FERC Security1. Introduction
All UsersFoundational information about the organizations and structure of the security program.
StartFERC Overview
Review each module to learn about FERC's Security Program for Hydropower Projects.
Watch the How-To video on our YouTube channel.
2. Licensee Requirements (this is you)
All UsersCovers Sections 3.2 and 3.3 of FERC's Security Program — general licensee responsibilities, Security Group 1/2/3 document requirements, recreational access restrictions, permanent closure rules, unconstructed and unlicensed project deadlines, and the master Table 3.3.8 summary of all program requirements.
Start3. FERC Responsibilities
All UsersCovers Section 3.4 of FERC's Security Program — D2SI program-level duties, the FERC Engineer's role in Dam Safety Inspections, inspection preparation and conduct, Project Security Memorandum, DAMSVR analysis, and security records management.
Start4. Annual Security Compliance Certification Letter (required by all project owners)
All UsersCovers Chapter 8 of FERC's Security Program — why licensees submit an annual certification letter instead of security documents, exactly what the letter must certify by Security Group, security contact requirements, classification marking, and signing authority.
StartSecurity Group 1 Requirements
1. Security Plan Requirements (required for Security Group 1 & 2 projects)
All UsersA detailed review of Chapter 7 of FERC's Security Program — what a Security Plan must contain, required vs. recommended sections, on-site maintenance rules, Internal Emergency Response coordination, Rapid Recovery planning, and annual documentation compliance.
Start2. Vulnerability & Security Assessments (required for Security Group 1 & 2 projects)
All UsersCovers Chapters 5 and 6 of FERC's Security Program — the definition and risk equation for Vulnerability Assessments (VA), the four required factors (Consequence, Vulnerability, Threat, Security Effectiveness), minimum threat scenarios, the design basis threat concept, VA documentation and update cycles, and the Security Assessment (SA) requirements for Group 2 Dams.
Start3. Computer Security and SCADA Requirements (required for all projects)
All UsersCovers Chapter 9 of FERC's Security Program — who must comply, the two-step applicability process (Remote Operation Determination + Consequence Determination), cyber asset classification (Critical/Operational/Non-Critical), baseline and enhanced security measures from Tables 9.3a and 9.3b, and NERC-CIP coordination.
Start4a. Vulnerability Assessments (Chapter 5 — required for Security Group 1 projects)
All UsersCovers Chapter 5 of FERC's Security Program — the definition and risk equation for Vulnerability Assessments, the four required analysis factors (Consequences, Vulnerability, Threat and Likelihood, Security Effectiveness), minimum required threat scenarios, the design basis threat concept, and VA documentation, update cycles, and submission rules.
Start4b. Security Assessments (Chapter 6 — required for Security Group 2 projects)
All UsersCovers Chapter 6 of FERC's Security Program — what a Security Assessment is, how it differs from a full Vulnerability Assessment, its required and suggested content, the minimum threat standard for Group 2 Dams, the 10-year reprint and annual update cycles, and how the SA integrates with the Security Plan and Dam Safety Inspection process.
StartSecurity Group 2 Requirements
1. Security Plan Requirements (required for Security Group 1 & 2 projects)
All UsersA detailed review of Chapter 7 of FERC's Security Program — what a Security Plan must contain, required vs. recommended sections, on-site maintenance rules, Internal Emergency Response coordination, Rapid Recovery planning, and annual documentation compliance.
Start2. Computer Security and SCADA Requirements (required for all projects)
All UsersCovers Chapter 9 of FERC's Security Program — who must comply, the two-step applicability process (Remote Operation Determination + Consequence Determination), cyber asset classification (Critical/Operational/Non-Critical), baseline and enhanced security measures from Tables 9.3a and 9.3b, and NERC-CIP coordination.
Start3. Security Assessments (Chapter 6 — required for Security Group 2 projects)
All UsersCovers Chapter 6 of FERC's Security Program — what a Security Assessment is, how it differs from a full Vulnerability Assessment, its required and suggested content, the minimum threat standard for Group 2 Dams, the 10-year reprint and annual update cycles, and how the SA integrates with the Security Plan and Dam Safety Inspection process.
StartSecurity Group 3 Requirements
1. Security Plan Requirements (suggested for Security Group 3 projects)
All UsersA detailed review of Chapter 7 of FERC's Security Program — what a Security Plan must contain, required vs. recommended sections, on-site maintenance rules, Internal Emergency Response coordination, Rapid Recovery planning, and annual documentation compliance.
Start2. Computer Security and SCADA Requirements (required for all projects)
All UsersCovers Chapter 9 of FERC's Security Program — who must comply, the two-step applicability process (Remote Operation Determination + Consequence Determination), cyber asset classification (Critical/Operational/Non-Critical), baseline and enhanced security measures from Tables 9.3a and 9.3b, and NERC-CIP coordination.
Start