Licensee Requirements (Chapter 3.3)

Section 3.2 establishes the baseline ongoing duties that apply to all FERC licensees regardless of Security Group. These responsibilities form the foundation of an effective site security program.

• Licensees are responsible for security at their projects — covering both physical and cyber domains — including completing required Vulnerability or Security Assessments, maintaining Security Plans, implementing security upgrades, and communicating with local law enforcement and nearby dam operators.
• Licensees must appropriately augment on-site walk-downs of project facilities with a security lens — paying special attention to suspicious activities, "danger signs" from vulnerable features, visual signs of distress, and critical dam safety instrumentation readings. "Trigger points" for action arising from critical instrumentation must be defined.
• Licensees must maintain awareness of potential threats to the project in the surrounding area and region.
• Annual training and information updates must be provided to appropriate company employees covering both physical and cyber security, security plans, and current threat conditions. Protection of sensitive information and operational security (OPSEC) must be ensured.
• Licensees must designate a primary point of contact to receive FERC security notifications, and at least one alternate contact for security-related communications (which may include 24/7 watch offices if desired by the owner).
• The security contact and dam safety contact for FERC must remain in communication with each other on project responsibilities and operations — especially if they are separate individuals.
• Responsible security staff/managers and dam safety/operations managers must both be involved in all major security-associated activities at the project site.
• Any security measures that may conflict with License requirements must be identified and resolved.
• Licensees must ensure efficient coordination among the procedures in all applicable plans — particularly the Emergency Action Plan (EAP) and Security Plan(s), including the Internal Emergency Response and Rapid Recovery sub-element for applicable Security Groups.
• Licensees must establish and maintain open communications with FERC D2SI staff and nearby dam operators regarding suspicious activity, security breaches, or incidents — unless expressly restricted by law enforcement. FERC Regional Office must be notified of any suspicious activity or incidents as soon as practical (usually within one working day).
• The security contact (or their representative) and all required security documents must be available for review by FERC D2SI Engineers, especially during the Dam Safety Operation Inspection.

Security Group 1 dams have the highest potential consequence, vulnerability, and likelihood of attack as determined by the DAMSVR(v2) analysis. They are inspected with the highest level of scrutiny and carry the most comprehensive document requirements.

• Security Group 1 classification is based on Consequence (C), Vulnerability (V), and Likelihood of Attack (L) values from the DAMSVR(v2) analysis conducted by FERC in 2010. The specific thresholds defining Group 1 are not publicly revealed.
• Licensees were notified of Security Group classifications in letters from FERC on November 21, 2001, and reclassified via letter in January 2010 using updated DAMSVR(v2) methodology.

Required Documents — Security Group 1

• Vulnerability Assessment (VA) — Must be updated annually and fully reprinted at least once every five years. The SG1 VA also encompasses all content required for a Security Group 2 Security Assessment.
• Security Plan(s) (SP) — Must be updated annually, or whenever changes are made to security measures or procedures. The SP must be exercised (tested) at least every five years, at minimum to the Drill level. SP testing may be consolidated into a single exercise for multiple dams in the same watershed that use the same responding agencies.
• The SP must demonstrate how the security response can be escalated in response to changing threat conditions.
• The SP must contain an Internal Emergency Response and Rapid Recovery sub-element (see §7.4) showing how security and emergency notification/response actions are integrated and how the project can rapidly recover from lost services.
• The SP must incorporate cyber/SCADA security measures — either within the main Security Plan or in a separate Cyber/SCADA Security Plan — if cyber/SCADA systems are used at the site. Cyber scope covers remote control/operation of water retention structures and continued operation of licensed power generation (not electric reliability/grid stability).
• Annual Security Compliance Certification Letter — Due annually by December 31, submitted to the FERC Regional Engineer. The letter certifies compliance with SG1 Vulnerability Assessment and Security Plan requirements, and highlights any parameters that changed from the previous year.

Security Group 2 dams have significant consequence or vulnerability but do not reach the highest tier. They are inspected at a high level of awareness and have their own specific document requirements, which are somewhat less stringent than SG1.

• Security Group 2 classification is also based on DAMSVR(v2) Consequence, Vulnerability, and Likelihood of Attack values. The specific thresholds defining Group 2 are not publicly revealed.
• Any Security Group 2 project that has control over — or the potential to control — a Security Group 1 project must follow the requirements of Security Group 1.
• Requests for Permanent Licensed Facility Closures for any SG2 Dam require completion of a full Vulnerability Assessment to justify the closure.

Required Documents — Security Group 2

• Security Assessment (SA) — Must be updated annually and fully reprinted at least once every ten years.
• Security Plan (SP) — Must be updated annually, or whenever changes are made. The SP must demonstrate how security response can be increased due to changing threat conditions, though threat-level changes do not need to be as stringent as for SG1.
• The SP must contain an Internal Emergency Response sub-element showing how security and emergency notification/response actions are integrated. The Rapid Recovery sub-element is not required for Group 2 Dams.
• There is no requirement to exercise (test) the Security Plan for a Group 2 Dam — although a SP exercise program is strongly recommended.
• The SP must incorporate cyber/SCADA security measures — either within the main Security Plan or in a separate Cyber/SCADA Security Plan — if cyber/SCADA systems are used at the site.
• Annual Security Compliance Certification Letter — Due annually by December 31, submitted to the FERC Regional Engineer. The letter certifies compliance with SG2 Security Assessment and Security Plan requirements, and highlights any parameters that changed from the previous year.

Security Group 3 covers all FERC-licensed dams not classified as Group 1 or Group 2. There are no mandatory security documents for SG3, but several items are highly recommended, and some cyber security obligations may apply based on interconnections.

• Security Group 3 is defined as any FERC dam not meeting the definitions of Security Group 1 or Group 2. Specific classification thresholds are not publicly revealed but can be provided to the licensee during a security inspection.
• SG3 dams are inspected by FERC D2SI Engineers as they come up for scheduled Dam Safety Inspections on a 1-to-3-year cycle. FERC comments on SG3 security are expected to be minimal.
• There are no mandatory security documents for SG3 — no required Security Assessment, Security Plan, or Annual Compliance Letter.
• A Security Assessment and Security Plan are highly recommended for SG3 dams and are left to the discretion of the licensee. Security will be highly dependent on the licensee's own judgment.
• Any SG3 project that has control over — or the potential to control — a Security Group 1 or Group 2 project must follow the requirements of the highest applicable Security Group.
• Remotely operated or controlled SG3 projects must have appropriate physical and cyber security measures in place to protect cyber/SCADA systems if those systems are tied to Group 1 and/or (some) Group 2 dam projects.
• All Security Groups should consider having a cyber security plan if they utilize cyber/SCADA assets — even if not required.
• Although some SG3 dams may be exempt from Emergency Action Plan (EAP) requirements, licensees should still consider how emergency response would be initiated in the event of a security breach, and ensure that pertinent law enforcement contact numbers are included in the Project's Contact List.
• Requests for Permanent Licensed Facility Closures for any SG3 Dam require completion of a full Vulnerability Assessment to justify the closure.

Several sections of Chapter 3.3 address specific circumstances that affect how security requirements apply: recreational access restrictions, permanent closures, unconstructed projects, unlicensed projects, and facilities where the licensee does not own the dam.

§3.3.4 — Licensee License and Recreational Responsibilities

• Interruptions to recreational and project use due to security concerns must be minimized to the greatest extent possible.
• Temporary restrictions of 30 days or less may be implemented without prior FERC D2SI approval, as long as the FERC Regional Office is notified as soon as practical (usually within one working day).
• Security measures affecting recreation or project use for more than 30 days must be coordinated with the FERC Regional Office before implementation.
• Permanent facility closures due to security concerns require completion and sharing of a Vulnerability Assessment to evaluate conditions and determine whether permanent closure is justified, or whether modifications to project use plans are more appropriate.
• For SG1 dams: the existing Vulnerability Assessment must be used to justify a permanent closure request.
• For SG2 or SG3 dams: a special full Vulnerability Assessment must be completed specifically to justify whether permanent licensed facility closure is appropriate.

§3.3.5 — Unconstructed Projects

• For projects that have not yet been constructed, all applicable security requirements (as described in §3.3.1 through §3.3.3 based on the project's Security Group) must be completed no later than 60 days before the initial filling of the project reservoir begins.

§3.3.6 — Unlicensed Constructed Projects

• An unlicensed constructed project is one where a license application has been filed, or where the Commission has determined that licensing is required.
• Such projects must complete all applicable §3.3 requirements no later than the earliest of: (1) six months after the date the license application is filed; (2) six months after the Commission issues an order requiring licensing; or (3) a date specified by the Commission or its authorized representative.

§3.3.7 — Projects with Dams Not Owned by the Applicant/Licensee

• When the applicant/licensee is not the owner of the dam and is not responsible for its maintenance, operation, or monitoring, the licensee must coordinate with the dam owner to ensure security is appropriately addressed.
• If the dam owner or the licensee refuses to cooperate, the appropriate Federal or State Dam Safety Official will be contacted and FERC will moderate a meeting to resolve the situation.

Table 3.3.8 summarizes the document and program requirements across all three Security Groups. Understanding this summary allows licensees to quickly identify their obligations based on their dam's classification.

• Update requirements: VA — annual update, reprinted every 5 years; SP — annual update or as required; SA — annual update, reprinted every 10 years minimum for Group 2 (the SA is included within the VA for a Group 1 Dam).
• The SP must address how the licensee is handling security upgrade recommendations identified in the VA and/or SA, as applied to the specific site.
• Internal Emergency Response and Rapid Recovery is a sub-element of the Security Plan. It documents procedures for transitioning from a security incident to emergency notification/response activities and for rapidly recovering lost services (see §7.4).
• A Vulnerability Assessment must be completed prior to FERC approval of any request for permanent closure of recreational or other project facilities — regardless of Security Group.