FERC Security Plan Requirements (Chapter 7)

Section 7.1 of the FERC Security Program defines the Security Plan as the foundational operating document for all security activity at a licensed hydropower facility.

• A Security Plan (SP) is a formal document — or organized set of documents — that constitutes the Standard Operating Procedures for all security concerns at the dam and project.
• The SP covers physical security, cybersecurity, and procedural security in a single comprehensive framework.
• The plan may be one document or a collection of individual plans that together address all aspects of security management at the facility.
• The SP must be comprehensive enough to be used by both security personnel and dam operators — operators are often the "eyes and ears" of security and must be able to initiate responses.
• Licensees may cross-reference other internal documents rather than duplicating content, as long as the indexing between plans is straightforward.
• The Security Plan is distinct from the Emergency Action Plan (EAP) — the EAP addresses dam safety emergencies (natural or sabotage-related), while the SP governs security protocols and procedures.
• Security Plans are required for Security Group 1 and Security Group 2 dams, and are strongly recommended for Security Group 3 dams.

Section 7.2 defines both required and recommended contents of the Security Plan. Required topics are those FERC will specifically review during Dam Safety Inspections.

Section 7.3 specifies where the SP must be maintained, who may access it, how it must be kept current, and when it must be exercised.

• The Security Plan must be available on-site at each dam for all Security Group 1 and 2 facilities — in hard copy or secured electronic form.
• Exception for un-staffed dams: if a dam has no on-site staff (operated remotely from a control center), the SP may be retained at the control center where roving operators work.
• Dam owners may share the SP with outside agencies that have a documented "need-to-know," but hard copies must never be provided to or retained by any outside agency or non-owner.
• The SP documents security hardware, operational procedures, personnel roles and responsibilities, and pre-planned responses to changing threat conditions.
• A separate Security Plan must be developed for each individual dam — one plan does not cover multiple sites.
• Any recommendations from a completed Vulnerability Assessment (VA) or Security Assessment (SA) that have been implemented must be fully incorporated into the Security Plan.
• The SP must be updated continuously as site changes occur — it must never be allowed to become outdated.
• Security Group 1 SPs must be exercised (tested) at least every five years — at the drill level or higher — to verify that security and operational employees know its contents.
• SP exercises for Group 1 may be combined with the regular Dam Safety Exercise program or consolidated across multiple projects in the same watershed.
• Security Group 2 SP exercises are not required but are strongly encouraged.

Section 7.4.1 addresses one of the most commonly deficient areas in dam security programs: the coordinated notification and hand-off between a detected security incident, law enforcement, and emergency management.

• When a serious security incident is detected, two simultaneous notifications must occur: (a) law enforcement to respond to/stop the adversary, and (b) Emergency Management Agencies (EMA) to protect downstream public life and property.
• These two actions must be pre-planned — law enforcement and emergency management have separate goals, and coordination failures at the worst moment are preventable through good planning.
• The Emergency Action Plan (EAP) governs dam safety emergencies; the Security Plan governs the security response. The two must be coordinated — but security protocol details must not be placed in the EAP, which has wider distribution.
• The Internal Emergency Response sub-element of the SP documents the transition from security concern to EAP implementation — this transition must be seamless.
• If the licensee has a dedicated security officer, that person must review the EAP and resolve any conflicts between security protocols and emergency response procedures before an incident occurs.
• Security personnel must be trained on EAP procedures; EAP coordinators must understand when security concerns trigger EAP actions.
• The Internal Emergency Response sub-element of the SP is required for all Security Group 1 and Security Group 2 dams.
• This sub-element must be updated annually with the SP — especially all contact information for law enforcement agencies.
• The SP should be reviewed with COOP (Continuity of Operations) Plans and other company documents to ensure internal consistency and no procedural conflicts.

Section 7.4.2 requires Security Group 1 dams to document specific pre-planned actions for restoring dam operations quickly after a security incident or disaster, minimizing the impact of service interruption.

• The Rapid Recovery of Essential Services sub-element is required only for Security Group 1 dams — SP exercising for Group 2 is strongly encouraged but not mandated for this element.
• Compliance with NERC CIP-009-1 satisfies the cyber asset recovery requirements — licensees subject to CIP-009-1 need only include a footnote in the SP indicating that compliance.
• An adversary may deliberately target power generation or water supply — rapid restoration of these services reduces the overall consequence of an attack and therefore reduces Security Risk.
• The Rapid Recovery sub-element documents pre-planned actions for a utility to continue, or quickly restore, power generation or facility function after natural or criminal disruption.
• This sub-element differs from company-level recovery plans (COOP, Utility Recovery Plan) — it focuses on restoring a specific facility, not the enterprise.
• Key content includes: stockpiles of critical materials, location of heavy equipment, warehousing of critical spare parts, and contacts for contractors and vendors.
• Interruptions to transmission lines and switchyards must also be addressed in the Rapid Recovery plan.
• The DHS publication "Dams Sector Crisis Management Handbook" (2008) provides a suggested format and is available online.
• Suggested content for the Rapid Recovery sub-element includes: applicable emergency scenarios, Incident Command System assignments, coordination with local authorities, communications and maps, vehicles/equipment/contractors, response time and geographic limitations, and meals/lodging for extended events.

Section 7.5 defines how Security Plans must be documented, maintained, and certified. FERC does not receive the SP directly — compliance is verified during Dam Safety Inspections and through an annual certification letter.

• All plans, procedures, and hardware relevant to on-site security must be fully documented within the SP.
• Security Plans for Group 1 and 2 dams were first required by December 31, 2010.
• Each SP must be updated annually — changes to parameters, hardware, and procedures must be highlighted from the previous year.
• Changes may be inserted as attachments or replacement sections; any on-site modification to security systems or procedures must be reflected in the SP.
• If there were no changes in the prior year, an acceptable update is a one-page dated insert stating "reviewed the SP and there are no changes."
• Licensees do not submit their Security Plan to FERC — but the SP must be made available for review during every Dam Safety Inspection without exception.
• In place of direct submission, licensees must submit an Annual Security Compliance Certification Letter to their FERC Regional Office by December 31 of each year.
• The annual letter must certify compliance with SP requirements, confirm that the Internal Emergency Response sub-element has been updated (including all law enforcement contact information), and report the last date of SP exercise for Group 1 dams.
• For licensees with multiple dams, a single annual letter may cover all VA, SA, and SP compliance certifications across the portfolio.