FERC Directs NERC To Develop Reliability Standard For Supply Chain Cyber Controls

On July 21, 2016, in Order No. 829, FERC directed the North American Electric Reliability Corporation ("NERC") to develop a new or modified Critical Infrastructure Protection ("CIP") Reliability Standard that addresses supply chain risk management for industrial control system hardware, software, and computing and networking services associated with Bulk Electric System operations. FERC directed NERC to submit the new or modified Reliability Standard within one year of the effective date of the order, which is 60 days after the order's publication in the Federal Register.

Order No. 829 is the final rule in a proceeding initiated by FERC's July 16, 2015 Notice of Proposed Rulemaking ("NOPR") in which FERC described a number of recent malware campaigns targeting electric industry supply chain vendors, and expressed its belief that such attacks evidenced a "gap" in the CIP Reliability Standards (see July 20, 2015 edition of the WER). In order to address this gap, FERC