Compliance Program Implementation Plan 2011 December 15, 2010 Ray Palmieri 1

Overview Areas of Change to the Annual Implementation Plan Risk-Based Methodology Changes From Past Plans New Outreach Programs No Process Changes Compliance Program Implementation Plan

Risk-Based Methodology Risk Factors Considered in Defining Scope of Activities  North American-wide NERC Reliability Standards most violated, including both all time historical and rolling twelve-month statistics, are considered. This encompasses the core standards to be monitored across the industry.  Regional Entity-specific most violated NERC Reliability Standards, which may include standards already identified in item #1 for some Regional Entities, or additional standards. This analysis allows Regional Entities to focus on significant trends and issues within the Regional Entity boundary. This also could lead to the identification of Interconnection-wide issues and concerns.  Regional Entity Reliability Standards most violated, as applicable.  Registered Entity specific issues, including but not limited to operational issues, operational footprint changes, corporate restructuring, other trends, etc.  Analytical determination (other high risk reliability standards, registered functions trends and concerns, standards rising in prominence and identified through trend analysis)  Other factors, as determined by ReliabilityFirst, including Compliance Culture, which considers the entity’s compliance culture and overall strength of compliance Compliance Program Implementation Plan

Compliance Audits Standards Monitored for the First Time  MOD - 001, 004, 008, effective 4/1/2011  PRC  CIP Suite of Standards – Version 3  IRO and Compliance Program Implementation Plan

Self-Certifications Standards Self Certified for the First Time  CIP Suite of Standards – Version Compliance Program Implementation Plan

Spot Checking Standards to be Spot Checked for the First Time  NUC-001  BAL-003  IRO-005, R13  CIP Suite of Standards – Version Compliance Program Implementation Plan

Data Submittals Standards Requiring First Time Data Submittals  MOD-028, 029, 030  PRC-004, 016, 022  PRC-007, 021  TPL-001, 002, 003, Compliance Program Implementation Plan

Outreach Programs Open Compliance Calls CIP Webinars Compliance Application Notices (CANs) Compliance Program Implementation Plan

SCOPE Minimum Number of Standards to be Monitored Total of 39 Standards for Audit (2010 – 56) Total of 55 Standards for Self Certification (2010 – 60) Total of 14 Standards for Spot Checks (2010 – 9) Total of 22 Standards for Data Submittals (2010 – 20) Total of 102 Standards are FERC approved, with expectation of compliance at all times Compliance Program Implementation Plan

Compliance Program Implementation 10 Questions