FERC Hydropower Security Program Overview

The federal government regulates hydropower projects to safely provide reliable power in an environmentally responsible manner that preserves natural, cultural, clean water resources.

• The Federal Energy Regulatory Commission (FERC) is an independent federal agency within the Department of Energy that regulates the interstate transmission of electricity, natural gas, and oil — and licenses non-federal hydropower projects across the United States.
• FERC licenses approximately 1,600 non-federal hydropower projects at roughly 2,500 dams, representing about 55% of U.S. non-federal hydroelectric capacity.
• FERC's Division of Dam Safety and Inspections (D2SI) is responsible for overseeing the safety and security of licensed hydropower facilities.
• D2SI conducts regular inspections and can require corrective actions, additional studies, or security upgrades at any time.
• These inspections determine if the licensees have implemented a security plan appropriate to site conditions and to current threat conditions while remaining flexible enough to address elevated threat conditions.
• Security requirements for FERC-licensed hydropower projects are distinct from — and in addition to — any applicable NERC CIP requirements for cyber assets.
• FERC security requirements apply to the physical infrastructure of the dam and powerhouse; NERC CIP applies to bulk electric system cyber assets at the same facility.

FERC's Security Program for Hydropower Projects, Revision 3A, is the foundational guidance document that defines security expectations for all FERC-licensed hydropower facilities. Understanding its structure is essential for compliance.

• The foundation for the FERC Hydropower Security Program are the three security groups (Security Groups 1, 2, and 3) as based on potential dam hazard classification, project size, potential consequences, and installed generation capacity.
• Security Groups were determined by FERC using the Dam Assessment Matrix for Security and Vulnerability Risk – DAMSVR(v2) in 2010.
• The DAMSVR(v2) is a security assessment methodology that contains information and procedures that could potentially be used to plan an attack against a dam. As such, access to the assessments is controlled.
• Only one person from each organization should request a copy of the DAMSVR.
• Request a copy of the DAMSVR(v2) assessment.

FERC classifies each licensed hydropower project into one of three Security Groups based on a structured assessment of consequence, vulnerability, and likelihood of attack. Security Group determines which documents are required and the level of scrutiny applied during inspections.

Projects classified as Security Group 1 have specific assessment and security planning requirements.

• A Site Security Plan that desribes the physical and cyber protection programs specific to the project.
• A Vulnerability Assessment (VA), (defined in Chapter 5 of Revision 3a document) is a formal document and provides an analysis of the factors that define full Security Risk.
• Traditional risk analysis is defined as (Impact x Threat x Vulnerability). If Risk Analysis is desired by the licensee, a suggested general comparative risk equation that is currently being used by the FERC is shown below, although any method is acceptable provided it is fully substantiated.

• Where, C = Consequence (scale of 1 - 10), V = Vulnerability (scale of 1 - 10), L = Likelihood of Attack (scale of 1 - 10), T = Threat (scale of 1 - 10), S = Security (scale of 10 - 1), and 300 is a scaling factor to normalize to the maximum result.
• Hydropowersecurity.com uses this method to develop the relative risk register for each asset you define for your project.

• Designate the project's cyber assets as critical, operational, or non-critical, as described in Chapter 9 of FERC's Revision 3a document and apply cyber security controls as applicable..
• A new VA should be completed every five (5) years and updated annually.
• The VA is not submitted to FERC, but must be available during each Dam Safety Inspection.

The table below identifies required and suggested section for the VA and Site Security Plan.

• Hydropowersecurity.com modeled the navigation for each project assessment after this table.

FERC's Division of Dam Safety and Inspections conducts regular inspections of licensed hydropower facilities to verify compliance with license conditions, dam safety standards, and security requirements. Understanding the inspection process helps licensees stay prepared.

• Any Security Group 2 project that has a control or the potential of control of a Security Group 1 project must follow the requirements of Security Group 1.
• A Site Security Plan that desribes the physical and cyber protection programs specific to the project.
• A Security Assessment (SA), (defined in Chapter 6 of Revision 3a document) is a formal document and is an abbreviated evaluation of the security procedures and features at the dam without fully accounting for attack Consequences, Vulnerabilities, or Threat. Hence, although the VA fully evaluates the four factors discussed in section 5.0, above (C, V, T, and S), the SA - as the name implies - only addresses an evaluation of Security.
• A Security Assessment must be completed for all Security Group 2 Dams, and is an integral part of the VA of a Security Group 1 Dam.
• Project owners are encouraged to evaluate attack scenarios specific to their site.
• At a minimum, each Security Group 2 SA should evaluate their security against an unarmed intruder with no specialized equipment or training.
• Designate the project's cyber assets as critical, operational, or non-critical, as described in Chapter 9 of FERC's Revision 3a document and apply cyber security controls as applicable..
• A new SA should be completed every five (5) years and updated annually.
• The SA is not submitted to FERC, but must be available during each Dam Safety Inspection.

The table below identifies required and suggested section for the SA and Site Security Plan.

• Hydropowersecurity.com modeled the navigation for each project assessment after this table.

Security Group 3 is the least impactful type of hydropower project.

• Any Security Group 3 project that has a control or the potential of control of a Security Group 1 or 2 project must follow the requirements of the highest Security Group.
• Designate the project's cyber assets as critical, operational, or non-critical, as described in Chapter 9 of FERC's Revision 3a document and apply cyber security controls as applicable.
• Cyber asset designation is covered in detial in the "Computer Security and SCADA Requirements (required for all projects)" module.
• A Site Security Plan is not required, but highly recommended.