FERC Responsibilities (Chapter 3.4)

Section 3.4.1 lists the duties D2SI and its Regional Engineers carry out to administer the FERC Security Program for Hydropower Projects at the national level. Understanding these responsibilities helps licensees know what to expect from FERC and why.

• D2SI administers the Security Program by providing guidance and direction on all matters of security program management. Regional Engineers are responsible for executing and implementing the program within their jurisdiction.
• Maintain a master list of Security Groupings (SG1, SG2, SG3) of all dams under D2SI jurisdiction — this list is protected from public view.
• Establish and maintain communications with other federal and state agencies responsible for Dam Safety and Security.
• Participate in the DHS Dams Sector Government Coordinating Council (GCC) activities and coordinate with the Dams Sector (Private) Coordinating Council — making every effort to avoid undue duplication of security requirements for the dam sector.
• Contribute to the national database of suspicious incidents at U.S. dams, and pass along pertinent threat information derived from the database to FERC staff and FERC dam owners.
• Maintain positive control of all security-related FERC memos compiled or developed as a result of the program (see §8.0 for details).
• Provide in-house guidance and training to FERC Engineers on security inspection methods, threat awareness, and program requirements.
• Maintain and update the Security Program periodically to remain current with federal security policies and industry best practices.
• Notify licensees via letter of their upcoming security inspection and the requirements applicable to their Security Group — the notification letter will specify that the responsible security individual and all required security documents must be present during the on-site inspection.
• Conduct meetings and perform inspections with licensees to discuss and review both physical and cyber security programs.
• Review, monitor, audit, and evaluate security measures at projects as part of regularly scheduled Dam Safety Inspections — covering both physical and cyber security.
• Review whether the Emergency Action Plan (EAP) and Security Plan for each project are compatible and that their actions do not conflict.
• Review all required security documentation as required by the dam's security classification.
• Where required, become familiar with the identified vulnerabilities of the dam.
• Review the thoroughness of periodic security assessments conducted by licensees as required under their security classification.
• Facilitate communication on matters of threat alerts and threat information from other federal agencies, nearby licensees, and similar-sized projects throughout FERC jurisdiction.
• Complete a Project Security Memorandum — with the FERC-prepared DAMSVR assessment and Security Checklists (Site and Document) as memo appendices — for all Group 1 and Group 2 Dams.
• Protect information regarding security at projects from public disclosure.
• Review security measures for conflicts with License requirements.
• Coordinate, to the greatest extent possible, FERC security and recreational requirements with NERC security requirements to ensure licensees are not subject to conflicting obligations.

Section 3.4.2 establishes the FERC Engineer as the responsible security agent for D2SI in all matters regarding the security program with the licensee. It defines who must be present during inspections and how the notification process works.

• The FERC Engineer is the responsible security agent for D2SI on all matters regarding the Security Program with the licensee representative.
• During the Dam Safety Inspection, security matters are discussed with the appropriate licensee personnel. The person responsible for security at the facility — or other appropriate personnel — must be present during these security discussions and the physical inspection.
• FERC sends a notification letter to the licensee in advance of each inspection. This letter clearly states that the security representative must attend the security portion of the inspection and have all required security documentation available.
• The pre-inspection notification letter also specifies which security documents must be on hand and which personnel are required to participate — giving licensees the opportunity to prepare fully.
• The FERC Engineer uses the Dam Safety Inspection as an opportunity to evaluate the overall effectiveness of the licensee's security plan and program — not just to verify that documents exist.
• Security discussions during the inspection cover both physical security measures (fencing, access control, surveillance) and cyber security (SCADA, ICS, remote access controls).

Before arriving on-site, the FERC Engineer completes a structured set of preparatory activities designed to maximize the effectiveness of the security portion of the Dam Safety Inspection.

• Review and become familiar with all technical aspects of the project — dam type, structure, appurtenant features, and operational characteristics.
• Review the Potential Failure Modes for the project, keeping in mind how a potential adversary could exploit those vulnerabilities to damage or disable the facility.
• Review the Emergency Action Plan (EAP) to understand which responding agencies are involved (including law enforcement), and assess the potential consequences of whole or partial dam failure — including the effects of discrete feature destruction (e.g., one or more spillway gates) versus a full dam breach.
• Through FERC training, understand how different types of dams and appurtenant structures can be compromised by various means — explosive, non-explosive, and control-manipulation attacks.
• Consider how an adversary could gain access to the site from off-site, both by land and by water.
• Complete (or review an existing) DAMSVR analysis of the project before arriving on-site. Having the DAMSVR analysis prepared in advance significantly facilitates the field inspection.
• Review the previous year's FERC Security Checklists (Site and Document) and the Project Security Memorandum. Comparing prior-year data with current-year expectations helps identify changes made in the field since the last inspection.
• Confirm with the licensee that their security representative and all required security documents will be available for review during the inspection, or at a separately scheduled security meeting.

The field inspection provides the FERC Engineer with four core opportunities: (1) speak with licensee security and operations personnel, (2) review all security documents, (3) observe physical security measures in place, and (4) record all inspection observations.

Personnel Interviews and Organizational Readiness

• Talk to both the security representative(s) and dam operating personnel to gain an overview of how the organization views and handles security concerns — both physical and cyber.
• Determine whether there is clear instruction and communication between Corporate Security and operational personnel, and whether roles are clearly established so that everyone "knows what is expected of them."
• Determine whether contact information for responding agencies (police and others) is clearly posted at the facility.
• Verify that operating personnel know all plans and procedures for security — including how to handle a bomb threat and what activities are permitted at varying threat alert levels.
• Confirm that operating personnel know what suspicious activity looks like, including adversary surveillance, tests of security, illicit intelligence-gathering, and pre-attack rehearsals — for both physical and cyber attack methods.
• Verify that a consistent chain of communication exists between field personnel and others within the organization and with external responding personnel — similar in structure to EAP communications.

Document Review

• Review all required and related security documentation — including Vulnerability Assessments, Security Assessments, and Security Plans (which must include the Internal Emergency Response and Rapid Recovery sub-element where required).
• Become familiar with the documents to understand how the licensee's security system is designed to work — not just that the documents exist.
• Review any recommendations made in the self-assessment documents (SA or VA) and determine their current status. Request a Plan and Schedule or resolution for any outstanding recommendations. Confirm that appropriate recommendations have been implemented and incorporated into the current Security Plan.
• Ensure that all required documents are up to date and — for Security Group 1 Dams — that the Security Plan has been exercised within the last five years.

Physical Site Inspection

• Confirm estimations made during the preparatory phase about the potential consequences of damage to the dam and its critical appurtenant physical structures (Table 1 of DAMSVR).
• Inspect the project to identify all critical physical dam-related assets important to project operation. Determine whether those assets are vulnerable to a reasonable worst-case scenario and what the consequences of their destruction would be (Table 2 of DAMSVR).
• Determine how accessible and visible the dam and all appurtenant critical physical dam-related structures are (Table 3 of DAMSVR).
• Ask the licensee about the perceived threat — local, regional, and national (Table 6 of DAMSVR).
• Observe the effectiveness of the security in place relative to the current threat state and verify consistency with the Security Plan guidance (Table 7 of DAMSVR).
• Determine whether provisions exist for improving security on a temporary basis in response to increased threat levels.
• Ensure that the Security Plan includes all upgrades to physical, cyber, and operational security — confirming it is fully up to date.
• Review upgraded security elements for their impact on license articles, particularly relating to environmental concerns and recreation. Closures of facilities exceeding 30 days may require the license amendment process; permanent closures must not proceed without a license amendment determination.

Completing Inspection Records

• Complete the FERC Security Checklists (Site and Document) as the inspection progresses. The blank Security Checklists are in Appendix A of the Security Program guidance.
• Complete or verify the DAMSVR analysis. See §3.4.3.3 for details on when DAMSVR must be updated.
• Review all observations with the licensee representatives at the close of the inspection. If there are no written plans for a Group 1 or Group 2 Dam, request a plan and schedule for their completion and ask how the organization determines the effectiveness of their security response in the interim.
• The completed Security Checklist and DAMSVR sheets while in the field must not contain any specifics that could locate or identify the specific project. If electronic files are created outside the FERC network, they must be scrubbed of any names, locations, or descriptions that could identify a specific project or licensee.
• A copy of the completed Security Checklist and DAMSVR results may be provided to the licensee upon request. The FERC Project Security Memorandum cannot be shared with outside organizations — it remains a decisional, non-public document.

After each Dam Safety Inspection, the FERC Engineer prepares a structured set of post-inspection documents. Section 3.4.3 defines the three core outputs: the Project Security Memorandum, the Security Checklists, and the DAMSVR Analysis.

§3.4.3.1 — FERC Project Security Memorandum

• The observations and conclusions of the security portion of each Dam Safety Inspection are recorded in the FERC Project Security Memorandum. The Security Checklist and the DAMSVR Analysis summary page are attached as appendices.
• The Security Memorandum is an internal decisional memorandum — classified as Privileged (non-public) working notes. It is not submitted to FERC's eLibrary system.
• The memorandum addresses the security posture of the project in generalized terms only, deliberately omitting specific security details. To remain a decisional document, the working copy written from the inspection cannot be shared with the licensee.
• A FERC Project Security Memorandum is completed annually for all Security Group 1 Dams, and every five years for all Security Group 2 Dams.
• Each year, the FERC Engineer discusses the results of the security inspection — observations, memos, checklists, and DAMSVR data — with the Branch Chief. Recommendations for Group 1 Dams are reviewed by both the FERC Regional Office and HQ to ensure national consistency.

§3.4.3.2 — Security Checklists (Appendix 1 of the Security Memo)

• Inspection observations and security responses are recorded by the FERC Engineer using the Security Checklists as a guide, and discussed interactively with site personnel during the inspection.
• Security recommendations made in the field should be of a generic nature to minimize disclosure of site-specific vulnerability details.
• The FERC Hydro Security Checklist is structured around the logical progression of "Detect → Assess → Delay → Respond" to evaluate security effectiveness.
• The documentation review checklists for Group 1 and 2 Dams (Appendix A) are used to identify missing sections in required VA, SA, SP, and Internal Emergency Response and Rapid Recovery documents.
• New documentation must be filled out at every inspection — do not reuse or duplicate prior forms. Compare results from the previous year's documentation to identify any changes; record observed changes in detail on a supplemental sheet.
• The Checklists must be completed in full during each annual inspection of Group 1 and Group 2 Dams. When attached to the Security Memo, the checklist becomes Appendix 1. In off-years for Group 2 Dams, it is retained separately in FERC security files.

§3.4.3.3 — DAMSVR Analysis (Appendix 2 of the Security Memo)

• A DAMSVR analysis evaluates five project and asset values: Consequence (C), Vulnerability (V), Likelihood of Attack (L), Threat (T), and Security System Effectiveness (S). These are combined in the DAMSVR formula to determine comparative risk.
• The DAMSVR analysis serves two purposes: (1) to assist in classifying and verifying Security Group assignments, and (2) to cross-check the Vulnerability and Security Assessments completed by the licensee.
• A DAMSVR analysis of the dam and all associated structures must be completed prior to inspections of all Group 1 and Group 2 Dams, according to the following schedule: every five years from the 2009 Version 2 roll-out; the first year a new FERC Engineer is assigned to the project; or whenever substantive changes occur to physical security, procedural operations, Cyber/SCADA modifications, new project features, downstream conditions, or local/regional/national threat levels.
• The FERC Engineer must review the existing DAMSVR analysis during the inspection and discuss the results with the licensee to arrive at mutually agreed-upon values where possible.
• When a FERC Project Security Memorandum is completed, the Summary Asset Worksheet (SAW) page of the DAMSVR analysis is attached as Appendix 2. The full DAMSVR analysis for all Group 1 and 2 Dams is retained separately in FERC security files.

Section 3.4.3.4 establishes the procedures for handling requests for additional security information after an inspection, and defines how all FERC security records must be stored, transmitted, and protected.

Requests for Additional Security Information

• Any requests for additional security details or procedures arising from an inspection must not become part of the Dam Safety Inspection Report — they are handled through a separate follow-up process.
• When additional information is needed, instruct the dam owner verbally during the inspection that the information is required, and that a follow-on telephone request will be made within five working days of the inspection.
• Record all details about the request in the Checklist (Question 24 and supplemental sheet if needed) and provide the licensee a 30-day deadline from the date of inspection to submit a plan and schedule addressing the recommendations.
• The dam owner must provide the additional information directly to the FERC Regional Office via hand delivery, certified mail, or parcel services — not via eLibrary. The Regional Office forwards it to D2SI headquarters via UPS.
• The licensee should refrain from including detailed security data in the submittal to the greatest extent possible.
• All data supplied by the dam owner through this process must be marked on each page: "Privileged — Security Sensitive Material."

Electronic Data Handling

• Electronic versions of any D2SI materials containing security information for a specific project may only be retained on computers connected to the FERC network.
• Electronic files must be erased from computer hard drives not connected to the FERC network immediately after preparation.
• Any work conducted on a computer connected to the Internet outside the FERC office must be completed only through FERC-managed clients.
• Only two paper copies of security documents are retained.

Physical Records Retention

• All FERC working notes on security issues are placed in a project folder and filed in a secure location (locked file or safe) with the Regional Engineer, separate from the general project files.
• An additional copy is stored at FERC Headquarters in Washington, DC in a secured file cabinet.
• The project security folder contains: security response correspondence from the licensee; the most recent FERC Project Security Memorandum (with attached Security Checklists and DAMSVR); any subsequently related correspondence or telephone memos; and pertinent field notes.
• Specific details about security measures at a facility must not be communicated by FERC Dam Safety staff via email.
• Security details must be recorded only by means of the FERC Project Security Memorandum and attached Security Checklist/DAMSVR. No copies of FERC-generated security data may be sent to eLibrary.

Dam Safety Inspection Report

• The Dam Safety Inspection Report includes a statement that security has been discussed and reviewed by the FERC Engineer during the inspection.
• No additional security details are provided in the Dam Safety Inspection Report — the report is a public-facing document and security specifics are protected through the separate, non-public Security Memorandum process.