June 13, 2020, whf. R1 Fisk/Locklear BOP Initiative, Attachment 2 – Low-Impact Rated Generator Owner/Operators (Effects of CIP-002-5.x) –

Terms and Definition: There are two (2) qualifying factors [i.e., a change in time ( ≤ 15 minutes) and Real Power capability ≥ 1500 MWe at a single interconnection] that establish a basis for this initiative and how it relates to NPP Owner/Operators. Because NPP Owner/Operators provide < 1500 MWe they are now categorized as Low-Impact Rated which makes the NERC Bright-Line Survey agreed to by NPPs and the NRC in 2010-2011 moot.

The purpose of this Attachment is to show that during 2008 – 2012 the NERC CIP Standards were immature as were the decisions being made during that period. As the NERC CIP Standards matured NPPs did not seek relief from the NRC regarding the over-regulation of BOP Systems under 10CFR 73.54.

When NERC began revising CIP-002-x in 2012 the authors of this initiative believes it was to set more specific guidelines for what, and who (which Functional Entity), could adversely affect the BES. The FERC/NERC charter is to establish controls over these entities to protect the integrity and reliability of the BES. CIP-002-1 through CIP-002-4a (before 2012), had no “qualifying factors” for Functional Entities so the provisions and requirements of all nine (9) CIP Standards applied which required implementation by the Functional Entity. Specifically, from 2006 to 2011 the CIP Standards did not define the Functional Entities’ responsibilities for who could protect what on the grid. During this time all energy providers, shown in the table below, were all in, and were required to follow all the then-established, CIP rules – which were seen as overbearing and, as recognized by NERC, still not protecting the grid adequately.

In 2012 NERC began establishing “qualifying criteria” for Functional Entities that could affect the BES if digital assets within their jurisdiction (control) were mismanaged or compromised due to a cyber-attack. NERC continue refining the BES Functional Entities that could affect the grid (e.g., Balancing Authorities, Generator Owners, Generator Operators, Interchange Coordinators of Authority, Reliability Coordinators, Transmission Operators, and Transmission Owners). This then led to a more robust approach for protecting the grid while holding entities accountable for digital devices within their area of responsibility.

As these CIP Standards matured (specifically CIP-002-5 and later revisions) NERC began placing regulations on the subordinate entities more strategically to ensure the reliability of the BES without placing undue regulations on “all” entities generally, or across the board. In 2006-2011 there was no relief and all rules applied to all entities which placed the NRC and NPPs in a bad situation …. NPPs did not wanting two (2) regulators regulating their plants. To prevent this, the NRC agree to provide a “way out” by allowing NPPs to treat BOP Systems as Important-To- Safety pursuant to their desired response to NERC 706-B in 2010.

When the CIP Standards changed in 2012, NPPs and the NRC did not react to the change and the 10 CFR 73.54 over-regulation has continued ever sense. When NPPs were identified as Low- Impact-Rated they failed to act which could have been a huge burden lifted off NPPs; operationally, administratively and financially. In an effort to decrease this over-regulation the Fisk/Locklear BOP Initiative has been initiated. Page 1 of 3

June 13, 2020, whf. R1

Of the 57 Generator Owner/Operators in only two (2) have a Medium-Impact Rating. This is because two (2) plants have ≥ 1500 MWe passing through a single interconnection. These plants are still Low-Risk Rated but must handle the interconnections as Medium Risk. Until 2012 all these Generator Owner/Operations had to comply with all nine (9) CIP Standards because there were no High, Medium, and Low-Impact Ratings or a 15-minute timetable. Today only the requirements for Low-Impact-Rating applies for 55 Owner/Operators per CIP-002.5.x listed below, which is good. This proves to be manageable from an operations standpoint and further negates the possibility of CIP over-regulation based solely on MW produced.

Arizona (an example: 1 of 29 States): Generator Owner/Operator Impact Ratings

BES CIP Rating Coal Location MWe Classification 1. Apache Generating Station Cochise Co 204 Low Impact Rating 2. Cholla Power Plant Unit 1 Navaho Co 114 Low Impact Rating 3. Cholla Power Plant Unit 3 Navaho Co 312 Low Impact Rating 4. Cholla Power Plant Unit 4 Navaho Co 414 To Be Retired in 2020 5. Coronado Generating Station Apache Co 822 Low Impact Rating 6. Four Corners Power Plant – Two 770 MWe Units with a Single Apache Co 1540 Medium Impact Rating Connection 7. Springerville Generating Station Apache Co 380 Low Impact Rating Unit 1 8. Springerville Generating Station Apache Co 380 Low Impact Rating Unit 2 9. Springerville Generating Station Apache Co 400 Low Impact Rating Unit 3 10. Springerville Generating Station Apache Co 400 Low Impact Rating Unit 4 Natural Gas-Fired Peaking Stations 11. H. Wilson Sundt Generating Pima Co 200 Low Impact Rating Station Natural Gas 12. Agua Fria Generating Station Maricopa Co 626 Low Impact Rating 13. Arlington Valley Plant Maricopa Co 577 Low Impact Rating 14. Coolidge Generating Station Pina Co 575 Low Impact Rating 15. Desert Basin Power Plant Pima Co 577 Low Impact Rating 16. Gila River Generating Station Maricopa Co 1100 Low Impact Rating Block 1 17. Gila River Generating Station Maricopa Co 1100 Low Impact Rating Block 2 18. Griffin Energy Mohave Co 654 Low Impact Rating 19. Harquahala Generating Station Maricopa Co 783 Low Impact Rating 20. H. Wilson Sundt Generating Pima Co 222 Low Impact Rating 21. Kyrene Power Plant Maricopa Co 521 Low Impact Rating 22. Mesquite Power Plant Maricopa Co 1250 Low Impact Rating Page 2 of 3

June 13, 2020, whf. R1 23. Ocotillo Power Plant Maricopa Co 334 Low Impact Rating 24. Redhawk Power Station Maricopa Co 1060 Low Impact Rating 25. Saguaro Power Plant – 5 Units Pinal Co 395 Total Low Impact Rating 26. Santan Power Company Maricopa Co 875 Low Impact Rating 27. Sundance Generating Station Pinal Co 450 Low Impact Rating 28. West Phoenix Power Plant 5 Units Maricopa Co 535 Total Low Impact Rating 29. Yucca Power Plant Yuma Co 264 Low Impact Rating 30. Yuma Power Plant Yuma 50 Low Impact Rating Hydroelectric Dams 31. Arizona Falls Maricopa Co .75 Low Impact Rating 32. Gila Co 10 Low Impact Rating 33. Crosscut Hydroelectric Plant Maricopa Co 3 Low Impact Rating 34. Mohave Co 251 Low Impact Rating 35. Coconino Co 1320 Low Impact Rating 36. – 17 Generators Mohave Co 2080 Medium Impact Rating 37. Maricopa Co 129 Low Impact Rating 38. Mormon Flat Dam Maricopa Co 60 Low Impact Rating 39. New Waddell Dam Maricopa Co 45 Low Impact Rating 40. La Paz Co 120 Low Impact Rating 41. South Consolidated Hydroelectric Maricopa Co 1.4 Low Impact Rating Unit 42. Maricopa Co 13 Low Impact Rating 43. Gila/Maricopa 36 Low Impact Rating Windfarms 44. Dry Lake Wind Power Project Navajo Co 127 Low Impact Rating 45. Perrin Ranch Wind Navajo Co 99 Low Impact Rating Solar Thermal Plants 46. Solana Generating Station Maricopa Co 280 Low Impact Rating Solar Photovoltaic Plants 47. Mesquite Solar Plant Maricopa Co 400 Low Impact Rating 48. Agua Caliente Solar Project Yuma Co 290 Low Impact Rating 49. Arlington Valley Solar 2 Maricopa Co 125 Low Impact Rating 50. Copper Crossing Solar Ranch Pina Co 20 Low Impact Rating 51. Queen Creek Solar Pina Co 19 Low Impact Rating 52. Sandstone Solar Pina Co 45 Low Impact Rating 53. Bonnybrooke Solar Pina Co 50 Low Impact Rating 54. Pinal Central Energy Center Pina Co 20 Low Impact Rating Nuclear Plants 55. Palo Verde Generating Station – Maricopa Co 1314 Low Impact Rating Unit 1 56. Palo Verde Generating Station – Maricopa Co 1314 Low Impact Rating Unit 2 57. Palo Verde Generating Station – Maricopa Co 1314 Low Impact Rating Unit 3

Page 3 of 3