FERC Declines To Require Cybersecurity Modifications To Bulk Electric System Control Centers

On October 2, 2017, the Federal Energy Regulatory Commission (the "Commission") terminated its inquiry into the need for, and potential effects of, modifications to the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection Reliability Standards ("CIP Standards") regarding the cybersecurity of control centers used to monitor and control the bulk electric system. That inquiry, initiated, in part, in response to a 2015 cyberattack on Ukraine's electric grid, sought industry and stakeholder feedback on whether the Commission should modify the CIP Standards to require (i) separation between the Internet and BES cyber systems in control centers performing transmission operator functions and (ii) "application whitelisting"—a computer administration practice used to prevent unauthorized programs from running—for such systems. After reviewing comments on its Notice of Inquiry (NOI), the Commission concluded that the risks and operational