2020 MRO Regional Risk Assessment January 28, 2020 Table of Contents 1. PREFACE................................................................................................................................................. 4 2. INTRODUCTION ...................................................................................................................................... 5 3. 2019 MRO REGIONAL RISK IDENTIFICATION .................................................................................... 6 3.1 2019 RISC Report ............................................................................................................................. 6 3.1.1 Risks Associated with Grid Transformation ............................................................................... 7 MRO Region’s Exposure to Grid Transformation ............................................................................................ 8 3.1.2 Risks Associated with Extreme Natural Events ....................................................................... 12 MRO Exposure to Extreme Weather Events ................................................................................................. 12 MRO Exposure to Geo-Magnetic Disturbance Events................................................................................... 14 3.1.3 Physical and Cyber Security Risks .......................................................................................... 15 Physical and Cyber Security Threats Identified in SOR Report ..................................................................... 15 MRO Region Physical, Cyber Security and Control System Threats ............................................................ 16 Adequate Security Staffing ............................................................................................................................ 16 Asset Inventory .............................................................................................................................................. 17 Cloud Storage ................................................................................................................................................ 17 Connectivity ................................................................................................................................................... 17 Copper Theft and Vandalism ......................................................................................................................... 18 Insider Threat ................................................................................................................................................. 18 Mitigating System Vulnerabilities ................................................................................................................... 18 Saboteurs....................................................................................................................................................... 18 Security Visibility, Monitoring, and Incident Response .................................................................................. 19 Spear Phishing............................................................................................................................................... 19 Supply Chain.................................................................................................................................................. 19 UASs .............................................................................................................................................................. 19 3.1.4 Critical Infrastructure Interdependencies: ................................................................................ 20 3.1.5 MRO Exposure to Critical Infrastructure Interdependencies ................................................... 20 Impact of Natural Gas Disruption on Bulk Power System.............................................................................. 20 Critical Communication Circuit Sunset........................................................................................................... 22 3.2 2019 State of Reliability Report ...................................................................................................... 22 Trending Misoperations Associated with Event Analysis Reports ................................................................. 23 3.3 2019 NERC Long-Term Reliability Assessment Report ................................................................. 25 3.4 Additional Operational and Planning Risks Identified for the MRO Region ................................... 27 3.5 2020 ERO CMEP Implementation Plan .......................................................................................... 29 2 3.6 Requirements with High Risk Violations .......................................................................................... 30 3.7 Reliability Standards and Requirements .......................................................................................... 31 FAC, TOP, and IRO Operating Limits Reliability Standards .......................................................................... 31 GMD Reliability Standards EOP-010-1 and TPL-007-1 ................................................................................. 32 Model Data Reliability Standards ................................................................................................................... 32 Planning Standard TPL-001-4 ....................................................................................................................... 33 New Reliability Standards Enforceable in 2020 ............................................................................................. 34 Oversight of “Risks in Aggregate” .................................................................................................................. 34 4. CONCLUSION ....................................................................................................................................... 36 References .................................................................................................................................................... 37 3 2020 MRO Regional Risk Assessment PREFACE 1. PREFACE Midwest Reliability Organization (MRO) is dedicated to its vision of a highly reliable and secure North American bulk power system. To ensure reliability of the bulk power system in the United States, Congress passed the Energy Policy Act of 2005, creating a new regulatory organization called the Electric Reliability Organization (ERO) to establish mandatory Reliability Standards and monitor and enforce compliance with those standards on those who own, operate or use the interconnected power grid. In 2006, the Federal Energy Regulatory Commission (FERC) approved the North American Electric Reliability Corporation (NERC) as the ERO under section 215(e)(4) of the Federal Power Act. NERC delegates its authority to monitor and enforce compliance to six Regional Entities established across North America, including MRO. Recognizing the international nature of the grid, NERC as the ERO, along with MRO, established similar arrangements with provincial authorities in Canada. The MRO region spans the provinces of Saskatchewan and Manitoba, and all or parts of the states of Arkansas, Illinois, Iowa, Kansas, Louisiana, Michigan, Minnesota, Missouri, Montana, Nebraska, New Mexico, North Dakota, Oklahoma, South Dakota, Texas, and Wisconsin. The region includes approximately 200 organizations that are involved in the production and delivery of electric power, including municipal utilities, cooperatives, investor- owned utilities, transmission system operators, federal power marketing agencies, Canadian Crown Corporations, and independent power producers. MRO's primary responsibilities are to: ensure compliance with mandatory Reliability Standards by entities who own, operate, or use the North American bulk power system; conduct assessments of the grid's ability to meet electric power demand in the region; and analyze regional system events. Additionally, MRO creates an open forum for stakeholder experts in the region to discuss important topics related to addressing risk and improving reliable operations of the bulk power system. 4 2020 MRO Regional Risk Assessment INTRODUCTION 2. INTRODUCTION The MRO Regional Risk Assessment (RRA or assessment) is a document that MRO staff, with input from industry subject matter experts, prepares annually to identify risks to the reliable and secure operations of the bulk power system within MRO’s regional footprint. Several continent-wide risks identified by the ERO are summarized in the assessment. The sources for this information include: 2019 ERO Reliability Issues Steering Committee (RISC) Priorities Report (RISC report) 2020 ERO Compliance Monitoring and Enforcement Program Implementation Plan (CMEP IP) 2019 NERC State of Reliability Report (SOR report) 2019 NERC Long-Term Reliability Assessment (LTRA report) Some risks identified at the North American level can broadly present themselves in any of the ERO regions, such as Human Performance and Skilled Workforce. However, other risks may be more geographic, regional, or registered entity-specific, that is, certain areas, regions or entities may have a higher exposure to, or are more susceptible to, a specific risk. Severe weather conditions or high concentrations of renewable generation are examples of these. Therefore, this assessment identifies