RFC determined that Veolia York did not have adequate procedures in place to communicate information on sabotage events to the appropriate parties in the Interconnection, had not provided its operating personnel with sabotage reporting guidelines (such as personnel to contact) for reporting sabotage-related disturbances, and had not established communications contacts with its local FBI official nor developed the necessary reporting procedures.

Finding: RFC and Covanta York entered into a settlement agreement, whereby Covanta York neither admitted nor denied the violations but agreed to pay a penalty of $7,500 and to undertake other mitigation measures. RFC found that the alleged violations did not constitute a serious or substantial risk to the bulk power system since Covanta York is a waste-to-energy facility (of the 48 MW generated at the facility – 18 MW are used to operate the facility and 30 MW are available for the grid) that has a small impact on the grid. And although it was not contained in the emergency plan, Covanta York was obligated, under contract, to notify certain parties of any sabotage events and posted the relevant phone numbers in its control room. The duration of the alleged violations were from August 22, 2007 through October 2, 2009. In determining the penalty amount, RFC also considered the fact that these alleged violations were Covanta York's first violations of the Reliability Standards; Covanta was cooperative during the enforcement process; after being registered as the Generator Operator, Covanta York took immediate action to improve compliance with the Reliability Standards and reduce risks to bulk power system reliability; Covanta York has a compliance program in place; and there were no additional mitigating or aggravating factors.

Penalty: $7,500

FERC Order: Issued August 5, 2010 (no further review)

Cowlitz County PUD No. 1, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Cowlitz County PUD No. 1 ("Cowlitz") did not provide its personnel with sabotage response guidelines, including whom to contact in the event of a sabotage event. Duration of the violation was from June 18, 2007 when the standards became enforceable through May 30, 2008.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was Cowlitz's first violation of this standard, Cowlitz had a plan in place, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system because it was a documentation issue.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

CPI (CP) LLC, FERC Docket No. NP11-183-000 (May 26, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: NPCC

Issue: CPI (CP) LLC (CPI), a Generator Operator, did not have a signed Sabotage Reporting Procedure, as required by CIP-001-1 R1; failed to include within its Sabotage Reporting Procedure actions to notify other parties in the Interconnection of a sabotage event as required by R2; failed to provide its personnel with sabotage reporting guidelines for reporting disturbances due to sabotage events as required by R3; and failed to contact the local office of the Federal Bureau of Investigation to verify the accuracy of the contact information located within CPI’s Sabotage Reporting Procedure document and did not have an established communications contact at the local FBI office as required by R4.

Finding: NPCC assessed a penalty of $15,000 for these and other violations. In reaching this determination, the NPCC considered the following: the violations constituted CPI’s first violations of the subject Reliability Standards; CPI self-reported the violations; CPI cooperated throughout the compliance process; CPI did not attempt to conceal the violations; the violations posed a minimal risk and did not pose a serious or substantial risk to the reliability of the bulk power system and there were no other mitigating or aggravating factors or extenuating circumstances that would affect the assessed penalty.

Penalty: $15,000 (aggregate for 7 violations)

FERC Order: Issued June 24, 2011 (no further review)

Deseret Generation & Transmission Co-operative, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Deseret Generation & Transmission Co-operative ("Deseret") did not provide evidence that it had established contacts with the local authorities required by the standard. Duration of the violation was from June 18, 2007 when the standard became enforceable through March 10, 2008.

Finding: Penalty was deemed appropriate because the violation was self-reported, this was Deseret's first violation of this standard, Deseret had a plan in place, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system because it was a documentation issue.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Doyle I, LLC, FERC Docket No. NP08-20-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Lower

Region: SERC

Issue: SERC found that, although Doyle I, LLC ("Doyle") developed procedures to report sabotage, it failed to establish communication contacts with local FBI officials or to verify the FBI's phone number.

Finding: SERC declined to assess penalties for the violation because the violation (i) occurred during the transition period to mandatory standards and (ii) did not put the bulk power system reliability at a serious or substantial risk. NERC affirmed SERC's findings for these reasons, and also added that the violation was the first incidence of violation by Doyle and Doyle worked cooperatively with SERC and acted immediately to mitigate and/or correct the violation.

Penalty: $0

FERC Order: 124 FERC ¶ 61,105, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Dynegy Inc., FERC Docket No. NP11-241-000 (July 28, 2011)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: NPCC

Issue: During a compliance audit in 2009, NPCC found that Dynegy Inc.’s (Dynegy) Sithe Independence gas-fired station (a 1,086 MW facility in Oswego County, New York) did not possess security sabotage reporting procedures that included provisions on communicating information about sabotage events to its Transmission Operators and Reliability Coordinators, as required.

Finding: NPCC and Dynegy entered into a settlement agreement to resolve multiple violations, whereby Dynegy agreed to pay a penalty of $50,000 and to undertake other mitigation measures. NPCC found that the CIP-001-1 violation constituted a serious or substantial risk to bulk power system reliability since the failure of the Sithe Independence plant to send out the required sabotage notifications to its Transmission Operators and Reliability Coordinators had the potential to jeopardize the safe and reliable operation of the bulk power system. The duration of the CIP-001-1 violation was from June 21, 2007 through August 5, 2010. In approving the settlement agreement, NERC found that these were Dynegy’s first violations of the Reliability Standards in the NPCC region; some of the violations were self-reported; Dynegy was cooperative during the enforcement process and did not conceal the violations; Dynegy had a compliance program in place (which was evaluated as a mitigating factor); and there were no additional aggravating or mitigating factors.

Penalty: $50,000 (aggregate for 8 violations)

FERC Order: Issued August 29, 2011 (no further review)

East Kentucky Power Cooperative, FERC Docket No. NP10-83-000 (March 31, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SERC

Issue: East Kentucky Power Cooperative (EKPC) did not have a written procedure describing how to recognize a sabotage event and make operating personnel aware of the event or have procedures for communicating sabotage information to appropriate parties in the Interconnection. EKPC did not provide supply operating personnel with sabotage response guidelines or have written or electronic documentation of reporting procedures for coordination between local FBI and EKPC facilities.

Finding: The violation period was June 18, 2007, the date the standard became enforceable, through September 23, 2008, when EKPC completed a mitigation plan. SERC and EKPC entered a settlement agreement in which SERC assessed a $7,000 penalty (aggregate for multiple violations). In determining the penalty amount, SERC considered that EKPC did not have prior violations of CIP-001-1 or any closely-related standard, was cooperative during the enforcement process, agreed to resolve the issue through settlement, and the alleged violations did not pose a serious or substantial risk to the bulk power system.

Penalty: $7,000 (aggregate for multiple violations)

FERC Order: Issued April 30, 2010 (no further review)

East Mississippi Electric Power Association, FERC Docket No. NP11-104-000 (February 1, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: East Mississippi Electric Power Association (EMEPA) did not have procedures for the recognition of, or making its operating personnel aware of, sabotage events on its facilities and multi-site sabotage affecting larger portions of the Interconnection, including at what stage operating personnel should be alerted to the event, in violation of CIP-001-1 R1. EMEPA did not have procedures for the communication of information concerning sabotage events to appropriate parties in the Interconnection in violation of CIP-001-1 R2, and EMEPA did not have sabotage response guidelines, including personnel to contact, for reporting disturbances due to sabotage events provided to its operations personnel for the entire enforceable period in violation of CIP-001-1 R3.

Finding: SERC determined that the violations posed a minimal risk to the reliability of the bulk power system because EMEPA had an Emergency Response Plan (ERP) in place since April 2006, and it would have provided guidance on how to respond during an emergency situation even though it was not compliant with the requirements. Also, EMEPA does not own or operate any bulk power system facilities, and the duration of the violation was limited and was mitigated by September 28, 2007.

Penalty: $4,000

FERC Order: Issued March 3, 2011 (no further review)

East Texas Electric Cooperative, Inc., FERC Docket No. NP08-17-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: East Texas Electric Cooperative's Emergency Operations Plan did not address recognition of sabotage events, communicating sabotage events to relevant entities, or contact with law enforcement officials. In addition, employee training regarding recognition of sabotage had not been given.

Finding: Penalty was appropriate because the violations were due to a lack of documentation, occurred during the period of transition to mandatory standards, and were deemed not to be violations that put the bulk power system reliability at serious or substantial risk.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Eastman Cogeneration Limited Partnership, FERC Docket No. NP09-32-000 (July 10, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: SPP

Issue: SPP found that Eastman failed to (i) have procedures in place for recognizing and making its operating personnel aware of sabotage events and (ii) establish contacts with FBI officials or develop FBI reporting procedures.

Finding: SPP declined to assess penalties for Eastman's violations based on the following findings: (i) Eastman self-reported the violations, (ii) Eastman submitted a mitigation plan which would resolve the violations and prevent recurrence of the violations, and (iii) the Eastman cogeneration facility is physically located within the perimeter of a facility owned by the Eastman Chemical Company which already has its own plant protection personnel and procedures in place. SPP further determined that the violations would not put the bulk power system reliability at a serious or substantial risk based upon its location within the perimeter of Eastman Chemical Company and the fact that any attempt to sabotage the cogeneration facility would have to first penetrate Eastman Chemical security, which already had its own protocols in place. Finally, SPP noted that the violations were not repeat violations, Eastman did not have any negative compliance history, Eastman did not attempt to conceal the violations, evidence did not suggest that the violations were intentional, and there were no aggravating circumstances. NERC approved SPP's recommendations for some of these reasons, and also based upon its findings that Eastman submitted a mitigation plan to prevent recurrence of the violations and was cooperative during the investigation.

Penalty: $0

FERC Order: Issued August 7, 2009 (no further review)

EFS Parlin Holdings LLC, FERC Docket No. NP10-58-000 (March 1, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: RFC

Issue: EFS Parlin's procedures for communicating information about sabotage events to required entities did not describe when communication of sabotage events should take place or who is responsible for the communications. Duration of violation was from May 12, 2008, the date EFS Parlin was registered with NERC, through May 29, 2009.

Finding: The violation did not create a serious or substantial risk to the bulk power system because while deficient, EFS Parlin did have a procedure in place.

Penalty: $5,000

FERC Order: Issued March 31, 2010 (no further action)

Electric Reliability Council of Texas, Inc., FERC Docket No. NP11-268-000 (September 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: High

Region: Texas RE

Issue: Through an audit, Texas RE determined that the Electric Reliability Council of Texas, Inc. (ERCOT) did not provide evidence that it had procedures in place for recognition of sabotage events, and its training programs did not contain criteria for the recognition of sabotage events.

Finding: Texas RE determined that the violation did not pose a serious or substantial risk to the BPS because after the audit, ERCOT provided evidence that at the time of the audit, procedures were in place for personnel to recognize and report some sabotage events such as suspicious activities. Duration of violation was June 18, 2007 through December 1, 2008. Texas RE and the NERC BOTCC took into consideration that this was ERCOT's first violation of the Standard in reaching a penalty assessment.

Penalty: $384,000 (aggregate for 15 violations)

FERC Order: Issued October 28, 2011 (no further review)

Electrical District No. 2, Docket No. NP11-270 (September 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: WECC

Issue: During an off-site compliance audit, WECC determined Electrical District No. 2 (ED2) was in violation of CIP-001-1 because it: failed to have procedures for the recognition of sabotage events or procedures to make its staff aware of sabotage events in violation of R1; failed to have procedures for the communication of information concerning sabotage events to the appropriate parties in the Interconnection in violation of R2; failed to provide its operating personnel with sabotage response guidelines for reporting disturbances due to sabotage events in violation of R3; and failed to have communication contacts at its local FBI office in violation of R4. The violations lasted from June 18, 2007 to Apr. 1, 2008.

Finding: WECC determined that the violations posed a minimal risk, but did not pose a serious or substantial risk, to the reliability of the BPS because ED2 was a small entity that had a service area of 100 sq. miles with a peak load of only 60 MW and only had a radial connection to a 115 kV transmission system.

Penalty: $6,500 (aggregate for 4 violations)

FERC Order: Issued October 28, 2011 (no further review)

Elmhurst Mutual Power & Light Co., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Elmhurst Mutual Power & Light Co. ("Elmhurst") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violations was from June 18, 2007 when the standard became enforceable through September 30, 2007.

Finding: Penalty was deemed appropriate because the violations were self-reported, these were Elmhurst's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Elmhurst's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Emerald People's Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Emerald People's Utility District ("Emerald") had an Emergency Response Plan, but it did not have in place the required procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violations was from June 18, 2007 when the standard became enforceable through September 4, 2009.

Finding: Penalty was deemed appropriate because the violations were self-reported, these were Emerald's first violations of this standard, Emerald had in place an Emergency Response Plan, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Emerald's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Energy Northwest - Energy Business Services, FERC Docket No. NP10-68-000 (March 1, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3 and R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Energy Northwest self-reported that it did not have in place procedures for recognizing sabotage events, making its operating personnel aware of sabotage events, communicating information regarding sabotage events to relevant entities in the Interconnection, and it did not provide personnel with sabotage response guidelines or establish communication contacts with local government officials. Duration of violations was from June 30, 2008, the date Energy Northwest was registered with NERC, through July 9, 2008.

Finding: The violations did not create a serious or substantial risk to the bulk power system because Energy Northwest only owned a number of wind turbines, and sabotage at one wind turbine would not be expected to influence the operation of other turbines, the net effect being within the normal variation of wind generation. Energy Northwest received credit for self-reporting the violations, cooperation with the investigation and no prior history of violations.

Penalty: $3,000

FERC Order: Issued March 31, 2010 (no further review)

EPCOR USA North Carolina LLC (Roxboro), FERC Docket No. NP10-155-000 (July 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SERC

Issue: During an audit, EPCOR USA North Carolina LLC (EPCOR) produced its required procedure (Sabotage Reporting and associated documents) but noted that it had been put in place only a month earlier, and other documentation of compliance prior to adoption of the procedure was insufficient to show compliance with the Reliability Standard.

Finding: Duration of violations of R1, R2 and R4 was from June 28, 2007 until September 22, 2008. Duration of violation of R3 was from June 28, 2007 until October 8, 2008. The violations did not pose a serious or substantial risk to the reliability of the bulk power system due to the small size of EPCOR's generating facility. EPCOR had no prior violations of the Reliability Standard and cooperated with the audit, including starting its own internal investigation, and voluntarily resolved the issue by quickly adopting a testing and maintenance plan. While EPCOR did not fully complete its mitigation plan until after the due date, SERC determined that it had substantially completed the mitigation plan on time and no resulting impact on the penalty amount occurred.

Penalty: $30,000 (aggregate for multiple violations)

FERC Order: Issued August 27, 2010 (no further review)

EPCOR USA North Carolina LLC (Southport), FERC Docket No. NP10-156-000 (July 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SERC

Issue: During an audit, EPCOR USA North Carolina LLC (EPCOR) produced its required procedure (Sabotage Reporting and associated documents) but noted that it had been put in place only a month earlier, and other documentation of compliance prior to adoption of the procedure was insufficient to show compliance with the Reliability Standard.

Finding: Duration of violations of R1, R2 and R4 was from June 28, 2007 until September 22, 2008. Duration of violation of R3 was from June 28, 2007 until October 8, 2008. The violations did not pose a serious or substantial risk to the reliability of the bulk power system due to the small size of EPCOR's generating facility. EPCOR had no prior violations of the Reliability Standard and cooperated with the audit, including starting its own internal investigation, and voluntarily resolved the issue by quickly adopting a testing and maintenance plan. While EPCOR did not fully complete its mitigation plan until after the due date, SERC determined that it had substantially completed the mitigation plan on time and no resulting impact on the penalty amount occurred.

Penalty: $30,000 (aggregate for multiple violations)

FERC Order: Issued August 27, 2010 (no further review)

Escanaba Municipal Electric Utility, FERC Docket No. NP09-22-000 (May 4, 2009)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: MRO

Issue: While personnel had been instructed to report any instances of sabotage to management or to plant operators, Escanaba failed to have a written procedure for recognizing sabotage events.

Finding: No penalty due to mitigating factors including (1) the violation was deemed to be a documentation issue and was deemed not to be a violation that put the bulk power system reliability at serious or substantial risk; (2) Escanaba self-reported the violation and cooperated in the MRO investigation; and (3) the violation was Escanaba's first standards violation.

Penalty: $0

FERC Order: Issued May 29, 2009 (no further review)

Escanaba Municipal Electric Utility, FERC Docket No. NP09-22-000 (May 4, 2009)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: MRO

Issue: While personnel had been instructed to report any instances of sabotage to management or to plant operators, who were in turn instructed to report evidence of sabotage to appropriate contacts in the Interconnection, Escanaba failed to have a written procedure for the communication of information concerning sabotage events.

Finding: No penalty due to mitigating factors including (1) the violation was deemed to be a documentation issue and was deemed not to be a violation that put the bulk power system reliability at serious or substantial risk; (2) Escanaba self-reported the violation and cooperated in the MRO investigation; and (3) the violation was Escanaba's first standards violation.

Penalty: $0

FERC Order: Issued May 29, 2009 (no further review)

Escanaba Municipal Electric Utility, FERC Docket No. NP09-22-000 (May 4, 2009)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: MRO

Issue: While personnel had been instructed to contact management and the appropriate local authorities upon discovery of any sabotage event, Escanaba failed to provide written sabotage report guidelines to its operators.

Finding: No penalty due to mitigating factors including (1) the violation was deemed to be a documentation issue and was deemed not to be a violation that put the bulk power system reliability at serious or substantial risk; (2) Escanaba self-reported the violation and cooperated in the MRO investigation; and (3) the violation was Escanaba's first standards violation.

Total Penalty: $0

FERC Order: Issued May 29, 2009 (no further review)

Escanaba Municipal Electric Utility, FERC Docket No. NP09-22-000 (May 4, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: MRO

Issue: Escanaba failed to establish the required communication contacts with local authorities.

Finding: No penalty due to mitigating factors including (1) the violation was deemed to be a documentation issue and was deemed not to be a violation that put the bulk power system reliability at serious or substantial risk; (2) Escanaba self-reported the violation and cooperated in the MRO investigation; and (3) the violation was Escanaba's first standards violation.

Penalty: $0

FERC Order: Issued May 29, 2009 (no further review)

ExxonMobil Refining and Supply Company, FERC Docket No. NP12-10 (December 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: TRE

Issue: After receiving notice of an upcoming audit by TRE, ExxonMobil, a GO, self-reported it did not incorporate consistent communications procedures in its sabotage reporting guidelines as required by the Standard. Specifically, the guidelines in place did not have sufficient procedures on communicating sabotage events to ERCOT ISO.

Finding: TRE found the violation constituted a minimal risk to BPS reliability as the violation was mainly a documentation issue. ExxonMobil’s operators generally knew to contact ERCOT ISO regarding any sabotage event. The duration of the violation was June 28, 2007 through January 12, 2011. ExxonMobil’s compliance program was not considered a mitigating factor in determining the appropriate penalty.

Penalty: $13,000 (aggregate for two violations)

FERC Order: Issued January 27, 2012 (no further review)

Florida Public Utilities Company, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: FRCC

Issue: Florida Public Utilities Company ("FPUC") did not have a procedure for the recognition of, and making its operating personnel aware of, sabotage events or communicating information to appropriate parties in the Interconnection concerning sabotage events. It also did not establish the required contacts with local authorities, and did not provide its operating personnel with the required sabotage response guidelines. Duration of the violation was from June 18, 2007 when the standard became enforceable through June 1, 2008.

Finding: Penalty was deemed appropriate because these were FPUC's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system because while FPUC did not have the required procedures in place, it had trained its employees with respect to certain emergency information.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

FPL Energy, LLC (NextEra Energy Resources, LLC), FERC Docket No. NP09-17-000 (March 31, 2009)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: SERC

Issue: SERC found that FPL Energy's sabotage response program failed to include procedures for identifying sabotage and for apprising its personnel of sabotage events affecting its facilities and other portions of the Interconnection. SERC further found that this violation superseded an earlier alleged violation because FPL Energy failed to remedy the violation in accordance with a mitigation plan which FPL Energy had certified as completed.

Finding: SERC found that FPL Energy's failure to document protection system maintenance and testing and its insufficient sabotage reporting program was a "low actual and foreseen risk to bulk power system reliability." SERC's Compliance Enforcement Staff therefore determined that a single, aggregate penalty of $250,000 bore a reasonable relationship to the alleged violation's duration and seriousness. The penalty amount took into consideration FPL Energy's efforts to remedy the violation in a timely manner and its willingness to remedy the issue through settlement. NERC approved SERC's penalty recommendation, and noted that: (i) FPL Energy self-reported the original violation, (ii) FPL Energy was cooperative during the investigation, (iii) the violation was primarily documentation-related, and (iv) FPL Energy revamped and improved its compliance program. NERC also listed the following "aggravating circumstances": (i) FPL Energy failed to provide evidence supporting the completion of its mitigation plan when required, (ii) FPL Energy did not respond to SERC's request for evidence of the completion of its mitigation program for a four-month period, and (iii) FPL Energy certified that it had successfully completed its mitigation program when it, in fact, had not completed the program successfully.

Penalty: $250,000 (aggregate for four violations)

FERC Order: Issued April 30, 2009 (no further review)

FPL Energy, LLC (NextEra Energy Resources, LLC), FERC Docket No. NP09-17-000 (March 31, 2009)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: SERC

Issue: SERC determined that FPL Energy's sabotage response program had no procedures in place for communicating information on sabotage events to the appropriate Interconnection parties. SERC further found that this violation superseded an earlier alleged violation because FPL Energy failed to remedy the violation in accordance with a mitigation plan which FPL Energy had certified as completed.

Finding: SERC found that FPL Energy's failure to document protection system maintenance and testing and its insufficient sabotage reporting program was a "low actual and foreseen risk to bulk power system reliability." SERC's Compliance Enforcement Staff therefore determined that a single, aggregate penalty of $250,000 bore a reasonable relationship to the alleged violation's duration and seriousness. The penalty amount took into consideration FPL Energy's efforts to remedy the violation in a timely manner and its willingness to remedy the issue through settlement. NERC approved SERC's penalty recommendation, and noted that: (i) FPL Energy self-reported the original violation, (ii) FPL Energy was cooperative during the investigation, (iii) the violation was primarily documentation-related, and (iv) FPL Energy revamped and improved its compliance program. NERC also listed the following "aggravating circumstances": (i) FPL Energy failed to provide evidence supporting the completion of its mitigation plan when required, (ii) FPL Energy did not respond to SERC's request for evidence of the completion of its mitigation program for a four-month period, and (iii) FPL Energy certified that it had successfully completed its mitigation program when it, in fact, had not completed the program successfully.

Penalty: $250,000 (aggregate for four violations)

FERC Order: Issued April 30, 2009 (no further review)

Fox Energy Company LLC, FERC Docket No. NP10-186-000 (September 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: RFC

Issue: Fox Energy's sabotage reporting manual did not include reporting procedures for contacting the Reliability Coordinator, Transmission Owner, Transmission Operator or Balancing Authority as required by R2.

Finding: It was determined by ReliabilityFirst that the violation did not constitute a serious or substantial risk to the bulk power system because Fox Energy maintained a list of appropriate parties to contact in the event of sabotage in its control room. An additional factor for the determination of penalty amount included that the violation was an administrative documentation issue.

Penalty: $4,000

FERC Order: Issued October 29, 2010 (no further review)

French Broad Electric Membership Corporation, FERC Docket No. NP11-104-000 (February 1, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: SERC staff found French Broad Electric Membership Corporation (French Broad) failed to have procedures for the recognition of and for making its operating personnel aware of sabotage events on its facilities and multi-site sabotage affecting larger portions of the Interconnection in violation of CIP-001-1 R1. French Broad was also found in violation of CIP-001-1 R2 as it did not have procedures for the communication of information concerning sabotage events to appropriate parties in the Interconnection. French Broad was in violation of CIP-001-1 R3 because SERC staff found it failed to provide its operating personnel with sabotage response guidelines, including personnel to contact, for reporting disturbances due to sabotage events, and it did not establish communications contacts, as applicable, with local FBI officials and develop reporting procedures as appropriate to its circumstances in violation of CIP-001-1 R4.

Finding: SERC determined that the violations posed a minimal risk to the reliability of the bulk power system because the violations involved French Broad's registration as a load serving entity and French Broad has no generation or transmission bulk power system assets. French Broad had a Rural Utilities Service approved Electric System Emergency Restoration Plan (ERP) in place, and even though the ERP did not meet the exact requirements of CIP-001-1, it would have provided guidance on how to respond during an emergency situation.

Penalty: $5,000

FERC Order: Issued March 3, 2011 (no further review)

Grays Harbor County PUD, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Grays Harbor County PUD ("Grays Harbor") did not have in place procedures for recognition of sabotage events, making personnel aware of sabotage events, communicating information about sabotage events to relevant entities, reporting disturbances due to sabotage events, and did not establish the required contacts with local governments. Duration of the violations was from June 18, 2007 when the standards became enforceable through September 28, 2007 except for R3 which lasted through March 31, 2009.

Finding: Penalty was deemed appropriate because the violations were self-reported, these were Grays Harbor's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system due to Grays Harbor's size and location.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Greenwood Commissioners of Public Works, FERC Docket No. NP10-147-000 (July 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (R1, R2, R3, R4)

Violation Severity Level: Severe (R1, R2, R3, R4)

Region: SERC

Issue: In October 2009, the Greenwood Commissioners of Public Works (GCPW) submitted a self-report and self-certification that it did not have adequate procedures in place for: (1) recognizing sabotage events (concerning both its facilities and for multi-site sabotage affecting large parts of the Interconnection) and making operating personnel aware of the sabotage event; (2) communicating sabotage events to the appropriate parties in the Interconnection; (3) having sabotage response guidelines available for operating personnel (such as a list of personnel to contact); and (4) reporting to or coordinating with personnel at the local Federal Bureau of Investigation office during a sabotage event.

Finding: SERC and GCPW entered into a settlement agreement, whereby GCPW agreed to pay a penalty of $10,000 and to undertake other mitigation measures. SERC found that the violations did not constitute a serious or substantial risk to bulk power system reliability since GCPW's total load is less than 75 MW and is only interconnected to the grid through a radial connection. Also, while the violations were ongoing, there were no reported sabotage events on GCPW's system. The duration of the violations was from June 18, 2007 (when the Reliability Standards became enforceable) through September 30, 2009 (when the mitigation plan was completed). In addition, NERC considered the fact that these violations were GCPW's first violations of the relevant Reliability Standards; GCPW was cooperative during the enforcement process and did not attempt to conceal the violations; GCPW had a positive compliance program; and there were no additional mitigating or aggravating factors.

Penalty: $10,000

FERC Order: Issued August 27, 2010 (no further review)

Hardee Power Partners Limited, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: FRCC

Issue: Hardee did not have evidence that it had established the required contacts with local authorities. Duration of the violation was from June 18, 2007 when the standard became enforceable through February 13, 2008.

Finding: Penalty was deemed appropriate because this was Hardee's first violation of this standard, and the violation did not pose a serious or substantial threat to the reliability of the bulk power system because Hardee did provide the contact information for local authorities to its personnel.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Haywood Electric Membership Corporation, FERC Docket No. NP11-253-000 (July 29, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: Haywood Electric Membership Corporation (Haywood) self-reported that it failed to include procedures for recognition of and making operating personnel aware of sabotage events in its facilities or multi-site sabotage events in violation of R1; it failed to have procedures for communicating sabotage information to relevant parties in the interconnection in violation of R2; it failed to provide its operating personnel with sabotage response guidelines in violation of R3; and it failed to establish communications contacts with the local authorities and develop necessary reporting procedures as required by R4. Duration of violation was January 16, 2009 through February 24, 2011 (R1), July 17, 2009 (R2, R4) and June 2, 2010 (R3).

Finding: SERC determined that the violation posed a minimal risk to the bulk power system because Haywood is a small utility of 84 MW with 0.42 miles of 115 kV transmission lines. Moreover, the local Transmission Owner/Transmission Operator had procedures in place such that any sabotage event that affected the bulk power system would have been reported by it. The Administrative Citation Notice also stated that the violation was self-reported, and noted that Haywood developed an appropriate sabotage reporting procedure.

Penalty: $0

FERC Order: Issued August 29, 2011 (no further review)

Henderson Municipal Power & Light, FERC Docket No. NP10-50-000 (February 12, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R3

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SERC

Issue: Henderson Municipal Power & Light ("HMPL") failed to include language in its documentation of its procedure for the recognition of and making its operators aware of sabotage events. HMPL also self-reported that it had not performed training with respect to sabotage detection. Duration of violations was from June 18, 2007 when the standard became effective through July 23, 2008.

Finding: The violations were deemed to be documentation issues that did not pose a serious or substantial risk to bulk power system reliability.

Penalty: $35,000 (aggregate with various penalties)

FERC Order: Issued March 12, 2010 (no further review)

Hermiston Generating Co., L.P., FERC Docket No. NP10-133-000 (July 6, 2010)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Lower

Region: WECC

Issue: Hermiston Generating Co., L.P.'s (HERM) process for the recognition of and making its operating personnel aware of sabotage events was not complete.

Finding: The alleged violations occurred from June 18, 2007, when the Standard became enforceable, until August 17, 2009. WECC imposed a $59,500 penalty for this and other alleged violations. In assessing the penalty, WECC considered these factors: this was HERM's first alleged violations of the Reliability Standards; HERM cooperated during the compliance enforcement process; HERM did not attempt to conceal the violations or intend to do so; the Violation Severity Levels and Violation Risk Factors, the durations of the violations, the lack of aggravating factors that would justify a higher penalty, and WECC found that the alleged violations did not create a serious or substantial risk to the bulk power system.

Penalty: $59,500 (aggregate for multiple violations)

FERC Order: Issued August 5, 2010 (no further review)

Hetch Hetchy Water and Power, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium (for R1, R2)

Violation Severity Level: Not provided

Region: WECC

Issue: Hetch Hetchy Water and Power (Hetch Hetchy) self-reported that it needed to update its procedures to recognize and to make its operating personnel aware of sabotage events on its facilities. Hetch Hetchy also self-reported that it needed to update its procedures regarding the communication of information about the sabotage events to the appropriate parties in the Interconnection.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system due to the nature and location of Hetch Hetchy's assets. The violations were self-reported and they were Hetch Hetchy's first violations of this Reliability Standard. Even though the violations were committed before the Reliability Standards became mandatory, Hetch Hetchy did not timely complete its mitigation plan, turning the violations into post-June 18, 2007 violations. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

High Desert Power Project, LLC, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2008, High Desert Power Project, LLC (HDPP) self-certified that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities and for multi-site sabotage events that affect larger portions of the Interconnection. HDPP also self-certified that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, HDPP self-certified that it had not established the appropriate communications contacts with the relevant officials (in either the local Federal Bureau of Investigation or the Royal Canadian Mounted Police) and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of HDPP's assets. These were HDPP's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Hoosier Energy REC, Inc., FERC Docket No. NP11-190-000 (May 26, 2011)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: ReliabilityFirst

Issue: During a spot check, ReliabilityFirst determined that Hoosier Energy REC, Inc. (Hoosier) did not include procedures for the recognition of sabotage events as required by the standard, though it did maintain a procedure addressing sabotage events generally and the reporting requirements related to such events. Duration of violation was June 18, 2007 when the standard became mandatory and enforceable through January 20, 2010, when the violation was mitigated.

Finding: ReliabilityFirst determined that the violation posed a minimal risk to the bulk power system because Hoosier adopted its policies regarding sabotage events in 2005 and the policy identified possible threats to the system, operators were trained on these policies, and no actual harm came as a result of the violation. The NERC BOTCC also considered that the violation constituted Hoosier’s first occurrence of violation of the standards, Hoosier self-reported the PRC-005-1 violation, and Hoosier agreed to take actions that exceed those expected to achieve and maintain baseline compliance.

Penalty: $80,000 (aggregate for 10 violations)

FERC Order: Issued June 24, 2011 (no further review)

Illinois Municipal Electric Agency, FERC Docket No. NP08-15-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SERC

Issue: Illinois Municipal Electric Agency ("IMEA") self-reported that its existing processes and procedures with respect to sabotage events did not have all the required elements.

Finding: No penalty assessed because the violations were self-reported and quickly remedied, occurred prior to the standard becoming mandatory, and the violations were deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that these violations constituted IMEA's first.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Illinois Municipal Electric Agency, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: RFC

Issue: Illinois Municipal Electric Agency ("IMEA") did not have a procedure for the recognition of sabotage events or communicating information to appropriate parties in the Interconnection concerning sabotage events. It also did not establish the required contacts with local authorities, and did not provide its operating personnel with the required sabotage response guidelines. Duration of the violation was from June 18, 2007 when the standard became enforceable through December 14, 2007.

Finding: Penalty was deemed appropriate because these were IMEA's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system because no sabotage events occurred during the non-compliance period.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Incorporated County of Los Alamos, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: Incorporated County of Los Alamos (LAC) self-reported that it did not have complete and fully documented procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. LAC also self-reported that it did not have complete and fully documented procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and for providing its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, LAC self-reported that it did not have complete and fully documented procedures in place regarding the establishment of appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of LAC's assets. The violations were self-reported and these were LAC's first violations of this Reliability Standard. Even though the violations occurred before the Reliability Standards became mandatory, LAC did not timely complete its mitigation plans, turning the violations into post-June 18, 2007 violations. Even with the mitigation plans completed late, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Kings River Conservation District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2008, Kings River Conservation District (KRCD) self-certified that it had not established the appropriate communications contacts with officials at the local Federal Bureau of Investigation office.

Finding: WECC found that this violation did not cause a serious or substantial risk to the bulk power system because of the nature and location of KRCD's assets. In additional, this violation was primarily a documentation issue. This was KRCD's first violation of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Klickitat County PUD, FERC Docket No. NP10-184-000 (September 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: WECC

Issue: Klickitat self-certified non-compliance with the standard because it failed to develop reporting procedures appropriate to its circumstances as required by R4.

Finding: It was determined by WECC that the violation did not constitute a serious or substantial risk to the bulk power system because Klickitat had provided the local FBI telephone number to its personnel and established contacts with the FBI. An additional factor for the determination of penalty amount included that the violation was an administrative documentation issue.

Penalty: $4,800 (aggregate for multiple violations)

FERC Order: Issued October 29, 2010 (no further review)

Lassen Municipal Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: In May 2008, it was determined that Lassen Municipal Utility District (LMUD) did not have procedures in place to communicate information regarding sabotage events to the appropriate parties in the Interconnection.

Finding: WECC found that this violation did not cause a serious or substantial risk to the bulk power system because of the nature and location of LMUD's assets. This was LMUD's first violation of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Lincoln County Power District No. 1, FERC Docket No. NP10-17-000 (November 13, 2009)

Reliability Standard: CIP-1-001

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: WECC

Issue: During WECC's audit of LNPD, WECC's audit staff determined that LNPD failed to establish contact with local FBI officials to communicate sabotage events, but instead relied upon the local county sheriff's office to make contact with the FBI in the event of a sabotage event. WECC determined that the violation lasted from June 18, 2007, when the reliability standard became enforceable, through March 20, 2008, when LNPD completed its mitigation plan.

Finding: WECC recommended a penalty of $2,000, based upon its consideration of the following factors: (i) LNPD had not previously violated any reliability standard; (ii) LNPD mitigated its violation before WECC reviewed its mitigation plan; (iii) LNPD was cooperative during the investigation; (iv) LNPD's violation did not seriously or substantially affect the reliability of the bulk power system since LNPD had procedures in place to contact the local sheriff's office, which would in turn contact the FBI in the event of a sabotage event; (v) there were no aggravating factors warranting a higher payment amount; and (vi) LNPD did not attempt to conceal the violation and the violation did not appear intentional. NERC found WECC's recommendation appropriate, based on its consideration of the following: (i) LNPD is a small non-profit entity that has a peak load of 15 MW and only serves 1,000 customers; (ii) LNPD did not previously violate this or any related reliability standards; (iii) LNPD did not attempt to misrepresent or conceal facts; (iv) LNPD corrected its violation in a timely manner; and (v) LNPD was cooperative during the investigation process.

Penalty: $2,000

FERC Order: Issued December 11, 2009 (no further review)

Littleton Electric Light Department, FERC Docket No. NP11-199-000 (May 26, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (R1, R2, R3, R4)

Violation Severity Level: Severe (R1, R2, R3, R4)

Region: NPCC

Issue: During an audit, NPCC determined that Littleton Electric Light Department (LELD) did not possess appropriate procedures: (a) to recognize and make operating personnel aware of sabotage events (R1), (b) to communicate relevant information about sabotage events to the appropriate parties in the Interconnection (R2), and (c) to communicate with local law enforcement authorities (R4). In addition, LELD had not given all of its relevant personnel the sabotage response guidelines as required (R3).

Finding: LELD agreed to pay a penalty of $5,000 and to undertake other mitigation measures to resolve the violations. NPCC found that the violations posed only a minimal risk to bulk power system reliability since LELD only operates three 115 kV to 25 kV transformers in order to deliver 49 MW (peak load) at a 25 kV distribution voltage. In addition, LELD did have in place an Emergency Response Contract spreadsheet which contained information on the appropriate parties to contact (even though LELD did not have procedures in place to communicate emergency information). The duration of the violations was from June 10, 2008 through December 14, 2010.

Penalty: $5,000 (aggregate for 4 penalties)

FERC Order: Issued June 24, 2011 (no further review)

Los Angeles Department of Water and Power, FERC Docket No. NP10-141-000 (July 6, 2010)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: During an audit, WECC discovered that LADWP's sabotage procedures in place prior to February 13, 2008 did not include guidelines for recognizing sabotage events or for communicating with operating personnel regarding such events. WECC also determined that LADWP control center and other operating personnel were not familiar with the sabotage procedures put in place on February 13, 2008, and could not find them in a reasonable amount of time when asked to do so. Thus, LADWP's procedure failed to adequately raise operating personnel's awareness of sabotage events or appropriate responsive actions.

Finding: Duration of the violation was from June 18, 2007, when the standards became enforceable, through June 28, 2008. WECC determined that the violation did not pose a serious or substantial risk to the reliability of the bulk power system, but it did pose a moderate risk because it reduced operating personnel's ability to effectively address a sabotage event.

Penalty: $225,000 (aggregate for multiple violations)

FERC Order: Issued Oct. 8, 2010 (no further review)

Louisiana Energy and Power Authority, FERC Docket No. NP11-260-000 (August 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SPP

Issue: During a compliance audit, SPP determined that Louisiana Energy and Power Authority (LEPA) violated R1 because it failed to include details in its Sabotage Reporting Procedure that are necessary to recognize sabotage events and did not identify steps to make operating personnel aware of sabotage events on LEPA’s system. SPP also determined that LEPA failed to include procedures for notifying appropriate parties of sabotage events in violation of R2.

Finding: SPP determined that the violations did not pose a serious or substantial risk to the reliability of the BPS because the only BPS element under LEPA’s control is its control center, and therefore it has relatively limited exposure to sabotage events. Moreover, LEPA did have procedures n place for employees to report incidents of sabotage to their supervisor and to report any physical security violations to local law enforcement and the FBI. In approving the LEPA-NERC settlement agreement, NERC BOTCC found this was LEPA’s first violation of the subject reliability standards, LEPA was cooperative, there was no evidence of an intent or attempt to conceal a violation; and there were no other mitigating or aggravating factors.

Penalty: $25,000 (aggregate for 4 violations)

FERC Order: Issued September 30, 2011 (no further review)

Lubbock Power and Light, Docket No. NP11-270 (September 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SPP

Issue: During a compliance audit, SPP determined that Lubbock Power and Light’s (Lubbock) did not have a documented sabotage reporting procedure from Aug. 24, 2007 to Aug. 18, 2008.

Finding: SPP determined that the violations posed a minimal risk, but did not pose a serious or substantial risk, to the reliability of the BPS because Lubbock had an employee emergency action plan that outlined procedures to react to emergencies and Lubbock’s dispatch personnel had received sabotage training.

Penalty: $14,000 (aggregate for 8 violations)

FERC Order: Issued October 28, 2011 (no further review)

Mason County PUD No. 3, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In June 2007, Mason County PUD No. 3 (Mason County) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Mason County also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Mason County self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Mason County's assets. The violations were self-reported and these were Mason County's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Minnesota Power (Allete, Inc.), FERC Docket No. NP11-08-000 (November 5, 2010)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: High

Region: MRO

Issue: MRO determined that Minnesota Power (Allete, Inc.) (MP), as a Balancing Authority, Transmission Operator, Generator Operator and Load Serving Entity, maintained a written procedure titled "Sabotage Recognition and Reporting," that did not expressly include a procedure for recognizing and identifying acts of sabotage.

Finding: MRO imposed a $62,500 penalty for this and other violations. In assessing the penalty, MRO considered the following facts: the violation constituted MP's first violation of the subject NERC Reliability Standard; MP cooperated during the compliance enforcement process; MP's compliance program; MP did not attempt to conceal the violation or intend to do so; the violation did not create a serious or substantial risk to the bulk power system and there were no other mitigating or aggravating factors or extenuating circumstances.

Penalty: $62,500 (aggregate for multiple violations)

FERC Order: Issued December 3, 2010 (no further review)

Minnesota Power (Allete, Inc.), FERC Docket No. NP11-08-000 (November 5, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: MRO

Issue: MRO determined that Minnesota Power (Allete, Inc.) (MP), as a Transmission Operator, did not issue a directive in a clear, concise and definitive manner and did not ensure the recipient of the directive repeated the information back correctly.

Finding: MRO imposed a $62,500 penalty for this and other violations. In assessing the penalty, MRO considered the following facts: the violation constituted MP's first violation of the subject NERC Reliability Standard; MP cooperated during the compliance enforcement process; MP's compliance program; MP did not attempt to conceal the violation or intend to do so; the violation did not create a serious or substantial risk to the bulk power system and there were no other mitigating or aggravating factors or extenuating circumstances.

Penalty: $62,500 (aggregate for multiple violations)

FERC Order: Issued December 3, 2010 (no further review)

Missoula Electric Cooperative, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In June 2007, Missoula Electric Cooperative, Inc. (MEC) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. MEC also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, MEC self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of MEC's assets. The violations were self-reported and these were MEC's first violations of this Reliability Standard. Even though the mitigation plan was completed over two months late, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Modesto Irrigation District, FERC Docket No. NP10-93-000 (March 31, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3

Violation Risk Factor: Medium

Violation Severity Level: Not discussed

Region: WECC

Issue: Modesto Irrigation District (MID) failed to have a comprehensive procedure that addresses recognition, awareness, communication, and reporting of sabotage events and other vulnerabilities that could pose a threat to its system and the reliability of the bulk power system.

Finding: The alleged violations occurred from June 18, 2007, when the Standard became enforceable, until March 5, 2008, when MID completed a mitigation plan. Through settlement, no penalty was assessed and MID agreed to undertake a number of activities, including accelerating "Job Task Analysis" development for MID's operators and construction of a back-up control center. In reaching the agreement, WECC considered that it was MID's first violations of this Standard; the violations did not pose a serious or substantial risk to the reliability of the bulk power system; MID is a government entity and a small irrigation district; most violations were self-reported; MID did not attempt to conceal the violations; and the violations were not intentional.

Penalty: $0

FERC Order: Issued April 30, 2010 (no further review)

Mt. Carmel Public Utility Co., FERC Docket No. NP08-24-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Lower

Region: SERC

Issue: Mt. Carmel Public Utility Co. ("Mt. Carmel") self-certified that it failed to establish communication contacts with the FBI.

Finding: SERC declined to assess penalties for the violation because the violation (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC affirmed SERC's exercise of discretion to not assess penalties for these reasons, and also added that the violation was the first incidence of violation by Mt. Carmel and that Mt. Carmel worked cooperatively with SERC and acted immediately to mitigate and/or correct the violations.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Mt. Tom Generating Co., LLC, FERC Docket No. NP11-104-000 (February 1, 2011)

Reliability Standard: CIP-008-0

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Lower

Region: NPCC

Issue: Mt. Tom self-reported that it did not have a contact number for the Federal Bureau of Investigation (FBI).

Finding: NPCC determined that the violation posed a minimal risk to the reliability of the bulk power system as Mt. Tom's internal security procedures included requirements for reporting suspected incidents of sabotage to Homeland Security and the Federal Bureau of Investigation (FBI). Mt. Tom subsequently obtained the contact information and updated its procedures.

Penalty: $0

FERC Order: Issued March 3, 2011 (no further review)

Navopache Electric Cooperative, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In March 2008, Navopache Electric Cooperative, Inc. (Navopache) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Navopache also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Navopache self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Navopache's assets. The violations were self-reported and these were Navopache's first violations of this Reliability Standard. Even though the mitigation plan was completed 6 1/2 months late, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

NERC Registered Entity, FERC Docket No. NP10-137-000 (July 6, 2010)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Not discussed

Region: WECC

Issue: The NERC Registered Entity failed to provide a document providing guidance for sabotage reporting and communicating with operations personnel for the entire audit period.

Finding: The NERC Registered Entity mitigated the violation by amending its sabotage procedure to contain guidelines for recognizing and notifying operating personnel of possible sabotage events. No further publicly available information was provided.

Penalty: $39,000 (aggregate for multiple violations)

FERC Order: Issued August 5, 2010 (no further review)

New Hope Power Partnership, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: FRCC

Issue: New Hope Power Partnership ("New Hope") did not have a procedure for the recognition of, and making its operating personnel aware of, sabotage events or communicating information to appropriate parties in the Interconnection concerning sabotage events. It also did not establish the required contacts with local authorities, and did not provide its operating personnel with the required sabotage response guidelines. Duration of the violations was from June 18, 2007 when the standard became enforceable through June 30, 2008.

Finding: Penalty was deemed appropriate because these were New Hope's first violations of this standard, and the violations did not pose a serious or substantial threat to the reliability of the bulk power system because New Hope did provide emergency training to its employees and its facility is very small.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

North Carolina Power Holdings, Inc. – Lumberton Power, LLC, FERC Docket No. NP08-31-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: Since Lumberton could not produce evidence of a sabotaging reporting procedure, SRERC determined that Lumberton did not have such a procedure. SERC deemed this to be a documentation issue.

Finding: SERC declined to assess penalties for the violations because the violations (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC affirmed this determination since SERC deemed these violations documentation issues rather than a finding that Lumberton did not have such a procedure.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

North Carolina Power Holdings, Inc. – Elizabethtown Power, LLC, FERC Docket No. NP08-28-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: Since Elizabethtown could not produce evidence of its sabotage reporting procedure, SERC found that Elizabethtown did not have such a procedure. SERC deemed this to be a documentation issue.

Finding: SERC declined to assess penalties for the violations because these violations (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC affirmed this determination since SERC deemed these violations documentation issues rather than a finding that Elizabethtown did not have such a procedure.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Northern States Power, FERC Docket No. NP08-16-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: MRO

Issue: Northern States self-reported that its written procedures did not document the required notifications of appropriate parties in the interconnection in the event of sabotage.

Finding: No penalty assessed because the violation was self-reported and quickly remedied, occurred prior to the standard becoming mandatory, and the violation was deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that the violation constituted Northern States' first violation of this requirement.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Northern Wasco County People's Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: Northern Wasco County People's Utility District (Northern Wasco) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Northern Wasco also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Northern Wasco self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Northern Wasco's assets. The violations were self-reported and these were Northern Wasco's first violations of this Reliability Standard. Even though the violations occurred before the Reliability Standards became mandatory, Northern Wasco did not timely complete its mitigation plan, turning the violations into post-June 18, 2007 violations. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

NorthWestern Energy, FERC Docket No. NP09-23-000 (May 4, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: MRO

Issue: Based on a self-certification, NorthWestern Energy was found to be in violation of CIP-001-1, R1 through 4. Specifically, (i) NorthWestern did not have a written procedure in place for dealing with sabotage events, (ii) while it did not have a written procedure in place for the communication of information regarding sabotage events, NorthWestern did have a draft plan, (iii) while NorthWestern did not have a written sabotage report guideline for operators, it did have draft procedures; and (iv) while NorthWestern had not yet established communication contacts with FBI officials, it did have a draft procedure which included communication contacts with the FBI.

Finding: MRO declined to assess a penalty for NorthWestern's violations, since: (i) NorthWestern had informal processes in addition to the draft plan for dealing with sabotage events that had been effective in the past, (ii) there had been several events in recent years to which operators responded property, (iii) NorthWestern self-certified its non-compliance, (iv) the violations were NorthWestern's first violations, (v) the violations were not of the type that would put the bulk power system reliability at serious or substantial risk, (vi) NorthWestern had the draft plan in place, and (vii) there were no repetitive violations, no negative relevant compliance history and no evidence to demonstrate that the violations were intentional. NERC approved MRO's findings for these reasons.

Penalty: $0

FERC Order: Issued May 29, 2009 (no further review)

Norwich Public Utilities, FERC Docket No. NP08-13-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NPCC

Issue: Norwich self-reported that, while it had an emergency response plan in place, the procedure needed to be updated with respect to sabotage events.

Finding: No penalty assessed because the violations were self-reported and quickly remedied, occurred prior to the standard becoming mandatory, and the violations were deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that these violations constituted Norwich's first.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Parkland Light and Water Company, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R4

Violation Risk Factor: Medium (for R1, R2, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: Parkland Light and Water Company (Parkland) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Parkland also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection. In addition, Parkland self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Parkland's assets. The violations were self-reported and these were Parkland's first violations of this Reliability Standard. Even though the violations occurred before the Reliability Standards became mandatory, Parkland did not timely complete its mitigation plan, turning the violations into post-June 18, 2007 violations. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Peabody Municipal Light Plant, FERC Docket No. NP08-8-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: NPCC

Issue: Peabody self-reported that it had not properly documented its sabotage reporting procedures as required by the standard.

Finding: No penalty because (1) the violations were deemed to be documentation issues and occurred during the period of transition to mandatory reliability standards; (2) the violations were deemed not to be violations that put the bulk power system reliability at serious or substantial risk; (3) Peabody self-reported the violations and cooperated in the NPCC investigation; and (4) the violations were Peabody's first standards violations.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015 (2008); http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Peninsula Light Company, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2007, Peninsula Light Company, Inc. (Peninsula) self-reported that it did not have written procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Peninsula also self-reported that it did not have written procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with written sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Peninsula self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Peninsula's assets. In addition, the violations were primarily documentation issues. The violations were self-reported and these were Peninsula's first violations of this Reliability Standard. Even though the mitigation plan was completed over 8 months late, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Port of Oakland, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: The Port of Oakland had an Emergency Management Plan in place that covered general emergency situations, but which did not meet all of the sabotage reporting requirements of CIP-001-1. In December 2007, the Port of Oakland self-reported that it did not have written procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. The Port of Oakland also self-reported that it did not have written procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with written sabotage response guidelines for reporting disturbances related to sabotage events. In addition, the Port of Oakland self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of the Port of Oakland's assets. In addition, the Port of Oakland did actually have an Emergency Management Plan in place that covered general emergency situations. These violations were also primarily documentation issues. The violations were self-reported and these were the Port of Oakland's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Public Service Company of Colorado, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: In September 2007, the Public Service Company of Colorado (PSCC) self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection.

Finding: WECC found that this violation did not create a serious or substantial risk to the bulk power system since PSCC had met all of the other requirements of CIP-001-1. The violation was self-reported and this was PSCC's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Public Service Company of New Mexico (PNM), Docket No. NP12-47-000 (September 28, 2012)

Reliability Standard: CIP-001-1

Requirement: 1

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: WECC

Issue: In response to a Notice of Self-Certification to PNM for the period between January 1, 2010, and December 31, 2010, PNM, in its role as a GOP and LSE, filed a Self-Certification citing noncompliance with CIP-001-1 R1 based on its failure to document procedures for recognition of and making operating personnel aware of sabotage events at generation facilities.

Following that, WECC gave notice of an On-site Compliance Audit to occur from May 31, 2011 through June 10, 2011. The Audit Team found that PNM did have a documented sabotage procedure meeting the requirements of CIP-001-1 for BA and TOP staff; but, the procedure used at the San Juan Generating Station did not address recognition of a sabotage event or notification of a sabotage event.

Finding: The violation was deemed to pose minimal risk to BPS reliability which was mitigated because even though sabotage event reporting procedures did not specifically address reporting at three generation units at San Juan, PNM did implement sabotage event reporting procedures at other generation sites and its control centers. Operators at San Juan knew of the sabotage reporting procedures in place at other facilities, and despite that there was no sabotage event reporting procedure specific to San Juan, San Juan operators could rely on other generator reporting procedures and control center reporting procedures to identify and report a sabotage event. Additionally, San Juan operators received training on sabotage reporting. In determining the appropriate penalty, WECC considered PNM's internal compliance program as a mitigating factor and the repeat violation of BAL-004-WECC-01 as an aggravating factor. PNM agreed/stipulated to WECC's findings.

Penalty: $79,000 (aggregate for nine penalties)

FERC Order: Issued October 26, 2012 (no further review)

Public Utility District No. 1 of Benton County, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In June 2007, Public Utility District No. 1 of Benton County (Benton) self-reported that it had not documented its procedures to recognize and to make operating personnel aware of sabotage events on its facilities. Benton also self-reported that it had not documented its procedures regarding communicating information about sabotage events to the appropriate parties in the Interconnection and for providing its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Benton self-reported that it had not documented its procedures regarding the establishment of appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Benton's assets. In addition, the violations were primarily documentation issues. The violations were self-reported and these were Benton's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Public Utility District No. 1 of Whatcom County, FERC Docket NP10-118-000 (June 2, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Public Utility District No. 1 of Whatcom County ("Whatcom") self-reported that it only had informal procedures in place for use by its operating personnel regarding identifying incidents and notifying relevant authorities but did not have formal documented procedures in place for meeting the requirements of R1 through R4. The violations became post-June 18, 2007 violations because Whatcom failed to complete its mitigation plan by the required date.

Finding: Duration of violations from August 10, 2007, the date Whatcom was included in the NERC registry, through May 16, 2008. The violations did not pose a serious or substantial risk to the reliability of the bulk power system because Whatcom is a non-generating small load utility with only one substation and thirteen (13) miles of low-voltage transmission lines. The violations were also Whatcom's first of this standard.

Penalty: $20,000 (aggregate for multiple violations)

FERC Order: Issued July 2, 2010 (no further review)

Rosebud Operating Services, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R3

Violation Risk Factor: Medium (for R1, R3)

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2008, Rosebud Operating Services, Inc. (Rosebud) self-certified that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Rosebud also self-certified that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Rosebud's assets. These were Rosebud's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Rosebud Operating Services, Inc., FERC Docket No. NP11-32-000 (November 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: WECC

Issue: WECC determined that Rosebud Operating Services, Inc. (“ROSI”), as a Generator Operator, failed to maintain procedures for the communication of information concerning sabotage events to appropriate parties in the Interconnection.

Finding: The NERC Board of Trustees Compliance Committee (“BOTCC”) imposed a $2,000 penalty for this violation. In assessing the penalty, the BOTCC considered the following facts: ROSI cooperated during the compliance enforcement process; ROSI self-reported the violation; ROSI did not attempt to conceal the violation or intend to do so; the violation did not create a serious or substantial risk to the bulk power system and there were no other mitigating or aggravating factors or extenuating circumstances.

Penalty: $2,000

FERC Order: Issued December 30, 2010 (no further review)

Sacramento Municipal Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Sacramento Municipal Utility District (SMUD) self-reported that its procedures did not provide for full recognition of and to make operating personnel aware of sabotage events on its facilities as required.

Finding: WECC found that the violation did not pose a serious or substantial risk to the bulk power system since SMUD met all of the other requirements of CIP-001-1 and this was primarily a documentation issue. The violation was self-reported and this was SMUD's first violation of this Reliability Standard. Even though the violation occurred before the Reliability Standards became mandatory, Parkland did not timely complete its mitigation plan, turning the violation into post-June 18, 2007 violation. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Sam Rayburn G&T Electric Cooperative, Inc., FERC Docket No. NP08-22-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: Sam Rayburn G&T Electric Cooperative, Inc.'s ("Sam Rayburn") Emergency Operations Plan failed to address (i) recognition of sabotage events, (ii) communication of sabotage events to the appropriate Interconnection personnel, or (iii) communication with the appropriate federal law enforcement officials. Sam Rayburn failed to train employees to recognize sabotage events.

Finding: SERC declined to assess penalties for the violations because the violations (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC affirmed SERC's exercise of discretion to not assess penalties for these reasons, and also added that the violations were the first incidence of violation by Sam Rayburn and that Sam Rayburn worked cooperatively with SERC and acted immediately to mitigate and/or correct the violations.

Penalty: $0

FERC Order: 124 FERC ¶ 61,105, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Scurry County Wind LP, FERC Docket No. NP11-85-000 (January 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: TRE

Issue: Scurry County Wind LP (SCW), as a Generation Operator, did not, as required by CIP-001-1, include an FBI contact in its sabotage reporting procedures from July 11, 2007 (the date SCW was included on the NERC Registry) through July 30, 2008.

Finding: The violation did not pose a serious or substantial risk to the reliability of the bulk power system because local law enforcement, as well as others, would have been contacted in the event of sabotage. The NERC Board of Trustees Compliance Committee (BOTCC) assessed a $3,000 penalty for the violation. In determining the penalty, the NERC BOTCC considered the following facts: the violation was SCW's first occurrence of violation of the subject Reliability Standard; SCW cooperated during the compliance enforcement process; and there was no evidence SCW attempted to conceal the violation.

Penalty: $3,000

FERC Order: Issued March 2, 2011 (no further review)

Seneca Light and Water, FERC Docket No. NP10-170-000 (September 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Severe (for R1, R2, R3, R4)

Region: SERC

Issue: In November 2009, Seneca Light and Water (Seneca) self-reported that it did not: (1) have an appropriate procedure in place for recognizing sabotage events and timely making operating personnel aware of the event; (2) have appropriate procedures in place to communicate information regarding sabotage events to the appropriate parties in the Interconnection; (3) make the sabotage response guidelines fully available to its operating personnel; and (4) have appropriate procedures in place concerning reporting and coordination, in cases of sabotage, with personnel from the local Federal Bureau of Investigation.

Finding: SERC and Seneca entered into a settlement agreement to resolve the violations, whereby Seneca agreed to pay a penalty of $3,000 and to undertake other mitigation measures. SERC found that the violations did not pose a serious or substantial risk to bulk power system reliability since Seneca's total load is less than 35 MW and, therefore, even if there was a sabotage event, the likely impact from sabotage would have been minimal. Furthermore, Seneca is connected to the grid through a radial connection and the entity to which Seneca is connected has the appropriate procedures in place under CIP-001-1 to recognize sabotage events. The duration of the violations was from June 18, 2007 through March 30, 2010. In addition, these were Seneca's first violations of CIP-001-1; the violations were self-reported (after SERC advised Seneca of their applicability); Seneca was cooperative during the enforcement process and did not attempt to conceal the violations; there was a compliance program in place; and there were no additional mitigating or aggravating factors present.

Penalty: $3,000

FERC Order: Issued October 29, 2010 (no further review)

South Louisiana Electric Cooperative Association, FERC Docket No. NP10-185-000 (September 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1 and R4

Violation Risk Factor: Medium

Violation Severity Level: High (R1) and Severe (R4)

Region: SERC

Issue: SLECA self-reported that it failed to have adequate reporting procedures for coordination with local FBI contacts as required by R4 by the date the standard became enforceable. It further self-reported that it did not have a written procedure that described when and how operating personnel were to be made aware of sabotage events in violation of R1.

Finding: It was determined by SERC that the violation did not constitute a serious or substantial risk to the bulk power system because SLECA is only connected to the bulk power system via a radial line and isolated from the bulk power system by switches owned by other entities. Additional factors for the determination of penalty amount included that the violation was an administrative documentation issue, and that SLECA self-reported the violations.

Penalty: $5,000

FERC Order: Issued October 29, 2010 (no further review)

Sierra Pacific Industries, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2008, Sierra Pacific Industries (SPI) self-certified that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. SPI also self-certified that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, SPI self-certified that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of SPI's assets. These were SPI's first violations of this Reliability Standard. Even though SPI completed one of its mitigation plans one month late, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Southwestern Electric Cooperative, FERC Docket No. NP10-28-000 (December 30, 2009)

Reliability Standard: CIP-1-001

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: SERC

Issue: During the course of an audit, SERC staff determined that Southwestern Electric Cooperative could not establish that it had in place a reporting procedure for sabotage events or that it had established contacts with local FBI officials for the period from June 18, 2007, when the requirement became enforceable, through July 28, 2008, when Southwestern Electric Cooperative created a reporting procedure.

Finding: In recommending a penalty of $3,000, SERC determined that the impact on the reliability of the bulk power system was not serious or substantial since (i) Southwestern Electric Cooperative previously had in place a procedure for communicating with local officials; (ii) the violation was limited in scope; (iii) Southwestern Electric Cooperative promptly and voluntarily corrected the violation; (iv) Southwestern Electric Cooperative was cooperative during the investigation; and (v) Southwestern Electric Cooperative had not previously violated this or any other closely-related requirement. NERC approved SERC's recommendation.

Penalty: $3,000

FERC Order: Issued January 29, 2010 (no further review)

Southwestern Public Service Co., FERC Docket No. NP08-9-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SPP

Issue: SPS self-reported a deficiency in its sabotage-reporting procedures related to the requirement that certain other entities be notified in the event of sabotage.

Finding: No penalty assessed because the violation was self-reported and quickly remedied, occurred prior to the standard becoming mandatory, and the violation was deemed not to put bulk power system reliability at serious or substantial risk.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Springfield Utility Board, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: WECC

Issue: Springfield Utility Board (Springfield) self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violation did not cause a serious or substantial risk to the bulk power system because of the nature and location of Springfield's assets. This violation was self-reported and this was Springfield's first violations of this Reliability Standard. Even though the violation occurred before the Reliability Standards became mandatory, Springfield did not timely complete its mitigation plan, turning the violation into post-June 18, 2007 violation. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Suez Energy Marketing, FERC Docket No. NP08-12-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: TRE

Issue: Suez Energy Marketing ("Suez") self-reported that, while it had a procedure for bomb threats and emergencies, the procedure did not address sabotage events as required.

Finding: No penalty assessed because the violations occurred prior to the standard becoming mandatory, and the violations were deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that these violations constituted Suez's first.

Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Sunbury Generation LP, FERC Docket No. NP11-39-000 (November 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Level 4

Region: ReliabilityFirst

Issue: ReliabilityFirst determined that Sunbury Generation LP (“Sunbury”), as a Generator Operator, did not indicate that Sunbury established communications contacts with local FBI.

Finding: The NERC Board of Trustees Compliance Committee (“BOTCC”) assessed a $3,000 penalty for this violation. In reaching this determination, the BOTCC considered the following facts: the violation constituted Sunbury's first violation of this Reliability Standard; Sunbury cooperated during the compliance enforcement process; Sunbury did not have a formal compliance program; Sunbury did not attempt to conceal a violation or intend to do so; the violation did not create a serious or substantial risk to the bulk power system; and there were no other mitigating or aggravating factors or extenuating circumstances.

Penalty: $3,000

FERC Order: Issued December 30, 2010 (no further review)

Tex-LA Electric Cooperative, Inc., FERC Docket No. NP08-25-000 (June 5, 2008)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: High

Region: SERC

Issue: Tex-LA Electric Cooperative, Inc. ("Tex-LA") self-certified that its Emergency Operations Plan failed to address (i) recognition of sabotage events, (ii) communication of sabotage events to the appropriate Interconnection personnel, or (iii) communication with the appropriate federal law enforcement officials. Tex-LA further self-certified that it failed to train employees to recognize sabotage events.

Finding: SERC declined to assess penalties for the violations because the violations (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC affirmed SERC's exercise of discretion to not assess penalties for these reasons, and also added that the violations were the first incidence of violation by Tex-LA and that Tex-LA worked cooperatively with SERC and acted immediately to mitigate and/or correct the violations.

Penalty: $0

FERC Order: 124 FERC ¶ 61,015, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Thermo Power and Electric LLC, Docket No. NP11-270 (September 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: WECC

Issue: Following a self-certification of non-compliance, WECC determined Thermo Power and Electric LLC (TPEL) was in violation of CIP-001-1 because it failed to ensure that its sabotage reporting documentation contained: procedures for the recognition of sabotage events, procedures for the communication of information concerning sabotage to appropriate parties within the interconnection, and sabotage response guidelines. The violations lasted from June 18, 2007 to Sept. 8, 2009.

Finding: WECC determined that the violations posed a minimal risk to the reliability of the BPS because TPEL operates a single generating facility with a total capacity of approximately 80 MW, which is only a small percentage of the generation available to TPEL’s TOP and BA. Moreover, TPEL instructed facility personnel to remain alert and report any suspicious activities while it updated its sabotage procedures and there were no incidents of sabotage at the facility and no actual impact to the BPS as a result of the violations.

Penalty: $10,000 (aggregate for 5 violations)

FERC Order: Issued October 28, 2011 (no further review)

Tillamook People's Utility District, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In June 2007, Tillamook People's Utility District (Tillamook) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Tillamook also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Tillamook self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not cause a serious or substantial risk to the bulk power system because of the nature and location of Tillamook's assets. In addition, the violations were primarily documentation issues. The violations were self-reported and these were Tillamook's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Topaz Power Management LP, FERC Docket No. NP08-18-000 (June 4, 2008)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: TRE

Issue: A spot check determined that while Topaz Power Management ("TPM") had a sabotage reporting procedure in place, it did not address the requirement that operating personnel must be notified of sabotage events.

Finding: No penalty assessed because the violation occurred prior to the standard becoming mandatory, and the violation was deemed not to put bulk power system reliability at serious or substantial risk. It was also noted that the violation constituted TPM's first violation of this requirement.

Total Penalty: $0

FERC Order: Issued July 3, 2008 (no further review)

Town of Sharpsburg, FERC Docket No. NP11-162-000 (March 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: The Town of Sharpsburg (Sharpsburg) self-reported that it did not possess the appropriate procedures for recognizing and making its operating personnel aware of sabotage events on its facilities, as well as for multi-site sabotage events that would affect large portions of the interconnection (R1). In addition, Sharpsburg self-reported that it did not have procedures in place to communicate relevant information regarding sabotage events to the appropriate parties in the interconnection (R2). Sharpsburg also did not establish sabotage response guidelines (including information on who to contact to report sabotage events) for its operating personnel (R3), nor did it develop the required communication contacts with the local FBI office and establish the relevant reporting procedures (R4).

Finding: SERC found that the violations only posed a minimal risk to bulk power system reliability since Sharpsburg is a small utility (serving 1,132 residential and 136 commercial customers with a peak summer load of 5 MW) that does not own or operate any bulk power system facilities (even though its interconnected Transmission Operator requires Sharpsburg to own an Underfrequency Load Shedding System). The interconnected Transmission Operator/Owner does have the required procedures in place to recognize sabotage activities affecting the bulk power system and then report those activities to the operator of the bulk power system facilities. The duration of the violations was from June 18, 2007 through December 14, 2010 for R1 and R3 and through November 19, 2007 for R2 and R4.

Penalty: $0

FERC Order: Issued April 29, 2011 (no further review)

Town of Stantonsburg, FERC Docket No. NP11-162-000 (March 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: The Town of Stantonsburg (Stantonsburg) self-reported that it did not possess the appropriate procedures for recognizing and making its operating personnel aware of sabotage events on its facilities, as well as for multi-site sabotage events that would affect large portions of the interconnection (R1). In addition, Stantonsburg self-reported that it did not have procedures in place to communicate relevant information regarding sabotage events to the appropriate parties in the interconnection (R2). Stantonsburg also did not establish sabotage response guidelines (including information on who to contact to report sabotage events) for its operating personnel (R3), nor did it develop the required communication contacts with the local FBI office and establish the relevant reporting procedures (R4).

Finding: SERC found that the violations only posed a minimal risk to bulk power system reliability since Stantonsburg is a small utility (serving 1,095 residential and 80 commercial customers with a peak summer load of 6.1 MW) that does not own any bulk power system facilities (even though its interconnected Transmission Operator requires Stantonsburg to own an Underfrequency Load Shedding System). The interconnected Transmission Operator/Owner does have the required procedures in place to recognize sabotage activities affecting the bulk power system and then report those activities to the operator of the bulk power system facilities. The duration of the violations was from June 18, 2007 through December 14, 2010 for R1 and R3 and through November 19, 2007 for R2 and R4.

Penalty: $0

FERC Order: Issued April 29, 2011 (no further review)

Town of Winterville, FERC Docket No. NP11-162-000 (March 31, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: SERC

Issue: The Town of Winterville (Winterville) self-reported that it did not possess the appropriate procedures for recognizing and making its operating personnel aware of sabotage events on its facilities, as well as for multi-site sabotage events that would affect large portions of the interconnection (R1). In addition, Winterville self-reported that it did not have procedures in place to communicate relevant information regarding sabotage events to the appropriate parties in the interconnection (R2). Winterville also did not establish sabotage response guidelines (including information on who to contact to report sabotage events) for its operating personnel (R3), nor did it develop the required communication contacts with the local FBI office and establish the relevant reporting procedures (R4).

Finding: SERC found that the violations only posed a minimal risk to bulk power system reliability since Winterville is a small utility (serving 2600 residential and 100 small to medium commercial customers with a peak load of 12 MW) that does not own any bulk power system facilities (even though its interconnected Transmission Operator requires Winterville to own an automatic Underfrequency Load Shedding System (UFLS)). Winterville's peak load (as well as its load shedding contribution of 4 MW) represents less than 0.1% of the total load and the load shedding requirements for its Transmission Operator. Therefore, even if sabotage activities did occur on Winterville's distribution facilities or UFLS devices, it would have a minimal impact on the bulk power system. In addition, Winterville did have a Distribution System Disaster Plan, which addressed sabotage events. The duration of all of the violations was from June 18, 2007 through January 26, 2011.

Penalty: $0

FERC Order: Issued April 29, 2011 (no further review)

TransAlta Centralia Generation, LLC, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: TransAlta Centralia Generation, LLC (TransAlta) did have emergency procedures in place, but they did not address all of the requirements of CIP-001-1. In December 2007, TransAlta self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. TransAlta also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, TransAlta self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not pose a serious or substantial risk to the bulk power system since TransAlta did actually have emergency procedures in place (even though they did not meet all of the requirements of CIP-001-1). In addition, the violations were primarily documentation issues. The violations were self-reported and these were TransAlta's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Tri-Dam Project of the Oakdale and South Joaquin Irrigation Districts, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In July 2008, Tri-Dam Project of the Oakdale and South Joaquin Irrigation Districts (OSJID) self-certified that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities and for multi-site sabotage that affects larger portions of the Interconnection. OSJID also self-certified that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, OSJID self-certified that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office or the Royal Canadian Mounted Police and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not pose a serious or substantial risk to the bulk power system due to the nature and location of OSJID's assets. These were OSJID's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

Truckee Donner Public Utility District, FERC Docket No. NP09-46-000 (September 25, 2009)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: WECC

Issue: During an off-site compliance audit, WECC determined that Truckee Donner Public Utility District ("TDPD") violated CIP-001-1, R2, which requires it to have procedures in place for communicating sabotage events to the appropriate parties in the Interconnection. WECC found that TDPD's documents governing its internal processes for communicating sabotage events only contained processes for communicating such events internally, but not to integral Interconnection parties such as TDPD's Balancing Authority and Transmission Operator, Sierra Pacific Power Company. Following the audit, TDPD revised its sabotage-reporting procedure to clarify that, if a sabotage event occurs, TDPD would notify neighboring electric utilities.

Finding: WECC and TDPD entered into a settlement agreement pursuant to which WECC assessed a penalty of $3,000 against TDPD for the violation of CIP-001-1, R2. In arriving at this conclusion, WECC noted that TDPD's sabotage-reporting procedure only had provisions for internal communication of sabotage events but not procedures for communication of sabotage events to Interconnection parties. WECC determined this violation could pose a moderate risk to the bulk power system as the failure to communicate with Interconnection parties could cause a sabotage event to escalate, and could leave neighboring entities unprepared for imminent sabotage events. WECC also noted: (i) that this violation was TDPD's first violation of this standard; (ii) that TDPD cooperated with WECC to mitigate the violation within two days; (iii) the violation did not pose a serious or substantial risk to the bulk power system; (iv) TDPD cooperated during the audit and investigation process; (v) TDPD did not attempt to conceal the violation; and (vi) there was no evidence to suggest that the violation was intentional. NERC approved the settlement penalty for these reasons, and noted in addition that: (i) TDPD did not contest the violation; (ii) TDPD agreed to the settlement to resolve the violation and in order to avoid litigation; (iii) TDPD is a small publicly owned non-profit entity with a peak load of only 36 MW.

Penalty: $3,000

FERC Order: Issued October 23, 2009 (no further review)

Unidentified Registered Entity, FERC Docket No. NP11-79-000 (December 22, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium (R1, R2)

Violation Severity Level: High (R1, R2)

Region: FRCC

Issue: Unidentified Registered Entity (URE) self-reported violations of CIP-001-1 R1 and R2 because it was concerned that it had implemented separate procedures in each functional area of the company for the recognition and reporting of sabotage events. Upon review, FRCC determined that URE lacked a clear procedure for reporting sabotage, as required by R2, and URE's sabotage procedures did not include a procedure for making its operating personnel aware of sabotage events, as required by R1.

Finding: FRCC determined that the violations of R1 and R2 did not pose a serious or substantial threat to reliability of the bulk power system, because URE had created procedures for recognizing sabotage events, including notification to appropriate parties in the Interconnection; however, the URE did not formalize or coordinate the procedures.

Penalty: $100,000 (aggregate for multiple violations)

FERC Order: Issued January 21, 2011 (no further review)

Unidentified Registered Entity, FERC Docket No. NP11-137-000 (March 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium

Violation Severity Level: Severe (R1, R2, R3); High (R4)

Region: WECC

Issue: URE self-certified compliance with the Standard, but upon notice of a pending spot-check, it conducted an internal review and discovered violations of R1, R2, R3 and R4. URE self-reported that it did not have a procedure for the recognition of, and for making its operating personnel aware of, sabotage events in violation of R1; it failed to have a procedure with adequate steps for the communication of information concerning sabotage events to relevant parties in violation of R2; it did not provide operating personnel with relevant guidelines including contact information in the event of sabotage in violation of R3; and it did not establish communications links with local law enforcement in violation of R4. Duration of violation was June 18, 2007, when the Standard became enforceable, through September 19, 2008, when the violations were mitigated.

Finding: WECC Enforcement determined that the violation of R1, R2, R3 and R4 posed a severe risk to the bulk power system because the loss of URE's generation due to a sabotage event, and the inability to quickly communicate with relevant third-parties, could impact URE's customers and the grid. Further, the NERC BOTCC concluded the penalty appropriate because this was URE's first violation of most of the Standards involved, URE self-reported 28 of 30 violations, and URE was cooperative during the investigation.

Penalty: $106,000 (aggregate for 30 violations)

FERC Order: Issued April 29, 2011 (no further review)

Unidentified Registered Entity, FERC Docket No. NP11-161-000 (March 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: WECC

Issue: An Unidentified Registered Entity (“URE”) self-reported a violation of R1 and R2 after purchasing a facility. WECC determined that the URE violated R1 because it did not have an adequate procedure for the recognition of sabotage events at the facility, and URE violated R2 because the facility did not have written procedures for the appropriate communication of information regarding sabotage events.

Finding: WECC Enforcement determined the violation did not pose a serious or substantial risk to the Bulk Power System because the facility had some sabotage procedures and was disconnected from the BPS at the time URE purchased it for maintenance. The NERC BOTCC considered the following factors: URE self-reported the violations; URE was cooperative; URE had a compliance procedure in place, which WECC considered a mitigating factor; there was not evidence of any attempt or intent to conceal the violations; and there were no other mitigating or aggravating factors.

Penalty: $35,000 (aggregated for 8 violations)

FERC Order: Issued April 29, 2011 (no further review)

Unidentified Registered Entity, FERC Docket No. NP11-211-000 (June 29, 2011)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: WECC

Issue: During a compliance audit, WECC found that the Registered Entity had not documented the interconnected Balancing Authorities and Transmission Operators as “appropriate” parties to be notified of sabotage events according to its sabotage communications procedures.

Finding: WECC and the Registered Entity entered into a settlement agreement to resolve multiple violations, whereby the Registered Entity agreed to pay a penalty of $14,000 and to undertake other mitigation measures. WECC found that the CIP-001-1 violation constituted a moderate risk to bulk power system reliability since there is an increased chance that relevant sabotage information may not be passed along to affected entities when the Registered Entity fails to identify all of the parties entitled to receive such information. But, the Registered Entity did have procedures in place to communicate sabotage information to all of the required parties (even though the parties were not specified by name) and procedures for the recognition of sabotage events. The duration of the CIP-001-1 violation was from June 18, 2007 through October 15, 2009. In approving the settlement agreement, NERC found that these were the Registered Entity’s first violations of the relevant Reliability Standards; the Registered Entity was cooperative during the enforcement proceeding and did not conceal the violations; there was a compliance program in place (which was evaluated as a mitigating factor); and there were no additional aggravating or mitigating factors.

Penalty: $14,000 (aggregate for 4 violations)

FERC Order: Issued July 29, 2011 (no further review)

Unidentified Registered Entity, FERC Docket No. NP11-218-000 (June 29, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3

Violation Risk Factor: Medium (for R1, R2, R3)

Violation Severity Level: High (for R1, R2, R3)

Region: WECC

Issue: The Registered Entity self-reported that it did not have adequate procedures in place to make its operating personnel aware of sabotage events that occurred on its facilities or of multi-site sabotage events that would impact large parts of the Interconnection (R1) and did not share its sabotage response guidelines with its generation operating personnel (R3). In addition, the Registered Entity, in its sabotage reporting guidelines, did not list all of the appropriate parties in the Interconnection who are to be notified (R2).

Finding: WECC and the Registered Entity entered into a settlement agreement to resolve multiple violations, whereby the Registered Entity agreed to pay a penalty of $130,000 and to undertake other mitigation measures. WECC found that the CIP-001-1 violations constituted only a minimal risk to bulk power system reliability since the Registered Entity’s personnel actually received training on how to recognize sabotage events. In addition, due to the design and operating characteristics of the Registered Entity’s system, even if there was a sabotage event, it would likely remain contained within the Registered Entity’s system. The duration of all of the CIP-001-1 violations was from June 18, 2007 through October 29, 2009. In approving the settlement agreement, NERC found that there were three instances of noncompliance with Regional Reliability Standard PRC-STD-005-1 WR1 (which was evaluated as an aggravating factor); some of the violations were self-reported; the Registered Entity was cooperative during the enforcement process and did not conceal the violations; the Registered Entity had a compliance program in place (which was evaluated as a mitigating factor); the penalties for the violations of Reliability Standards EOP-001-0 R6 and EOP-005-1 R2 were aggregated since both penalties were based on a single act of noncompliance; the penalties for the violations of Reliability Standards PRC-STD-005-1 WR1 and VAR-STD-002b-1 WR1 were based on the respective Sanction Tables; and there were no additional aggravating or mitigating factors.

Penalty: $130,000 (aggregate for 27 violations)

FERC Order: Issued July 29, 2011 (no further review)

Unidentified Registered Entity, Docket No. NP11-270-000 (September 30, 2011)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (R1, R2, R3, R4)

Violation Severity Level: Severe (R1, R2, R3, R4)

Region: WECC

Issue: Based on WECC_URE1’s failure to respond to audit notices, WECC found that WECC_URE1 did not possess the required documentation showing that it had procedures to recognize sabotage events and to make its operating personnel aware of sabotage events (both on its facilities and those affecting larger portions of the interconnection) (R1). WECC also found that WECC_URE1 did not show that it had developed procedures to communicate information regarding sabotage events to the appropriate parties in the interconnection (R2), provided its operating personnel with sabotage response guidelines (R3), or established communications contacts with the local FBI officials and developed reporting procedures (R4).

Finding: WECC found that the CIP-001-1 violations constituted a moderate risk to bulk power system reliability. WECC_URE1 operates a facility with a nameplate capacity of less than 30 MW and has only one interconnection with the bulk power system. In addition, WECC_URE1 sells all of its output to one entity (and does not have a significant impact on the purchaser’s electricity supply). Therefore, there would only be a very limited impact on the bulk power system from a sabotage event at WECC_URE1. WECC_URE1 developed a compliance program to manage its future compliance efforts (which was evaluated as a mitigating factor). However, WECC_URE1 was not cooperative during the compliance audit process and did not timely complete the required self-certifications (which were evaluated as aggravating factors).

Penalty: $90,000 (aggregate for 14 violations)

FERC Order: Issued October 28, 2011 (no further review)

Unidentified Registered Entity, FERC Docket No. NP12-20 (March 30, 2012)

Reliability Standard: CIP-001-1

Requirement: R1, R2

Violation Risk Factor: Medium (R1, R2)

Violation Severity Level: Moderate (R1), High (R2)

Region: WECC

Issue: URE self-certified that it did not enact procedures to make its operating personnel aware of multi-stage sabotage events that affect larger portions of the Interconnection (R1). URE also self-certified that it had not implemented the required procedures for communicating information about sabotage events to the appropriate parties in the Interconnection (R2).

Finding: WECC found that the CIP-001-1 violations constituted only a minimal risk to BPS reliability. While having URE’s system operators aware of sabotage events occurring on multiple facilities outside of URE’s system which impact larger portions of the Interconnection would increase awareness and vigilance, it would otherwise have no impact on the BPS. In addition, URE did have procedures to identify and make personnel aware of sabotage on its own facilities. Plus, URE is a small electric cooperative, so any risk was mitigated by its size. In approving the settlement agreement, NERC BOTCC considered the fact that these were URE’s first violations of the relevant Reliability Standards; URE was cooperative during the enforcement process and did not conceal the violations; and the violations did not constitute a serious or substantial risk to BPS reliability.

Penalty: $60,000 (aggregate for 13 violations)

FERC Order: Issued April 30, 2012 (no further review)

Unidentified Registered Entity 1 (RFC_URE1), FERC Docket No. NP15-29-000 (May 28, 2015)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: ReliabilityFirst

Issue: RFC_URE1 self-certified that it violated CIP-001-1 R1 by failing to "have procedures for the recognition of and for making their operating personnel aware of sabotage events" on certain facilities as required by the standard. RFC_URE1 was operating under the incorrect belief that it was not subject to NERC Reliability Standards.

Finding: ReliabilityFirst found that this violation posed a moderate, but not a serious or substantial, risk to BPS reliability. RFC_URE1 had significant sabotage response and detection procedures and RFC_URE1's Bulk Electric System facilities were relatively small. To mitigate the violation, RFC_URE1 (1) established guidelines for reporting disturbances caused by sabotage, (2) included sabotage recognition and communication with Interconnection entities as requirements in its procedures, (3) provided appropriate personnel with training on the updated procedures, and (4) strengthened communication channels between itself and the FBI.

Penalty: No penalty

FERC Order: FERC approved the settlement on June 26th, 2015.

Unidentified Registered Entity 1 (RFC_URE1), FERC Docket No. NP15-29-000 (May 28, 2015)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: ReliabilityFirst

Issue: RFC_URE1 self-certified that it violated CIP-001-1 R2 by failing to have "procedures for the communication of information concerning sabotage events to appropriate parties in the Interconnection" as required by the standard. RFC_URE1 was operating under the incorrect belief that it was not subject to NERC Reliability Standards.

Finding: ReliabilityFirst found that this violation posed a moderate, but not a serious or substantial, risk to BPS reliability because RFC_URE1's communication procedures did not explicitly involve interconnection entities. However, RFC_URE1 had significant sabotage response and detection procedures and RFC_URE1's Bulk Electric System facilities were relatively small. To mitigate the violation, RFC_URE1 (1) established guidelines for reporting disturbances caused by sabotage, (2) included sabotage recognition and communication with Interconnection entities as requirements in its procedures, (3) provided appropriate personnel with training on the updated procedures, and (4) strengthened communication channels between itself and the FBI.

Penalty: No penalty

FERC Order: FERC approved the settlement on June 26th, 2015.

Unidentified Registered Entity 1 (RFC_URE1), FERC Docket No. NP15-29-000 (May 28, 2015)

Reliability Standard: CIP-001-1

Requirement: R3

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: ReliabilityFirst

Issue: RFC_URE1 self-certified that it violated CIP-001-1 R3 by failing to "provide its operating personnel with sabotage response guidelines, including personnel to contact, for reporting disturbances due to sabotage events" as required by the standard. RFC_URE1 was operating under the incorrect belief that it was not subject to NERC Reliability Standards.

Finding: ReliabilityFirst found that this violation posed a moderate, but not a serious or substantial, risk to BPS reliability because RFC_URE1's communication plans did not explicitly involve interconnection entities. However, RFC_URE1's Bulk Electric System facilities were relatively small. To mitigate the violation, RFC_URE1 (1) established guidelines for reporting disturbances caused by sabotage, (2) included sabotage recognition and communication with Interconnection entities as requirements in its procedures, (3) provided appropriate personnel with training on the updated procedures, and (4) strengthened communication channels between itself and the FBI.

Penalty: No penalty

FERC Order: FERC approved the settlement on June 26th, 2015.

Unidentified Registered Entity 1 (RFC_URE1), FERC Docket No. NP15-29-000 (May 28, 2015)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Severe

Region: ReliabilityFirst

Issue: RFC_URE1 self-certified that it violated CIP-001-1 R4 by failing to "establish communications contacts, as applicable, with local Federal Bureau of Investigation (FBI) [officials]" and develop appropriate reporting procedures. RFC_URE1 was operating under the incorrect belief that it was not subject to NERC Reliability Standards.

Finding: ReliabilityFirst found that this violation posed a moderate, but not a serious or substantial, risk to BPS reliability because RFC_URE's communication channels with the FBI did not explicitly address the BPS. However, RFC_URE1's Bulk Electric System facilities were relatively small. To mitigate the violation, RFC_URE1 (1) established guidelines for reporting disturbances caused by sabotage, (2) included sabotage recognition and communication with Interconnection entities as requirements in its procedures, (3) provided appropriate personnel with training on the updated procedures, and (4) strengthened communication channels between itself and the FBI.

Penalty: No penalty

FERC Order: FERC approved the settlement on June 26th, 2015.

Union Power Partners, L.P., FERC Docket No. NP10-8-000 (November 13, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: N/A

Region: SERC

Issue: During the course of an audit, UPP presented evidence that it had established communications with local FBI officials as of January 18, 2008, but UPP could not produce evidence of the existence of contact with the FBI or reporting procedures prior to that date. After the completion of the audit and during settlement discussions, however, SERC was able to produce evidence from an email dated May 29, 2007 that UPP had, as of June 18, 2007, sabotage procedures in place that included a local FBI 24/7 contact number and a policy about who would contact the FBI.

Finding: SERC ultimately found that the May 29, 2007 email communication was acceptable evidence that UPP had established communication with the FBI and had in place an acceptable reporting protocol. SERC determined, however, that UPP should be subject to a penalty for its failure to produce such evidence during its scheduled compliance audit. In reaching its determination to assess the penalty, SERC took into consideration UPP's cooperation, commitment to compliance and its agreement to expeditiously reconcile the issue through settlement. In approving the settlement, NERC considered the following factors: (i) the violation was deemed a documentation issue; (ii) the time of actual non-compliance began in 2007 but was remedied by early 2008; (iii) UPP corrected its documentation to remedy the violation in a timely manner; (iv) UPP cooperated throughout the proceeding; (v) UPP did not have any prior violations of this or any closely-related requirement; (vi) no evidence suggested that UPP attempted to conceal any information; (vii) no evidence suggested that the violation was intentional; and (viii) UPP agreed to reconcile the issue through settlement.

Penalty: $2,500

FERC Order: Issued December 11, 2009 (no further review)

United Electric Co-op, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: United Electric Co-op, Inc. (United) self-reported that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. United also self-reported that it did not have procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, United self-reported that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not pose a serious or substantial risk to the bulk power system due to the nature and location of United's assets. The violations were self-reported and these were United's first violations of this Reliability Standard. Even though the violations occurred before the Reliability Standards became mandatory, United did not timely complete its mitigation plans, turning the violations into post-June 18, 2007 violations. Even with the late completion of the mitigation plans, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

USACE – Little Rock District, FERC Docket No. NP11-19-000 (November 5, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SPP

Issue: In March 2008, USACE – Little Rock (USACE-LR) self-certified that the security procedures it had in place did not mandate that certain non-governmental authorities (such as the appropriate parties in the Interconnection) be notified.

Finding: SPP found that the violation did not constitute a serious or substantial risk to the bulk power system since, even though USACE-LR did not have all of the appropriate security procedures in place as required by the Reliability Standard, it did have security plans at each of its generating facilities that required personnel to report, through established communication means, sabotage events to local law enforcement, the District Security Personnel, the U.S. Army Corps of Engineers Headquarters, the Department of Homeland Security, and the Federal Bureau of Investigation. The duration of the violation was from July 10, 2007 through March 19, 2010. In deciding not to impose a penalty for multiple violations, SPP considered the fact that the violations represented USACE-LR's first violations of the relevant Reliability Standards; the violations were caused by USACE-LR not having formal procedures and policies in place; and USACE-LR did not attempt to conceal the violations. In addition, the violations were self-certified.

Penalty: $0

FERC Order: Issued December 3, 2010 (no further review)

USACE-Seattle District, FERC Docket No. NP10-160-000 (September 13, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R3, R4

Violation Risk Factor: Medium (for R1, R3, and R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In June 2008, USACE-Seattle District self-certified that it did not have procedures in place for recognizing and making its operating personnel aware of sabotage events on its facilities; had not provided its operating personnel with sabotage response guidelines (such as personnel to contact when reporting disturbances from sabotage events); and had not established communications contacts with its local Federal Bureau of Investigation officials and had not developed appropriate reporting procedures.

Finding: WECC found that the violations did not constitute a serious or substantial risk to the bulk power system based on the nature and location of USACE-Seattle District's assets. In addition, USACE-Seattle District did have a set of emergency plans and physical security procedures in place that would apply in cases of sabotage. Furthermore, the violations were primarily based on documentation issues. The duration of the violations was from August 10, 2007 through October 8, 2008. These were USACE-Seattle District's first violations of this Reliability Standard.

Penalty: $0

FERC Order: Issued October 13, 2010 (no further review)

USACE – Tulsa District, FERC Docket No. NP10-160-000 (September 13, 2010)

Reliability Standard: CIP-001-1

Requirement: R2

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: SPP

Issue: As required by CIP-001-1, R2, the sabotage procedures in place by USACE-Tulsa did not require notification to non-governmental authorities in the Interconnection, such as the Transmission Operator and Host Balancing Authority.

Finding: It was determined by SPP that the violation did not constitute a serious or substantial risk to the bulk power system because security procedures were in place by USACE-Tulsa had included communication of sabotage events to the local law enforcement, District Security Personnel, Headquarters US Army Corps of Engineers, Department of Homeland Security, and the Federal Bureau of Investigation, and USACE-Tulsa regularly communicated with its Transmission Operator. The duration of the violation was July 10, 2007 through December 10, 2009. Additional factors for the determination of no penalty amount included that that the violation was a documentation issue and was the first violation of this Reliability Standard.

Penalty: $0

FERC Order: Issued December 16, 2010, 133 FERC ¶ 61,214 (2010), reh'g denied 137, FERC ¶ 61,044 (2010)

Vermont Marble Power Division of Omya Inc (VMPD), FERC Docket No. NP10-173-000 (September 30, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Moderate (for R3); Severe (R1, R2, R4)

Region: NPCC

Issue: In September 2009, Vermont Marble Power Division of Omya Inc (VMPD) self-certified that one of its employees had not received the required personnel training for sabotage response. While NPCC was investigation this violation, it discovered three additional violations related to VMPD not having written sabotage reporting procedures in place.

Finding: NPCC found that the violations of CIP-001-1 did not constitute a serious or substantial risk to the bulk power system since VMPD does not own any generating facilities or transmission lines that are designed to produce and deliver energy to the electric grid (as VMPD's facilities only deliver energy to its distribution customers). VMPD only maintains an Underfrequency Load Shedding Program in order to protect the bulk power system during low frequency system excursions where the frequency decays to 59.3 Hertz. The duration of the violations was from June 21, 2007 through September 24, 2009. NPCC reported that VMPD was not fully cooperative during the enforcement process for multiple violations (i.e., VMPD was late in responding to NPCC requests and produced some incorrect information). But, VMPD did have a compliance program in place and did not attempt to conceal any violations. Furthermore, the violations were VMPD's first violations of the relevant Reliability Standard; some of the violations (including the violations of CIP-001-1 R3) were self-certified; and there were no additional mitigating or aggravating factors present.

Penalty: $5,000 (aggregate for multiple violations)

FERC Order: Issued October 29, 2010 (no further review)

Verso Androscoggin LLC, FERC Docket No. NP10-52-000 (March 1, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NPCC

Issue: Verso's Sabotage Procedure was not dated or signed, it did not contain a revision history, and it did not contain all required elements such as procedures for notification of required entities in the Interconnection, or the telephone number for the FBI. Duration of violations was from June 21, 2007, the date Verso was registered with NERC, through February 11, 2009.

Finding: The violations did not create a serious or substantial risk to the bulk power system because while deficient, Verso did have a procedure. Verso also received credit for no prior history of violations.

Penalty: $2,500

FERC Order: Issued March 31, 2010 (no further action)

Verso Bucksport LLC, FERC Docket No. NP10-53-000 (March 1, 2010)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NPCC

Issue: Verso's Sabotage Procedure did not contain all required elements such as stating that operating personnel needed to be notified of sabotage events, correct contact information for local transmission operators and other entities in the Interconnection, or the telephone number for the FBI. Duration of the violations was from April 8, 2008, the date Verso was registered with NERC, through February 28, 2009.

Finding: The violations did not create a serious or substantial risk to the bulk power system because while deficient, Verso did have a procedure. Verso also received credit for no prior history of violations.

Penalty: $2,500

FERC Order: Issued on March 31, 2010 (no further action)

Vigilante Electric Cooperative, Inc., FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R3, R4

Violation Risk Factor: Medium (for R1, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: In April 2008, Vigilante Electric Cooperative, Inc. (VIEC) self-certified that it did not have procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities and for multi-site sabotage that affects larger portions of the Interconnection. VIEC also self-certified that it had not provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, VIEC self-certified that it had not established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office or the Royal Canadian Mounted Police and therefore had not developed the necessary reporting procedures.

Finding: WECC found that the violations did not pose a serious or substantial risk to the bulk power system since VIEC did have certain procedures in place for handling catastrophic events (even though there were no formal written plans to cover sabotage events). In addition, VIEC did not experience any sabotage incidents during its period of noncompliance. These violations were VIEC's first violations of this Reliability Standard. A mitigation plan has been completed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

WECC RC [California Mexico Reliability Coordinator OC], Docket No. NP10-160-000 (September 13, 2010)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NERC as Compliance Enforcement Authority (NCEA)

Issue: During the period from June 18, 2007 through January 1, 2009, the California Mexico Reliability Coordinator had not established contacts for communications with certain local law enforcement officials and had no reporting procedures appropriate for the circumstances.

Finding: The violation was the first violation of this Reliability Standard and it did not constitute a serious or substantial risk to the bulk power system. WECC was certified as the Reliability Coordinator on January 1, 2009 and assumed all further responsibilities. The violation was mitigated through the dissolution of the entity and NERC's certification of WECC as the new Reliability Coordinator for the region.

Penalty: $0

FERC Order: Issued October 13, 2010 (no further review)

WECC RC [Pacific Northwest Security Coordinator], Docket No. NP10-160-000 (September 13, 2010)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: NERC as Compliance Enforcement Authority (NCEA)

Issue: During the period from June 18, 2007 through January 1, 2009, the Pacific Northwest Security Coordinator was not able to provide evidence that it had established contacts for communications with law enforcement officials and had no reporting procedures appropriate for the circumstances.

Finding: The violation was the first violation of this Reliability Standard and it did not constitute a serious or substantial risk to the bulk power system. WECC was certified as the Reliability Coordinator on January 1, 2009 and assumed all further responsibilities. The violation was mitigated through the dissolution of the entity and NERC's certification of WECC as the new Reliability Coordinator for the region.

Penalty: $0

FERC Order: Issued October 13, 2010 (no further review)

Wells Rural Electric Company, FERC Docket No. NP10-2-000 (October 14, 2009)

Reliability Standard: CIP-001-1

Requirement: R1, R2, R3, R4

Violation Risk Factor: Medium (for R1, R2, R3, R4)

Violation Severity Level: Not provided

Region: WECC

Issue: Wells Rural Electric Company (Wells) self-reported that it did not have written procedures in place to recognize and to make operating personnel aware of sabotage events on its facilities. Wells also self-reported that it did not have written procedures in place regarding communicating information about sabotage events to the appropriate parties in the Interconnection and that it did not have evidence showing that it had provided its operating personnel with sabotage response guidelines for reporting disturbances related to sabotage events. In addition, Wells self-reported that it could not show that it had established the appropriate communications contacts with the relevant officials in the local Federal Bureau of Investigation office and had developed the necessary reporting procedures.

Finding: WECC found that the violations did not pose a serious or substantial risk to the bulk power system due to the nature and location of Wells' assets. In addition, the violations were primarily documentation issues. The violations were self-reported and these were Wells' first violations of this Reliability Standard. Even though the violations occurred before the Reliability Standards became mandatory, Wells did not timely complete its mitigation plan, turning the violations into post-June 18, 2007 violations. Even with the late completion of the mitigation plan, no penalty was imposed.

Penalty: $0

FERC Order: Issued November 13, 2009 (no further review)

West Georgia Generating Company, LLC, FERC Docket No. NP08-19-000 (June 5, 2009)

Reliability Standard: CIP-001-1

Requirement: R4

Violation Risk Factor: Medium

Violation Severity Level: Moderate

Region: SERC

Issue: SERC found that West Georgia failed to establish communication contacts with the local FBI officials in order to report suspected sabotage events.

Finding: SERC declined to assess a penalty for the violation because the violation (i) occurred during the transition period to mandatory standards and (ii) would not put the bulk power system reliability at a serious or substantial risk. NERC also noted that it affirmed SERC's decision not to assess a penalty because the violation was the first incidence of violation by West Georgia and because West Georgia worked cooperatively with SERC and acted immediately to mitigate and/or correct the violation.

Penalty: $0

FERC Order: 124 FERC ¶ 61,105, http://www.nerc.com/files/NoticeOfPenaltyOrder.pdf

Westmoreland Partners, FERC Docket No. NP10-9-000 (November 13, 2009)

Reliability Standard: CIP-1-001

Requirement: R1

Violation Risk Factor: High

Violation Severity Level: N/A

Region: SERC

Issue: SERC found that Westmoreland violated CIP-001-1 R1 since it failed to have in place a method of identification of sabotage events in its sabotage reporting procedure for the period June 18, 2007 through November 9, 2007.

Finding: NERC approved SERC's decision to impose a $10,000 fine on Westmoreland for its violation of two reliability standards. NERC considered several factors, including: (i) the violations were related to documentation issues; (ii) the non-compliance began in 2007 and was remedied by early 2008; (iii) Westmoreland was cooperative during the process; (iv) Westmoreland had not previously violated these or similar requirements; (v) Westmoreland did not attempt to hide its violations; (vi) Westmoreland did not intentionally violate the reliability standards; and (vii) Westmoreland agreed to the settlement.

Penalty: $10,000 (aggregate for violation of two standards)

FERC Order: Issued December 11, 2009 (no further review)

Whiting Clean Energy, Inc. (WCE), Docket No. NP14-8 (Nov. 27, 2013)

Reliability Standard: CIP-001-1

Requirement: 2

Violation Risk Factor: Medium

Violation Severity Level: High

Region: RFC

Issue: While conducting a Compliance Audit, RFC found that WCE could not show that sufficient procedures for communicating sabotage events had been developed and distributed as required. No sabotage events occurred during the violation period, which was determined to be July 9, 2008, the date WCE registered as a GOP, until January 10, 2013, the date mitigation actions were completed.

Finding: This violation was deemed to pose minimal risk to reliable BPS operations, but not serious or substantial risk. WCE had sabotage reporting procedures in place; however, the notification procedures did not meet those required by CIP-001-1. In determining the appropriate penalty, RFC considered several factors, including that these violations were the first by WCE of the subject Reliability Standards; one violation was self-reported; WCE cooperated during the compliance enforcement process; and WCE has a compliance program in place and certain aspects were considered a mitigating factor by RFC. However, RFC determined that WCE’s performance during the Compliance Audit was an aggravating factor as WCE did not fully understand its responsibilities under NERC’s Reliability Standards nor even its own processes and procedures.

Total Penalty: $35,000 (aggregate for 7 violations)

FERC Order: Issued December 27, 2013 (no further review)

Wolverine Power Supply Cooperative, Inc., FERC Docket No. NP10-99-000 (April 28, 2010)

Reliability Standard: CIP-001-1

Requirement: R1

Violation Risk Factor: Medium

Violation Severity Level: Not provided

Region: RFC

Issue: During a compliance audit of Wolverine Power Supply Cooperative, Inc. (Wolverine) in June 2009, RFC discovered a potential violation of CIP-001-1 since Wolverine's protocols for reporting sabotage events did not require Wolverine personnel to report such events on its non-bulk power system facilities, as required. Wolverine's sabotage identification flowchart only classified as sabotage incidents that affected bulk power system operations.

Finding: RFC and Wolverine entered into a settlement agreement to resolve multiple violations, whereby Wolverine neither admitted nor denied the violations but agreed to a penalty and to undertake mitigation measures. RFC found that the alleged violation of CIP-001-1 did not create a serious or substantial risk to the bulk power system since Wolverine did actually have a sabotage reporting procedure in place and its personnel knew how to identify and report sabotage events on the bulk power system facilities. In determining the penalty, RFC considered that the multiple alleged violations were Wolverine's first occurrence of violations of the relevant Reliability Standards and that Wolverine was cooperative during the compliance enforcement process and did not attempt to conceal the alleged violations. In addition, RFC noted certain positive aspects of Wolverine's compliance program and Wolverine completed a mitigation plan for the alleged violation of CIP-001-1.

Penalty: $15,000 (aggregate for multiple violations)

FERC Order: Issued May 28, 2010 (no further review)