FERC Issues Order Denying Mabee Complaint

On October 2, 2020, in Docket No. EL20-46-000, FERC issued an order denying a complaint filed by Mr. Michael Mabee on May 12, 2020 related to CIP-013-1 (Cyber Security Supply Chain Risk Management). The complaint alleged that CIP-013-1 does not comport with Presidential Executive Order 13,920 and that the Critical Infrastructure Protection (CIP) Reliability Standards do not fully address the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The complaint contends that Reliability Standard CIP-013-1 does not comport with Executive Order 13,920 because the Reliability Standard excludes low impact BES Cyber Systems. FERC’s order denying the complaint notes that Executive Order 13,920 does not require that every piece of equipment in the bulk power system be covered. FERC’s order also states that the NIST Framework is used to inform NERC and provides voluntary standards – not mandatory requirements. Therefore, the complaint was denied in its entirety.

To view FERC’s order, click here.