Reliability Assurance Initiative (RAI) 101 Ben Christensen Senior Compliance Risk Analyst, Cyber Security

Western Electricity Coordinating Council Agenda Introduction to Reliability Assurance Initiative Risk Elements Inherent Risk Assessment (IRA) Internal Controls Evaluation (ICE) Overview of WECC’s IRA and ICE process and documents Western Electricity Coordinating Council

Western Electricity Coordinating Council Introduction to RAI Implements risk based compliance monitoring and enforcement Initial discussions by NERC in 2012 Regional RAI pilots during 2013 and 2014 2014 NERC and Regions designed the risk based framework Western Electricity Coordinating Council

Overview of Risk Based Framework Western Electricity Coordinating Council

Western Electricity Coordinating Council Risk Elements Replaces prior actively monitored lists WECC identified region wide risk elements 10 O&P risk elements 6 CIP risks elements WECC identified NERC Standards and Requirements associated with risk elements Western Electricity Coordinating Council

Western Electricity Coordinating Council IRA Overview Western Electricity Coordinating Council

Western Electricity Coordinating Council What is the IRA? Review of inherent risks posed by an entity to the BPS Review of an entity’s characteristics Such as event history, compliance history, devices owned/operated, types of transmission lines, generation portfolio, etc. IRA process is located on the WECC website Western Electricity Coordinating Council

WECC’s IRA Process Identify Major Inputs into IRA Review Entity Background Identify Initial List of Applicable Functions and Standards Identify and Review Applicable Risk Element Determine Monitoring Strategy Western Electricity Coordinating Council

Western Electricity Coordinating Council IRA Surveys Currently posted on WECC website Completed by Registered Entities Helps identify Entity’s inherent risks Western Electricity Coordinating Council

Western Electricity Coordinating Council IRA Final Report Documents WECC’s assessments and evaluations Helps develop Registered Entity’s Compliance Oversight Plan Summary of Final Reports provided to Entity Western Electricity Coordinating Council

Internal Controls Evaluation (ICE) Western Electricity Coordinating Council

Western Electricity Coordinating Council What is ICE? Voluntary process WECC will evaluate internal controls related to the risks and associated standards WECC will make recommendations to strengthen controls ICE process is located on the WECC website Western Electricity Coordinating Council

WECC’s ICE Process Identify key controls related to risks Request controls information Test effectiveness of controls Identify how well controls address risks and provide compliance assurance Western Electricity Coordinating Council

Western Electricity Coordinating Council ICE Surveys Currently posted on WECC website Completed by Registered Entities Helps identify Entity’s internal controls Western Electricity Coordinating Council

Western Electricity Coordinating Council ICE Final Report Documents WECC’s assessments and evaluations Helps develop Registered Entity’s Compliance Oversight Plan Summary of Final Report provided to Entity Western Electricity Coordinating Council

How will WECC use IRA and ICE? WECC can better tailor compliance monitoring activities using existing CMEP tools (i.e., audits, spot checks, or self-certifications) WECC may use the results to focus the depth and scope of monitoring engagements Not a one size fits all but a risk based approach Western Electricity Coordinating Council

Western Electricity Coordinating Council Additional Resources NERC RAI Page NERC Risk Elements Guide WECC CMEP IP IRA IRA Process IRA Survey template IRA Report template ICE ICE Process O&P ICE Survey CIP ICE Survey Western Electricity Coordinating Council