FERC Security
← Back to FERC Overview
Annual Security Compliance Certification Letter (Chapter 8)
A review of Chapter 8 of the FERC Security Program for Hydropower Projects — covering why the annual letter exists instead of document submittal, exactly what certifications the letter must contain by Security Group, security contact requirements, and letter classification and signing rules.
Module 1: Why an Annual Letter Instead of Document Submittal?
Section 8.0 opens by explaining why FERC chose an annual certification letter — rather than direct submission of security documents — as the primary compliance mechanism.
- FERC does not require licensees to submit security documents (Vulnerability Assessments, Security Plans, etc.) directly to FERC because of unresolved uncertainty around the Freedom of Information Act (FOIA).
- FERC D2SI believes security-specific documents can be successfully protected from public release — but the legal basis for that protection has not been fully settled, and specific FOIA exemptions for security documents were still being developed when Revision 3 was issued.
- Submitting sensitive security documents to a federal agency creates the risk that they could be released through a FOIA request, potentially exposing facility vulnerabilities to adversaries.
- Instead of document submittal, D2SI Engineers capture the necessary security details directly during Dam Safety Inspections, and those findings are recorded only in FERC decisional memos — which have a narrower distribution than submitted documents.
- In addition to inspection-based capture, each licensee must submit an Annual Security Compliance Certification Letter to their FERC Regional Office by December 31 of each year.
- The letter certifies that all applicable security program requirements have been met — without including any of the security-specific details that would pose a FOIA risk.
- This two-track approach (inspections + annual letter) allows FERC to verify compliance while keeping sensitive security information out of the public record.
Module 2: Required Certifications — What the Letter Must Cover
The annual letter must address each applicable requirement based on the dam's Security Group. The table below maps each required certification to the Security Groups for which it applies.
| Required Certification | SG1 | SG2 | SG3 |
|---|---|---|---|
| Compliance with Vulnerability Assessment (VA) requirements, including the date of the most recent full reprinting (must be within five years of the letter date) | Required | N/A | N/A |
| Compliance with VA updating for the current year (required in years when a full reprinting is not performed) | Required | N/A | N/A |
| Compliance with Security Assessment (SA) requirements, including the date of SA completion | Required (within VA) | Required | N/A |
| Compliance with SA updating for the current year | Required (within VA) | Required | N/A |
| Compliance with Security Plan (SP) requirements and annual updating | Required | Required | If SP maintained |
| Compliance with Internal Emergency Response sub-element of the SP (SG1 & SG2), with confirmation that all contact information has been verified for the current year | Required | Required | N/A |
| Compliance with Rapid Recovery of Essential Services sub-element of the SP, with confirmation that contact information has been verified | Required | N/A | N/A |
| Compliance with Section 9.0 Computer Security and SCADA requirements (if the facility has applicable cyber assets) | If applicable | If applicable | If interconnected |
| Date of last Security Plan exercise testing (must be within five years of the date of the annual letter) | Required | N/A | N/A |
| Confirmation of primary and alternate security contact (name, phone, mailing address, and email) | Required | Required | Required |
Module 3: Security Contact Requirements
Each annual letter must confirm the identity and contact details of the facility's security contacts. This information is used by FERC D2SI for ongoing communications and security notices.
- The letter must confirm both a primary security contact and an alternate security contact for the facility.
- For each contact, the following information must be provided: name, telephone number, mailing address, and email address.
- The email address provided will be used by D2SI for future security notices — it is important that this address is actively monitored and kept current.
- If the security contact changes during the year, the licensee should notify FERC promptly and not wait for the December 31 annual letter to update this information.
- Contact information for law enforcement agencies contained in the Internal Emergency Response sub-element of the Security Plan must also be verified and confirmed as current in the annual letter.
- For licensees with multiple dams, a single set of contacts may be listed in the letter with clarification of which contacts cover which facilities, if they differ.
- The security contact does not need to be the same person as the FERC compliance representative — but both should be identified if they are different individuals.
Module 4: Signing Authority, Classification, and Multi-Dam Portfolios
The annual letter has specific requirements for who may sign it, how it must be marked, and how licensees with multiple dams should structure their submission.
- The annual letter must be signed by an appropriate organizational authority — FERC suggests the Chief Dam Safety Engineer, Dam Safety Coordinator, or other official contact such as the FERC compliance representative.
- The signer's authority matters: the letter is a formal certification to a federal regulator and should reflect organizational accountability for the security program.
- Every Annual Security Compliance Certification Letter must be marked: "Privileged — Security Sensitive Material." This marking must appear on the letter itself.
- Despite this marking, the letter must not contain security-specific information — it certifies compliance but does not describe security measures, hardware, layouts, or vulnerabilities.
- Security-specific details belong in the Security Plan, Vulnerability Assessment, and related documents — not in the annual letter.
- Licensees with multiple dams may submit a single annual letter that covers all dams in their portfolio, as long as the letter includes sufficient detail to certify compliance for each individual dam.
- The letter must be submitted to the FERC Regional Office (not FERC headquarters) by December 31 of each year.
- Late submission or missing certifications may be noted during the next Dam Safety Inspection and can result in compliance findings.