new 2015 general rate case application · 2013. 11. 13. · 2015 general rate case - application...

An EDISON INTERNATIONAL® Company

(U 338-E)

2015 G en era l R ate C ase A PPLIC A TIO N

W orkpapers

Information Technology (IT)Overview, O&M and CapitalSCE-05 Volume 01, Chapters I & II, P art 02

N ovem b er 2013

2015 General Rate Case - APPLICATION INDEX OF WORKPAPERS

EXH IBIT SCE-05, Vol. 1, Chapter 1 - 2, Pt. 02, O&M

DOCUMENT PAGE(S)TDM FERC Account 517 1-26“The Biggest Cybersecurity Threats of 2013,” by Tomer Teller 27-32US Electric Industries: Top Threat Scenarios & Mitigation Actions Final Report, The Chertoff Group and Edison Electric Institute 33-70

Edison Electric Institute on Principles for Cybersecurity and Critical Infrastructure Protection, Edison Electric Institute 71-73

Putting SCADA Protection on the Radar, by Marc Solomon 75-78JEA victim of cyber attack 79-81Rockefeller asks Fortune 500 CEOs to weigh in on cybersecurity debate, by Jennifer Martinez 83-85

Letter to SCE from Representatives Markey and Waxman, January 17, 2013 87-91Improving the Security of the Nation’s Critical Infrastructure, by Michael Daniel 93-96C&C FERC Account 920-921 97-117C&C O&M Labor and Non-Labor Additions 119-121EIM&A FERC Account 920-921 123-148CS&P FERC Account 920-921 149-187Incremental O&M for New Software FERC Account 920-921 189-2032015 GRC SCE-05 Vol. 1 - Capital Projects Used for O&M Analysis 205-206

Workpaper - Southern California Edison / 2015 GRC - APPLICATION1

TECHNOLOGY DELIVERY &

MAINTENANCE

FERC Account 517

Exhibit No. SCE-05 / Information Technology / Vol. 01 / Ch. I-II / Pt.02Witnesses: T. Inlander, C. Carazo, J. Castleberry, G. Haddox, J. Kelly, K. Sweetser

2Workpaper - Southern California Edison / 2015 GRC - APPLICATION

Beginning of Workpapers for:

FERC Account: 517 Operation Supervision and Engineering

Activity: TECHNOLOGY DELIVERY & MAINTENANCE FOR NUCLEAR - 517

Witness: Jay A. Castleberry

Forecast Meth od Chosen

2012$ (000)

Recorded2012

Forecast2015

Labor Last Recorded Year Adj. 3,844 2,067Non-Labor Last Recorded Year 1,281 1,281Other N/A 0 0Total 5,125 3,348

Description of Activity:

This activity is used to record costs associated with maintenance activities provided by Technology Delivery and Maintenance in support of nuclear activities. Costs recording in FERC Account 517 are SCE labor, office supplies, travel, training, and software licenses.

Final Cost Centers included in this activity (See Appendix A for additional detail):

F300144 F300175 F300186 F401181 F525068 F525080 F525142 F525143 F528100 F528101



FERC Account: 517 Operation Supervision and Enginee ring



DETERMINATION OF RECORDED/ADJUSTED

Recorded Period$ (000)

2008 2009 2010 2011 2012FERC Form 1 Recorded (Nominal $)

Labor 2,633 3,888 4,060 3,865 3,844Non-Labor 469 1,478 1,438 1,895 1,281Other 0 0 0 0 0Total 3,102 5,366 5,498 5,760 5,125

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 3 (255) 0 0 0Non-Labor 0 (70) 0 0 0Other 0 0 0 0 0Total 3 (325) 0 0 0

Recorded/Adjusted (Nominal $)Labor 2,636 3,633 4,060 3,865 3,844Non-Labor 469 1,408 1,438 1,895 1,281Other 0 0 0 0 0Total 3,105 5,041 5,498 5,760 5,125

Escalation:Labor 1.1414 1.1070 1.0701 1.0327 1.0000

Non-Labor 1.0653 1.0900 1.0599 1.0106 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

6,000

5.000

4.000

3.000

2.000

1,000

0

Recorded Adjusted 2008-2012 (2012$)

2008 2009 2010 2011

□ Labor (std escl) Non-Labo r (std escl) □ Other (not escl)

2012



FERC Account: 517 Operation Supervision and Engineeri ng



Forecasting Methods - Summary of Results of all Methods Studied - 2012$ (000)

2 Recorded Years (2011 - 2012):Results of Averaging (A2)

COoCM roCM 2015 | sd** | ChosenLabor 3,918 3,918 3,918 74 noNon-Labor 1,598 1,598 1,598 317 noOther 0 0 0 0 noTotal 5,516 5,516 5,516 n/a n/a

3 Recorded Years (2010 - 2012):Results of Linear Trending (T3) Results of Averaging (A3)

2013 | roCM 2015 | r2* 1 Chosen 2013 | 2014 | 2015 | sd** | ChosenLabor 3,560 3,309 3,059 0.95 no 4,060 4,060 4,060 210 noNon-Labor 1,330 1,209 1,087 0.14 no 1,573 1,573 1,573 261 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 4,890 4,518 4,146 n/a n/a 5,633 5,633 5,633 n/a n/a


LaborNon-LaborOtherTotal

COoCM roCM 2015 | r2* 1 Chosen

COoCM roCM 2015 | sd** | Chosen3,829 3,740 3,652 0.29 no 4,050 4,050 4,050 183 no1,471 1,434 1,397 0.03 no 1,564 1,564 1,564 227 no

0 0 0 0.00 no 0 0 0 0 no5,300 5,174 5,049 n/a n/a 5,614 5,614 5,614 n/a n/a





0 0 0 0.00 no 0 0 0 0 no6,268 6,626 6,984 n/a n/a 5,193 5,193 5,193 n/a n/a

Other Methods:

Last Recorded Year (LRY) Itemized Forecast (IF)


COoCM roCM 2015 | | Chosen

COoCM roCM 2015 | | Chosen3,844 3,844 3,844 yes 0 0 0 no1,281 1,281 1,281 yes 0 0 0 no

0 0 0 no 0 0 0 no5,125 5,125 5,125 n/a 0 0 0 n/a

Forecast Adjustments:Base Forecast Method Adjustments*


Method

COoCM roCM 2015 |

COoCM roCM 2015 | |LRY 3,844 3,844 3,844 0 (494) (1,777)LRY 1,281 1,281 1,281 0 0 0N/A 0 0 0 0 0 0

5,125 5,125 5,125 0 (494) ( t 777)

* r2 = R Squared (Based on recorded years data)** sd = standard deviation (Based on recorded years data)*** See Appendix B For Additional Detail






Results:Forecasting Results

Method SelectedLOoCMroCMCOoCM

Labor Last Recorded Year Adj. 3,844 3,350 2,067Non-Labor Last Recorded Year 1,281 1,281 1,281Other N/A 0 0 0Total 5,125 4,631 3,348

Analysis of Forecasting Methods

Analysis of Linear Trending Method:In D.89-12-057, the CPUC stated that if costs have shown a trend in a certain direction over three or more years, the last year recorded is an appropriate base estimate. Labor and non-labor costs have not been stable between 2008-2012. In 2012, labor and non-labor decreased as a result of company-wide Operational Excellence efforts that were put in place. For that reason, linear trending is not an appropriate forecasting method.

Analysis of Averaging Method:In D.89-12-057, the CPUC stated that for those accounts which have significant fluctuations in recorded expenses from year to year, an average of recorded expenses is appropriate. For this account, costs have not been stable between 2008-2012. In 2012, labor and non-labor decreased as a result of company-wide Operational Excellence efforts that were put in place. Even though historical recorded data indicates an averaging methodology would be the most likely basis for a forecast of labor and non-labor costs, we have chosen the last year recorded as it best represents the expenses we anticipate beginning in 2015.

Analysis of Last Recorded Year (2012):Labor and non-labor costs have fluctuated significantly from year to ye ar; the averaging methodology would have been appropriate for forecasting both areas. Even though historical recorde d data indicates an averaging methodology would be the most likely basis for a forecast of labor and non-labor costs, we have chosen the last year recorded as it best represents the expenses we anticipate beginning in 2015. To the labor costs we have added the increments discussed elsewhere in these workpapers and our testimony.

Analysis of Itemized Forecast Method:Not applicable.






6,000

5.000

4.000

3.000

2.000

1,000

0

Recorded 2008-2012 / Forecast 2013-2015 2012$ (000)

■ ■ ■

2008 2009 2010 2011 2012 2013 2014 2015

□ Labor (std escl) ■ Non-Labor (std escl) □ Other (not escl)


Forecast Expenses (constant 2012$) 2008 | 2009 | 20 10 | 2011 | 2012 2013 | 2014 | 2015Labor (standard escalation) 3,009 4,022 4,344 3,992 3,844 3,844 3,350 2,067Non-Labor (standard escalation) 500 1,535 1,524 1,915 1,281 1,281 1,281 1,281Other (not escalatable) 0 0 0 0 0 0 0 0Total 3,509 5,557 5,868 5,907 5,125 5,125 4,631 3,348

Labor Prior year Total 3,844 3,844 3,350Change 0 (494) (1,283)Total 3,844 3,844 3,350 2,067

Non-Labor Prior year Total 1,281 1,281 1,281ChangeTotal

0 0 01,281 1,281 1,281 1,281

Other Prior year Total 0 0 0Change 0 0 0Total 0 0 0 0

Total ChangeLabor 0 (494) (1,283)Non-Labor 0 0 0Other 0 0 0Total N/A 0 (494) (1,283)






This page shows the changes in Labor, Non-Labor, and Other expenditures forecast during 2013 through 2015, including reasons for the addition of person nel (labor), increased office supplies required due to an increase in activity (non-labor).

2012 - 2013

Labor: 0

Not applicable.

Non-Labor: 0

Not applicable.

Other: 0

Not applicable.




Activity: TECHNOLOGY DELIVERY & MAINTENAN CE FOR NUCLEAR - 517


This page shows the changes in Labor, Non-Labor, and O ther expenditures forecast during 2013 through 2015, including reasons for the addition of personnel (labor), increased office supplies required due to an increase in activity (non-labor).

2013 - 2014

Labor: (494)

The forecasted labor decrease is attributed to the decomm issioning of SONGS which is further detailed in the testimony (SCE-05, Vol 1). See Appendix B.

Non-Labor: 0

Not applicable.

Other: 0

Not applicable.






This page shows the changes in Labor, Non-Labor, and O ther expenditures forecast during 2013 through 2015, including reasons for the addition of person nel (labor), increased office supplies required due to an increase in activity (non-labor).

2014 - 2015____________________________________________________________________________________

Labor: (1,283)

The forecasted labor decrease is attributed to the decommissioning of SONGS which is further detailed in the testimony (SCE-05, Vol 1). See Appendix B.

Non-Labor: 0

Not applicable.

Other: 0

Not applicable.



FERC Account:

Activity:

Witness:

517 Operation Supervision and Enginee ring

TECHNOLOGY DELIVERY & MAINTENANCE FOR NUCLEAR - 517

Jay A. Castleberry

APPENDIX A

D e t a i l D e s c r i p t i o n o f F in a l C o s t C e n t e r s

I n c lu d e d in T h i s A c t i v i t y




Activity: TECHNOLOGY DELIVERY & MAINTENA NCE FOR NUCLEAR - 517


Description of Final Cost Centers included in this activity:

F300144 GENERATION / NUCLEARIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Program Management Office Generation/Nuclear.

F300175 BUSINESS CUSTOMER DIVISION NUCL EAR & PROCESSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Software Development of Nuclear Generation.

F300186 BUSINESS CONTINUITY MAINTENANCE GENERATION BUSINESS UNIT NUCLEARIncludes salaries, employee expenses, of fice supplies and additional miscellaneous costs for Software Maintenance of Nuclear Generation.

F401181 ENTERPRISE RESOURCE PLANNING - SONGS ENTERPRISE RESOURCE PLANNING EXPENSESIncludes the labor and other expenses for preparation activities associated with the SAP project.

F525068 ENTERPRISE PROCESS ALIGNMENT - MANAGEMENTIncludes labor and expenses associated with Center for Continuous Improvement activities. Includes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Process Alignment Management.

F525080 ENTERPRISE RESOURCE PLANNING - NUCLEARIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Resource Planning Nuclear.

F525142 SOLUTIONS ARCHITECTURE & CONSU LTING SERVICES - SONGSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for San Onofre Nuclear Generating Station (SONGS) Solutions Architecture and Consulting Services.

F525143 SYSTEMS ENGINEERING & DESIGN - SAN ONOFRE NUCLEAR GENERATION STATIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for SONGS Systems Engineering and Design.

F528100 MAINTENANCE GENERATION BUSINESS UNIT OPERATIONS & WORK MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Maintenance Generation Business Unit Operations & Work Management.

F528101 MAINTENANCE GENERATION BUSINESS UNIT CONFIGURATION MANAGEMENT & EQUIPMENT RELIABILITYIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Maintenance Generation Business Unit Configuration Management & Equipment Reliability.






Recorded/Adjusted (Constant 2012$) By Final Cost Center

$ (000)2008 2009 2010 2011 2012

355 591 602 839 502

508 442 1,263 1,229 1,466

2,507 4,345 3,488 3,588 1,310

0 0 0 1 0

0 0 358 12 2

0 0 3 67 (24)

96 96 51 98 180

42 83 103 71 39

0 0 0 0 957

0 0 0 0 693

3,508 5,557 5,868 5,905 5,125

F300144

F300175

F300186

F401181

F525068

F525080

F525142

F525143

F528100

F528101

GENERATION / NUCLEAR

BUSINESS CUSTOMER DIVISION NUCLEAR & PROCESS

BUSINESS CONTINUITY MAINTENANCE GENERATION BUSINESS UNIT NUCLEAR

ENTERPRISE RESOURCE PLANNING - SONGS ENTERPRISE RESOURCE PLANNING EXPENSES

ENTERPRISE PROCESS ALIGNMENT - MANAGEMENT

ENTERPRISE RESOURCE PLANNING - NUCLEAR

SOLUTIONS ARCHITECTURE & CONSULTING SERVICES - SONGS

SYSTEMS ENGINEERING & DESIGN - SAN ONOFRE NUCLEAR GENERATION STATION

MAINTENANCE GENERATION BUSINESS UNIT OPERATIONS & WORK MANAGEMENT

MAINTENANCE GENERATION BUSINESS UNIT CONFIGURATION MANAGEMENT & EQUIPMENT RELIABILITY

Total

** Due to rounding, totals may not tie to other workpaper pages.



FERC Account:

Activity:

Witness:

517 Operation Supervision and Engineering

TECHNOLOGY DELIVERY & MAINTENANCE FOR NUCLEAR - 517

Jay A. Castleberry

APPENDIX B

D e t a i l o f T o t a l C o m p a n y

A d j u s t m e n t s t o R e c o r d e d




Activity: TEC H NOLOGY DELIVERY & MAINTENANCE FOR NUCLEAR - 517


Detail of Total Company A djustments to Recorded Expenses

Adjs - (Nominal $) $ (000)2008 2009 20 10 2011 2012 2013 2014 2015

Labor 3 (255) 0 0 0 0 (494) (1,777)Non-Labor 0 (70) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 3 (325) 0 0 0 0 (494) (1,777)

Organizational Unit Adjustment 1 A&G IT-KWK-OU-FYA IT.SONGS.RETIRE

This future year adjustment reduces labor forecasts for IT supp ort of San Onofre Nuclear Generating Station (SONGS)in preparation of decommissioning of SONGS.

Labor 0 0 0 0 0 0 (494) (1,777)Non-Labor 0 0 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 0 (494) (1,777)

Organizational Unit Adjustment 2 A&G IT-KWK-OU-CCI 517 TO APP SVCS 920921

This adjustment transfers final cost center F525068 from Technology Delivery & Maintenance 517 to Technology Delivery & Maintenance 920-921; costs are not San Onofre Nuclear Generating Station related.

Labor 3 (255) 0 0 0 0 0 0Non-Labor 0 (70) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 3 (325) 0 0 0 0 0 0



End of Workpapers for:








Activity: TECHNOLOGY DELIVERY & MAINTENANCE PARTICIPATION CREDITS - 517


Forecast Method Chosen

2012$ (000)

Recorded2012

Forecast2015

Labor N/A 0 0Non-Labor Calculated (1,117) (730)Other N/A 0 0Total (1,117) (730)


This activity is used to record the participants' share of costs associated with application development and maintenance for nuclear business unit applications.

Final Cost Centers included in this activity (See Appendix A for addition al detail):

F200315 F525031







\ Recorded Period$ (000)


Labor 0 0 0 0 0Non-Labor r1,023) (1,772) (1,944) (2,328) (1,653)Other 0 0 0 0 0Total (1,023) (1,772) (1,944) (2,328) (1,653)

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 0 0 0 0 0Non-Labor 347 673 747 1,073 536Other 0 0 0 0 0Total 347 673 747 1,073 536

Recorded/Adjusted (Nominal $)Labor 0 0 0 0 0Non-Labor (676) (1,099) (1,197) (1,255) (1,117)Other 0 0 0 0 0Total (676) (1,099) (1,197) (1,255) (1,117)


Non-Labor 1.0653 1.0900 1.0599 1.0106 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

Recorded/Adjusted (Constant 2012$)Labor 0 0 0 0 0Non-Labor (720) (1,198) (1,269) (1,268) (1,117)Other______________________ 0_________ 0_________ 0_________ 0_________0_Total (720) (1,198) (1,269) (1,268) (1,117)

0

-200-400

-600

-800

■1,000■1,200

■1,400


IRecorded Adjusted 2008-2012 (2012$)

2008 2009 2010 2011 2012








2013 | roCM 2015 | sd** | ChosenLabor 0 0 0 0 noNon-Labor (1,193) (1,193) (1,193) 76 noOther 0 0 0 0 noTotal (1,193) (1,193) (1,193) n/a n/a



2013 1 2014 1 2015 | r2* | Chosen 2013 | 2014 | 2015 | sd** | Chosen0 0 0 0.00 no

(1,066) (991) (915) 0.75 no 0 0 0 0.00 no

0 0 0 0 no (1,218) (1,218) (1,218) 71 no

0 0 0 0 no(1,066) (991) (915) n/a n/a (1,218) (1,218) (1,218) n/a n/a



2013 | roCM 2015 | r2* | Chosen

COoCM roCM 2015 | sd** | Chosen0 0 0 0.00 no 0 0 0 0 no

(1,152) (1,128) (1,104) 0.19 no (1,213) (1,213) (1,213) 62 no0 0 0 0.00 no 0 0 0 0 no

(1,152) (1,128) (1,104) n/a n/a (1,213) (1,213) (1,213) n/a n/a


COoCM roCM 2015 | r2* | Chosen

COoCM roCM 2015 | sd** | ChosenLabor 0 0 0 0.00 no 0 0 0 0 noNon-Labor (1,374) (1,460) (1,546) 0.36 no (1,114) (1,114) (1,114) 205 noOther 0 0 0 0.00 no 0 0 0 0 noTotal (1,374) (1,460) (1,546) n/a n/a (1,114) (1,114) (1,114) n/a n/a

Other Methods:



2013 | roCM 2015 | | Chosen

COoCM roCM 2015 | | Chosen0 0 0 no 0 0 0 no

(1,117) (1,117) (1,117) no 0 0 0 no0 0 0 no 0 0 0 no

(1,117) (1,117) (1,117) n/a 0 0 0 n/a



Method

COoCM roCM 2015 |

COoCM roCM 2015 | |N/A 0 0 0 0 0 0

CALC (1,117) (1,009) (730) 0 0 0N/A 0 0 0 0 0 0

(1,117) (1,009) (730) 0 0 0

r2 = R Squared (Based on recorded years data) sd = standard deviation (Based on recorded years data) See Appendix B For Additional Detail







Method Selected 2013 | 2014 | 2015 | |Labor N/A 0 0 0Non-Labor Calculated (1,117) (1,009) (730)Other N/A 0 0 0Total (1,117) (1,009) (730)


Analysis of Linear Trending Method:Not applicable.

Analysis of Averaging Method:Not applicable.

Analysis of Last Recorded Year (2012):Not applicable.

Analysis of Itemized Forecast Method:The participant share credit represents the SONGS participant (City of Riverside and San Diego Gas and Electric), ownership share of the O&M expenses. It is a calculated amount that is derived by applying the participant ownership share of the 21.79% to the 100% level O&M expenses. Therefore, we have applied 21.79% credit to 100% level O&M expenses.







-1,400 ---------------------,---------------------.--------------------- .---------------------.---------------------A-------------------- .--------------------- .--------------2008 2009 2010 2011 2012 2013 2014 2015



Forecast Expenses (constant 2012$) 2008 | 2009 | 2 0 10 | 2011 | 2012 2013 | 2014 | 2015Labor (standard escalation) 0 0 0 0 0 0 0 0Non-Labor (standard escalation) (720) (1,198) (1,269) (1,268) (1,117) (1,117) (1,009) (730)Other (not escalatable) 0 0 0 0 0 0 0 0Total (720) (1,198) (1,269) (1,268) (1,117) (1,117) (1,009) (730)

Labor Prior year Total 0 0 0Change 0 0 0Total 0 0 0 0

Non-Labor Prior year Total (1,117) (1,117) (1,009)Change 0 108 279Total (1,117) (1,117) (1,009) (730)

Other Prior year Total 0 0 0ChangeTotal

0 0 00 0 0 0

Total Change |Labor 0 0 0Non-Labor 0 108 279Other 0 0 0Total N/A 0 108 279



FERC Account:

Activity:

Witness:

517 Operation Supervision and Enginee ring

TECHNOLOGY DELIVERY & MAINTENANCE PARTICIPATION CREDITS - 517

Jay A. Castleberry

APPENDIX A

D e t a i l D e s c r ip t i o n o f F in a l C o s t C e n t e r s








F200315 SONGS PARTICIPANTS SHARE - COMM ONThis final cost center records the participant credits associated with Federal Energy Regulatory Commission (FERC) account 517 at San Onofre Nuclear Generation Station. Expenses recorded under this final cost center have been tran sferred to/from another activity.

F525031 SONGS PARTICIPANT CREDITSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for SONGS participant credits.





Jay A. Castleberry

Recorded/Adjusted (Constant 2012$) By Final Cost Center$ (000)

2008 2009 2010 2011 2012

F200315 SONGS PARTICIPANTS SHARE - COMMON (720) (1,198) 792 1,084 536

F525031 SONGS PARTICIPANT CREDITS 0 0 (2,060) (2,353) (1,653)

Total (720) (1,198) (1,268) (1,269) (1,117)

** Due to rounding, totals may not tie to other workpaper pages.

FERC Account:

Activity:

Witness:



FERC Account:

Activity:

Witness:



Jay A. Castleberry

APPENDIX B






Activity: TE C H NOLOGY DELIVERY & MAINTEN ANCE PARTICIPATION CREDITS - 517


Detail of Total Company A djustments to Recorded Expenses

Adjs - (Nominal $) $ (000)2008 2009 20 10 2011 2012 2013 2014 2015

Labor 0 0 0 0 0 0 0 0Non-Labor 347 673 747 1,073 536 0 0 0Other 0 0 0 0 0 0 0 0Total 347 673 747 1,073 536 0 0 0

Organizational Unit Adjustment 1 A&G IT-KWK-OU-ALLOCATE.PARTCREDITS.TDM

This adjustment allocates nuclear participant credits for Techno logy Delivery & Maintenance Participant Credits 517.

Labor 0 0 0 0 0 0 0 0Non-Labor 809 968 747 1,073 536 0 0 0Other 0 0 0 0 0 0 0 0Total 809 968 747 1,073 536 0 0 0

Organizational Unit Adjustment 2 GBU NUC-KLB.KWK-OUX-IT Part CR

Remapping of Participant Credits associated with IT Support to SONGS. This adjustment moves the participant share amounts (credits) to the Information Technology Department so that the historical amounts for the Information Technology Department reflect only SCE's share of these costs . The net change to the recorded costs (100% level) atSONGS 2 & 3 is zero.

Labor 0 0 0 0 0 0 0 0Non-Labor (462) (295) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total (462) (295) 0 0 0 0 0 0



The Biggest Cybersecurity

Threats of 2013



Forbes



The Biggest Cybersecurity Threats o f 2013 - Forbes Page 2 of 5

Threat # i: Social E ngineering

This begins with focusing on a tried-and-true blackhat tactic in both the physical and digital worlds - social engineering. Before the computer age, this meant sneaking one’s way past a company’s defenses with the gift of gab as opposed to a cleverly-worded email. Now social engineering has moved onto social networks, including Facebook and Linkedln.

Attackers are increasing their use of social engineering, which goes beyond calling targeted employees and trying to trick them into giving up information. In years past, they might call a receptionist and ask to be transferred to a targeted employee so that the call appears to be coming from within the enterprise if caller ID is being used. However, such tactics aren’t needed if the details the cybercriminal is looking for are already posted on social networks. After all, social networks are about connecting people, and a convincing-looking profile of a company or person followed by a friend or connection request can be enough to get a social engineering scam rolling.

Threat # 2: APTs

Being aware of social engineering is important, of course, because it can be the precursor for a sophisticated attack meant to breach the wall of your organization. This year saw a number of high-profile attacks (think: Gauss and Flame) targeting both corporations and governments. These attacks are known as Advanced Persistent Threats (APTs). They are highly sophisticated and carefully constructed. The intention behind APT attacks is to gain access to a network and steal information quietly. They take a low-and-slow approach that often makes them difficult to detect, giving them a high likelihood of success.

Additionally, APTs need not always target well-known programs, such as Microsoft Word; they may also target other vectors, such as embedded systems. In a world where a growing number of devices have Internet protocol addresses, building security into these systems has never been more important.

APTs will continue as governments and other well-funded organizations look to cyber-space to conduct their espionage. In fact, APT attacks are running as we speak so look out for those anomalies in your network traffic.

http://www.forbes.com/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-tbreats-of-20... 4/22/2013


http://www.forbes.com/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-tbreats-of-20


The Biggest Cybersecurity 'Threats o f 2013 - Forbes Page 3 of 5

Threat # 3 : In tern al Threats

But some of the most dangerous attacks come from the inside. These attacks can be the most devastating, due to the amount of damage a privileged user can do and the data they can access. In a study funded by the U.S.Department of Homeland Security, the CERT Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute and the U.S.Secret Service, researchers found malicious insiders within the financial industry typically get away with their fraud for nearly 32 months before being detected. Trust, as they say, is a precious commodity - but too much trust can leave you vulnerable.

Threat # 4 : BYOD

The issue of trust comes into play in the mobile world as well, with many businesses struggling to come up with the right mix of technologies and policies to hop aboard the bring-your-own-device (BYOD) trend. Users are increasingly using their devices as they would their PCs, and by doing so are opening themselves up to w^eb-based attacks the same as they would if they were operating a desktop computer.

For attackers, it is likely as well that there will be more attempts to circumvent the app review and detection mechanisms mobile vendors use to guard their app markets. All this means that the flood of iPhones, Google Android phones and other devices making their way into the workplace are opening up another potential gateway for attackers that needs to be secured.Think about it - your smartphone has a camera. It has a microphone. It can record conversations. Add these features to the ability to access your corporate network, and you have the ideal stepladder to climb the walls we are talking about.

Threat # 5: C loud Security

BYOD is not the only thing changing the walls corporations must build around critical data however. There is also this little trend called cloud computing. With more companies putting more information in public cloud services, those services become juicy targets, and can represent a single point of failure for the enterprise. For businesses, this means that security must continue to be an important part of the conversation they have with cloud providers, and the needs of the business should be made clear.

http://www.forbes.com/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-thjeats-of-20... 4/22/2013


http://www.forbes.com/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-thjeats-of-20


The Biggest Cybersecurity Threats of 2013 - Forbes Page 4 of 5

Threat # 6: HTML5

J u s t as t h e a d o p t i o n o f c lo u d c o m p u t in g h a s c h a n g e d t h e v u l n e r a b i l i t y

s u r f a c e , s o w i l l t h e a d o p t i o n o f H T M L 5 . E a r l i e r t h i s y e a r , i t w a s n o t e d a t t h e

B la c k H a t c o n f e r e n c e , a p la c e w h e r e s e c u r i t y p r o s c a n g e t a s ig n o f a t t a c k s t o

c o m e , t h a t H T M L s 's c r o s s - p la t f o r m s u p p o r t a n d i n t e g r a t i o n o f v a r i o u s

t e c h n o lo g ie s o p e n s u p n e w p o s s ib i l i t i e s f o r a t t a c k , s u c h a s a b u s in g W e b

W o r k e r f u n c t i o n a l i t y . E v e n w i t h a n in c r e a s in g a m o u n t o f a t t e n t i o n b e in g p a id

t o H T M L 5 s e c u r i t y , t h e n e w n e s s o f i t m e a n s t h a t d e v e lo p e r s a r e b o u n d t o

m a k e m is t a k e s a s t h e y u s e i t , a n d a t t a c k e r s w i l l l o o k t o t a k e a d v a n ta g e . S o ,

e x p e c t t o s e e a s u r g e i n H T M L 5 o r i e n t e d a t t a c k s n e x t y e a r , h o p e f u l l y f o l l o w e d

b y a g r a d u a l d e c l in e a s s e c u r i t y im p r o v e s o v e r t im e .

Threat # 7: B otn ets

B u t e v e n t h o u g h t h e a r m s r a c e b e t w e e n r e s e a r c h e r s a n d a t t a c k e r s f a v o r s

in n o v a t i o n , e x p e c t c y b e r c r im in a l s t o s p e n d a l o t o f t im e p e r f e c t in g w h a t t h e y

k n o w b e s t , s u c h a s m a k in g s u r e t h e i r b o t n e t s h a v e h i g h a v a i l a b i l i t y a n d a re

d i s t r i b u t e d . W h i l e t h e le g a l t a k e d o w n s b e in g la u n c h e d b y c o m p a n ie s s u c h as

M ic r o s o f t s u c c e e d e d i n t e m p o r a r i l y d i s r u p t i n g s p a m a n d m a lw a r e o p e r a t io n s ,

i t is n a iv e t o a s s u m e a t t a c k e r s a r e n ’t t a k in g w h a t t h e y h a v e le a r n e d f r o m th o s e

t a k e d o w n s a n d u s in g i t t o s h o r e u p t h e i r o p e r a t io n s . B o t n e t s a r e h e r e t o s ta y .

Threat # 8: P recision T argeted M alw are

A t t a c k e r s a r e a ls o l e a r n in g f r o m t h e s te p s r e s e a r c h e r s a r e t a k in g t o a n a ly z e

t h e i r m a lw a r e , a n d t e c h n iq u e s w e r e r e c e n t l y d e m o n s t r a t e d t h a t c a n h e lp

r e n d e r a n a ly s is in e f f e c t i v e b y d e s ig n in g m a lw a r e t h a t w i l l f a i l t o e x e c u te

c o r r e c t l y o n a n y e n v i r o n m e n t o t h e r t h a n t h e o n e o r i g i n a l l y t a r g e t e d .

E x a m p le s o f th e s e a t t a c k s in c lu d e F la s h b a c k a n d G a u s s . B o t h h a v e b e e n

s u c c e s s fu l , e s p e c ia l l y G a u s s , a t s t o p p in g r e s e a r c h e r s f r o m a u t o m a t e d m a lw a r e

a n a ly s is . I n t h e c o m in g y e a r , a t t a c k e r s w i l l c o n t in u e t o im p r o v e a n d

im p le m e n t th e s e t e c h n iq u e s a n d m a k e t h e i r m a lw a r e m o r e d e d ic a t e d s o t h a t

i t o n l y a t t a c k s c o m p u t e r s w i t h a s p e c i f ic c o n f ig u r a t io n .

O n e t h i n g is f o r c e r t a in - 2 0 1 3 is s u r e t o b r i n g a n a r m y o f e x p lo i t s a n d

m a lw a r e t h r o u g h v e c t o r s r a n g in g f r o m s o c ia l n e t w o r k s t o m o b i le d e v ic e s t o

e m p lo y e e s t h e m s e lv e s . A s c o m p u t e r a n d o p e r a t i n g s y s te m s e c u r i t y c o n t in u e s

http://www.forbes.eom/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-threats-of-20... 4/22/2013


http://www.forbes.eom/sites/ciocentral/2012/12/05/the-biggest-cybersecurity-threats-of-20


US Electric Industries: Top Threat Scenarios & Mitigation

Actions Final Report


Exhibit No. SCE-05 / Information Technology / Vol. 01 / Ch. I-II / Pt.02 Witnesses: T. Inlander, C. Carazo, J. Castleberry, G. Haddox, J. Kelly, K. Sweetser

co

THE

■==; C

HERT

OFF

1111 G

ROUP

US

Ele

ctri

c U

tilit

ies:

Top

Th

reat

Sce

nari

os &

Mit

igat

ion

Act

ion

s Ed

iSO

Pi E

lGC

tfiC

FIN

AL

RE

PO

RT

1

33

i In

stit

ute

Powe

r by A

ssoc

iation

™15

Dec

embe

r 20

11

EE

I an

d T

CG

Pro

prie

tary

Workpaper - Southern California Edison / 2015 GRC - APPLICATION


iiil

▲ A

cuTe

ch™

>ff

T

able

of

Con

tent

s

I.B

ackg

roun

d

II.

Th

reat

Ide

ntif

icat

ion

vs.

Ris

k A

sses

smen

t

III.

App

roac

h t

o T

hre

at I

dent

ific

atio

n

IV.

Th

reat

Sce

nari

o M

atri

x

V.

Th

reat

Sce

nari

o Su

mm

ary

VI.

Spec

trum

of

Th

reat

Act

ors

VII

.T

hre

at S

cena

rio

Tem

plat

e

VII

I.A

ligni

ng M

itig

atio

n A

ctio

ns

Aga

inst

Th

reat

s

IX.

Cat

egor

ies

of

Mit

igat

ion

Act

ion

s (a

-b)

X.

Mit

igat

ion

Act

ion

s La

ngu

age

XI.

Eva

luat

ing

Mit

igat

ion

Act

ion

s A

gain

st T

hre

ats

XII

.T

hre

at S

cena

rios

and

Mit

igat

ion

Act

ion

s (1

-9)

XII

I.C

omm

unic

atin

g th

e In

dust

ry A

ppro

ach

(a-

b)

XIV

.C

oncl

usio

ns a

nd N

ext

Step

s

EE

I an

d T

CG

Pro

prie

tary

co cn



co CD

iiij

X A

cuTe

chCg

roup

F I*

B

ackg

roun

d▲

i P

roce

ss R

isk

Man

agem

ent

Th

e C

her

toff

Gro

up—

in c

once

rt w

ith

its

stra

tegi

c pa

rtne

r A

cuT

ech

Con

sult

ing—

de

velo

ped

a fr

amew

ork

that

:

• D

escr

ibes

the

top

thr

eat

scen

ario

s fa

cing

U.S

. el

ectr

ic u

tilit

ies

incl

udin

g:^

Sp

ecif

ic a

ttac

k pa

ths

and

likel

y ta

rget

typ

es^

P

oten

tial

thr

eat

acto

rs

^

Like

ly im

pact

s o

f su

cces

sful

att

acks

• Id

enti

fies

mit

igat

ion

acti

ons

that

uti

litie

s ca

n us

e to

pro

tect

aga

inst

and

red

uce

thei

r vu

lner

abili

ty t

o th

e th

reat

sce

nari

os

In a

ddit

ion,

the

Ch

erto

ff G

roup

ide

ntif

ied

and

enga

ged

in m

edia

an

d/o

r op

en

pres

s ac

tivi

ties

tha

t pr

omot

ed in

dust

ry in

vest

men

ts in

sec

urit

y to

dat

e an

d m

ovin

g fo

rwar

d in

to t

he f

utur

e.

EE

I an

d T

CG

Pro

prie

tary



1111

CHER

TOFF

GR

OU

PII

. T

hrea

t Id

enti

fica

tion

vs.

Ris

k A

sses

smen

tA

Acu

Tech

Pro

cess

Ris

k M

anag

emen

t

Secu

rity

risk

man

ifest

s at

the

inte

rsec

tion

of a

pot

entia

l ca

use

of h

arm

(th

reat

), ty

pes

of

harm

(con

sequ

ence

),and

the

wea

knes

ses

that

mak

e ha

rm

poss

ible

(vul

nera

bilit

y)

Thre

atA

sses

smen

t

/ \

Est

imat

edC

apab

ility

*

*In

tent

to

Att

ack

*

\C

urr

ent

Cap

abili

tyE

ffor

t to

Acq

uire

a

Cap

abili

ty

Gen

eral

Sec

tor

Inte

rest

Spe

cific

Hei

gh

ten

edIn

tere

st

Ris

k A

naly

sis

Th

reat

Ide

ntif

icat

ion

and

Con

side

rati

ons

Ana

lysi

s C

onsi

dera

tion

s

In t

his

proj

ect,

we

focu

sed

pri

mar

ily o

n t

hrea

t id

enti

fica

tion

and

m

itig

atio

n a

ctio

ns

to a

ddre

ss t

he t

hrea

ts.

EE

I an

d T

CG

Pro

prie

tary

oo ^i



co oo

iili

A A

cuTe

chcS

erSup

ff

III.

App

roac

h to

Thr

eat

Iden

tifi

cati

on

The

thr

eat

scen

ario

s ar

e ev

ents

tha

t ar

e H

igh

-Im

pac

t/L

ow

Fre

quen

cy.

Thi

s pr

ojec

t is

sync

hron

ized

with

the

“N

ER

C’

Cri

tical

Inf

rast

ruct

ure

Stra

tegi

c R

oadm

ap.

The

like

lihoo

d of

the

se a

ttac

ks is

a f

unct

ion

of t

he in

tent

, ca

pabi

lity,

and

mot

ivat

ion

of e

ach

adve

rsar

y in

add

ition

to

the

exte

nt o

f m

itiga

tion

for

each

vul

nera

bilit

y th

ey s

eek

to e

xplo

it.

EE

I an

d T

CG

Pro

prie

tary



Ull

CHER

TOFF

GR

OU

PIV

. T

hrea

t Sc

enar

io M

atri

xA

cuTe

chP

roce

ss R

isk

Man

agem

ent

Th

e T

hre

at S

cen

ario

s w

ere

chos

en in

con

sult

atio

n w

ith

EE

I st

aff

and

mem

ber

com

pan

ies

and

wer

e fu

lly d

escr

ibed

in a

mat

rix

form

at.

I in;:=

■ CH

ERTO

FFU

ll G

RO

UP

ED

ISO

N E

LE

CT

RIC

IN

STIT

UT

E: T

hre

at S

cena

rio

Iden

tifi

cati

on*

|AAc

uTec

hP

roce

ss R

isk

Man

agem

ent

GE

NE

RA

L T

HR

EA

T

SCE

NA

RIO

S

DE

SC

RIP

TIO

N O

F T

HR

EA

T

SCE

NA

RIO

SP

EC

IFIC

AT

TA

CK

PA

TH

SL

IKE

LY

TA

RG

ET

TY

PE

SP

OT

EN

TIA

L T

HR

EA

T

AC

TO

RS

LIK

EL

Y I

MP

AC

T O

F S

UC

CE

SS

FU

L

AT

TA

CK

Ad

van

ced

Per

sist

ent

Th

reat

("A

PT

")

AP

T ta

rget

s an

d ex

ploi

ts n

etw

ork

vuln

erab

ilitie

s ov

er a

n ex

tend

ed p

erio

d o

f

tim

e. I

t is

inte

nded

to

even

tual

ly c

olle

ct a

nd

exfi

ltra

te h

igh-

valu

e in

form

atio

n (p

ropr

ieta

ry

busi

ness

an

d te

chni

cal d

ata)

tha

t res

ides

on

the

net

wor

k an

d to

col

lect

targ

etin

g in

telli

genc

e

abou

t the

sys

tem

as

a pr

ecur

sor

to a

futu

re

cybe

r at

tack

. An

AP

T is

des

igne

d to

be

unde

tect

ed (

i.e. "

low

an

d sl

ow")

an

d to

esta

blis

h a

"saf

e" a

rea

insi

de t

he c

ompr

omis

ed

syst

em t

o al

low

the

intr

uder

s fu

rthe

r ac

cess

;

thus

, sys

tem

s th

at p

rese

nt a

ttra

ctiv

e ta

rget

s to

adve

rsar

ies

shou

ld b

e pr

esum

ed t

o ha

ve

alre

ady

been

bre

ache

d. A

PT

pro

cess

es a

nd

tact

ics

may

be

used

to

faci

litat

e an

y o

f th

e

cybe

r re

late

d sc

enar

ios

disc

usse

d be

low

.

Any

com

bina

tion

of th

e fo

llow

ing

met

hods

may

be

used

to a

chie

ve a

su

cces

sful

att

ack:

Rec

onna

issa

nce

- pr

obin

g th

e sy

stem

to

prov

ide

atta

cker

s inf

orm

atio

n o

n c

apab

iliti

es,

vuln

erab

ilitie

s an

d op

erat

iona

l det

ails

.

Inse

rtio

n of

mal

icio

us c

ode

- in

trod

ucin

g

viru

ses,

wor

ms

and

troj

an h

orse

s fo

r us

e in

curr

ent o

r fu

ture

att

acks

.

Eav

esdr

oppi

ng -

Exp

loit

ing

acce

ss t

o br

each

the

conf

iden

tialit

y o

f co

mm

unic

atio

ns p

ath

s

and

info

rmat

ion

wit

hin

the

netw

ork.

Una

utho

rize

d A

cces

s -

Act

ivit

y in

wh

ich

the

adve

rsar

y ex

erci

ses

a de

gree

of

con

trol

ove

r

the

syst

em a

nd

acce

sses

and

man

ipul

ates

ass

ets

wit

hou

t aut

hori

zati

on.

Exp

loit

atio

n of

zer

o-da

y vu

lner

abili

ties

-to

fac

ilita

te a

ny o

f the

abo

ve m

eth

ods.

Soci

al E

ngi

nee

rin

g -

the

use

of p

hish

ing

and

rela

ted

tech

niqu

es t

o al

low

the

adv

ersa

ry to

acqu

ire

a le

giti

mat

e us

er's

pri

vile

ges.

Ope

rati

onal

and

bus

ines

s

nel

wof

ks a

nd

asso

ciat

ed

hard

war

e, f

irm

war

e an

d

soft

war

e. I

niti

al a

ttem

pts

to

pene

trat

e th

e sy

stem

foc

us o

n

pene

trat

ing

or c

ircu

mve

ntin

g

secu

nty

barr

iers

, suc

h as

acc

ess

cont

rols

, fir

ewal

ls, v

irus

-

scan

ners

, an

d re

late

d pe

rim

eter

prot

ecti

ons.

Stat

e-sp

onso

red

(dir

ectly

or

thro

ugh

hir

ed s

urro

gate

s),

soph

isti

cate

d te

rror

ist

orga

niza

tion

s (a

nd

surr

ogat

es a

ctin

g on

thei

r

beha

lf),

an

d el

ite h

acke

r

orga

niza

tion

s.

A su

cces

sful

AP

T r

esul

ts in

loss

of

secu

nty

and

con

trol

of t

arge

ted

netw

orks

. T

he

use

of t

his

acce

ss a

nd

the

info

rmat

ion

obt

aine

d co

uld

be

use

d to

cre

ate

prol

onge

d bl

acko

uts

in o

ne o

r

mor

e re

gion

s du

e to

:

-los

s o

f co

ntr

ol a

nd/

or

situ

atio

nal a

war

enes

s

-dis

rupt

ion

of

com

mun

icat

ions

an

d in

dust

rial

con

trol

sys

tem

s

-com

prom

ise

of

ICS

/DC

S/S

C A

D A

mod

els

and

loss

of i

nfor

mat

ion

inte

gnty

or

avai

labi

lity

-the

phy

sica

l des

truc

tion

of c

riti

cal e

quip

men

t.

In a

ddit

ion

to l

ost p

rodu

ctiv

ity

cost

s, fu

ture

cost

s fo

r re

-for

tify

ing

cybe

r sy

stem

s an

d

rest

orin

g pu

blic

con

fide

nce

in a

sec

ure

and

resi

lient

pow

er g

nd

cou

ld b

e sig

nific

ant.

In th

e ca

se o

f AP

T a

ttac

ks f

or

the

purp

ose

of

cond

ucti

ng c

yber

-esp

iona

ge, t

he lo

ss o

f

inte

llect

ual p

rope

rty

and/

or

cust

omer

dat

a

coul

d al

so r

esul

t in

a w

eake

nin

g o

f a u

tility

's

com

peti

tive

ness

rel

ativ

e to

for

eign

com

peti

tors

wh

o m

ay b

e su

ppor

ted

in c

ondu

ctin

g

cybe

resp

iona

ge b

y th

eir g

over

nmen

ts.

The

info

rmat

ion

cont

aine

d in

the

resu

ltin

g pr

ojec

t is

inte

nded

to c

reat

e ex

ecut

ive

awar

enes

s an

d st

imul

ate

furt

her

cons

ider

atio

n of

pre

pare

dnes

s, p

reve

ntio

n, r

espo

nse,

and

rec

over

y ac

tivi

ties

. It

doe

s no

t rep

lace

the

nee

d fo

r a

mor

e th

orou

gh s

ite-

spec

ific

or

syst

em-w

ide

risk

ass

essm

ent.

EE

I an

d T

CG

Pro

prie

tary

co CD



7m?

mCH

ERTO

FFG

RO

UP

o

Acu

Tech

ri-

1-

O

O

"m Pr

ocess

Risk M

anag

emen

tV.

1

hrea

t Sc

enar

io S

umm

ary

Coo

rdin

ated

Cyb

er A

ttac

k A

dvan

ced

Pers

iste

nt T

hrea

t D

isru

ptio

n of

Voi

ce a

nd D

ata

Serv

ices

C

oord

inat

ed P

hysi

cal a

nd C

yber

Att

ack

Insi

der

Sabo

tage

Pa

ndem

icSu

pply

Cha

in D

isru

ptio

n or

Com

prom

ise

Cat

astr

ophi

c H

uman

Err

or

Inte

ntio

nal E

lect

rom

agne

tic

Inte

rfer

ence

EE

I an

d T

CG

Pro

prie

tary



gr

ou

p

VI.

Spe

ctru

m o

f T

hrea

t Act

ors

iili

▲ A

cuTe

ch

. __

_

Pro

cess

Ris

k M

anag

emen

t

The

fol

low

ing

adve

rsar

ies

wer

e co

nsid

ered

in t

he t

hrea

t sc

enar

ios:

• N

atio

n St

ates

(an

d th

eir

surr

ogat

es)

• So

phis

tica

ted

Terr

oris

t O

rgan

izat

ions

(an

d th

eir

surr

ogat

es)

• M

erce

nary

Cri

min

al O

rgan

izat

ions

• D

omes

tic

Extr

emis

t O

rgan

izat

ions

(an

d th

eir

surr

ogat

es)

• El

ite H

acke

r O

rgan

izat

ions

• C

o-op

ted

Thi

rd P

arty

Mai

nten

ance

Pro

vide

rs

• D

isgr

untl

ed I

nsid

ers

(as

wel

l as

thre

at-s

peci

fic

vari

atio

ns o

f th

e ab

ove

acto

rs)

EE

I an

d T

CG

Pro

prie

tary



K>

Llll

CHER

TOFF

GR

OU

PV

II.

Thr

eat

Scen

ario

Tem

plat

eA

cuTe

chP

roce

ss R

isk

Man

agem

ent

For

each

Th

reat

Sce

nari

o, e

ssen

tial

ele

men

ts f

rom

the

T

hre

at S

cena

rio

Mat

rix

wer

e ca

ptur

ed i

n th

e fo

rmat

bel

ow:

EE

I an

d T

CG

Pro

prie

tary



iiii

X A

cuTe

chcg

rou>p

f V

III.

Ali

gnin

g M

itig

atio

n A

ctio

ns

Aga

inst

Thr

eats

▲

i Pro

cess

Ris

k M

anag

emen

t

Our

App

roac

h C

onsi

ders

T

wo

Cat

egor

ies

of A

ctio

ns

Tac

tica

l M

itig

atio

n A

ctio

ns a

re f

ocus

ed o

n pl

ans

and

mea

sure

s th

at c

an b

e un

dert

aken

in

th

e ne

ar

term

; th

is

may

re

quir

e in

crea

sed

inve

stm

ent

beyo

nd t

he r

ange

of

exis

tin

g au

thor

ity,

bud

gets

, an

d pe

rson

nel.

Tac

tica

l m

itig

atio

n ac

tion

s te

nd t

o re

duce

ris

ks o

f in

divi

dual

att

acks

to

a ut

ility

, bu

t m

ay

do li

ttle

to

addr

ess

the

over

all r

isk

to t

he e

lect

ric

sect

or.

Stra

tegi

c M

itig

atio

n A

ctio

ns

are

focu

sed

on

larg

e in

itia

tive

s, p

lan

s,

and

prog

ram

s th

at w

ill li

kely

req

uire

add

itio

nal

tim

e, b

udge

t re

sour

ces,

and

the

co

oper

atio

n o

f ex

tern

al p

artn

ers.

Str

ateg

ic m

itig

atio

n ac

tion

s ar

e n

ot d

esig

ned

to c

ount

er s

peci

fic

atta

cks

at t

he u

tility

leve

l, bu

t se

ek t

o m

ake

sign

ific

ant

chan

ges

in t

he o

vera

ll ri

sk t

o th

e br

oade

r el

ectr

ic s

ecto

r.

10E

EI

and

TC

G P

ropr

ieta

ry

4^ CO



iiil

X A

cuTe

chC

gr

ou

pF

IX(a

). C

ateg

orie

s of

Mit

igat

ion

Act

ion

sA

i Pro

cess

Ris

k M

anag

emen

t

Tac

tica

l

Res

ilien

ce c

an b

e b

est

achi

eved

by

empl

oyin

g a

com

bina

tion

of

the

follo

win

g m

itig

atio

n ac

tion

s:

Pre

pare

dnes

s: A

ctio

ns t

hat i

nvol

ve a

com

bina

tion

of

plan

ning

, res

ourc

es, t

rain

ing,

exe

rcis

ing,

and

or

gani

zing

to b

uild

, su

stai

n, a

nd im

prov

e op

erat

iona

l cap

abili

ties

for

a w

ide

rang

e o

f po

tent

ial

inci

dent

s.

Pre

vent

ion:

Act

ions

to

avoi

d an

inci

dent

or

to i

nter

vene

to

stop

an

inci

dent

fro

m

occu

rrin

g It

invo

lves

app

lyin

g in

telli

genc

e an

d ot

her

info

rmat

ion

to a

ran

ge o

f co

unte

rmea

sure

s ai

med

at

dete

rrin

g, p

reem

ptin

g, in

terd

ictin

g, o

r di

srup

ting

ille

gal

or

harm

ful a

ctiv

ity.

Res

pons

e: I

mm

edia

te a

ctio

ns t

o sa

ve l

ives

, pro

tect

pro

pert

y, a

nd m

eet

basi

c op

erat

iona

l nee

ds d

urin

g an

inci

dent

. R

espo

nse

also

incl

udes

the

exe

cuti

on o

f em

erge

ncy

plan

s an

d ac

tion

s to

sup

port

sho

rt-t

erm

rec

over

y.

Rec

over

y: T

he d

evel

opm

ent,

coor

dina

tion

, and

exe

cuti

on

of

serv

ice-

and

sit

e-re

stor

atio

n pl

ans;

eva

luat

ion

of

the

inci

dent

to

iden

tify

less

ons

lear

ned;

pos

t in

cide

nt r

epor

ting

; and

dev

elop

men

t o

f in

itiat

ives

to

mit

igat

e th

e ef

fect

s o

f fu

ture

inc

iden

ts.

Mod

ified

from

FE

MA

Nat

ion

al R

espo

nse

Fra

mew

ork

EE

I an

d T

CG

Pro

prie

tary

it



iiij

X A

cuTe

chCg

roup

F IX

(b).

Cat

egor

ies

of M

itig

atio

n A

ctio

ns

Pro

cess

Ris

k M

anag

emen

t

Stra

tegi

c•

Seek

mor

e ro

bust

in

form

atio

n-s

har

ing:

S w

ith f

eder

al e

ntiti

es t

o pr

ovid

e ut

ilitie

s gr

eate

r in

telli

genc

e an

d w

arni

ng

of o

ngoi

ng o

r an

tici

pate

d at

tack

met

hods

and

tar

gets

S th

roug

h lo

ng-t

erm

, su

stai

nabl

e ut

ility

-to-

utili

ty t

hrea

t inf

orm

atio

n ex

chan

ges

• St

imul

ate

indu

stry

-wid

e de

velo

pmen

t an

d ap

plic

atio

n o

f se

curi

ty s

tan

dard

sfo

r in

form

atio

n an

d op

erat

iona

l sy

stem

s•

Eng

age

cont

rol

syst

em v

endo

rs t

o de

velo

p en

han

ced

secu

rity

fea

ture

s in

the

ir

prod

ucts

giv

en t

he e

lect

ric

sect

or’s

need

for

inte

rcon

nect

ivity

bet

wee

n op

erat

iona

l an

d bu

sine

ss n

etw

orks

• C

ondu

ct a

lar

ge s

cale

(m

ulti

-reg

ion

al,

nati

onal

, or

inte

rnat

ion

al)

tabl

e-to

pex

erci

se m

odel

ing

a ca

tast

roph

ic in

cide

nt/a

ttac

k th

at is

des

igne

d to

rev

eal a

ny

gaps

bet

wee

n th

e ro

les

and

expe

ctat

ions

of

gove

rnm

ent

and

indu

stry

• D

evel

op a

sh

ared

an

d un

iver

sal

"Pow

er G

rid

Ris

k an

d R

esil

ien

ce"

risk

as

sess

men

t m

eth

odol

ogy

that

util

ities

can

use

to

asse

ss t

he r

ole

each

util

ity p

lays

in

mai

ntai

ning

the

stab

ility

and

sec

urity

of

the

shar

ed p

ower

gri

d

Ple

ase

note

: B

ecau

se t

hese

Str

ateg

ic A

ctio

ns h

ave

gene

ral a

pplic

abili

ty, t

hey

are

not

alig

ned

agai

nst

the

follo

win

g in

divi

dual

thre

at s

cena

rios

.12

EE

I an

d T

CG

Pro

prie

tary

cn



CD

trow

X

. M

itig

atio

n A

ctio

ns

Lan

guag

eiii

i ▲

Acu

Tech

9

9

9

9

Pro

cess

Ris

k M

anag

emen

t

In t

his

proj

ect,

the

ter

m m

itiga

tion

is u

sed

in it

s m

ore

gene

ral

defi

niti

on:

the

act

of m

akin

g a

cond

itio

n or

con

sequ

ence

les

s se

vere

.

Th

is p

roje

ct r

epre

sent

s a

volu

ntar

y ap

proa

ch t

o el

ectr

ic s

yste

m r

esili

ence

. It

is n

ot i

nten

ded

to i

mpl

y or

req

uire

a c

ompl

ianc

e-ty

pe a

ppro

ach.

Any

com

mon

te

rmin

olog

y or

sim

ilari

ty t

o th

e N

ER

C C

IP c

onst

ruct

or

othe

r on

goin

g ac

tivi

ties

is

uni

nten

tion

al.

Rat

her,

the

int

ent i

s to

use

con

cept

s an

d te

rms

for

whi

ch t

here

is

a co

mm

on u

nder

stan

ding

.

Spec

ifica

lly,

whe

n th

e te

rm “

crit

ical

” is

use

d, t

he i

nten

t is

for

the

use

r o

f th

is

mat

eria

l to

con

side

r th

at p

orti

on o

f th

e us

er’s

com

pany

’s en

terp

rise

(vi

rtua

l an

d ph

ysic

al)

that

the

use

r be

lieve

s is

cri

tica

l to

the

giv

en f

acili

ty o

r op

erat

ion

unde

r co

nsid

erat

ion.

Th

roug

hou

t th

is p

roje

ct,

refe

renc

es t

o em

ploy

ees

shou

ld i

nclu

de c

ontr

acto

rs,

vend

ors,

an

d ot

her

per

son

nel

with

app

rove

d ac

cess

.

13E

EI

and

TC

G P

ropr

ieta

ry



grou

p X

I. E

valu

atin

g M

itig

atio

n A

ctio

ns

Aga

inst

Thr

eats

w

iiii

▲ A

cuTe

ch_

_

- ^

•

••

a

*

a

• ,

, Pr

«>ce

ss R

isk

Man

agem

ent

EE

I R

esil

ien

cy S

elf-

Ass

essm

ent

Wha

t is

your

uti

lity’

s st

ate

of r

esili

ency

aga

inst

the

maj

or th

reat

s fa

cing

the

ele

ctri

c se

ctor

?

• T

he f

ollo

win

g th

reat

sce

nari

os e

xplo

re h

igh

cons

eque

nce,

low

freq

uenc

y ev

ents

an

d th

e re

com

men

ded

prac

tice

s us

ed to

miti

gate

the

m.

• Ea

ch t

hrea

t sc

enar

io is

des

igne

d to

def

ine

the

sign

ifica

nt th

reat

s fa

ced

by th

e el

ectr

ic s

ecto

r.•

Each

thr

eat

scen

ario

is f

ollo

wed

by

reco

mm

ende

d M

itiga

tion

Act

ions

to

help

id

entif

y ar

eas

for

impr

ovin

g th

e re

silie

ncy

of t

he c

ompa

ny a

nd t

he e

lect

ric

grid

.•

Thi

s re

view

is in

tend

ed t

o pr

ovid

e th

e ba

sis

for

a di

alog

ue b

etw

een

CE

O,

CIO

, an

d ot

her

com

pany

per

sonn

el.

How

to u

se t

his

self

ass

essm

ent:

1.

Th

e gr

oup

chos

en t

o en

gage

in

this

dia

logu

e sh

ould

rev

iew

eac

h th

reat

sce

nar

io a

nd

asso

ciat

ed m

itig

atio

n a

ctio

ns.

2.

Dis

cuss

whi

ch o

f th

e m

itig

atio

n a

ctio

ns y

our

com

pan

y do

es, a

nd

does

not

em

ploy

.

3.

Iden

tify

gap

s th

at le

ave

your

com

pan

y at

ris

k an

d id

enti

fy s

peci

fic

acti

ons

that

sh

ould

be

tak

en t

o be

com

e m

ore

resi

lient

in t

he f

ace

of

each

of

thes

e th

reat

sce

nari

os.

EE

I an

d T

CG

Pro

prie

tary

14

4



oo

•!!? ilij

▲ A

cuTe

ch™

ff

XII

. Th

reat

Sce

nari

os a

nd M

itig

atio

n A

ctio

ns

^

"

Mit

igat

ion

Act

ions

Com

mon

to

Cyb

er T

hre

ats.

......

......

......

......

Slid

e 16

1.

Coo

rdin

ated

Cyb

er A

ttac

k...

......

......

......

......

......

......

......

......

......

......

Slid

es 1

7-18

2.

Adv

ance

d P

ersi

sten

t Th

reat

......

......

......

......

......

......

......

......

......

......

..Slid

es 1

9-20

3.

Dis

rupt

ion

of

Voi

ce a

nd D

ata

Serv

ices

......

......

......

......

......

......

....S

lides

21-

22

4.

Coo

rdin

ated

Phy

sica

l and

Cyb

er A

ttac

k....

......

......

......

......

......

.....

Slid

es 2

3-24

5.

Insi

der

Sabo

tage

......

......

......

......

......

......

......

......

......

......

......

......

......

.....S

lides

25-

26

6.

Pan

dem

ic...

......

......

......

......

......

......

......

......

......

......

......

......

......

......

......

...Sl

ides

27-

28

7.

Supp

ly C

hain

Dis

rupt

ion

or

Com

prom

ise.

......

......

......

......

......

....S

lides

29-

30

8.

Cat

astr

ophi

c H

uman

Err

or

Slid

es 3

1-32

9.

Inte

ntio

nal E

lect

rom

agne

tic

Inte

rfer

ence

Sl

ides

33-

34

15E

EI

and

TC

G P

ropr

ieta

ry



ilii

▲ A

cuTe

chcg

ro?p

f x

n- M

itig

atio

n A

ctio

ns

Com

mon

to

Cyb

et T

hre

ats

^

"T

he m

itig

atio

n ac

tion

s de

scri

bed

belo

w a

re c

omm

on t

o ea

ch o

f th

e th

reat

sce

nari

os

addr

esse

d in

this

ana

lysi

s fo

r w

hich

ther

e is

a c

yber

com

pone

nt.

The

se m

easu

res

are

iden

tifi

ed h

ere

once

and

then

not

iona

lly r

efer

ence

d in

the

app

licab

le m

itig

atio

n ac

tion

slid

es.

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• Id

entif

y cr

itica

l cyb

er a

sset

s th

at s

uppo

rt r

elia

ble

oper

atio

n of

the

util

ity’s

ente

rpri

se•

Cre

ate

and

mai

ntai

n se

curi

ty m

anag

emen

t con

trol

s to

pro

tect

the

syst

em’s

criti

cal c

yber

ass

ets

• C

reat

e an

d m

aint

ain

a cy

bers

ecur

ity a

nd a

war

enes

s tr

aini

ng p

rogr

am•

Cre

ate

and

mai

ntai

n a

phys

ical

and

vir

tual

sec

urity

per

imet

er a

roun

d cr

itica

l cyb

er a

sset

s•

Esta

blis

h te

chni

cal a

nd p

roce

dura

l con

trol

s th

at e

nfor

ce a

cces

s au

then

ticat

ion

and

acco

unta

bilit

y (in

clud

ing

stro

ng p

assw

ord

prot

ecti

on m

echa

nism

s)•

Use

info

rmat

ion

shar

ing

reso

urce

s to

mon

itor

cre

dibl

e so

urce

s of

vul

nera

bilit

ies

and

thre

ats

• D

evel

op a

nd te

st in

cide

nt r

espo

nse

plan

s

Prev

enti

on

• Pe

rfor

m te

stin

g to

ens

ure

chan

ges

to th

e as

set b

asel

ine

do n

ot im

pact

cyb

erse

curi

ty c

ontr

ols

• E

nfor

ce a

pro

cess

that

onl

y en

able

s th

ose

port

s an

d se

rvic

es r

equi

red

for

norm

al a

nd

emer

genc

y op

s•

Use

app

ropr

iate

ant

i-vi

rus

and

othe

r m

alw

are

prev

entio

n to

ols

(incl

udin

g si

gnat

ure

upda

tes)

• Im

plem

ent a

utom

ated

tool

s an

d pr

oces

s co

ntro

ls th

at p

rovi

de f

or th

e co

ntin

uous

mon

itor

ing

of s

ituat

iona

l aw

aren

ess

indi

cato

rs•

Peri

odic

ally

und

erta

ke a

cyb

er v

ulne

rabi

lity

asse

ssm

ent

• M

aint

ain

an a

ctiv

e pa

tch

man

agem

ent p

rogr

am

Res

pons

e•

Act

ivel

y m

onit

or s

ituat

iona

l aw

aren

ess

indi

cato

rs to

ass

ess

succ

essf

ul c

yber

intr

usio

ns•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

Rec

over

y•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

16E

EI

and

TC

G P

ropr

ieta

ry

CD



cn o

Ull

CHER

TOFF

GR

OU

PX

II. T

hrea

t Sc

enar

io 1

AA

cuTe

chP

roce

ss R

isk

Man

agem

ent

Coo

rdin

ated

Cyb

er A

ttac

k on

Bul

k E

lect

ric

Syst

em I

nfra

stru

ctur

e

z o HH H HH u cr>

W

Q

A c

oord

inat

ed c

ampa

ign

expl

oiti

ng o

pera

tion

al (

proc

ess

cont

rol)

tec

hnol

ogy

and

netw

orks

for

acc

ess

that

res

ults

in

the

sim

ulta

neou

s or

nea

r si

mul

tane

ous

targ

etin

g o

f m

ulti

ple

key

syst

ems,

sof

twar

e, a

nd

data

on

a ut

ility

’s ne

twor

ked

infr

astr

uctu

re o

r th

e co

ntro

lling

sys

tem

s o

f th

e el

ectr

ical

gri

d. A

ltho

ugh

initi

ated

pri

mar

ily t

hrou

gh c

yber

pat

hway

s, th

e at

tack

may

be

desi

gned

to

dam

age

or d

estr

oy p

hysi

cal

syst

ems.

In a

ddit

ion

to in

terr

upti

ng th

e ef

fect

ive

oper

atio

n o

f th

e el

ectr

ic g

rid,

thi

s at

tack

cou

ld

inte

rcep

t co

ntro

l si

gnal

s th

at b

lock

or

alte

r in

form

atio

n re

sult

ing

in l

oss

of

situ

atio

nal a

war

enes

s.

Lik

ely

Tar

get T

ypes

Com

mon

ly u

sed

syst

ems/

har

dwar

e:•

Con

trol

cen

ter

com

mun

icat

ions

• G

ener

atio

n br

eake

r re

lays

• Su

bsta

tion

com

mun

icat

ion

proc

esso

rs•

EM

S or

GM

S so

ftw

are

• IC

S/D

CS/

SCA

DA

• Sm

art G

rid

com

pone

nts

• A

dvan

ced

Met

erin

g In

fras

truc

ture

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

terr

oris

t or

gani

zatio

ns (

and

surr

ogat

es)

Mer

cena

ry c

rim

inal

org

aniz

atio

ns

Elite

hac

ker

orga

niza

tions

D

isgr

untl

ed in

side

rs

Co-

opte

d th

ird

part

y m

aint

enan

ce

prov

ider

s

Spec

ific

Att

ack

Path

sA

PT

Att

ack

Pat

hs

(see

sli

de 1

9)V

ia c

omm

unic

atio

n lin

ksV

ia c

onne

cted

WA

NV

ia r

ogue

dev

ices

or

port

able

med

iaV

ia te

leco

mm

unic

atio

n ne

twor

kV

ia w

irel

ess

netw

ork

Via

rem

ote

conn

ectio

nPh

ysic

al a

cces

s to

sys

tem

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

A s

ucce

ssfu

l cam

paig

n of

coo

rdin

ated

cyb

er a

ttac

ks c

ould

res

ult i

n pr

olon

ged

blac

kout

s in

one

or

mor

e re

gion

s du

e to

: lo

ss o

f co

ntro

l an

d/or

situ

atio

nal a

war

enes

s; di

srup

tion

of

com

mun

icat

ions

and

indu

stri

al c

ontr

ol s

yste

ms;

com

prom

ise

of I

CS/

DC

S/SC

AD

A m

odel

s an

d lo

ss o

f in

form

atio

n in

tegr

ity o

r av

aila

bilit

y; b

reak

dow

n of

cri

tical

pr

oces

ses

(e.g

. con

figur

atio

n m

anag

emen

t, ch

ange

man

agem

ent,

inci

dent

res

pons

e); l

oss

of c

omm

unic

atio

n be

twee

n E

MS/

GM

S to

RT

Us;

and

phy

sica

l des

truc

tion

of

criti

cal e

quip

men

t. In

add

itio

n to

lost

pro

duct

ivity

cos

ts,

futu

re c

osts

fo

r re

-for

tifyi

ng c

yber

sys

tem

s an

d re

stor

ing

publ

ic c

onfid

ence

in a

sec

ure

and

resil

ient

pow

er g

rid

coul

d be

sig

nific

ant.

17E

EI

and

TC

G P

ropr

ieta

ry



iiij

A A

cuTe

chcg

rcJ?

pf

XII

. Thr

eat

Scen

ario

- C

oord

inat

ed C

yber

Att

ack

<>

—

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• M

itiga

tion

Act

ions

Com

mon

to a

ll C

yber

Thr

eats

(se

e sl

ide

16)

• In

spec

t co

mm

on p

roto

cols

for

kno

wn

vuln

erab

ilitie

s•

Ensu

re th

at f

ield

dev

ices

hav

e ph

ysic

al a

nd c

omm

unic

atio

ns s

ecur

ity p

rote

ctio

n•

Dev

elop

and

test

inci

dent

res

pons

e pl

ans

Prev

enti

on

• Is

olat

e op

erat

iona

l and

bus

ines

s ne

twor

ks t

o th

e gr

eate

st e

xten

t pos

sibl

e•

Har

den

the

oper

atio

nal n

etw

ork

to c

lose

bac

kdoo

rs a

nd v

ulne

rabi

litie

s in

the

netw

ork

peri

met

er•

Ensu

re th

at li

nks

betw

een

oper

atio

nal n

etw

ork

and

cont

rol c

ente

r(s)

are

via

ded

icat

ed

com

mun

icat

ions

pat

hs (

not a

pub

lic n

etw

ork

or In

tern

et)

• M

onit

or o

pera

tion

s ne

twor

k to

det

ect m

alic

ious

act

ivity

and

sus

pect

traf

fic•

Min

imiz

e un

prot

ecte

d re

mot

e ac

cess

to

term

inal

end

poi

nts

and

tele

met

ry in

the

oper

atio

nal

netw

ork

• U

se w

irel

ess

com

mun

icat

ions

tech

nolo

gy s

elec

tivel

y an

d w

ith a

ppro

pria

te s

afeg

uard

s in

the

oper

atio

nal n

etw

ork

Res

pons

e

• D

isab

le E

MS/

SCA

DA

con

trol

of

all B

ulk

Elec

tric

Sys

tem

Ele

men

ts•

Coo

rdin

ate

with

nei

ghbo

ring

util

ities

and

Rel

iabi

lity

Coo

rdin

ator

s on

dat

a va

lidat

ion

poin

ts•

Dis

able

Aut

omat

ed G

ener

ator

Con

trol

and

con

side

r is

land

ing

stra

tegi

es•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

Rec

over

y•

Impl

emen

t dis

aste

r re

cove

ry a

nd b

usin

ess

cont

inui

ty p

lans

18E

EI

and

TC

G P

ropr

ieta

ry

cn



cn K>

Ull

CHER

TOFF

GR

OU

PX

II. T

hrea

t Sc

enar

io 2

Acu

Tech

Pro

cess

Ris

k M

anag

emen

t

Adv

ance

d Pe

rsis

tent

Thr

eat

("A

PT

”)

z o HH H HH u cr>

W

Q

AP

T t

arge

ts a

nd e

xplo

its

netw

ork

vuln

erab

iliti

es o

ver

an e

xten

ded

peri

od o

f tim

e.

It is

int

ende

d to

ev

entu

ally

col

lect

and

exf

iltra

te h

igh-

valu

e in

form

atio

n (p

ropr

ieta

ry b

usin

ess

and

tech

nica

l dat

a) t

hat

resi

des

on t

he n

etw

ork

and

to c

olle

ct t

arge

ting

inte

llige

nce

abou

t th

e sy

stem

as

a pr

ecur

sor

to a

fut

ure

cybe

r at

tack

. An

AP

T is

des

igne

d to

be

unde

tect

ed (

i.e.

"low

and

slo

w")

and

to

esta

blis

h a

"saf

e" a

rea

insi

de t

he c

ompr

omis

ed s

yste

m t

o al

low

the

intr

uder

s fu

rthe

r ac

cess

; thu

s, s

yste

ms

that

pre

sent

at

trac

tive

targ

ets

to a

dver

sari

es s

houl

d be

pre

sum

ed t

o ha

ve a

lrea

dy b

een

brea

ched

.

Lik

ely

Tar

get T

ypes

Initi

al a

ttem

pts

to p

enet

rate

die

sys

tem

foc

us

on p

enet

ratin

g or

cir

cum

vent

ing

secu

rity

ba

rrie

rs, s

uch

as a

cces

s co

ntro

ls, f

irew

alls,

vi

rus-

scan

ners

, and

rel

ated

per

imet

er

prot

ectio

ns.

Oth

er ta

rget

s in

clud

e op

erat

iona

l an

d bu

sine

ss n

etw

orks

and

ass

ocia

ted

hard

war

e, fi

rmw

are

and

soft

war

e.

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

terr

oris

t or

gani

zatio

ns (

and

surr

ogat

es)

Elite

hac

ker

orga

niza

tions

Spec

ific

Att

ack

Path

sA

ny c

ombi

nati

on o

f th

e fo

llow

ing

met

hods

:•

Rec

onn

aiss

ance

—

• In

sert

ion

of

mal

icio

us c

ode

• E

aves

drop

pin

g “A

PT

• U

nau

thor

ized

Acc

ess

U-

Att

ack

• Z

ero-

day

vuln

erab

iliti

es

Pat

hs’

• So

cial

En

gin

eeri

ng

• Sp

ear

Ph

ish

ing

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

A s

ucce

ssfu

l AP

T r

esul

ts in

los

s of

sec

urity

and

con

trol

of

targ

eted

net

wor

ks.

The

use

of

this

acc

ess

and

the

info

rmat

ion

obta

ined

cou

ld b

e us

ed to

cre

ate

prol

onge

d bl

acko

uts

in o

ne o

r m

ore

regi

ons

due

to l

oss

of c

ontr

ol a

nd/

or

situ

atio

nal a

war

enes

s, di

srup

tion

of

com

mun

icat

ions

and

indu

stri

al c

ontr

ol s

yste

ms,

com

prom

ise

of

ICS/

DC

S/SC

AD

A m

odel

s, lo

ss o

f in

form

atio

n in

tegr

ity o

r av

aila

bilit

y, a

nd th

e ph

ysic

al d

estr

ucti

on o

f cr

itica

l eq

uipm

ent.

In a

dditi

on to

los

t pro

duct

ivity

cos

ts, f

utur

e co

sts

for

re-f

ortif

ying

cyb

er s

yste

ms

and

rest

orin

g pu

blic

co

nfid

ence

in a

sec

ure

and

resi

lient

pow

er g

rid

coul

d be

sig

nific

ant.

19E

EI

and

TC

G P

ropr

ieta

ry



ilii

▲ A

cuTe

chcg

rchj

pf

XII

. Thr

eat

Scen

ario

- A

dvan

ced

Per

sist

ent

Thr

eat

0“

—

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• M

itiga

tion

Act

ions

for

Coo

rdin

ated

Cyb

er A

ttac

k (s

ee s

lide

18)

• Id

entif

y m

issi

on c

ritic

al in

form

atio

n an

d op

erat

iona

l con

trol

dat

a an

d pa

rtit

ion

and

prot

ect

thes

e re

sour

ces

in a

“da

ta c

entr

ic”

secu

rity

con

stru

ct•

Iden

tify

the

indi

vidu

als w

ho a

re a

utho

rize

d to

acc

ess

thes

e re

sour

ces

and

prov

ide

at le

ast a

tw

o fa

ctor

aut

hent

icat

ion

proc

ess

to a

llow

this

aut

hori

zed

acce

ss•

Esta

blis

h “n

orm

s of

net

wor

k be

havi

or”

for

thes

e au

thor

ized

use

rs b

oth

in te

rms

of

freq

uenc

y of

acc

ess

and

data

exf

iltra

tion

as w

ell a

s fo

r sy

stem

s op

erat

ion

and

appl

icat

ions

use

• D

evel

op a

nd te

st in

cide

nt r

espo

nse

plan

s

Prev

enti

on•

Mai

ntai

n a

robu

st m

onit

orin

g ef

fort

that

det

ects

whe

n “n

orm

s of

net

wor

k be

havi

or”

are

exce

eded

• E

nfor

ce s

epar

atio

n of

dut

ies

and

empl

oy th

e pr

inci

ple

of l

east

pri

vile

ge

Res

pons

e•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

Rec

over

y•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

20E

EI

and

TC

G P

ropr

ieta

ry

cn co



cn

IU1

CHER

TOFF

GR

OU

PX

II. T

hrea

t Sc

enar

io 3

Acu

Tech

Pro

cess

Ris

k M

anag

emen

t

Dis

rupt

ion

of V

oice

and

Dat

a C

omm

unic

atio

n Sy

stem

s to

Cau

se L

oss

of

Situ

atio

nal A

war

enes

s (I

neff

ectiv

e Lo

ad-B

alan

cing

and

Rel

ated

Dec

isio

ns)

z o HH H Ph HH P4 U c/5 W Q

Use

of

phys

ical

or

cybe

r at

tack

s to

den

y or

dis

rupt

com

mun

icat

ion

syst

ems

and

info

rmat

ion

requ

ired

by

ope

rato

rs t

o m

ake

good

dec

isio

ns a

bout

load

bal

anci

ng a

nd r

elat

ed p

roce

sses

im

pact

ing

grid

op

erat

ion.

A

suc

cess

ful

atta

ck o

n te

leco

mm

unic

atio

n pr

ovid

ers

and

thei

r as

soci

ated

infr

astr

uctu

re

coul

d ca

use

loss

of

accu

rate

sit

uati

onal

aw

aren

ess

and

info

rmat

ion

rela

ting

to t

he d

eman

d an

d su

pply

o

f el

ectr

icity

on

the

grid

. A

s a

resu

lt, e

rron

eous

dec

isio

ns a

re m

ade

caus

ing

the

grid

to

have

in

stab

ility

and

pos

sibl

e ca

scad

ing

failu

re.

Lik

ely

Tar

get T

ypes

Thi

rd p

arty

voi

ce a

nd d

ata

com

mun

icat

ions

' net

wor

ks

Prop

riet

ary

com

mun

icat

ion

serv

ices

suc

h as

IC

CP

(use

d by

util

ities

for

con

trol

cen

ter

com

mun

icat

ions

)R

elay

s th

at p

rote

ct g

ener

atio

n br

eake

rs a

nd

line

brea

kers

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

terr

oris

t or

gani

zatio

ns (

and

surr

ogat

es)

Mer

cena

ry c

rim

inal

org

aniz

atio

ns

Elite

hac

ker

orga

niza

tions

D

isgr

untl

ed in

side

rs

Co-

opte

d th

ird

part

y m

aint

enan

ce

prov

ider

s

Spec

ific

Att

ack

Path

sA

PT

Att

ack

Pat

hs

(see

sli

de 1

9)Ph

ysic

al A

ttac

ks (

on c

omm

unic

atio

ns

infr

astr

uctu

re)

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

A s

ucce

ssfu

l dis

rupt

ion

of c

omm

unic

atio

ns s

yste

ms

and

info

rmat

ion

coul

d re

sult

in d

isru

ptio

n of

sou

rces

of

info

rmat

ion

used

for

aut

omat

ed d

ecis

ions

(e.

g. c

ontr

ol s

igna

ls f

or a

utom

atic

gen

erat

ion

cont

rol)

and

by o

pera

tors

to

mak

e lo

ad-b

alan

cing

and

rel

ated

dec

isio

ns.

Shou

ld th

is c

oinc

ide

with

a n

atur

ally

-occ

urri

ng o

r m

an-m

ade

stat

e of

in

stab

ility

on

the

grid

, bla

ckou

ts c

ould

occ

ur in

one

or

mor

e re

gion

s fo

r a

shor

t per

iod

of t

ime

due

to c

asca

ding

fa

ilure

s.

21E

EI

and

TC

G P

ropr

ieta

ry



iili

▲ A

cuTe

chCg

roup

F X

II. T

hrea

t Sc

enar

io —

Dis

rup

tion

of

Voi

ce/D

ata

w

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• Id

entif

y m

issi

on c

ritic

al v

oice

and

dat

a co

mm

unic

atio

n ne

twor

ks (

and

thei

r pr

ovid

ers)

and

de

linea

te th

e vi

rtua

l and

phy

sica

l top

olog

y of

the

se n

etw

orks

• Id

entif

y m

issi

on c

ritic

al d

ata

and

voic

e “m

inim

ize”

pro

toco

ls to

red

uce

the

voic

e an

d da

ta

flow

and

hav

e pr

oced

ures

in p

lace

to o

pera

te u

nder

thes

e pr

otoc

ols

• C

reat

e an

d m

aint

ain

secu

rity

man

agem

ent c

ontr

ols

to p

rote

ct th

e sy

stem

’s cr

itica

l tel

ecom

as

sets

, as

appl

icab

le (

i.e. t

hose

sys

tem

s th

at a

re o

wne

d an

d op

erat

ed b

y co

mpa

ny)

• D

evel

op a

nd te

st in

cide

nt r

espo

nse

plan

s fo

r lo

ss o

f vo

ice

and

data

com

mun

icat

ions

Prev

enti

on•

Coo

rdin

ate

with

net

wor

k pr

ovid

ers

to d

eter

min

e al

tern

ativ

e ro

utin

g co

nstr

ucts

for

mis

sion

cr

itica

l net

wor

ks s

houl

d pr

imar

y pa

ths

be u

nava

ilabl

e

Res

pons

e

• Pr

ovid

e re

dund

ant o

r ba

ckup

cap

acity

sho

uld

prim

ary

prop

riet

ary

com

mun

icat

ions

ser

vice

s (e

.g. I

CC

P) b

e un

avai

labl

e•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

• St

atio

n pe

rson

nel a

t cr

itica

l fac

ilitie

s•

Coo

rdin

ate

grid

ope

rati

ons w

ith n

eigh

bori

ng u

tiliti

es, R

egio

nal T

rans

mis

sion

Off

icer

s (R

TO

s), a

nd R

elia

bilit

y C

oord

inat

ors

Rec

over

y•

Mai

ntai

n sa

telli

te c

omm

unic

atio

n ca

paci

ty th

at c

ould

be

activ

ated

sho

uld

the

netw

ork

prov

ider

’s al

tern

ate

rout

ing

be u

nava

ilabl

e•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

22E

EI

and

TC

G P

ropr

ieta

ry

cn cn



cn CD

CHER

TOFF

GR

OU

P

1111

XII

. Thr

eat

Scen

ario

4A

cuTe

chP

roce

ss R

isk

Man

agem

ent

Coo

rdin

ated

/Ble

nded

Phy

sica

l and

Cyb

er A

ttac

k on

Bul

k El

ectr

ic

Syst

em I

nfra

stru

ctur

e

z o HH H Ph HH P4 U c/5 W Q

A c

oord

inat

ed c

ampa

ign

of

sim

ulta

neou

s or

nea

r si

mul

tane

ous

cybe

r an

d ph

ysic

al a

ttac

ks o

n m

ultip

le

targ

ets

in t

he e

lect

ric

grid

. T

he i

nten

t o

f su

ch a

sop

hist

icat

ed a

ttac

k w

ould

be

to c

ause

dis

rupt

ion

and

dest

ruct

ion

of

grid

ope

rati

ons

for

a si

gnifi

cant

per

iod

of

tim

e by

rap

idly

bri

ngin

g th

e sy

stem

and

its

ope

rato

rs b

eyon

d th

eir

capa

bilit

y to

eff

ecti

vely

ass

ess,

pre

vent

, res

pond

to,

or

reco

ver

from

the

co

mbi

ned

effe

cts

of

the

atta

cks.

Such

an

atta

ck c

ould

als

o be

tim

ed t

o co

inci

de w

ith a

hur

rica

ne,

pand

emic

or

acci

dent

to

max

imiz

e th

e di

srup

tion

or

incr

ease

the

att

ack'

s lik

elih

ood

of

succ

ess.

Lik

ely

Tar

get T

ypes

Pow

er g

ener

atio

n pl

ants

E

HV

and

HV

tran

sfor

mer

s an

d tr

ansm

issi

on li

nes

Con

trol

cen

ters

and

sup

port

ing

syst

ems

ICS/

DC

S/SC

AD

A

Ener

gy m

anag

emen

t sys

tem

s an

d da

ta

Oth

er k

ey p

hysi

cal e

quip

men

t and

cri

tical

el

ectr

onic

sys

tem

s

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

terr

oris

t or

gani

zatio

ns (

and

surr

ogat

es)

Elite

hac

ker

orga

niza

tions

Spec

ific

Att

ack

Path

s•

AP

T A

ttac

k P

ath

s (s

ee s

lide

19)

The

phys

ical

att

ack

com

pone

nt a

gain

st

faci

litie

s, eq

uipm

ent o

r pe

ople

may

incl

ude:

• Im

prov

ised

Exp

losi

ve D

evic

es/V

ehic

le

Born

e Im

prov

ised

Exp

losi

ve D

evic

es•

Use

of

airc

raft

or

mar

itim

e ve

ssel

s as

a

wea

pon

• Sa

bota

ge

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

A s

ucce

ssfu

l att

ack

coul

d re

sult

in p

rolo

nged

bla

ckou

ts in

mul

tiple

reg

ions

due

to

disr

upti

on a

nd/

or d

estr

ucti

on o

f: ke

y po

wer

gen

erat

ion

faci

litie

s; cr

itica

l EH

V tr

ansm

issi

on c

ompo

nent

s; c

omm

unic

atio

ns a

nd in

dust

rial

con

trol

sys

tem

s; pr

imar

y an

d ba

ckup

con

trol

cen

ters

; and

com

prom

ise

of I

CS/

DC

S/SC

AD

A m

odel

s an

d da

ta.

Loss

of

hum

an li

fe,

inju

ries

, and

sig

nific

ant r

epai

r/re

cons

titu

tion

cos

ts a

re a

lso

likel

y du

e to

the

kin

etic

eff

ects

of

phys

ical

att

acks

. In

ad

ditio

n to

los

t pro

duct

ivity

cos

ts, f

utur

e co

sts

coul

d be

sig

nific

ant

for

re-f

ortif

ying

phy

sica

l and

cyb

er s

yste

ms

and

rest

orin

g pu

blic

con

fiden

ce in

a s

ecur

e an

d re

silie

nt p

ower

gri

d.23

EE

I an

d T

CG

Pro

prie

tary



ilij

X A

cuTe

chCg

roup

F X

II. T

hrea

t Sc

enar

io —

Ph

ysic

al a

nd C

yber

Att

ack

Ai P

roce

ss R

isk

Man

agem

ent

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• M

itiga

tion

Act

ions

for

Coo

rdin

ated

Cyb

er A

ttac

k (s

ee s

lide

18)

• En

sure

that

faci

litie

s un

derg

o a

peri

odic

phy

sica

l sec

urity

ris

k an

alys

is t

o de

term

ine

thei

r de

taile

d pr

otec

tion

nee

ds•

Mai

ntai

n ro

bust

phy

sica

l sec

urity

and

acc

ess

cont

rols

at

criti

cal f

acili

ties

that

effe

ctiv

ely

excl

ude

unau

thor

ized

veh

icle

s an

d pe

dest

rian

s fr

om g

aini

ng a

cces

s•

Ensu

re th

at b

uild

ing

entr

ance

s (in

clud

ing

load

ing

dock

s) a

t cri

tical

faci

litie

s ha

ve a

cces

s co

ntro

l mea

sure

s em

ploy

ed to

pre

vent

una

utho

rize

d en

try

• U

se in

trus

ion

dete

ctio

n sy

stem

s to

det

ect u

naut

hori

zed

entr

y to

cri

tical

are

as w

ithin

fac

ilitie

s•

Dev

elop

and

test

inci

dent

res

pons

e pl

ans

Prev

enti

on

• E

scor

t vis

itors

, con

trac

tors

, ven

dors

, and

oth

er n

on-e

mpl

oyee

s at

all

times

whe

n in

side

cr

itica

l fac

ilitie

s or

acc

essi

ng c

ritic

al I

T s

yste

ms

• M

aint

ain

an e

ffec

tive

guar

d fo

rce

that

mon

itor

s fa

cilit

y al

arm

s an

d co

rres

pond

ing

elec

tron

ic

secu

rity

sys

tem

s du

ring

wor

k an

d no

n-w

ork

hour

s•

Ensu

re th

at a

reas

sur

roun

ding

cri

tical

faci

litie

s ar

e w

ell l

it an

d ha

ve a

dequ

ate

CC

TV

su

rvei

llanc

e m

onit

ored

by

a hu

man

ope

rato

r•

Cre

ate

phys

ical

com

part

men

taliz

atio

n of

cri

tical

are

as th

roug

h a

com

bina

tion

of

lock

s an

d au

tom

ated

acc

ess

cont

rols

Res

pons

e•

Ensu

re th

at a

n ef

fect

ive

guar

d fo

rce

mon

itor

s an

d re

spon

ds to

fac

ility

ala

rms

and

corr

espo

ndin

g el

ectr

onic

sec

urity

sys

tem

s du

ring

wor

k an

d no

n-w

ork

hour

s•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

Rec

over

y•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

24E

EI

and

TC

G P

ropr

ieta

ry

cn



cn oo

Ull

CHER

TOFF

GR

OU

PX

II. T

hrea

t Sc

enar

io 5

Acu

Tech

Pro

cess

Ris

k M

anag

emen

t

Insi

der

Sabo

tage

of

Phy

sica

l an

d/o

r C

yber

Sys

tem

s

z o HH H HH u cr>

W

Q

"Ins

ider

Sab

otag

e" r

efle

cts

the

thre

at p

osed

by

the

empl

oyee

, for

mer

em

ploy

ee, o

r th

ird-

part

y se

rvic

e pr

ovid

er w

ho is

eith

er c

o-op

ted

by a

nat

ion

stat

e or

a t

erro

rist

or

crim

inal

gro

up, o

r is

sim

ply

seek

ing

to r

etal

iate

aga

inst

an

empl

oyer

or

form

er e

mpl

oyer

. B

ecau

se o

f th

e pr

opri

etar

y op

erat

iona

l kn

owle

dge

and

priv

ilege

d ac

cess

pro

vide

d to

em

ploy

ees,

the

re a

re a

larg

e nu

mbe

r o

f ph

ysic

al a

nd

cybe

r at

tack

met

hods

suc

h in

divi

dual

s ca

n em

ploy

In

side

r sa

bota

ge b

y a

co-o

pted

em

ploy

ee c

ould

al

so b

e co

ordi

nate

d w

ith

othe

r co

mpo

nent

s o

f an

org

aniz

ed a

ttac

k by

sta

te a

ctor

s or

terr

oris

t gr

oups

.

Lik

ely

Tar

get T

ypes

Peop

leM

ajor

phy

sica

l and

cyb

er s

yste

ms

Expe

nsiv

e an

d ha

rd to

rep

lace

equ

ipm

ent

Ope

rati

onal

con

trol

sys

tem

s an

d su

ppor

ting

com

mun

icat

ion

syst

ems

Pote

ntia

l Thr

eat A

ctor

sIn

side

rs (

curr

ent,

form

er, a

nd c

oop

ted

empl

oyee

s)T

hird

par

ty s

ervi

ce p

rovi

ders

Te

rror

ist

"mol

es"

(indi

vidu

als

gain

ing

empl

oym

ent

on b

ehal

f of

a

terr

oris

t or

gani

zatio

n)

Spec

ific

Att

ack

Path

sB

oth

ph

ysic

al a

nd

cybe

r m

eth

ods

may

be

use

d.

Spec

ific

tac

tics

inc

lude

:•

Soci

al E

ngin

eeri

ng•

Una

utho

rize

d ac

cess

or

mis

usin

g le

gitim

ate

acce

ss•

Mis

conf

igur

atio

n of

equ

ipm

ent

• M

an-i

n-th

e-m

iddl

e cy

ber

atta

cks

• D

isre

gard

ing

acce

ss c

ontr

ol p

olic

ies

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

Dep

endi

ng o

n th

e le

vel o

f ac

cess

and

kno

wle

dge

of t

he in

sider

, a s

ucce

ssfu

l att

ack

coul

d re

sult

in lo

ss o

f po

wer

ge

nera

tion

and

even

bla

ckou

ts d

ue to

dis

rupt

ion

of p

ower

gen

erat

ion,

com

mun

icat

ions

and

indu

stri

al c

ontr

ol s

yste

ms,

and

the

com

prom

ise

of I

CS/

DC

S/SC

AD

A m

odel

s an

d da

ta.

Loss

of

hum

an li

fe, i

njur

ies,

and

sign

ifica

nt

repa

ir/r

econ

stit

utio

n co

sts

are

also

pos

sibl

e.

25E

EI

and

TC

G P

ropr

ieta

ry



ilii

A A

cuTe

chCg

roup

F X

II. T

hrea

t Sc

enar

io —

Ins

ider

Sab

otag

eP

roce

ss R

isk

Man

agem

ent

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• M

itiga

tion

Act

ions

Com

mon

to a

ll C

yber

Thr

eats

(se

e sl

ide

16)

• C

ondu

ct p

erio

dic

ente

rpri

se-w

ide

risk

ass

essm

ents

con

side

ring

insi

der

thre

ats

• In

stitu

te p

erio

dic

empl

oyee

sec

urity

and

All-

Haz

ards

aw

aren

ess

trai

ning

for

all e

mpl

oyee

s•

Con

duct

bac

kgro

und

chec

ks a

nd c

onsi

der

resu

lts c

aref

ully

• C

lear

ly d

ocum

ent i

nsid

er th

reat

con

trol

s an

d po

licie

s•

Dev

elop

and

test

inci

dent

res

pons

e pl

ans

Prev

enti

on

• Em

ploy

rol

e-ba

sed

phys

ical

and

ele

ctro

nic

acce

ss c

ontr

ols

to f

acili

ties,

phys

ical

equ

ipm

ent,

and

info

rmat

ion

syst

ems

• E

nfor

ce s

epar

atio

n of

dut

ies

and

empl

oy th

e pr

inci

ple

of l

east

pri

vile

ge•

Ensu

re p

hysi

cal c

ompa

rtm

enta

lizat

ion

of c

ritic

al a

reas

• Im

plem

ent

stri

ct p

assw

ord

and

acco

unt

man

agem

ent p

olic

ies

and

prac

tices

• Pr

ohib

it th

e in

trod

uctio

n of

con

trab

and

data

sto

rage

tech

nolo

gies

into

sen

sitiv

e ar

eas

• U

se a

dditi

onal

con

trol

s fo

r sy

stem

adm

inis

trat

ors

and

priv

ilege

d us

ers

• U

se la

yere

d de

fens

e ag

ains

t re

mot

e at

tack

s (e

mpl

oyee

log-

ins)

• D

eact

ivat

e em

ploy

ee p

hysi

cal a

nd c

yber

acc

esse

s fo

llow

ing

sepa

ratio

n or

cha

nge

in

resp

onsi

bilit

ies

• Lo

g, m

onito

r, a

nd a

udit

empl

oyee

onl

ine

acti

ons

Res

pons

e

• M

onit

or a

nd r

espo

nd to

rul

e vi

olat

ions

and

sus

pici

ous/

disr

upti

ve b

ehav

ior

• Em

ploy

HR

pro

cedu

res

to a

ddre

ss c

once

rnin

g be

havi

ors

and

rule

vio

lati

ons

• M

onit

or e

mpl

oyee

res

pons

es to

org

aniz

atio

nal s

anct

ions

and

str

essf

ul e

vent

s•

Impl

emen

t em

erge

ncy

resp

onse

pla

ns a

nd u

se a

n in

cide

nt m

anag

emen

t sy

stem

Rec

over

y•

Col

lect

and

sav

e da

ta f

or u

se in

inve

stig

atio

ns•

Impl

emen

t se

cure

bac

k-up

and

rec

over

y pr

oces

ses

• Im

plem

ent

disa

ster

rec

over

y an

d bu

sine

ss c

ontin

uity

pla

nsE

EI

and

TC

G P

ropr

ieta

ry

cn CD



CD o

Ull

CHER

TOFF

GRO

UPX

II. T

hrea

t Sc

enar

io 6

*A

cuTe

chP

roce

ss R

isk

Man

agem

ent

Pan

dem

ic

z o HH H HH u cr>

W

Q

A p

ande

mic

, suc

h as

a m

ore

seve

re o

utbr

eak

of

the

"Sw

ine

Flu"

or

"Avi

an I

nflu

enza

" pa

ndem

ics,

th

at c

ould

mak

e a

sign

ifica

nt p

orti

on o

f th

e w

orkf

orce

too

ill t

o w

ork.

Lik

ely

Tar

get T

ypes

Ther

e ar

e no

"ta

rget

s" i

f di

ssem

inat

ion

of t

he

viru

s oc

curs

nat

ural

ly. I

ndiv

idua

ls a

ssoc

iate

d w

ith a

ny p

art

of t

he o

rgan

izat

ion,

incl

udin

g th

ose

with

uni

que

and

nece

ssar

y sk

ills,

know

ledg

e an

d re

spon

sibi

litie

s co

uld

be

affe

cted

.

Pote

ntia

l Thr

eat A

ctor

sTh

is s

cena

rio

wou

ld b

e na

tura

lly

occu

rrin

g un

less

inte

ntio

nally

spr

ead

by a

dis

grun

tled

insi

der

or o

ther

in

divi

dual

s w

ith w

hom

per

sonn

el

com

e in

to c

onta

ct.

Spec

ific

Att

ack

Path

sTh

e di

ssem

inat

ion

of t

he v

irus

wou

ld o

ccur

na

tura

lly u

nles

s in

tent

iona

lly s

prea

d or

w

eapo

nize

d by

a t

erro

rist

gro

up.

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

A li

kely

impa

ct o

f su

ch a

n ev

ent w

ould

be

the

loss

of

staf

f cr

itica

l to

oper

atin

g th

e el

ectr

ic p

ower

sys

tem

, bac

k of

fice

supp

ort

func

tions

cri

tical

to b

usin

ess

cont

inui

ty, a

nd e

mer

genc

y re

spon

se p

erso

nnel

. In

pan

dem

ic e

vent

s, th

e m

ajor

fa

ilure

may

not

occ

ur d

irec

tly a

s a

resu

lt of

the

per

sonn

el a

ffec

ted,

but

rat

her

the

risk

of

grid

acc

iden

ts a

nd/

or d

elay

s in

re

pair

s an

d as

wel

l as

reco

very

fro

m o

ther

eve

nts

coul

d be

incr

ease

d. W

ithou

t the

se p

erso

nnel

, ope

rati

onal

issu

es o

n th

e sy

stem

may

incr

ease

as

less

-tra

ined

and

less

-exp

erie

nced

indi

vidu

als w

ork

to o

pera

te g

ener

atio

n pl

ants

, add

ress

m

echa

nica

l fai

lure

s, re

stor

e po

wer

fol

low

ing

outa

ges

caus

ed b

y na

tura

l eve

nts,

and

oper

ate

the

syst

em.

EE

I an

d T

CG

Pro

prie

tary

27



iili

▲ A

cuTe

chcg

rcJj

pf

XII

. Thr

eat

Scen

ario

- P

ande

mic

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• Id

entif

y es

sent

ial e

mpl

oyee

fun

ctio

ns a

nd w

ork

to e

nsur

e th

eir

resil

ienc

y an

d re

dund

ancy

• Pa

rtic

ipat

e in

tabl

etop

exe

rcis

es to

iden

tify

stre

ngth

s an

d ar

eas

of i

mpr

ovem

ent

• M

aint

ain

Stan

dard

Ope

rati

ng P

roce

dure

s (S

OP)

and

Con

tinui

ty o

f O

pera

tion

s Pl

ans

(CO

OP)

fo

r al

tere

d w

ork

cond

itio

ns•

Impl

emen

t fa

cilit

y vi

sito

r, t

rave

l, an

d sa

fety

pro

toco

ls a

nd m

aint

ain

capa

city

to s

uppo

rt

inve

stig

atio

n in

to r

isk

expo

sure

• En

sure

em

ploy

ee a

war

enes

s an

d ed

ucat

ion

thro

ugh

cros

s-tr

aini

ng a

nd in

form

atio

n di

stri

butio

n•

Ensu

re th

at p

lann

ing

for

mas

sive

rem

ote

wor

king

is m

atch

ed b

y IT

cap

abili

ties

such

as

suff

icie

nt b

andw

idth

and

har

dwar

e•

Dev

elop

and

test

inci

dent

res

pons

e pl

ans

Prev

enti

on

• Pl

an w

hich

bus

ines

s fu

nctio

ns w

ill r

ecei

ve p

rior

itize

d at

tent

ion

duri

ng r

educ

ed s

taff

ava

ilabi

lity

• M

aint

ain

Hum

an R

esou

rce

func

tions

and

pro

toco

ls to

ens

ure

offi

ce w

elln

ess

• W

ork

to im

prov

e in

stitu

tiona

l mea

ns to

iden

tify

and

trac

k sy

mpt

oms

of in

fluen

za•

Coo

rdin

ate

to e

nsur

e ac

cess

to

Stra

tegi

c N

atio

nal S

tock

pile

(SN

S) r

esou

rces

Res

pons

e

• M

aint

ain

cont

inge

ncy

plan

ning

with

key

ven

dors

, sup

plie

rs, a

nd p

artn

ers

abou

t the

tr

ansp

orta

tion

and

dis

trib

utio

n of

cri

tical

res

ourc

es, s

uppl

ies,

and

equi

pmen

t•

Ensu

re c

apab

ilitie

s fo

r ex

ecut

ives

to

effe

ctiv

ely

coor

dina

te a

nd c

omm

unic

ate

with

bot

h in

tern

al a

nd e

xter

nal p

artn

ers

duri

ng c

risi

s•

Ensu

re f

inan

cial

ope

rati

ons

duri

ng ti

mes

of

cris

is b

y st

reng

then

ing

finan

ce e

mer

genc

y pl

ans

incl

udin

g in

sura

nce

reco

very

, deb

t adm

inis

trat

ion,

and

com

mun

icat

ion

with

ban

ks•

Des

ign

regu

latio

ns t

o in

crea

se p

ool o

f sk

illed

wor

kers

• Im

plem

ent e

mer

genc

y re

spon

se p

lans

and

use

an

inci

dent

man

agem

ent s

yste

m

Rec

over

y•

Mai

ntai

n re

latio

nshi

ps w

ith c

linic

s to

dis

trib

ute

vacc

ines

or

antiv

iral

s•

Impl

emen

t dis

aste

r re

cove

ry a

nd b

usin

ess

cont

inui

ty p

lans

EE

I an

d T

CG

Pro

prie

tary

CD



cn K>

CHER

TOFF

GR

OU

P

III!

XII

. Thr

eat

Scen

ario

7A

cuTe

chP

roce

ss R

isk

Man

agem

enr

Supp

ly C

hain

Dis

rupt

ion

or C

ompr

omis

e

z o HH H HH u cr>

W

Q

The

dis

rupt

ion

or c

ompr

omis

e o

f th

e su

pply

of

criti

cal e

quip

men

t, pa

rts,

and

fue

ls n

eede

d to

sus

tain

an

d/or

rep

air

the

elec

tric

al g

rid.

Thi

s co

uld

be a

ccom

plis

hed

by n

atur

al d

isas

ter,

phy

sica

l des

truc

tion

, ac

quis

itio

n o

f a

supp

lier

by a

hos

tile

thi

rd p

arty

, or

any

com

bina

tion

ther

eof.

Lik

ely

Tar

get T

ypes

EH

V tr

ansf

orm

ers

Uni

que

and

hard

to r

apid

ly m

anuf

actu

re

part

s, eq

uipm

ent,

and

supp

lies

Fuel

sup

plie

sC

ritic

al r

epla

cem

ent p

arts

and

oth

er "

sing

le

poin

t of

fai

lure

" co

mpo

nent

s C

omm

only

use

d ha

rdw

are,

fir

mw

are

or

soft

war

e

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

ter

rori

st

orga

niza

tions

(an

d su

rrog

ates

) N

atur

al d

isas

ters

H

osti

le s

tate

-run

cor

pora

tions

Spec

ific

Att

ack

Path

sR

esul

tin

g fr

om D

efic

ien

cies

in

Th

ird

Par

ty S

uppo

rt o

r V

endo

r M

anag

emen

t:•

Com

prom

ise

of s

oftw

are

or fi

rmw

are

• U

nkno

wn

thir

d pa

rty

rela

tions

hip

chai

n•

Expl

oita

tion

of

thir

d pa

rty

host

ing

of

criti

cal s

yste

ms

(e.g

. dat

a ce

nter

s)•

Con

trol

ser

vice

pro

vide

r co

mpr

omis

e

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

The

dis

rupt

ion

or c

ompr

omis

e of

the

sup

ply

chai

n co

uld

have

con

sequ

ence

s on

a u

tility

or

a re

gion

's ab

ility

to

cont

inue

to o

pera

te a

t fu

ll ca

paci

ty, o

r to

obt

ain

the

part

s ne

eded

to r

ecov

er f

rom

a s

igni

fican

t inc

iden

t. Pr

oduc

ts a

nd

serv

ices

obt

aine

d th

roug

h th

ird

part

y pr

ovid

ers

are

subj

ect t

o bo

th d

isru

ptio

n an

d de

grad

atio

n of

fun

ctio

nalit

y or

se

curi

ty w

hich

cou

ld b

e ex

ploi

ted

by o

ther

adv

ersa

ries

.

29E

EI

and

TC

G P

ropr

ieta

ry



iijj

▲ A

cuTe

chc

gr

o?p

ff

XII

. Thr

eat

Scen

ario

- S

uppl

y C

hain

Dis

rup

tion

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• Pe

rfor

m a

n in

itial

sof

twar

e su

pply

cha

in s

ecur

ity r

isk

asse

ssm

ent

• Es

tabl

ish

requ

ired

sec

urity

pro

pert

ies

thro

ugho

ut th

e so

ftw

are

deve

lopm

ent l

ifecy

cle

• M

aint

ain

awar

enes

s of

sup

plie

r’s s

ub-t

ier

rela

tions

hips

• D

evel

op u

ser

guid

ance

to h

elp

miti

gate

sup

ply

chai

n se

curi

ty r

isk

• M

aint

ain

supp

lier

dive

rsity

whe

re p

ossi

ble

• C

ondu

ct s

uppl

ier g

ap a

naly

sis, d

evel

op a

nd te

st p

lans

Prev

enti

on

• C

onfi

gure

/inte

grat

e w

ith c

onsi

dera

tion

of

supp

ly c

hain

sec

urity

ris

ks•

Sele

ct s

uppl

iers

that

add

ress

sup

ply

chai

n se

curi

ty r

isk

in a

ccor

danc

e w

ith D

HS

exis

ting

guid

ance

for

con

trol

sys

tem

s pr

ocur

emen

t•

Mon

itor

com

pone

nt/s

uppl

ier

deliv

ery

of c

ompl

eted

pro

duct

s to

gua

rd a

gain

st th

e in

trod

uctio

n of

mal

war

e w

hile

in tr

ansi

t•

Ass

ess

all n

ew d

eliv

ered

pro

duct

s fo

r po

tent

ial s

ecur

ity c

ompr

omis

es a

nd r

isk

• En

sure

the

conf

igur

atio

n an

d m

onit

orin

g co

ntro

ls r

emai

n ac

tive

as th

e pr

oduc

t is

used

and

its

use

evol

ves

over

tim

e•

Clo

sely

eva

luat

e pa

tch

and

upda

te p

roce

dure

con

trol

s fo

r po

tent

ial m

alw

are

inse

rtio

n•

Ensu

re s

oftw

are

is f

ully

pur

ged

from

sys

tem

s whe

n re

mov

al is

des

ired

• M

itiga

te r

isks

of

info

rmat

ion

disc

losu

re d

urin

g di

spos

al o

f eq

uipm

ent

Res

pons

e•

Man

age

and

revi

ew s

ecur

ity in

cide

nts

• Im

plem

ent e

mer

genc

y re

spon

se p

lans

and

use

an

inci

dent

man

agem

ent

syst

em

Rec

over

y•

Incr

ease

inve

ntor

y of

equ

ipm

ent l

ikel

y to

be

dam

aged

in m

ost

likel

y th

reat

s•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

30E

EI

and

TC

G P

ropr

ieta

ry



CD

Ull

CHER

TOFF

GR

OU

PX

II. T

hrea

t Sc

enar

io 8

AA

cuTe

chP

roce

ss R

isk

Man

agem

ent

Cat

astr

ophi

c H

um

an E

rror

z o HH H HH u cr>

W

Q

The

uni

nten

tion

al a

ctio

ns (

and

inac

tion

s) o

f pe

ople

tha

t co

uld

resu

lt in

a m

ajor

fai

lure

.

Lik

ely

Tar

get T

ypes

Pote

ntia

l Thr

eat A

ctor

sSp

ecifi

c A

ttac

k Pa

ths

As

this

scen

ario

is u

nint

entio

nal,

ther

e ar

e no

"t

arge

ts"

per

se. F

ocus

sho

uld

be o

n gr

eate

st

area

s of

vul

nera

bilit

y to

uni

nten

ded

cons

eque

nces

.

• G

rid

cont

rolle

rs•

Plan

t ope

rato

rs•

Mai

nten

ance

per

sonn

el•

Thir

d-pa

rty

mai

nten

ance

pr

ovid

ers

• O

ther

s in

a s

yste

m's

criti

cal p

ath

Non

-mal

icio

us h

uman

fai

lure

pat

hway

s in

clud

e:•

Mis

take

s m

ade

perf

orm

ing

job

• M

isco

nfig

urin

g eq

uipm

ent

• V

iola

tion

of

polic

ies

due

to la

ck o

f tr

aini

ng o

r aw

aren

ess

• In

adve

rten

tly o

r un

witt

ingl

y be

com

ing

a so

cial

eng

inee

ring

targ

et

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

• C

usto

mer

out

ages

• G

ener

ator

s go

ing

off-

line

• D

amag

e to

equ

ipm

ent

• In

trod

ucti

on o

f m

alic

ious

sof

twar

e

31E

EI

and

TC

G P

ropr

ieta

ry



jili

A A

cuTe

chcg

rcJ?

pf

XII

. Thr

eat

Scen

ario

- C

atas

trop

hic

Hu

man

Err

or

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• M

aint

ain

an e

xecu

tive

com

mit

men

t to

proc

ess

safe

ty•

Con

duct

pro

cess

saf

ety

asse

ssm

ents

to u

nder

stan

d ha

zard

s an

d ri

sks

of h

uman

err

ors

• C

ondu

ct g

ap a

naly

sis,

deve

lop

and

test

pla

ns•

Dev

elop

and

test

inci

dent

res

pons

e pl

ans

Prev

enti

on

• M

anag

e hu

man

err

or r

isks

thr

ough

mai

ntai

ning

rob

ust a

nd c

urre

nt s

tand

ard

oper

atin

g pr

oced

ures

• M

onit

or a

nd e

valu

ate

adeq

uacy

of

prac

tice

s fo

r th

ird

part

y ve

ndor

/con

trac

tors

with

acc

ess

to

syst

ems

and

faci

litie

s•

Prov

ide

empl

oyee

s in

sen

sitiv

e po

siti

ons

with

reg

ular

saf

ety,

rel

iabi

lity,

and

aw

aren

ess

trai

ning

Res

pons

e

• Ex

erci

se p

lans

for

em

ploy

ees

to r

espo

nd to

ope

rati

onal

pro

blem

s an

d em

erge

ncie

s•

Con

tinua

lly le

arn

from

exp

erie

nces

by

cond

ucti

ng in

cide

nt in

vest

igat

ion,

aud

iting

, and

m

anag

emen

t rev

iew

• Im

plem

ent e

mer

genc

y re

spon

se p

lans

and

use

an

inci

dent

man

agem

ent

syst

em

Rec

over

y•

Impl

emen

t inc

iden

t-sp

ecifi

c di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

32E

EI

and

TC

G P

ropr

ieta

ry

CD cn



CD CD

CHER

TOFF

GR

OU

P

111!

XII

. Thr

eat

Scen

ario

9A

cuTe

chP

roce

ss R

isk

Man

agem

ent

Inte

ntio

nal E

lect

rom

agne

tic

Inte

rfer

ence

(IE

MI)

z o HH H HH u cr>

W

Q

Thi

s at

tack

invo

lves

the

inte

ntio

nal u

se o

f in

tens

e el

ectr

omag

neti

c fie

lds

gene

rate

d by

a r

epea

tabl

e (n

on-e

xplo

sive

) hi

gh-p

ower

rad

io f

requ

ency

(R

E) g

ener

ator

whi

ch a

re d

irec

ted

by a

n an

tenn

a to

ta

rget

s as

soci

ated

wit

h th

e ge

nera

tion

, con

trol

, or

tran

smis

sion

of

elec

tric

ity.

Lik

ely

Tar

get T

ypes

Hig

h vo

ltage

sub

stat

ion

cont

rols

and

com

mun

icat

ions

Pow

er g

ener

atio

n fa

cilit

ies

Pow

er c

ontr

ol c

ente

rsD

istr

ibut

ion

tran

sfor

mer

sD

istr

ibut

ion

line

insu

lato

rs

Pote

ntia

l Thr

eat A

ctor

sSt

ate-

spon

sore

d (a

nd s

urro

gate

s)

Soph

istic

ated

terr

oris

t or

gani

zatio

ns (

and

surr

ogat

es)

Spec

ific

Att

ack

Path

sT

he a

ttac

ker's

sta

ndof

f R

F w

eapo

n m

ay

impa

ct th

e ta

rget

eith

er th

roug

h di

e ra

diat

ed

elec

trom

agne

tic f

ield

pen

etra

ting

unsh

ield

ed

or p

oorl

y pr

otec

ted

build

ings

or

by

cond

ucti

on th

roug

h in

adeq

uate

ly s

hiel

ded

com

mun

icat

ions

and

dat

a lin

es.

A p

orta

ble

(sui

tcas

e) R

F w

eapo

n co

uld

be a

ctiv

ated

in a

ta

rget

ed fa

cilit

y.

Like

ly I

mpa

ct o

f Su

cces

sful

Att

ack

Unl

ess

mul

tiple

and

tim

e sy

nchr

oniz

ed a

ttac

ks o

ccur

, dam

age

to e

lect

rica

l util

ity o

pera

tion

s will

be

limite

d to

indi

vidu

al

atta

ck s

ites.

At t

hese

indi

vidu

al lo

cati

ons

the

follo

win

g im

pact

s ar

e po

ssib

le: d

amag

e to

con

trol

and

com

mun

icat

ions

sy

stem

s at

pow

er s

ubst

atio

ns, c

ontr

ol c

ente

rs, a

nd g

ener

atio

n fa

cilit

ies;

dest

ruct

ion

of s

enso

r an

d co

ntro

l cab

les

at h

igh

volt

age

subs

tati

ons;

and

des

truc

tion

of

dist

ribu

tion

tran

sfor

mer

s an

d as

soci

ated

insu

lato

rs.

33E

EI

and

TC

G P

ropr

ieta

ry



Ull

▲ A

cuTe

chC

gr

ou

pff

XII

. Thr

eat

Scen

ario

- I

nte

nti

onal

EM

Int

erfe

renc

e

Th

e fo

llow

ing

mit

igat

ion

acti

ons

appl

y to

a c

ompa

ny’s

hig

h vo

ltag

e su

bsta

tion

s, p

ower

gen

erat

ion

faci

litie

s, a

nd p

ower

con

trol

cen

ters

.

PH

ASE

SM

ITIG

AT

ION

AC

TIO

NS

Pre

pare

dnes

s

• En

sure

that

faci

litie

s un

derg

o a

peri

odic

phy

sica

l sec

urity

ris

k an

alys

is t

o de

term

ine

thei

r de

taile

d pr

otec

tion

nee

ds•

Mai

ntai

n pe

rim

eter

phy

sica

l sec

urity

and

acc

ess

cont

rols

at

faci

litie

s th

at e

ffect

ivel

y ex

clud

e un

auth

oriz

ed v

ehic

les

and

pede

stri

ans

from

gai

ning

acc

ess

• Em

ploy

acc

ess

cont

rol m

easu

res

at e

ntra

nces

/loa

ding

doc

ks to

pre

vent

una

utho

rize

d en

try

• C

reat

e ph

ysic

al c

ompa

rtm

enta

lizat

ion

of c

ritic

al a

reas

thr

ough

a c

ombi

nati

on o

f lo

cks

and

auto

mat

ed a

cces

s co

ntro

ls•

Use

intr

usio

n de

tect

ion

syst

ems

to d

etec

t una

utho

rize

d en

try

to c

ritic

al a

reas

with

in f

acili

ties

• D

evel

op a

nd te

st in

cide

nt r

espo

nse

plan

s

Prev

enti

on

• E

scor

t vis

itors

, con

trac

tors

, ven

dors

, and

oth

er n

on-e

mpl

oyee

s at

all

times

whe

n in

side

cr

itica

l fac

ilitie

s or

acc

essi

ng c

ritic

al I

T s

yste

ms

and

insp

ect a

ny it

ems

they

car

ry•

Mai

ntai

n an

eff

ectiv

e gu

ard

forc

e to

mon

itor

the

faci

lity

and

its e

lect

roni

c se

curi

ty s

yste

ms

duri

ng w

ork

and

non-

wor

k ho

urs

• En

sure

that

the

area

s su

rrou

ndin

g th

e fa

cilit

ies

are

wel

l lit

and

have

ade

quat

e C

CT

V

surv

eilla

nce

mon

itor

ed b

y a

hum

an o

pera

tor

• Fo

llow

app

licab

le I

EC

sta

ndar

ds (

6100

0-5-

8 an

d 61

000-

5-9)

for

IE

MI

miti

gatio

n

Res

pons

e•

Ensu

re th

at a

n ef

fect

ive

guar

d fo

rce

mon

itor

s an

d re

spon

ds to

fac

ility

ala

rms

and

corr

espo

ndin

g el

ectr

ic s

ecur

ity s

yste

ms

duri

ng w

ork

and

non-

wor

k ho

urs

• Im

plem

ent e

mer

genc

y re

spon

se p

lans

and

use

an

inci

dent

man

agem

ent

syst

em

Rec

over

y•

Impl

emen

t di

sast

er r

ecov

ery

and

busi

ness

con

tinui

ty p

lans

EE

I an

d T

CG

Pro

prie

tary

CD



CD oo

iili

▲ A

cuTe

chCg

roup

F X

III(

a).

Com

mu

nic

atin

g th

e In

dust

ry A

ppro

ach

w

Med

ia o

utle

ts c

onti

nue

to c

over

cyb

erse

curi

ty t

hrea

ts t

o cr

itic

al in

fras

truc

ture

,sp

ecifi

cally

the

elec

tric

indu

stry

and

pow

er g

rid

It is

impo

rtan

t to

stra

tegi

cally

iden

tify

and

en

gage

the

se o

ppor

tuni

ties

in o

rder

to

clea

rly a

rtic

ulat

e an

d pr

omot

e th

e in

dust

ry’s

shar

ed s

ecur

ity in

vest

men

t to

date

as

wel

l as

its

com

mitt

ed p

rinc

iple

s to

cyb

erse

curi

ty a

nd c

ritic

al in

fras

truc

ture

for

the

futu

re

• R

ecen

t med

ia o

ppor

tuni

ties

focu

sed

on th

e fo

llow

ing

mes

sage

s:—

Req

uire

s a

publ

ic/p

riva

te p

artn

ersh

ip: n

eith

er th

e go

vern

men

t nor

pri

vate

sec

tor

can

do t

his

alon

e.—

Rec

omm

end

a ri

sk-b

ased

, pri

oriti

zed

appr

oach

to c

ritic

al in

fras

truc

ture

pro

tect

ion

— In

crea

sed

info

rmat

ion

shar

ing

is re

quir

ed t

o be

tter

pre

pare

for

, pre

vent

, and

m

itiga

te c

yber

thre

ats

35E

EI

and

TC

G P

ropr

ieta

ry



I

A A

cuTe

chCg

roup

F X

III(

b).

Com

mu

nic

atin

g th

e In

dust

ry A

ppro

ach

w

Exa

mpl

es o

f re

cen

t op

port

unit

ies

incl

ude:

• Se

cret

ary

Mic

hael

Che

rtof

f on

Fox

Bus

ines

s N

etw

ork

on N

ovem

ber

3, 2

011

“In

the p

ower

indu

stry

... th

ere

is a

n in

crea

sedf

ocus

on

the

impo

rtanc

e of

prot

ectin

g ou

r elec

tric

grid

aga

inst

cybe

r atta

cks

... 1

1 ere

is w

hat t

he go

vern

men

t can

do

— th

ere

is a

n aw

ful l

ot o

f in

form

atio

n th

e gov

ernm

ent c

an sh

are

... a

nd w

e ha

ve to

be m

ore f

lexi

ble

in sh

arin

g. ”

(Int

ervi

ew:

htt

p://

ww

w.y

outu

be.c

om/w

atch

?v=9

GeS

brT

Tdq

E

• O

pini

on E

dito

rial

titl

ed “

Res

pond

ing

to T

oday

’s Pe

rsis

tent

Cyb

er T

hrea

t R

equi

res

Act

ion

Now

” by

TC

G M

anag

ing

Dir

ecto

r B

rian

Whi

te (

pend

ing

publ

icat

ion)

“Ene

rgy

com

pani

es a

nd pu

blic

util

ities

are

also

col

labo

ratin

g to

geth

er a

nd pu

tting

in pl

ace

stand

ards

to

impr

ove

cybe

rsec

urity

acr

oss t

his

extre

mel

y in

terco

nnec

ted sy

stem

. Th

is ty

pe o

f ind

ustry

co

llabo

ratio

n m

ust b

ecom

e th

e sta

ndar

d, e

mbr

aced

by

all o

f our

criti

cal i

nfra

struc

ture

own

ers a

nd

oper

ator

s. ”

• G

ener

al H

ayde

n’s

Test

imon

y Be

fore

the

Hou

se P

erm

anen

t Se

lect

Com

mitt

ee o

n In

telli

genc

e on

Oct

ober

4, 2

011

http

: / /

inte

llige

nce.

hous

e.go

v/he

arin

g/cv

ber-

thre

ats-

and-

ongo

ing-

effo

rts-

prot

ect-

nati

on

• Se

cret

ary

Che

rtof

f’s T

esti

mon

y Be

fore

the

Hou

se Ju

dici

ary

Subc

omm

itte

e on

Cri

me,

Te

rror

ism

, and

Hom

elan

d Se

curi

ty o

n N

ovem

ber

15, 2

011

http

: / /j

udic

iary

hous

e.go

v/he

arin

gs /

hear

11

1520

11 .h

tml

EE

I an

d T

CG

Pro

prie

tary

36

CD CD


http://www.youtube.com/watch?v=9GeSbrTTdqE


o

ilii

X A

cuTe

chCg

roup

F X

IV.

Con

clu

sion

s an

d N

ext

Step

sA

i P

roce

ss R

isk

Man

agem

ent

Con

clus

ion

s:•

Aft

er y

ou h

ave

com

plet

ed d

iscu

ssin

g sl

ides

15-

34, w

hat i

s yo

ur u

tility

’s st

ate

of

read

ines

s ag

ains

t th

e m

ajor

thr

eats

fac

ing

the

elec

tric

sec

tor?

—

Is y

our

com

pan

y re

silie

nt e

nou

gh t

o w

ith

stan

d th

e th

reat

s fa

ced

by t

he e

lect

ric

sect

or?

—

Is y

our

com

pan

y a

stro

ng

or w

eak

link

in t

he c

hain

of

elec

tric

gri

d re

silie

nce?

—

Are

the

CE

O,

CIO

, Se

curi

ty a

nd

key

oper

atio

nal

per

son

nel

in a

gree

men

t on

the

cur

rent

de

gree

of

risk

the

com

pan

y fa

ces?

Nex

t St

eps:

• U

tiliti

es a

re e

ncou

rage

d to

con

tinu

ousl

y st

rive

to

impr

ove

thei

r ow

n pr

epar

edne

ss,

prot

ecti

on, r

espo

nse

and

reco

very

act

iviti

es.

Onl

y by

eac

h ut

ility

pla

ying

its

part

ca

n th

e re

silie

nce

of t

he e

lect

ric

grid

be

impr

oved

.•

Onl

y by

em

ploy

ing

thes

e vo

lunt

ary

mea

sure

s ca

n th

e el

ectr

ic s

ecto

r se

cure

itse

lf

and

decr

ease

the

nee

d fo

r ad

diti

onal

gov

ernm

enta

l reg

ulat

ion.

• C

omm

unic

atin

g yo

ur u

niqu

e pa

rtne

rshi

p, s

hare

d re

spon

sibi

lity,

and

ong

oing

co

mm

itm

ent

to s

ecur

ing

the

grid

can

hel

p bu

ild c

onfid

ence

in y

our

ende

avor

s am

ong

othe

rs a

nd p

rom

ote

furt

her

inve

stm

ent a

cros

s th

is se

ctor

.

37E

EI

and

TC

G P

ropr

ieta

ry



Edison Electric Institute on Principles for Cybersecurity and Critical Infrastructure

Protection



f l H H l Edison Electric InstituteI b b I J Power by Association*

EEI Principles for Cybersecurity and Critical Infrastructure Protection

BackgroundProtecting the nation’s electric grid and ensuring a reliable supply of power are the electric power industry’s top priorities. Cybersecurity incidents may disrupt the flow of power or reduce the reliability of the electric system. Key to the success of this effort is the ability to provide measures capable of protecting the evolving intelligent network against interruption, exploitation, compromise or outright attack of cyber assets, whether the attack vector is physical, cyber, or both.

The electric power industry takes cybersecurity threats very seriously. As part of the industry’s overall reliability effort, electric companies work to maintain the reliability and the security of the computers, control systems, and other cyber assets that help electric companies operate the electric grid. In response to the cyber threat, electric companies employ various strategies to protect these systems, but cybersecurity threats still exist.

Addressing Cybersecurity ThreatsReliability is more than a slogan for the electric utility industry - it’s a mandate. In fact, federal and state regulators have significant interest and statutory authority in ensuring electric companies provide adequate reliability. Thus, utilities take very seriously their responsibility to address cyber vulnerabilities and the security of the computers, control systems, and other cyber assets that help operate the electric grid. This focus on reliability, resiliency, and recovery takes into account an all-hazards approach, recognizing risks from natural phenomena such as hurricanes or geomagnetic disturbances to intentional cyber attacks.

Protecting the grid from cyber attacks requires a coordinated effort among electric companies, the federal government, and the suppliers of critical electric grid systems and components. Electric companies work closely with the North American Electric Reliability Corporation (NERC) and federal agencies to enhance the cybersecurity of the bulk power system. This includes coordination with the Federal Energy Regulatory Commission (FERC), the Department of Homeland Security (DHS), and the Department of Energy (DOE), as well as receiving assistance from federal intelligence and law enforcement agencies.

To complement its cybersecurity efforts and to addres s rapidly changing intelligence on evolving threats, the industry embraces a cooperative relationship with federal authorities to protect against situations that threaten national security or public welfare, and to pri oritize the assets which need enhanced security. A well-practiced, public-private partnership utilizes all stakeholders’ expertise, including the government’s ability to provide clear direction and assess threats, while owners and operators of the critical infrastructure propose mitigation strategies that will avoid significant adverse consequences to utility operations or assets. At the same time a constructive regulatory environment will assure that incremental investments to protect the grid are prudent, and reduce risk in a manner proportional to the cost.

Approved by EEI Board o f Directors on September 9, 2010.



EEI Principles for Cybersecurity and Critical Infrastructure Protection 2

Protecting the Grid is a Shared Responsibility1. Prioritize Assets to Ensure Effective Protection

Recognizing that there are a variety of interdependencies, and potential consequences associated with the loss of different facilities, the utility industry supports a risk-based, prioritized approach that identifies assets truly critical to the reliable op eration of the electric grid. This ensures the most important elements of our system receive the highest level of attention, as well as the resources necessary to secure them.

2. Threats Require Emergency Action; Vulnerab ilities Should Be Addressed More Deliberately

In this context, a threat is imminent and requires a rapid response. In these instances, the industry is willing to accommodate certain operational consequences in the interest of addressing the threat. Vulnerabilities, on the other hand, have a longer time horizon and can benefit from a more measured response. Government authority should reflect and respect these different levels of danger.

3. Clear Regulatory Structure and Open Lines of Communication

The federal regulatory framework and roles fo r all stakeholders involved in securing the electric grid should be clear to avoid duplicative or conflicting actions in times of crisis. The electric utility industry is not in the law enforcement or intelligence gathering business, and the government has limited experience operating the electric grid. Thus, each should be consulted, and the flow of information should be regularly exercised, before a threat becomes a crisis. It is critical that the federal government and industry communicate with each other seamlessly; to avoid confusion, those at the highest levels of government and industry should be involved in coordinating responses and declaring the need for emergency action.

4. Proactively Manage New Risks

As the new smart grid develops, it is essential that cybersecurity protections are incorporated into both the grid architecture and the new smart grid technologies. The electric power industry must continue to work closely with vendors, manufacturers, and government agencies and be aligned with emerging and evolving cybersecurity standard s (such as those being driven by NIST) to ensure that the new technology running the grid is, most importantly, secure and reliable. We encourage the development of a security certification program that would independently test smart grid components and systems and certify that they pass security tests. This certification process would help utilities select only those systems that provide appropriate cybersecurity.

5. Committed to Protecting Bulk Electric System and Distribution Assets

The utility industry understands that cyber attacks affecting distribution systems could have broader implications. Since jurisdiction is split betwee n state regulators and FERC, the utility industry supports enhanced threat information coordination and communication between regulatory agencies and utilities to protect our systems (whether distribution or the bulk electric system) while also honoring the existing regulatory model.

6. Cost Recovery and Liability Protection

Costs associated with emergency mitigation are, by definition, unexpected and thus not included in a utility’s rate base. To ensure emergency actions do not put undue financial strain on electric utilities, the industry supports mechanisms for recovering costs. In addition, electric utilities support liability protections for actions taken under an emergency order.



THIS PAGE INTENTIONALLY LEFT BLANK



Putting SCADA Protection on the Radar



Putting SCADA Protection on the Radar | SecurityWeek.Com Page 2 of 9

o Compliance a Privacy ® Whitepapers

^ Security Infrastructure o Cloud Security o Identity & Access a Data Protection o White Papers o Network Security o Application Security

■* Management & Strategy o Risk Management e Security Architecture c Disaster Recovery c Incident Management ° Training & Certification

o Black Hat Home > Network Security

Putting SCADA Protection on the Radar

By Marc Solomon on May 17, 2012 ^ S h .i.e 10 ’1 3 Tweet y G |

http://www.securityweek.com/putting-scada-protection-radar 4/22/2013


http://www.securityweek.com/putting-scada-protection-radar


Putting SCADA Protection on the Radar | SecurityWeek.Com Page 3 of 9

SC A D A Networks are the M ost Unprotected Networks o f All and Now A ttackers Have Them inTheir Sights.

Recent high-profile compromises point to an urgent need to secure process control networks. Stuxnet, a purpose-built worm for attacking industrial control systems, led the way in showing just what can be done by a professional team. More recently, Duqu entered the threat landscape enabling attackers to steal data from manufacturers of industrial control systems and use that data to exploit entities using these systems.

Why are these networks under attack? Most large organizations are serious about security. They run specialized departments tasked with protecting two key networks: data center (servers) and office automation (workstations). These networks are essential for supporting the business processes throughout the organization. However a “third network,” the process control network, has yet to receive the same attention.

Often referred to as SCADA (supervisory control and data acquisition) networks due to their association with industrial processes, these networks connect equipment rather than computers and support systems rather than people. In sectors such as utilities, transportation, logistics, manufacturing and pharmaceuticals, these networks are critical to the operation of the organization. In utilities, they are so important as to be considered part of the national critical infrastructure. In logistics, they route millions of parcels a day. But in other companies this network operates behind the scenes, quietly mediating access to buildings, controlling heating and ventilation, elevators and data center cooling.

SCADA networks are the most unprotected networks o f all and now cyber-criminals have them in their sights. If they get access, the consequences for many organizations, their customers and perhaps the population at large, could be extremely damaging.

W hat makes these networks more vulnerable?

• Attacks are becoming more sophisticated as motives move away from amateur glory seeking, to politics in the form of ‘hactivism,’ espionage and nation-state aggression. Advanced persistent threats—the professionals— are driving a new level of stealthy and complex attacks that are difficult to discern let alone disarm.

• Networks are becoming more connected as the business hungers for data to drive decisionmaking and suppliers Internet-enable everything in order to drive down support costs and increase customer retention. • Designed in a different time, process control networks have been considered inherently safe and often do not include security basics. When released by systems vendors, patches are difficult to apply due to system availability requirements.

• The SCADA network is often ‘invisible’ and lacks the attention and investment to raise the level of security commensurate with increased threats.

• In most organizations process control engineers manage the process control network while the IT department runs the other networks. The two groups have separate mandates and priorities.

Given the typical separate of duties, when considering security solutions organizations should shift their “IT security” mindset to account for the unique requirements and priorities of process control engineers charged with managing the SCADA network. First, security tools should not interfere with dosed loop processes that could pose a risk to control. Second, availability/uptime is the most important goal of the network. Third, regular password change policies could endanger a plant,





Putting SCADA Protection on the Radar j SecurityWeek.Com Page 4 of 9

locking engineers out o f a system. And, fourth, security tools that require direct Internet access are not viable— many control networks are tightly firewalled from the Internet.

At the same time, process control networks have various areas of vulnerability that must be protected. The Human Machine Interface (HMI), process servers and historians are typically MS-Windows based and are potential entry points for any attacker coming in via the corporate network and using known exploits. The Remote Tenninal Units (RTUs) and Programmable Logic Controllers (PLCs) are often proprietary and require sophisticated knowledge o f the control system in order to penetrate, as demonstrated by Stuxnet and Duqu.

The following guidelines should help organizations identify security solutions that respect the requirements and priorities of the process control network environment while enhancing protection. Specifically, organizations should consider solutions that can:

• Provide the flexibility to operate in passive mode or in-line without interrupting closed-loop processes, even in the event of a software, hardware or power failure

• Support a vast rule library and an open rule format in order to accept SCADA rule sets, rules provided by government agencies, other third-party rules and proprietary rules unique to an organization’s own network

• Control network usage by application, user and group as an ideal way of segregating control network zones for maximum flexibility

• Provide passive asset discovery, automatic impact assessment and rules tuning to take corrective action only on threats that are relevant to an organization’s specific network

• Offer centralized monitoring and management to unify critical network security functions, streamline administration and expedite response

Process control networks are mission critical and security is of paramount importance. Increasingly on the radar of sophisticated attackers, it’s time for the SCADA network to be on the radar of management and get the organizational attention, and protection, it deserves.

Related Reading: A New Cyber Security Model for SCADA

SiCURITYWEEK BRIEFING Be Informed. Subscribe Free

Marc Solomon, Sourcefire’s Chief Marketing Officer, has over 15 years of experience defining and managing software and software-as-a-service platforms for IT Operations and Security. He was previously responsible for the product strategy, roadmap, and leadership of Fiberlink’s MaaS360 on- demand IT Operations software and managed security services. Prior to Fiberlink, Marc was Director of Product Management at McAfee, responsible for leading a S650M product portfolio. Before McAfee. Marc held various senior roles at Everdream (acquired by Dell), Deloitte Consulting and HP Marc has a Bachelor's degree from the University of Maryland, and an MBA from Stanford University.Previous Columns by Marc Solomon:





JEA victim of cyber attack



JEA victim of cyber attack | News - Home Page 1 of 2

JEA victim of cyber attack

Jacksonville-owned utility's website, email, automated phone systems down

Published On: Feb 19 2013 10:10:59 AM EST Updated On: Feb 19 2013 11:20:00 PM EST

JACKSONVILLE, Fla. -

JEA's website, Internet communications and automated phone systems are down due to what the city-owned utility is calling a denial-of-service attack.

Spokeswoman Gerri Boyce said that JEA.com has been inundated with data since midnight Sunday. Visits to the website return various error messages, including that there are network connectivity problems or the site is unavailable or too busy. Company emails are also affected.

Boyce said the attack has also taken down JEA's email and automated phone systems.

"What this person is doing or however it is, they are pushing tons and tons of data through the system, so it closes down," Boyce said. "It is an attack on our system."

http://www.news4jax.eom/news/JEA-victim-of-cyber-attack/-/475880/18982700/-/view/pr... 4/22/2013


http://www.news4jax.eom/news/JEA-victim-of-cyber-attack/-/475880/18982700/-/view/pr


JEA victim of cyber attack | News - Home Page 2 of 2

Payments or electric and water bills are being accepted at JEA's downtown office, the tax collector's office, Winn-Dixie stores and other third-party locations. JEA customer care employees are available by phone, but wait times may be longer than usual.

The downtown JE A office was flooded Tuesday with concerned customers who found it impossible to pay their bills or review their accounts online.

"This morning when I tried to log on, I had to call, and they said everything is down, phone systems, billing systems," JEA customer Lori Dotson said.

Boyce said orders for disconnects due to non-payment have been suspended during the outage.

Boyce said customers' personal information is not in jeopardy as a result of the security breach, but customers are skeptical.

'Yeah, I don't think anything is safe these days," Kenneth Smith said.

"It would be highly unlikely that internal data has been compromised," computer expert Christopher Hamer said. "This is the equivalent to trying to have a conversation with someone right in front of you and having five or six people yelling at you with a bullhorn."

Hamer said cyber attacks are remotely controlled to assault a website. He suspects a disgruntled JEA customer may be to blame.

"It is criminal, yes, but it's not difficult to do," Hamer said. "It's offered as a service in the dark belly of the Internet."

As of Tuesday afternoon, JEA did not have an estimated day or time its systems will be operational again.

Copyright 2013 by News4Jax.c0m. A ll rights reserved. This material may not be published, broadcast, rewritten or redistributed.

© 2013 © 2011

http://www.news4jax.eom/news/JEA-victim-of-cyber-attack/-/475880/18982700/-/view/pr... 4/22/2013


http://www.news4jax.eom/news/JEA-victim-of-cyber-attack/-/475880/18982700/-/view/pr


Rockefeller asks Fortune 500 CEOs to weigh in on

cybersecurity debate



Rockefeller asks Fortune 500 CEOs to weigh in on cybersecurity debate - The Hill's Hilli... Page 1 of 2

T H E ifO L L

Hillicon ValleyTHE HILL’S Technology Blog

Rockefeller asks Fortune 500 CEOs to weigh in on cyber security debateBy Jennifer Martinez - 0 9 /19 /1 2 10:33 AM ET

Sen. Jay Rockefeller (D-W.Va.) on Wednesday sent letters to every CEO o f Fortune's top 500 companies — including Apple, Cisco, Amazon, Oracle and Google — asking them to outline what measures their companies have in place to protect their computer systems from cyberattacks.

Rockefeller said he wanted to hear the chief executives' views "without the filter of Beltway lobbyists" and argued that a cybersecurity bill by Sen. Joe Lieberman (I-Conn.) was filibustered last month "largely due to opposition from a handful of business lobbying groups and trade associations, most notably the United States Chamber o f Commerce."

"I would be surprised to leam that many other American companies, most of which recognize that what is good for their bottom lines is also good for the country's national and economic security, are as intransigently opposed to our cybersecurity legislative efforts as the Chamber of Commerce has indicated they are," Rockefeller wrote.

He provided a set of eight questions for the CEOs to answer by Oct. 19. Among the questions, Rockefeller asked what best practices the companies have in place to protect their computer systems and networks, if a company or government helped the company craft these best practices and whether the security measures have been updated.

T r a s h b in s t h a t c a ll f o r t h e i r o w n p ic k u p .m o w n p ic k u p .

I f •' w b - LEARN HOW

* e jfe Wireless Is Limitless• A

■ h e ; ;■ fs iS fe j i t t

- I Pf - -cita 'Americas wireless companies

But he also asked the chief executives to state their views on Lieberman's Cybersecurity Act, including fisting concerns they have with a voluntary program established in the bill that would

http://thehill.com/blogs/hillicon-valley/technology/250335-rockefeller-asks-ceos-of-500-to... 4/22/2013


http://thehill.com/blogs/hillicon-valley/technology/250335-rockefeller-asks-ceos-of-500-to


Rockefeller asks Fortune 500 CEOs to weigh in on cybersecurity debate - The Hill's Hilli... Page 2 of 2

enable the government and industry to work together to develop cybersecurity best practices. Companies would then choose whether to meet them.

Senate Republicans have argued that the voluntary security standards would serve as a backdoor for regulatory agencies to adopt burdensome new rules for businesses to follow.

Rockefeller was a co-sponsor o f the Lieberman bill and has continued to push for the government to beef up the nation’s cybersecurity after Senate Republicans blocked the Cybersecurity Act last month, He sent a letter to the White House urging President Obama to issue an executive order that would establish a voluntary program in which companies operating critical infrastructure would make sure their computer systems and networks meet a set o f security standards.

In his letter to the CEOs, Rockefeller included statements from National Security Agency Director Keith Alexander and Gen. Martin Dempsey, chairman o f the Joint Chiefs of Staff, that called on Congress to act now and pass legislation that would protect the country from the growing cyberthreat.

"Yet for some reason I do not understand, the Chamber of Commerce and other business lobbying groups opposed our plan to create a voluntary program that would empower the private sector to collaborate with the federal government to develop dynamic and adaptable voluntary cybersecurity practices for companies to implement as they see fit," Rockefeller wrote.

"This private sector-led approach strikes me as one that companies would want to have codified in statute, rather than risking reactive and overly prescriptive legislation following a cyber disaster," he added.

Source:http://thehili.com /blogs/hillicon-vallev/technology/250335-rockefeller-asks-ceos-of-5QQ-ton-us- com panies-for-view s-on-cvbersecuritv


http://thehili.com/blogs/hillicon-vallev/technology/250335-rockefeller-asks-ceos-of-5QQ-ton-us-


Letter to SCE from Representatives Markey and Waxman



Congress of tlje United sta tesiffia a ^in g tn n , 3!© 205X5

January 17,2013

To Whom It May Concern:

We write to request information regarding your entity’s efforts to ensure that your electric grid assets are protected from a cyber or physical attack or geomagnetic storm. We ask that you provide responses to the following questions from your entity and, if applicable, separately from each of your U.S. subsidiaries that own or operate pieces o f the bulk power system. We further request that you submit your response electronically if possible to each of the staff members listed below no later than Friday, February 15,2013. If you have questions or concerns, please contact Michal Freedhoff (Rep. Markey, 202-225-2836 or [email protected]') or Jeff Baran (Rep. Waxman, 202-225-4407 or ieff.baran@mail■house■gov,).


Sincerely,

Ranking MemberHouse Natural Resources Committee

Ranking MemberHouse Energy & Commerce Committee

PRIN TED O N R EC YC LED PAPER


Questions

1) What is the name of the entity for which these responses are being submitted and how much electricity did the entity generate in 2012?

2) In September 2010, the North American Electric Reliability Corporation (NERC) issued twelve recommendations to address vulnerabilities to the Stuxnet computer worm.a) Five o f those recommendations were eventually included in mandatory Federal Energy

Regulatory Commission (FERC) Critical Infrastructure Protection (CIP) standards. How many of these five recommendations have been fully implemented by your entity? If they have not been implemented, why not?

b) The remaining seven recommendations are not currently mandated by any FERC CIP standard. How many of these seven recommendations have been implemented by your entity? If they have not been implemented, why not?

3) On October 13, 2010, in response to the Aurora malware threat to the grid, NERC issued i) nine recommendations and four options related to protection and control engineering practices, ii) five mitigation measures to address electronic and physical security, iii) nine examples of ways to address access control, iv) suggested actions related to monitoring and reporting, v) suggested actions on training, vi) suggested actions and three examples of means to conduct personnel risk assessments and vii) suggested action and three examples related to information protection to its members. None o f these have been included or proposed to be included in a mandatory FERC CIP standard. How many of these recommendations, options and suggested actions have been fully implemented by your entity? If they have not been implemented, why not?

4) On March 31, 2010, NERC issued twenty-five recommendations to address an FBI warning it received related to the ability of cyber-intruders to remotely gain access to utility assets.

a) Eight of those recommendations were eventually proposed for inclusion in a mandatory FERC CIP standard. How many o f these eight recommendations have been fully implemented by your entity? If they have not been implemented, why not?

b) The remaining seventeen recommendations are not currently planned for inclusion in any FERC CIP standard. How many of these seventeen recommendations have been implemented by your entity? If they have not been implemented, why not?

5) For each of the past five years, please indicate how many additional notices related to grid security containing a) Recommendations and b) Essential Actions were received by your entity from NERC. For each such notice, please indicate i) the type of notice, ii) the degree to which the notice related to grid security, iii) how many actions were included as part of



each notice, and iv) how many o f these recommended actions have been fully implemented by your entity. (If any o f the actions have not been implemented because they are not applicable to your entity, please also indicate this in your response.)

6) More recently, other cyber-vulnerabilities that could pose risks for the grid have emerged. These include but are not limited to vulnerabilities to computer malware including Flame, Shamoon, and Gauss. For each of these vulnerabilities, please describe what steps your entity has taken to protect the entity’s assets against the vulnerability. If you have not taken any measures, why not?

7) Does your entity currently utilize security protocols, special measures or other hiring practices to assess whether current and/or prospective employees could pose an insider cyber-security threat? If so, please describe them. If not, why not?

8) Are there any functions or job duties that you do not permit foreign nationals to undertake at your entity? If so, please list these functions or job duties.

9) How many large transformers (meaning an electric transformer that is part o f the bulk-power system) does your entity utilize? How many large transformers does your entity have contractual access to in the event that any of the large transformers utilized by your entity are rendered inoperable by a cyber-attack, accident or natural disaster? How many other entities could have similar competing claims to the same large transformers in the event of a wide-spread cyber-attack, accident or natural disaster?

10) In each o f the past five years, please indicate whether your entity has been subjected to one or more attempted or successful physical or cyber-attack. For each year, please list a) the number o f attempted physical attacks on your entity, b) the number o f attempted cyber attacks on your entity, c) whether any such attack caused significant damage (and if so, please describe the nature o f both the attack and the damage caused), d) how many attacks were reported to FERC, NERC, DHS, or other authority (and identify which authority in each case), and e) what measures were taken to prevent future similar attacks from taking place.

11) Please describe any steps your entity has taken to protect against the effects o f geomagnetic storms.

12) For each of the past five years, please indicate a) how many individuals working for your entity had as one o f their primary responsibilities efforts to protect your entity against cyberattacks and b) the title of the individual with primary authority over your entity’s cybersecurity efforts.



13) Has your entity identified and documented all the critical cyber assets under its ownership or control based on the “bright line” criteria for identifying critical assets that was approved as part o f the Version 4 CIP reliability standards? If not, when do you plan to complete the process of identifying and documenting critical cyber assets?

14) Do you believe that the current FERC CIP standards are adequate to protect against all known grid security vulnerabilities? Why or why not?

15) Does your organization conduct simulations of cybersecurity breaches or other exercises to assess the potential impacts of a cyber-attack on your entity’s assets as well as on the adequacy o f your entity’s protocols for responding to such an attack? If so, please describe your simulations and indicate their frequency. If not, why not?



Improving the Security of the Nation’s Critical Infrastructure



Second, it directs federal agencies to provide timely notification to companies if we have information indicating that a company is the target or victim of a cyber intrusion. Finally, the Executive Order directs DHS to expedite the processing of clearances for appropriate state and local government and private sector personnel to enable the federal government to efficiently share cyber threat information at the sensitive and classified level.

Cybersecurity Framework: The Executive Order directs the National Institute of Standards and Technology (NIST) to lead the development of a framework to reduce cyber risks to critical infrastructure. NIST will work with industry to identify existing voluntary consensus standards and industry best practices to incorporate into the framework.

The Administration recognizes that there are private-sector cyber leaders in our critical infrastructure sectors who are already implementing strong cybersecurity controls, policies, and procedures. Rather than burdening such organizations with more to do. the Executive Order puts these innovators at the core of informing and driving the development of voluntary best practices for the framework. In this way, we can distil common cybersecurity practices from the experts that know them best and leverage them to improve the security of the Nation's critical infrastructure.

The framework does not dictate “one-size fits all" technological solutions. Instead, it promotes a collaborative approach to encourage innovation and recognize the differing needs among critical infrastructure sectors. Organizations who want to upgrade their cybersecurity will have the flexibility to decide how best to do so using a wide range of innovative products and services available in the marketplace.

Privacy and Civil Liberties Protections: The Executive Order reflects the Administration's deep commitment to ensuring that processes for sharing cyber threat and incident information between the federal government, state, and local government, and private companies incorporates rigorous protections for individual privacy and civil liberties. Accordingly, the Executive Order directs departments and agencies to incorporate privacy and civil liberties protections into cybersecurity activities based upon widely-accepted Fair Information Practice Principles, and other applicable privacy and civil liberties frameworks and polices. The Executive Order also requires regular privacy assessments and public reporting of any privacy and civil liberties impacts.

More Action is Needed: This Executive Order represents an important step in improving cybersecurity protections for our critical infrastructure, and reflects recommendations from

many different groups, including the bi-partisan Commission on Cybersecurity for the 44th Presidency and the Recommendations of the House Republican Cybersecurity Task Force. However, more is needed. Executive action alone cannot create the new tools and authorities needed to meet the Nation's collective cybersecurity challenges. The Administration continues to urge Congress to pass legislation to more fully address our Nation's cybersecurity needs.

For decades, industry and all levels of government have worked together to protect the physical security of critical assets that reside in private hands - from airports and seaports to national broadcast systems and nuclear power plants. Similarly, we must now work in partnership to protect the cyber critical infrastructure systems upon which so much of our economic well-being, national security, and daily lives depend.

As we have made clear, industry has a significant role to play as well. As a first step, I would urge Chief Executive Officers (CEOs) to ask their team these five questions and ensure that they are satisfied with the answers. Additionally, I ask that industry, academia, the advocacy community, and all who are interested, participate in the NIST process to develop the Cybersecurity Framework. Visit NIST's website to view NISTs request for information (RFI) and find out how to participate.

As the President's Cybersecurity Coordinator, I look forward to engaging all stakeholders in this important national mission.

Michael Daniel is Special Assistant to the President and Cybersecurity Coordinator

Related Topics: Homeland Security

http ://www.whitehouse.gov/blog/2013/02/ 13/irnproving-security-nation-s-critical'infrastru,., 4/22/2013


http://www.whitehouse.gov/blog/2013/02/13/irnproving-security-nation-s-critical'infrastru


Cybersecurity & IT Compliance FERC Account 920/921




FERC Account: 920,921 Administrative and General Salaries/Office Supplies and Expenses

Activity: CYBERSECURITY & COMPLIANCE 920-921

Witness: Glenn R. Haddox


2012$ (000)

Recorded2012

Forecast2015

Labor Last Recorded Year Adj. 5,254 7,529Non-Labor Last Recorded Year Adj. 1,224 11,494Other N/A 0 0Total 6,478 19,023


This activity is used to record costs associated with maintenance activ ities provided by Cybersecurity & Compliance. Costs recording in FERC Accounts 920-921 are SCE labor, office supplies, t-avel, training, and software licenses.

See Appendix C for Final Cost Centers included in this activity.



FERC Account: 920,921 Administrative and General Sala ries/Office Supplies and Expenses



DETERMINATION OF RECO RDED/ADJUSTED

\ Recorded Pe riod$ (000)


Labor 4,451 4,025 4,830 4,819 5,254Non-Labor r ,863 3,899 4,558 2,512 1,224Other 0 0 0 0 0Total 6 ,314 7,924 9,388 7,331 6,478

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 2 0 0 0 0Non-Labor 311 7 (2) 5 0Other 0 0 0 0 0Total 313 7 (2) 5 0

Recorded/Adjusted (Nominal $)Labor 4 ,453 4,025 4,830 4,819 5,254Non-Labor 2,174 3,906 4,556 2,517 1,224Other 0 0 0 0 0Total 6 ,627 7,931 9,386 7,336 6,478

E scalation :Labor 1. 1414 1.1070 1.0701 1.0327 1.0000

Non-Labor 1.0932 1.0743 1.0518 1.0240 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

Recorded/Adjusted (Constant 2012$)Labor 5,083 4,456 5,168 4,977 5,254Non-Labor 2,377 4,196 4,792 2,577 1,224Other______________________ 0_________ 0_________ 0_________ 0________ 0Total 7,460 8,652 9,960 7,554 6,478

10,000

8,000

6,000

4.000

2.000

0



2008 2009 2010 2011 2012



FERC Account: 920,921 Administrative and General Salari es/Office Supplies and Expenses





COoCM roCM 2015 | sd** | ChosenLabor 5,115 5,115 5,115 139 noNon-Labor 1,901 1,901 1,901 677 noOther 0 0 0 0 noTotal 7,016 7,016 7,016 n/a n/a


COoCM roCM 2015 | r2* 1 Chosen 2013 | 2014 | 2015 | sd** | ChosenLabor 5,219 5,261 5,304 0.09 no 5,133 5,133 5,133 116 noNon-Labor (703) (2,487) (4,271) 0.98 no 2,864 2,864 2,864 1,471 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 4,516 2,774 1,033 n/a n/a 7,997 7,997 7,997 n/a n/a




COoCM roCM 2015 | sd** | Chosen5,515 5,735 5,955 0.63 no 4,964 4,964 4,964 310 no

414 (699) (1,812) 0.79 no 3,197 3,197 3,197 1,398 no0 0 0 0.00 no 0 0 0 0 no

5,929 5,036 4,143 n/a n/a 8,161 8,161 8,161 n/a n/a




COoCM roCM 2015 | sd** | Chosen5,247 5,333 5,419 0.19 no 4,987 4,987 4,987 281 no1,856 1,463 1,071 0.18 no 3,033 3,033 3,033 1,293 no

0 0 0 0.00 no 0 0 0 0 no7,103 6,796 6,490 n/a n/a 8,020 8,020 8,020 n/a n/a

Other Methods:





0 0 0 no 0 0 0 no6,478 6,478 6,478 n/a 0 0 0 n/a



Method

COoCM roCM 2015 |

COoCM roCM 2015 | |LRY 5,254 5,254 5,254 997 1,547 2,275LRY 1,224 1,224 1,224 5,133 6,854 10,270N/A 0 0 0 0 0 0

6,478 6,478 6,478 6,130 8,401 12,545

* r2 = R Squared (Based on recorded years data)** sd = standard deviation (Based on recorded years data)*** See Appendix B For Additional Detail







Method SelectedLOoCM^roCMCOoCM

Labor Last Recorded Year Adj. 6,251 6,801 7,529Non-Labor Last Recorded Year Adj. 6,357 8,078 11,494Other N/A 0 0 0Total 12,608 14,879 19,023


Analysis of Linear Trending Method:In D.89-12-057, the CPUC stated that if costs have shown a trend in a certain direction over three or more years, the last year recorded is an appropriate base estimate. For this account, labor costs have been relatively stable. Non-labor costs were increasing or stable from 2008-2010 and during 2011 -2012 decreased which does not result in a clear trend. For that reason, linear trending is not appropriate forecasting method.

Analysis of Averaging Method:In D.89-12-057, the CPUC stated that for those accounts which have significant fluctuations in recorded expenses from year to year, an average of recorded expenses is appropriate. For this account , labor costs have been relatively stable. For 2011-2012, non-labor decreased not resulting in a clear trend. Recorded costs in this account have fluctuated significantly from year to year, and the averaging methodology would have been appropriate but last recorded year methodology best represents the expense pattern we anticipate for 2015.

Analysis of Last Recorded Year (2012):In D.89-12-057, the CPUC stated that if costs have shown a trend in a certain direction over three or more years or is relatively stable, the last recorded year is an appropriate base estimate. Labor costs have been relatively stable during the recorded period and even though historical recorded data indicates an averaging methodology would be the most likely basis for a forecast of non-labor costs, we have chosen the last recorded year as it best represents the expenses we anticipate beginning in 2015. To that base we have added the increments discuss ed elsewhere in these workpapers and our testimony.








0 ----- ,----- ,----- ,----- ,----- rj--------------- ,----- ,--------------2008 2009 2010 2011 2012 2013 2014 2015


Recorded Period$(0 00)

Forecast Expenses (constant 2012$) 2008 | 2009 | 2 0 10 | 2011 | 2012 2013 | 2014 | 2 0 1 5Labor (standard escalation) 5,083 4,456 5,168 4,977 5,254 6,251 6,801 7,529Non-Labor (standard escalation) 2,377 4,196 4,792 2,577 1,224 6,357 8,078 11,494Other (not escalatable) 0 0 0 0 0 0 0 0Total 7,460 8,652 9,960 7,554 6,478 12,608 14,879 19,023

Labor Prior year Total 5,254 6,251 6,801Change 997 550 728Total 5,254 6,251 6,801 7,529

Non-Labor Prior year Total 1,224 6,357 8,078Change 5,133 1,721 3,416Total 1,224 6,357 8,078 11,494


Total Change |Labor 997 550 728Non-Labor 5,133 1,721 3,416Other 0 0 0Total N/A 6,130 2,271 4,144






This page shows the changes in Labor, Non-Labor, and Other expenditures forecast during 2013 through 2015, including reasons for the addition of personnel (labor), increased office supplies required due to an increase in activity (non-labor).

2012 - 2013

Labor: 997

The increase in the labor forecast is primarily driven by additions to the workforce supporting Cyber Engineering which is detailed in testimony (SCE-05, Vol 1) . See Appendix B.

Non-Labor: 5,133

The increase in the non-labor forecast is driven by contracts for tools and testing which is detailed in the testimony (SCE-05, Vol 1). See Appendix B.

Other: 0

Not applicable.




Activity: CYBERSECURITY & COMPLIANCE 920-9 21



2013 - 2014

Labor: 550

The increase in the labor forecast is primarily driven by additions to the workforce supporting Cyber Engineering which is detailed in testimony (SCE-05, Vol 1) . See Appendix B.

Non-Labor: 1,721


Other: 0

Not applicable.







2014 - 2015__________________________________________________________________________________

Labor: 728

The increase in the labor forecast is primarily driven by additions to the workforce supporting Cyber Engineering. See Appendix B.

Non-Labor: 3,416


Other: 0

Not applicable.



FERC Account:

Activity:

Witness:

920,921 Administrative and General Sala ries/Office Supplies and Expenses

CYBERSECURITY & COMPLIANCE 920-921

Glenn R. Haddox

APPENDIX A






Activity: CYBERSECURITY & COMPLIANCE 920-9 21



* S e e A ppendix C for Su m m ary F in al C o st C en ters________________________________

*SUMMARY NON CHARGEBACK BUSINESS & INFORMATION CONTINUITYIncludes salaries, personal expenses, and miscellaneous costs for Business and Information Continuities.

F300152 TECHNOLOGY AND RISK MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Technology and Risk Management.

F300164 RISK MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Risk Management.

F300165 INFORMATION SECURITY (GOVERNANCE)Includes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for Information Security Governance.

F300166 SECURITY PROGRAMS & SERVICESIncludes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for Security Programs and Services.

F300299 PROCESS MANAGEMENT COMPLIANCE & CONTROLSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Process Management Compliance and Controls.

F300302 QUALITY ASSURANCEIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Quality Assurance.

F525006 SOFTWARE LICENSE & MAINTENANCE - PLANVIEWIncludes software license and maintenance expenses for Planview.

F525011 SOFTWARE LICENSE & MAINTENANCE - INFORMATION SECURITYIncludes software license and maintenance expenses for Information Security.

F525012 SOFTWARE LICENSE & MAINTENANCE - SECURITY PROGRAMSIncludes software license and maintenance expenses for Security Programs.

F528129 COMPLIANCE ASSESSMENTSIncludes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for Compliance Assessments.

F528388 EXTERNAL REQUIREMENTS & ANALYSISIncludes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for External Requirements & Analysis.

F800272 REFERENCE ARCHITECTUREIncludes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for Reference Architecture.







* S e e A ppendix C for Su m m ary F in al C o st C en ters_________________________________

F800275

F800277

F800278

F800287

SECURITY PROGRAM AND SERVICESIncludes salaries, employee expenses, offi ce supplies and additional miscellaneous costs for Security Program and Services.

SYSTEM INTEGRATOR - DIVISION SUPPORT (GOVERNMENT)Includes salaries, employee expenses and miscellaneous cost for Technology and Risk Management Division support related activ ities.

SOLUTIONS CONSULTING SERVICESIncludes SCE and supplemental labor emp loyee expenses and miscellaneous non-labor costs related to the Enterprise Architecture activ ities in the Technology and Risk Management organization.

STRATEGIC INTEREST DIRECTORIncludes salaries, personal expense and miscellaneous costs for Strategic Integration Director.

F800290 TECHNICAL SERVICES MANAGERIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Technical Services Manager.







$ (000)* S e e A ppendix C for Su m m ary F in al C o st C en ters 2008 2009 2010 2011 2012

*SUMMARY NON CHARGEBACK BUSINESS & INFORMATION CONTINUITY

21 0 0 0 0

F300152 TECHNOLOGY AND RISK MANAGEMENT 1,876 4,190 2,930 1,523 746

F300164 RISK MANAGEMENT 431 412 416 304 253

F300165 INFORMATION SECURITY (GOVERNANCE) 1,281 980 2,165 1,769 1,498

F300166 SECURITY PROGRAMS & SERVICES 963 1,331 1,861 1,383 1,041

F300299 PROCESS MANAGEMENT COMPLIANCE & CONTROLS

1,134 195 294 581 1,107

F300302 QUALITY ASSURANCE 1,210 1,233 1,541 1,668 908

F525006 SOFTWARE LICENSE & MAINTENANCE - PLANVIEW

1 0 85 0 0

F525011 SOFTWARE LICENSE & MAINTENANCE - INFORMATION SECURITY

44 100 84 219 58

F525012 SOFTWARE LICENSE & MAINTENANCE - SECURITY PROGRAMS

293 212 583 108 150

F528129 COMPLIANCE ASSESSMENTS 0 0 0 0 4

F528388 EXTERNAL REQUIREMENTS & ANALYSIS 0 0 0 0 713

F800272 REFERENCE ARCHITECTURE (26) 0 0 0 0

F800275 SECURITY PROGRAM AND SERVICES 8 0 0 0 0

F800277 SYSTEM INTEGRATOR - DIVISION SUPPORT (GOVERNMENT)

76 0 0 0 0

F800278 SOLUTIONS CONSULTING SERVICES 8 0 0 0 0

F800287 STRATEGIC INTEREST DIRECTOR 143 0 0 0 0

F800290 TECHNICAL SERVICES MANAGER (4) 0 0 0 0

Total 7,459 8,653 9,959 7,555 6,478

* * D u e to rounding, to tals m a y n ot tie to o th er w orkpaper p a g e s .



FERC Account:

Activity:

Witness:

920,921 Administrative and General Salaries/Office Supplies and Expenses


Glenn R. Haddox

APPENDIX B






Activity: C Y B E RSECURITY & COMPLIANCE 920-921


Detail of Total Company Adjustments to Recorded Expenses

| Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

LaborNon-LaborOther

2311

0

070

0(2)

0

050

000

9975,133

0

1,5476,854

0

2,27510,270

0Total 313 7 (2) 5 0 6,130 8,401 12,545

Organizational Unit Adjustment 1 A&G IT-KWK-OU-FYA C&C MGMT INCREASE

This future year adjustment is for Cybersecurity & Compliance M anagement increases.

Labor 0 0 0 0 0 457 457 457Non-Labor 0 0 0 0 0 3,378 3,344 3,344Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 3,835 3,801 3,801

Organizational Unit Adjustment 2 A&G IT-KWK-OU-FYA IT C&C ENGINEERING INCRESES

This is the future year adjustment for Cybersecurity & Compliance Engineering increases.

Labor 0 0 0 0 0 540 945 1,205Non-Labor 0 0 0 0 0 842 842 3,413Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 1,382 1,787 4,618

Organizational Unit Adjustment 3 A&G IT-KWK-OU-FYA IT C&C SW LIC. & MNT

This is the future year adjustment for Cybersecurity & Complianc e Software Licenses and Maintenance increases.

Labor 0 0 0 0 0 0 0 0Non-Labor 0 0 0 0 0 678 2,433 3,278Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 678 2,433 3,278

Organizational Unit Adjustment 4 A&G IT-KWK-OU-FYA IT C&C RISK MGMT & POLICIES INCREASES

This is the future year adjustment for Cybersecurity & Compliance Risk Management & Policies increases.

Labor 0 0 0 0 0 0 145 405Non-Labor 0 0 0 0 0 235 235 235Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 235 380 640




Activity: C Y B E RSECURITY & COMPLIANCE 920- 921



Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Organizational Unit Adjustment 5 A&G IT-KWK-OU-FYA IT C&C COMPLIANCE INCREASES

This is the future year adjustment for Cybersecurity & Complianc e Compliance increases.


Organizational Unit Adjustment 6 A&G IT-KWK-OU-TRM 923 TO CC 920921

This adjustment transfers expenses from Technology & Risk Management 923 to Cybersecurity & Compliance 920-921 to reflect current charging practices.

Labor 2 Non-Labor 204 Other 0

000

000

000

0 0 0 0 0 0

0 0 0 0 0 0

Total 206 0 0 0 0 0 0 0

Organizational Unit Adjustment 7 A&G IT-KWK-OU-MAPCORRECT-F800315

This adjustment transfers portion of expenses that were incorrectly mapped to Infrastructure Technology Services 923to respective IT FERC accounts.


Organizational Unit Adjustment 8 A&G FINC-RSL.KWK-OUX-TRNSFR EMS SALES TAX

This adjustment transfers material supplies recorded in Participa nt Credits 930 to the appropriate Operating Units.


Organizational Unit Adjustment 9 A&G IT-KWK-OU-HR926TOITACEPOINTS

This adjustment transfers 2008 employee reward (ACE) points to respective IT Activities.





Activity: CYB ERSECURITY & COMPLIANCE 920-921



Adjs - (Nominal $) $ (0 00)2008 2009 201 0 2011 2012 2013 2014 2015

Organizational Unit Adjustment 10 A&G IT-KWK-OU-SHAREHOLDER COSTS

This adjustment removes dues, donations and shareholder expe nses from recorded history.

Labor 0 0 0 0 0 0 0 0Non-Labor (3) (3) (4) 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total (3) (3) (4) 0 0 0 0 0



FERC Account:

Activity:

Witness:


CYBERSECURITY & COMPLIANCE 920 -921

Glenn R. Haddox

APPE NDIX C

F in a l C o s t C e n t e r s







Final Cost Centers included in this activity:

*Summary Final Cost Centers:

NON CHARGEBACK BUSINESS & INFORMATION CONTINUITYF800264 F800266






Individual Final Cost Centers:

F300152 F300164 F300165 F300166 F300299 F300302 F525006 F525011 F525012

F528388 F800272 F800275 F800277 F800278 F8 00287 F800290

F528129





Activity:

Witness:


Glenn R. Haddox



C&C O&M Labor and Non-Labor Additions



l l i s s !

1

$5,2

54,0

00

ABU1

$6

0,69

4 AS

Y1

$60,

736

ASY

3 $9

5,95

0 ITS

4 $1

19,9

74

ITS 4

$119

,974

s ITS

2 $8

0,82

9 ITS

1

$64,

126

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

MPP2

$1

30,7

70 . 1 1 1 1 1 1 1 a 1 1

1 1s.£

I

$5,2

54,0

00

ABU1

$6

0,69

4 AS

Y1

$60,

736

ASY

3 $9

5,95

0 ITS

4

$119

,974

ITS

4

$119

,974

s ITS

2 $8

0,82

9 ITS

1 $6

4,12

6 ITS

5 $1

40,0

67

ITS 4

$119

,974

MPP2

$1

30,7

70

ITS 5

$140

,067

ITS

5 $1

40,0

67

ITS 5

$140

,067

ITS

4 $1

19,9

74

ITS 5

$140

,067

ITS

4 $1

19,9

74

ITS

2 $8

0,82

9 ITS

1 $6

4,12

6 ITS

5 $1

40,0

67

ITS 4

$119

,974

s *

£

1

$5,2

54,0

00

ABU1

$6

0,69

4 AS

Y1

$60,

736

ASY

3 $9

5,95

0 ITS

4

$119

,974

ITS

4

$119

,974

<

ITS

2 $8

0,82

9 ITS

1

$64,

126

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

i ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

ITS

2 $8

0,82

9 ITS

1

$64,

126

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

si ; l £ &

1

$5,2

54,0

00

ABU1

$6

0,69

4 AS

Y1

$60,

736

ASY

3 $9

5,95

0 ITS

4 $1

19,9

74

ITS 4

$119

,974

<

1 1 !

ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

ITS

2 $8

0,82

9 ITS

1

$64,

126

1

i

1

! 1 S I 1 I !

< < < - -<

ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

5 $1

40,0

67

ITS

4 $1

19,9

74

s s'

III-IIII s I

-

l ! : !

S

iii

ii

i iii


121Workpaper - Southern California Edison / 2015 GRC - APPLICATION____________________

3



ENTERPRISE INFORMATION MANAGEMENT & ARCHITECTURE

FERC Account 920/921





Activity: ENTERPRISE INFORMATION MANAGEMENT & ARCHITECTURE 920-921

Witness: Jason M. Kelly


2012$ (000)

Recorded2012

Forecast2015



This activity is used to record costs associated with Enterprise Information Management & Architecture. Costs recording in FERC Accounts 920-921 are SCE labor, office supplies, travel, and training.


F300156 F300157 F300158 F300159 F300160 F300161 F300162 F300163 F300188 F300189

F300190 F300191 F300192 F300193 F300194 F525088 F525135 F526451 F526879 F527005

F527536 F527694 F527957 F527958 F527959 F527960









Labor 7,193 9,671 11,417 12,738 12,707Non-Labor 6,323 6,523 6,078 7,898 4,932Other 0 0 0 0 0Total 13,516 16,194 17,495 20,636 17,639

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 717 717 717 717 810Non-Labor 653 618 618 618 1,277Other 0 0 0 0 0Total 1,370 1,335 1,335 1,335 2,087

Recorded/Adjusted (Nominal $)Labor 7,910 10,388 12,134 13,455 13,517Non-Labor 6,976 7,141 6,696 8,516 6,209Other 0 0 0 0 0Total 14,886 17,529 18,830 21,971 19,726

E scalatio n :Labor 1.1414 1.1070 1.0701 1.0327 1.0000

Non-Labor 1.0932 1.0743 1.0518 1.0240 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

Recorded/Adjusted (Constant 2012$)LaborNon-LaborOtherTotal

9,0287,627

0

11,5007,672

016,655 19,172

12,9847,043

020,027

13,8958,720

022,615

13,5176,209

019,726

24.000

20.000

16,000

12,000

8,000

4,000

0


2008 2009 2010 2011 2012

□ Labor (std escl) I Non-Labor (std escl) □ Other (not escl)








COoCM ^roCM 2015 | sd** | ChosenLabor 13,706 13,706 13,706 189 noNon-Labor 7,465 7,465 7,465 1,256 noOther 0 0 0 0 noTotal 21,171 21,171 21,171 n/a n/a


2013 |

^roCM 2015 | r2* 1 Chosen 2013 | 2014 | 2015 | sd** | ChosenLabor 13,998 14,265 14,531 0.34 no 13,466 13,466 13,466 374 noNon-Labor 6,490 6,073 5,656 0.11 no 7,324 7,324 7,324 1,044 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 20,488 20,338 20,187 n/a n/a 20,790 20,790 20,790 n/a n/a





0 0 0 0.00 no 0 0 0 0 no21,448 21,873 22,299 n/a n/a 20,385 20,385 20,385 n/a n/a




COoCM roCM 2015 | sd** | Chosen15,597 16,734 17,871 0.82 no 12,185 12,185 12,185 1,776 no6,918 6,739 6,561 0.09 no 7,454 7,454 7,454 825 no

0 0 0 0.00 no 0 0 0 0 no22,515 23,473 24,432 n/a n/a 19,639 19,639 19,639 n/a n/a

Other Methods:





0 0 0 no 0 0 0 no19,726 19,726 19,726 n/a 0 0 0 n/a



Method

COoCM roCM 2015 |

COoCM roCM 2015 | |LRY 13,517 13,517 13,517 (964) (2,070) (2,457)LRY 6,209 6,209 6,209 (98) (216) (323)N/A 0 0 0 0 0 0

19,726 19,726 19,726 (1,062) (2,286) (2,780)

* r2 = R S q u a re d (B a s e d on reco rd ed y e a r s data)

* * s d = sta n d a rd deviation (B a s e d on record ed y e a r s data)

* * * S e e A ppend ix B F o r Additional D etail







Method Selected 2013 | 2014 | 2015 | |Labor Last Recorded Year Adj. 12,553 11,447 11,060Non-Labor Last Recorded Year Adj. 6,111 5,993 5,886Other N/A 0 0 0Total 18,664 17,440 16,946


Analysis of Linear Trending Method:In D.89-12-057, the CPUC stated that if costs have shown a trend in a certain direction over three or more years, the last recorded year is an appropriate base estimate. For this account, costs have not been stable. Labor and non-labor costs were increasing or stable from 2008-2011. In 2012, labor and non-labor decreased as a result of company wide Operational Excellence efforts that were put in place. For that reason, linear trending is not appropriate forecasting method.

Analysis of Averaging Method:In D.89-12-057, the CPUC stated that for those accounts which have significant fluctuations in recorded expenses from year to year, an average of recorded expenses is appropriate. For this account , costs have not been stable. Labor and non-labor costs were increasing or stable from 2008-2011. In 2012, labor and non-labor decreased as a result of company wide Operational Excellence efforts that were put in place. For that reason, averaging methodology is not appropriate forecasting method and last recorded year methodology best represents the expense pattern we anticipate for 2015.

Analysis of Last Recorded Year (2012):Even though historical recorded data indicates an averaging methodology would be the most likely basis for a forecast of labor and non-labor costs, we have chosen the last recorded year as it best represents the expenses we anticipate beginning in 2015. To that base we have added the increments discussed elsewhere in these workpapers and testimony.





Activity: ENTERPRISE INFORMATION MANAGEME NT & ARCHITECTURE 920-921


24.000

20.000

16,000

12,000

8,000

4,000

0


■■ ■ ■ ■“ ■ “

2008 2009 2010 2011 2012 2013 2014 2015



Forecast Expenses (constant 2012$) 2008 | 2009 | 20 10 | 2011 | 2012 2013 | 2014 | 2015Labor (standard escalation) 9,028 11,500 12,984 13,895 13,517 12,553 11,447 11,060Non-Labor (standard escalation) 7,627 7,672 7,043 8,720 6,209 6,111 5,993 5,886Other (not escalatable) 0 0 0 0 0 0 0 0Total 16,655 19,172 20,027 22,615 19,726 18,664 17,440 16,946

Labor Prior year Total 13,517 12,553 11,447Change (964) (1,106) (387)Total 13,517 12,553 11,447 11,060

Non-Labor Prior year Total 6,209 6,111 5,993ChangeTotal

(98) (118) (107)6,209 6,111 5,993 5,886


Total ChangeLabor (964) (1,106) (387)Non-Labor (98) (118) (107)Other 0 0 0Total N/A (1,062) (1,224) (494)






This page shows the changes in Labor, Non-Labor, and Other expenditures forecast during 2013 through 2015, including reasons for the addition of personn el (labor), increased office supplies required due to an increase in activity (non-labor).

2012 - 2013

Labor: (964)

The reduction in labor forecast is driven by savings from Operational Excellence which is detailed in testimony (SCE-05, Vol 1). See Appendix B.

Non-Labor: (98)

The reduction in the non- labor forecast is driven by saving s from Operational Excellence which is detailed in testimony (SCE-05, Vol 1). See Appendix B.

Other: 0

Not applicable.







2013 - 2014

Labor: (1,106)


Non-Labor: (118)

The reduction in the non- labor forecast is driven by savings from Operational Excellence which is detailed in testimony (SCE-05, Vol 1). See Appendix B.

Other: 0

Not applicable.






This page shows the changes in Labor, Non-Labor, and Other expenditures forecast during 2013 through 2015, including reasons for the addition of personn el (labor), increased office supplies required due to an increase in activity (non-labor).

2014 - 2015____________________________________________________________________________________

Labor: (387)


Non-Labor: (107)


Other: 0

Not applicable.



FERC Account:

Activity:

Witness:

920,921 Administrative and General Sala ries/Office Supplies and Expenses

ENTERPRISE INFORMATION MANAGEMENT & ARCHITECTURE 920-921

Jason M. Kelly

APPENDIX A


I n c lu d e d in T h is A c t i v i t y







F300156 TECHNICAL SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Technical Services.

F300157 ENTERPRISE ARCHITECTUREIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Architecture.

F300158 SOLUTIONS ARCHITECTURE AND CONS ULTING SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Solutions Architecture and Consulting Services.

F300159 PROJECT ENGINEERING SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Project Engineering Services.

F300160 TECHNICAL RESOURCES & FRAMEWORKSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Technical Resources and Frameworks.

F300161 COMPETENCY DEVELOPMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Competency Development.

F300162 REFERENCE ARCHITECTURE & SERVICE DESIGNIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Reference Architecture and Service Design .

F300163 SYSTEMS ENGINEERING & DESIGNIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Systems Engineering and Design.

F300188 ENTERPRISE PLATFORM SERVICES MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Platform Services Management.

F300189 ENTERPRISE PLATFORM SUPPORT MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Platform Support Management.

F300190 ENTERPRISE PLATFORM SERVICES SUPPORT DEVELOPMENT AND MAINTENANCEIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Platform Services Support Deve lopment and Maintenance.

F300191 ENTERPRISE APPLICATION SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Applications Support.







F300192 ENTERPRISE INFORMATION MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Information Management.

F300193 DATABASE ADMINISTRATIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Database Administration.

F300194 DATA ANALYSIS & QUALITY SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Data Analysis and Quality Services.

F525088 BUSINESS PROCESS - ENTERPRISE MANAGEMENTIncludes salaries, personal expenses, and miscellaneous costs for Business Process - Enterprise Management.

F525135 SERVICES MANAGEMENTIncludes salaries, personal expenses, and miscellaneous costs for Services Management.

F526451 SMART GRID ARCHITECTURE & ENGINE ERINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for SmartGrid Architecture and Engineering.

F526879 SAP ARCHITECTURE & ENGINEERINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for SAP Architecture & Engineering.

F527005 SPECIAL PROJECTSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Special Projects.

F527536 CENTER OF CONTINUOUS IMPROVEMENT BUSINESS WAREHOUSE SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Business Warehouse for Center of Continuous Improvement.

F527694 ENTERPRISE TECHNOLOGY ARCHITECTURE & ENGINEERING MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Enterprise Tech Architectu re & Engineering Management.

F527957 PROJECT ARCHITECTURE CUSTOMER SERVICE/SONGSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Project Architecture Custo mer Service and SONGS.

F527958 SMART GRID COMMUNICATIONS ENGIN EERINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for SMART Grid Communications Engineering.







F527959 DATA & INFORMATION ARCHITECTUREIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Data & Information Archite cture.

F527960 ENTERPRISE DATA & SYSTEMS DESIGNIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Enterprise Data and Syste m Design.







$ (000)2008 2009 2010 2011 2012

F300156 TECHNICAL SERVICES 605 369 123 264 220

F300157 ENTERPRISE ARCHITECTURE 1,688 2,841 2,484 1,647 1,575

F300158 SOLUTIONS ARCHITECTURE AND CONSULTING SERVICES

861 1,182 1,356 949 657

F300159 PROJECT ENGINEERING SERVICES 423 458 871 990 673

F300160 TECHNICAL RESOURCES & FRAMEWORKS

405 541 595 281 283

F300161 COMPETENCY DEVELOPMENT 468 582 418 473 225

F300162 REFERENCE ARCHITECTURE & SERVICE DESIGN

614 753 658 357 238

F300163 SYSTEMS ENGINEERING & DESIGN 970 1,187 894 988 515

F300188 ENTERPRISE PLATFORM SERVICES MANAGEMENT

2,771 644 447 131 50

F300189 ENTERPRISE PLATFORM SUPPORT MANAGEMENT

(1) 163 223 186 156

F300190 ENTERPRISE PLATFORM SERVICES SUPPORT DEVELOPMENT AND MAINTENANCE

1,376 1,705 2,144 2,567 2,400

F300191 ENTERPRISE APPLICATION SUPPORT 3,380 3,406 3,101 3,080 2,571

F300192 ENTERPRISE INFORMATION MANAGEMENT

203 390 168 304 285

F300193 DATABASE ADMINISTRATION 843 1,281 1,443 1,182 1,053

F300194 DATA ANALYSIS & QUALITY SERVICES 545 758 938 1,008 767

F525088 BUSINESS PROCESS - ENTERPRISE MANAGEMENT

1,499 2,532 3,179 3,606 4,345

F525135 SERVICES MANAGEMENT 7 356 331 448 214

F526451 SMART GRID ARCHITECTURE & ENGINEERING

0 21 185 496 324

F526879 SAP ARCHITECTURE & ENGINEERING 0 0 98 661 227

F527005 SPECIAL PROJECTS 0 0 176 195 221

F527536 CENTER OF CONTINUOUS IMPROVEMENT BUSINESS WAREHOUSE SERVICES

0 0 195 417 434




ENTERPRISE INFORMATION MANAGEME NT & ARCHITECTURE 920-921

Jason M. Kelly

Recorded/Adjusted (Constant 2012$) By Final Cost Center$ (000)

2008 2009 2010 2011 2012

F527694 ENTERPRISE TECHNOLOGY ARCHITECTURE & ENGINEERING MANAGEMENT

0 0 0 1,602 974

F527957 PROJECT ARCHITECTURE CUSTOMER SERVICE/SONGS

0 0 0 118 460

F527958 SMART GRID COMMUNICATIONS ENGINEERING

0 0 0 82 129

F527959 DATA & INFORMATION ARCHITECTURE 0 0 0 430 533

F527960 ENTERPRISE DATA & SYSTEMS DESIGN 0 0 0 158 197

Total 16,657 19,169 20,027 22,620 19,726

* * D u e to rounding, totals m a y not tie to o th er w ork p aper p a g e s .


FERC Account:

Activity:

Witness:


FERC Account:

Activity:

Witness:


ENTERPRISE INFORMATION MANAGEM ENT & ARCHITECTURE 920-921

Jason M. Kelly

APPENDIX B






Activity: E N T E RPRISE INFORMATION MANAGEMENT & ARCHITECTURE 920-921



Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Labor 717 717 717 717 810 (964) (2,070) (2,457)Non-Labor 653 618 618 618 1,277 (98) (216) (323)Other 0 0 0 0 0 0 0 0Total 1,370 1,335 1,335 1,335 2,087 (1,062) (2,286) (2,780)

Company Wide Adjustment 1 GRC-JAB-CW-NONUTILCR

This adjustment reverses the non-utility affiliate credits related to expenses recorded in one or more of the final cost centers included in this activity and charged to non-utility affiliate s. These adjustments are appropriate because all recorded non-utility affiliate credits were refunded to customers through the Base Revenue Requirement Balancing Account (BRRBA) pursuant to D.99-10-057. If these adjustments were not made, non-utility affiliate credits would be refunded to customers twice: (1) through adjustments to the BRRBA; and (2) through reductions to rates.

Labor 0 0 0 0 2 0 0 Non-Labor 0 0 0 0 55 0 0 Other 0 0 0 0 0 0 0

000

Total 0 0 0 0 57 0 0 0

Company Wide Adjustment 2 GRC-KBS-CW-FYA OP EX SEVERANCE

This adjustment reflects anticipated severance expenses in 2015.


Company Wide Adjustment 3 GRC-KBS-CW-FYA OP EX SAVINGS

This adjustment reflects anticipated Operational Excellence savings.

Labor 0 0 0 0 0 (964) (2,070) (2,635)Non-Labor 0 0 0 0 0 (98) (216) (323)Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 (1,062) (2,286) (2,958)

Organizational Unit Adjustment 1 A&G IT-KWK-OU-TDM TO EIM&A

This adjustment transfers resources from Technology Delivery & Maintenance 920-921 to Enterprise Information Management & Architecture 920-921.

Labor 717 717 717 717 717 0 0 0Non-Labor 618 618 618 618 618 0 0 0Other 0 0 0 0 0 0 0 0Total 1,335 1,335 1,335 1,335 1,335 0 0 0




Activity: E N TE RPRISE INFORMATION MANAGEMENT & ARCHITECTURE 920-921



Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Organizational Unit Adjustment 2 A&G IT-KWK-OU-ESC TO EIM&A

This adjustment is for resources moving from SmartConnect to Enterprise Information Management & Architecture FERC 920-921.

LaborNon-LaborOther

000

000

0 0 0 0 0 0

91 0 604 0

0 0

0 0 0 0 0 0

Total 0 0 0 0 695 0 0 0

Organizational Unit Adjustment 3 A&G IT-KWK-OU-MAPCORRECT-F800315

This adjustment transfers portion of expenses that were incorrectly mapped to Infrastructure Technology Services to respective IT FERC accounts.

923

LaborNon-LaborOther

033

0

000

0 0 0 0 0 0

0 0 0 0 0 0

0 0 0 0 0 0

Total 33 0 0 0 0 0 0 0








Activity:

Witness:

ENTERPRISE INFORMATION MANAGEMENT & ARCHITECTURE 920-921

Jason M. Kelly





Activity: ENTERPRISE RESOURCE PLANNING 920-921



2012$ (000)

Recorded2012

Forecast2015

Labor N/A 0 0Non-Labor N/A 0 0Other N/A 0 0Total 0 0


This activity is not forecast.





Activity: ENTERPRISE RESOURCE PLANNING 920-921



\ Recorded Peri od$ (000)


Labor 4, 016 2,289 1,683 22 45Non-Labor 14, 161 3,937 2,644 64 51Other 0 0 0 0 0Total 18 , 177 6,226 4,327 86 96

Adjustments- (Nominal $) - see Appendix B for additional detailLabor (4,016) (2,289) (1,683) (22) (45)Non-Labor (14 , 161) (3,937) (2,644) (64) (51)Other 0 0 0 0 0Total (18,177) (6,226) (4,327) (86) (96)

Recorded/Adjusted (Nominal $)Labor 0 0 0 0 0Non-Labor 0 0 0 0 0Other 0 0 0 0 0Total 0 0 0 0 0

E scalation :Labor 1.1414 1.1070 1.0701 1.0327 1.0000

Non-Labor 1.0932 1.0743 1.0518 1.0240 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000



2008 2009 2010 2011 2012

□ Labor (std escl) Non-Labor (std escl) □ Other (not escl)

0 0 0 0 0

6



FERC Account:

Activity:

Witness:


ENTERPRISE RESOURCE PLANNING 920-921

Jason M. Kelly

APPENDIX A


I n c lu d e d in T h is A c t i v i t y




Activity: ENTERPRISE RESOURCE PLANNING 920 -921



$ (0 00)* S e e A ppendix C fo r S u m m ary F in al C o st C en ters 2008 2009 2010 2011 2012

*SUMMARY ENTERPRISE RESOURCE PLANNING - OTHER SUPPORT

0 0 0 0 0

F401175 ENTERPRISE RESOURCE PLANNING - TECHNOLOGY

0 0 0 0 0

F525005 ENTERPRISE RESOURCE PLANNING PROGRAM GENERAL AND ADMINISTRATIVE

0 0 0 0 0

Total 0 0 0 0 0

* * D ue to rounding, totals m a y not tie to o ther w orkpaper p a g e s .



FERC Account:

Activity:

Witness:


ENTERPRISE RESOURCE PLANNING 92 0-921

Jason M. Kelly

APPENDIX B






Activity: E N TE RPRISE RESOURCE PLANNING 920-921



Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Labor (4,016) (2,289) (1,683) (22) (45) 0 0 0Non-Labor (14,161) (3,937) (2,644) (64) (51) 0 0 0Other 0 0 0 0 0 0 0 0Total (18,177) (6,226) (4,327) (86) (96) 0 0 0




Organizational Unit Adjustment 2 A&G IT-KWK-OU-ERP SW LIC XFR

This adjustment transfers Enterprise Resource Planning Software License expenses from Enterprise ResourcePlanning 920-921 and Technology Delivery & Maintenance 920-921 to Infrastructure Technology Services 920-921

Labor 0 0 0 0 0 0 0 0Non-Labor (8,329) 0 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total (8,329) 0 0 0 0 0 0 0

Organizational Unit Adjustment 3 A&G IT-KWK-OU-ERP ONE-TIME COST

This adjustment removes one time Enterprise Resource Planning non-Software License costs from EnterpriseResource Planning 920-921 and Technology Delivery & Maintenance 920-921.

Labor (4,016) (2,289) (1,683) (22) (45) 0 0 0Non-Labor (5,847) (3,937) (2,644) (64) (51) 0 0 0Other 0 0 0 0 0 0 0 0Total (9,863) (6,226) (4,327) (86) (96) 0 0 0





Activity:

Witness:

ENTERPRISE RESOURCE PLANNING 920-921

Jason M. Kelly



CLIENT SERVICES & PLANNING FERC Account 920/921





Activity: CLIENT SERVICES & PLANNING 920-921

Witness: Bradley K. Sweetser


2012$ (000)

Recorded2012

Forecast2015



This activity is used to record costs associated with maintenance activities provided by Client Services and Planning. Costs recording in FERC Account 920-921 are SCE labor, office supplies, travel , and training.







DETERMINATION OF RECORD ED/ADJUSTED



Labor 18,271 14,549 25,033 25,533 13,813Non-Labor 3,776 (543) 2,943 4,717 9,723Other 0 0 0 0 0Total 22,047 14,006 27,976 30,250 23,536

Adjustments- (Nominal $) - see Appendix B for additional detailLaborNon-LaborOther

(2,484)3,088

0

1,3427,528

0

(5,543)4,584

0

(4,468)3,103

0

5,454(6,209)

0Total 604 8,870 (959) (1,365) (755)

Recorded/Adjusted (Nominal $)LaborNon-LaborOther

15,7876,864

0

15,8916,985

0

19,4907,527

0

21,0657,820

0

19,2673,514

0Total 22,651 22,876 27,017 28,885 22,781

E sca la tio n :LaborNon-Labor

1.1414

1.0932

1.1070

1.0743

1.0701

1.0518

1.0327

1.0240

1.0000

1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

Recorded/Adjusted (Constant 2012$)Labor 18,019 17,591 20,855 21,755 19,267Non-Labor 7,504 7,504 7,917 8,008 3,514Other 0_________0_________ 0_________ 0_________0Total 25,523 25,095 28,772 29,763 22,781

32.000

28.000

24.000

20.00016,00012,000

8,0004,000

0



2008 2009 2010 2011 2012


152__________________ Workpaper - Southern California Edison / 2015 GRC - APPLICATION






COoCM ^roCM 2015 | sd** | ChosenLabor 20,511 20,511 20,511 1,244 noNon-Labor 5,761 5,761 5,761 2,247 noOther 0 0 0 0 noTotal 26,272 26,272 26,272 n/a n/a


2013 |

^roCM 2015 | r2* 1 Chosen 2013 | 2014 | 2015 | sd** | ChosenLabor 19,037 18,243 17,449 0.40 no 20,626 20,626 20,626 1,028 noNon-Labor 2,077 (125) (2,326) 0.73 no 6,479 6,479 6,479 2,097 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 21,114 18,118 15,123 n/a n/a 27,105 27,105 27,105 n/a n/a



COoCM ^roCM 2015 | r2* 1 Chosen

COoCM ^roCM 2015 | sd** | Chosen21,349 21,941 22,534 0.17 no 19,867 19,867 19,867 1,587 no3,766 2,578 1,390 0.50 no 6,736 6,736 6,736 1,870 no

0 0 0 0.00 no 0 0 0 0 no25,115 24,519 23,924 n/a n/a 26,603 26,603 26,603 n/a n/a



COoCM ^roCM 2015 | r2* 1 Chosen

COoCM ^roCM 2015 | sd** | Chosen21,495 22,161 22,827 0.35 no 19,498 19,498 19,498 1,601 no4,646 3,899 3,151 0.39 no 6,889 6,889 6,889 1,700 no

0 0 0 0.00 no 0 0 0 0 no26,141 26,060 25,978 n/a n/a 26,387 26,387 26,387 n/a n/a

Other Methods:



COoCM ^roCM 2015 | | Chosen

COoCM ^roCM 2015 | | Chosen19,267 19,267 19,267 yes 0 0 0 no3,514 3,514 3,514 yes 0 0 0 no

0 0 0 no 0 0 0 no22,781 22,781 22,781 n/a 0 0 0 n/a



Method

COoCM roCM 2015 |

COoCM roCM 2015 | |LRY 19,267 19,267 19,267 (1,912) (3,359) (3,827)LRY 3,514 3,514 3,514 (554) (1 ,002) (1,138)N/A 0 0 0 0 0 0

22,781 22,781 22,781 (2,466) (4,361) (4,965)

* r2 = R S q u a re d ( B a s e d on rec ord ed y e a r s data)

* * s d = s tan d ard deviation (B a s e d on rec o rd ed y e a r s data)








Method Selected

LOoCM^r

oCMCOoCM

Labor Last Recorded Year Adj. 17,355 15,908 15,440Non-Labor Last Recorded Year Adj. 2,960 2,512 2,376Other N/A 0 0 0Total 20,315 18,420 17,816


Analysis of Linear Trending Method:In D.89-12-057, the CPUC stated that if costs have shown a trend in a certain direction over three or more years, the last year recorded is an appropriate base estimate. For this account, costs have not been stable. Labor decreased from 2008-2009 following with an increase from 2009-2011 and finally a decrease in 2012. Non-labor costs were increasing or stable from 2008-2011. In 2012, non-labor decreased as a result of company wide Operational Excellence efforts that were put in place. For that reason, linear trending is not appropriate forecasting method.

Analysis of Averaging Method:In D.89-12-057, the CPUC stated that for those accounts which have signifi cant fluctuations in recorded expenses from year to year, an average of recorded expenses is appropriate. For this account, costs have not been stable. Labor decreased from 2008-2009 following with an increase from 2009-2011 and finally a decrease in 2012. Non-labor costs were increasing or stable from 2008-2011. In 2012, non-labor decreased as a result of compa ny-wide Operational Excellence efforts that were put in place. Recorded costs in this account have fluctuated significantly from year to year, and the averaging methodology would have been appropriate but last year recorded methodology best represents the expense pattern we anticipate for 2015.

Analysis of Last Recorded Year (2012):Even though historical recorded data indicates an averaging methodology would be the most likely basis for a forecast of labor and non-labor costs, we have chosen the last recorded year as it best represents the expenses we anticipate beginning in 2015. To that base we have added the increments discussed elsewhere in these workpapers and testimony.








32.00028.00024.000

20.00016,00012,000

8,0004,000

02008 2009 2010 2011 2012 2013 2014 2015


Recorded Period$(000)

Forecast Expenses (constant 2012$) 2008 | 2009 | 2 0 10 | 2011 | 2012 2013 | 2014 | 2 0 1 5Labor (standard escalation) 18,019 17 ,591 20,855 21,755 19,267 17,355 15,908 15,440Non-Labor (standard escalation) 7,504 7 ,504 7,917 8,008 3,514 2,960 2,512 2,376Other (not escalatable) 0 0 0 0 0 0 0 0Total 25,523 25 ,095 28,772 29,763 22,781 20,315 18,420 17,816

Labor Prior year Total 19,267 17,355 15,908Change (1,912) (1,447) (468)Total 19,267 17,355 15,908 15,440

Non-Labor Prior year Total 3,514 2,960 2,512Change (554) (448) (136)Total 3,514 2,960 2,512 2,376


Total Change |Labor (1,912) (1,447) (468)Non-Labor (554) (448) (136)Other 0 0 0Total N/A (2,466) (1,895) (604)






This page shows the changes in Labor, Non-Labor, and Othe r expenditures forecast during 2013 through 2015, including reasons for the addition of personnel (labor), increased office supplies required due to an increase in activity (non-labor).

2012 - 2013

Labor: (1,912)

The reduction in labor forecast is driven by savings from Ope rational Excellence which is detailed in testimony (SCE-05, Vol 1). See Appendix B.

Non-Labor: (554)


Other: 0

Not applicable.







2013 - 2014

Labor: (1,447)


Non-Labor: (448)


Other: 0

Not applicable.







2014 - 2015____________________________________________________________________________________

Labor: (468)


Non-Labor: (136)


Other: 0

Not applicable.



FERC Account:

Activity:

Witness:


CLIENT SERVICES & PLANNING 920-921

Bradley K. Sweetser

APPENDI X A









* S e e A ppendix C for Su m m ary Fin al C o st C en ters________________________________

*SUMMARY AFFILIATE CREDITIncludes credits associated with support provided by Information Technology Affiliate Support.

*SUMMARY DIRECT CHARGES TO FERC ACCOUNTExpenses charged directly to the Federal Ene rgy Regulatory Commission (FERC) account and not to a specific final cost center.

*SUMMARY DIVISION SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Solution Delivery Management.

*SUMMARY OUTSIDE SERVICES EMPLOYEDIncludes consulting and related expenses for I nformation Technology Vice President.

F300121 BUSINESS RELATIONS MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Relations Management.

F300122 BUSINESS RELATIONSHIP MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Relationship Management.

F300123 RELATIONSHIP DEVELOPMENT MANAGEM ENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Development.

F300124 BUSINESS DEVELOPMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Request and Capacity Management.

F300129 DEMAND/WORK MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Demand/Work Management.

F300138 SOLUTION DELIVERY MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Solution Delivery Management.

F300139 INFORMATION TECHNOLOGY PROJECT MANAGEMENT OFFICE MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Program Management Office Management.

F300147 ENTERPRISE INTEGRATION & STRATEGIC INITIATIVESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Integration and Strategic Initiatives.

F300195 OPERATIONS SUPPORT MANAGERIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Operations Support Management.







* S e e A ppendix C for Su m m ary Fin al C o st C en ters_________________________________

F300197

F300200

F300290

F300291

F300292

F300293

F300294

F300295

F300305

F300306

F300312

F300313

F300314

PROJECT RESOURCE MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Project Resource Management.

TESTING, COMPLIANCE & CONTROLS MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Testing, Compliance and Controls Manageme nt.

BUSINESS OPERATIONS CENTER MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Operations Center Management.

PERFORMANCE & TALENT MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Performance and Talent Management.

BUSINESS OPERATIONS CENTER - OPERATIONSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Operations Center Operations.

BUSINESS OPERATIONS CENTER - DIVISIO N SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Operations Division Support.

ORGANIZATIONAL READINESSIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Organizational Readiness.

INFORMATION TECHNOLOGY TRAININGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Information Technology Training.

PLANNING & PERFORMANCE MONITORINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Department Planning and Performance Monitoring.

REGULATORY STRATEGY & PLANNINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Regulatory Strategy and Planning.

FINANCE AND ADMINISTRATIVE SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Finance and Administrative Services Management.

FINANCIAL PLANNING & REPORTINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Financial Planning and Reporting.

FINANCIAL ANALYSIS & PROJECT SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Financial Analysis and Project Support.








F300317

F300318

F300322

F300323

F300324

F300325

F300326

F401195

F503004

F515376

F515378

F515379

VENDOR MANAGEMENT VOLT DEFAULT COST CENTERThis is an Accounts Payable default account which includes Volt invoice processing errors for Information technology (IT).

VENDOR MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Vendor Management.

DEPARTMENT SUPPORT & SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Finance and Administrative Services Departm ent Support and Services.

FACILITY MAINTENANCE / MANAGEMENTIncludes labor, contract, and other expenses incurred in the maintenance of structures, parking areas, and associated facilities/systems including, but not limited to, lighting and electrical, air conditioning and heating, water, plumbing, water-heating, and elevators. Includes labor, contract, and other expenses incurred in the care of lan dscape, for activities relating to environmental studies and remedial action, and for cleaning buildings, furniture, and equipment. Includes labor and other expenses for structural engineering, civil engineering, and mechanical engineering in support of facility maintenance activities.

PAYROLL MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Payroll Management.

SAFETY & ENVIRONMENTAL PERFORMANCE MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Safety and Environmental Performance Management.

BUSINESS SUPPORT INVOICINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Support Invoicing.

INFORMATION TECHNOLOGY VICE PRESIDENT DEPARTMENT SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Information Technology Department Support.

CHARGEBACK ACCRUAL OFFSETTransactions in this final cost center account for the difference between the Service Providers ' expenses and the amount distributed to the customers based on the Service Provider Agreement and Product/Service price.

CHIEF INFORMATION OFFICER DEPARTME NT SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Chief Information Officer Department Support.

ENTERPRISE RESOURCE PLANNING FOR EDISON INTERNATIONALIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Resource Planning for Edison International.

ENTERPRISE PORTFOLIO MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Portfolio Management.








F516511

F525030

SERVER MANAGEMENT/HARDWARE MANAGEMENT (SM/HM ) - SUPPLEMENTAL - CONTRACTIncludes labor costs for contracted workers in support of SM/HM.

ENTERPRISE FUNDSIncludes salaries, employee expenses and mi scellaneous cost for IT Enterprise related activities.

F525091

F525096

F525099

BUSINESS PROCESS - DEVELOPMENT MANAGEMENTIncludes salaries, personal expenses, and mis cellaneous costs for Business Process - Development Management.

END USER SUPPORT MANAGEMENTIncludes salaries, personal expenses, and miscellaneous costs for End User Support Management.

END USER SUPPORT - SUPER USER NETWORK SUPPORTIncludes salaries, personal expenses, and miscellaneous costs for End User Support - Super User Network Support.

F525405 AFFILIATE CREDIT ITIncludes Affiliate Credits for IT.

F525406 VENDOR CREDITSIncludes credits associated with support provided by Vendors.

F525526 HOME COST CENTER RESIDUALSIncludes residual amounts from home cost centers.

F525527 DISTRIBUTION COST CENTER OVERHEAD RESIDUALSIncludes residual amounts from IT Overheads .

F525528 DISTRIBUTION COST CENTER - CHARGEBACK RESIDUALS Includes residual amounts from pass-through charges.

F525644

F526271

F526450

OPERATION SUPPORT - PROCESS MANAG EMENTIncludes salaries, personnel expenses and miscellaneous costs for Operation Support Process Management.

PROCESS MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Business Relations Process Management.

DEPLOYMENT MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Deployment Manager.








F526660 TELECOMM OVERHEAD RESIDUALIncludes cost from the IT Telecomm overhead accounts that do not clear to Telecomm capital work orders.

F526742

F526809

F526819

F526820

F526821

F526822

F526955

F526956

F526957

F526958

F526959

F526960

DELIVERY QUALITY MANAGEMENT/TESTING SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Delivery Quality Management/Testing Services.

CLIENT SERVICE PLANNING & CONTROLS DEPARTMENT SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Client Service Planning an d Controls Department.

ENTERPRISE INTEGRATION & INITIATIVES - INTEGRATION MANAGERIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Integration Manager.

ENTERPRISE INTEGRATION & INITIATIVES - INTEGRATION SERVICESIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Integration Services.

ENTERPRISE INTEGRATION & INITIATIVES - PROJECT GOVERNANCEIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Enterprise Integration & Initiatives Project Governance.

DELIVERY PROJECT MANAGEMENT ORGA NIZATIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Delivery Project Management Organization.

INFORMATION TECHNOLOGY & BUSINESS INTEGRATION CORPORATE CENTERIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Information Technology & Business Integration Corporate Center.

DIRECTOR CUSTOMER SERVICEIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Customer Service IT Portfolio.

INFORMATION TECHNOLOGY & BUSINESS INTEGRATION GENERATIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Generation IT Portfolio.

INFORMATION TECHNOLOGY & BUSINESS INTEGRATION OPERATIONS SUPPORTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Operations Support IT Portfolio.

INFORMATION TECHNOLOGY & BUSINESS INTEGRATION POWER PROCUREMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Power Procurement IT Po rtfolio.

INFORMATION TECHNOLOGY & BUSINESS INTEGRATION TRANSMISSION AND DISTRIBUTIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Transmission & Distribution IT Portfolio.








F526980

F527228

SERVICE PROVIDER IMM AGREEMENTIncludes salaries, personnel expenses, and m iscellaneous costs for Service Provider Internal Marketing Mechanism Agreement.

DIRECTOR SONGS/POWER PRODUCTIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for Director of San Onfre Nucl ear Generating Station/Power Production IT Portfolio.

F527245 SOLUTIONS DELIVERY SERVICES VENDOR CREDITSIncludes salaries, personnel expenses, and m i scellaneous costs for Solutions Delivery.

F527838

F527853

F527901

F527999

F528064

F800227

F800228

CLIENT SERVICE PLANNING AND CONTRO LS VICE PRESIDENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for day to day activities for office of Client Service Planning and Controls - Vice President.

BUDGET RECONCILIATIONIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Budget Reconciliation.

DELIVERY PROCESS MANAGEMENTIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Delivery Process Management.

CANCELED CAPITAL RELATED ORDERS-EXPENSES (CCRO E)Includes salaries, employee expenses, office supplies and additional miscellaneous costs for Canceled Capital Related Orders-Expense.

CLIENT ENGAGEMENT & PLANNINGIncludes salaries, employee expenses, office supplies and additional miscellaneous costs for Client Engagement & Planning.

DEPARTMENT FINANCEIncludes salaries, miscellaneous and supplem ental/contractor costs in support of all Finance and Department Services.

DEPARTMENT SUPPORTIncludes salaries, personal expenses and miscellaneous costs for Department Support related activities.

F800238

F800240

INFORMATION TECHNOLOGY MANAGEMENTIncludes salaries, personnel expenses, and m iscellaneous costs of Information Technologies CIO (Chief Information Officers) Operations.

INFORMATION TECHNOLOGY - GENERAL RATE CASEIncludes salaries, personnel expense, and miscellaneous cost for General Rate Case (GRC).

F800242 INFORMATION TECHNOLOGY BUSINESS PROCESS INTEGRATION (BPI) - DIRECTORIncludes salaries, personnel expense, and miscellaneous costs in Director support of BPI Enterprises.








F800246 INFORMATION TECHNOLOGY BUSINESS READINESS DIVISION SUPPORTIncludes expenses related to IT Business Readiness - Division Support.

F800247 INFORMATION TECHNOLOGY BUSINESS READINESS RELATIONSHIP MANAGERIncludes expenses related to IT Business Readiness - Relationship Manager.

F800249 INFORMATION TECHNOLOGY CONTRACT GOVERNANCEIncludes salaries, personnel expense, and miscellaneous costs in IT Contract Governance and related activities.

F800256 INFORMATION TECHNOLOGY/FINANCE DIRECTORIncludes salaries, personnel expenses, and m iscellaneous costs for IT Finance Director and related activities.

F800263 MISCELLANEOUS OPERATIONSIncludes salaries, personnel expenses, and miscellaneous costs for Miscellaneous Operations.

F800268 PERSONNEL AND PAYROLLIncludes salaries, personnel expenses and miscellaneous costs for Personnel and Payroll related activities.

F900000

F905693

SOUTHERN CALIFORNIA EDISON - MISCELLANEOUSUsed to record general operating expense for SCE for which specific final cost centers have not been provided.

TRANSMISSION IT INTERNAL MARKET MECHANISM (IMM) HARDWARE / SOFTWARE / COMMUNICATIONIncludes primarily IT costs charged back to the business unit, but can also include: overseeing maintenance of computer applications; installing and maintaining PC Local Area Network/Wide Area Network; supporting legacy system. Also includes expenses charged to the organizations for services such as PC moves/adds/changes , mainframe application services, and non-unix application/database servers.







$ (000)* See Appendix C for Summary Final Cost Centers 2008 2009 2010 2011 2012

*SUMMARY AFFILIATE CREDIT (22) 0 0 0 0

*SUMMARY DIRECT CHARGES TO FERC ACCOUNT 0 (390) 0 0 0

*SUMMARY DIVISION SUPPORT 1,504 2,124 1,846 1,021 626

*SUMMARY OUTSIDE SERVICES EMPLOYED 111 88 0 0 0

F300121 BUSINESS RELATIONS MANAGEMENT 1,279 781 496 488 93

F300122 BUSINESS RELATIONSHIP MANAGEMENT 927 1,033 24 13 11

F300123 RELATIONSHIP DEVELOPMENT MANAGEMENT 534 702 986 753 8

F300124 BUSINESS DEVELOPMENT 999 1,078 796 747 (4)

F300129 DEMAND/WORK MANAGEMENT 875 1,005 919 899 986

F300138 SOLUTION DELIVERY MANAGEMENT 1,245 1,050 377 365 423

F300139 INFORMATION TECHNOLOGY PROJECT MANAGEMENT OFFICE MANAGEMENT

275 302 230 306 33

F300147 ENTERPRISE INTEGRATION & STRATEGIC INITIATIVES

105 99 197 269 121

F300195 OPERATIONS SUPPORT MANAGER 1,155 567 785 822 453

F300197 PROJECT RESOURCE MANAGEMENT 908 796 762 864 709

F300200 TESTING, COMPLIANCE & CONTROLS MANAGEMENT

1,477 734 1,475 1,666 903

F300290 BUSINESS OPERATIONS CENTER MANAGEMENT

976 689 554 490 706

F300291 PERFORMANCE & TALENT MANAGEMENT 1,544 1,667 1,532 1,153 1,681

F300292 BUSINESS OPERATIONS CENTER - OPERATIONS

271 1,072 1,091 941 717

F300293 BUSINESS OPERATIONS CENTER - DIVISION SUPPORT

214 395 484 9 1

F300294 ORGANIZATIONAL READINESS 260 (1) 1 0 0

F300295 INFORMATION TECHNOLOGY TRAINING (25) 0 (66) 5 0







S e e A ppendix C for Su m m ary Final C o st C en ters

$ (000)2008 2009 2010 2011 2012

F300305 PLANNING & PERFORMANCE MONITORING 855 1,257 1,158 1,061 1,009

F300306 REGULATORY STRATEGY & PLANNING 287 619 363 497 407

F300312 FINANCE AND ADMINISTRATIVE SERVICES 595 648 780 1,438 1,216

F300313 FINANCIAL PLANNING & REPORTING 1,537 1,881 1,695 1,928 1,681

F300314 FINANCIAL ANALYSIS & PROJECT SUPPORT 283 224 451 226 66

F300317

F300318

VENDOR MANAGEMENT VOLT DEFAULT COST CENTER

VENDOR MANAGEMENT

0

930

54

413

(43)

453

9

332

23

219

F300322 DEPARTMENT SUPPORT & SERVICES 0 0 0 0 0

F300323 FACILITY MAINTENANCE / MANAGEMENT 0 0

F300324

F300325

F300326

PAYROLL MANAGEMENT

SAFETY & ENVIRONMENTAL PERFORMANCE MANAGEMENT

BUSINESS SUPPORT INVOICING

488

263

556

21

495 478

0

0

440

0

0

F401195

F503004

F515376

F515378

F515379

F516511

F525030

INFORMATION TECHNOLOGY VICE PRESIDENT DEPARTMENT SUPPORT

CHARGEBACK ACCRUAL OFFSET

CHIEF INFORMATION OFFICER DEPARTMENT SUPPORT

ENTERPRISE RESOURCE PLANNING FOR EDISON INTERNATIONAL

ENTERPRISE PORTFOLIO MANAGEMENT

SERVER MANAGEMENT/HARDWARE MANAGEMENT (SM/HM ) - SUPPLEMENTAL - CONTRACT

ENTERPRISE FUNDS

2,142 1,071

516

733

609

638

(50)

102

(53)

983

47

170

20

138

1,156

20

563

374

0

486

0

0

0

350

0

293

0

0

0

F525091

F525096

BUSINESS PROCESS - DEVELOPMENT MANAGEMENT

END USER SUPPORT MANAGEMENT

24 384 1,208 1,135 1,954

35 1,345 1,664 1,554 (3)

0 0 0

0 0 0

0

0

0

0

0 0 0








F525099 END USER SUPPORT - SUPER USER NETWORK SUPPORT

8 58 0 19 0

F525405 AFFILIATE CREDIT IT (11) 0 0 0 0

F525406 VENDOR CREDITS 0 0 (26) 0 0

F525526 HOME COST CENTER RESIDUALS 17 0 0 0 0

F525527 DISTRIBUTION COST CENTER OVERHEAD RESIDUALS

0 0 0 0 0

F525528 DISTRIBUTION COST CENTER - CHARGEBACK RESIDUALS

78 2 0 0 0

F525644 OPERATION SUPPORT - PROCESS MANAGEMENT

0 0 492 393 425

F526271 PROCESS MANAGEMENT 0 56 10 0 0

F526450 DEPLOYMENT MANAGEMENT 0 733 85 20 183

F526660 TELECOMM OVERHEAD RESIDUAL 0 0 0 0 0

F526742 DELIVERY QUALITY MANAGEMENT/TESTING SERVICES

0 0 805 1,133 336

F526809 CLIENT SERVICE PLANNING & CONTROLS DEPARTMENT SUPPORT

0 0 1,170 1,715 1,491

F526819 ENTERPRISE INTEGRATION & INITIATIVES - INTEGRATION MANAGER

0 123 369 441 212

F526820 ENTERPRISE INTEGRATION & INITIATIVES - INTEGRATION SERVICES

0 50 113 69 285

F526821 ENTERPRISE INTEGRATION & INITIATIVES - PROJECT GOVERNANCE

0 50 383 484 427

F526822 DELIVERY PROJECT MANAGEMENT ORGANIZATION

0 50 545 613 561

F526955 INFORMATION TECHNOLOGY & BUSINESS INTEGRATION CORPORATE CENTER

0 0 404 436 235

F526956 DIRECTOR CUSTOMER SERVICE 0 0 433 538 397

F526957 INFORMATION TECHNOLOGY & BUSINESS INTEGRATION GENERATION

0 0 295 309 2

F526958 INFORMATION TECHNOLOGY & BUSINESS INTEGRATION OPERATIONS SUPPORT

0 0 404 553 426

F526959 INFORMATION TECHNOLOGY & BUSINESS 0 0 235 347 278INTEGRATION POWER PROCUREMENT








F526960 INFORMATION TECHNOLOGY & BUSINESS INTEGRATION TRANSMISSION AND DISTRIBUTION

0 0 409 275 313

F526980 SERVICE PROVIDER IMM AGREEMENT 0 0 1 0 0

F527228 DIRECTOR SONGS/POWER PRODUCTION 0 0 430 934 607

F527245 SOLUTIONS DELIVERY SERVICES VENDOR CREDITS

0 0 (234) 10 9

F527838 CLIENT SERVICE PLANNING AND CONTROLS VICE PRESIDENT

0 0 0 399 307

F527853 BUDGET RECONCILIATION 0 0 0 0 2

F527901 DELIVERY PROCESS MANAGEMENT 0 0 0 736 112

F527999 CANCELED CAPITAL RELATED ORDERS-EXPENSES (CCRO E)

0 0 0 9 (2 20)

F528064 CLIENT ENGAGEMENT & PLANNING 0 0 0 0 1,268

F800227 DEPARTMENT FINANCE 34 0 0 0 0

F800228 DEPARTMENT SUPPORT 21 0 0 0 0

F800238 INFORMATION TECHNOLOGY MANAGEMENT 301 0 0 0 0

F800240 INFORMATION TECHNOLOGY - GENERAL RATE CASE

4 0 0 0 0

F800242 INFORMATION TECHNOLOGY BUSINESS PROCESS INTEGRATION (BPI) - DIRECTOR

1 0 0 0 0

F800246 INFORMATION TECHNOLOGY BUSINESS READINESS DIVISION SUPPORT

90 0 0 0 0

F800247 INFORMATION TECHNOLOGY BUSINESS READINESS RELATIONSHIP MANAGER

0 0 0 0 0

F800249 INFORMATION TECHNOLOGY CONTRACT GOVERNANCE

9 0 0 0 0

F800256 INFORMATION TECHNOLOGY/FINANCE DIRECTOR

1 0 0 0 0

F800263 MISCELLANEOUS OPERATIONS 349 0 0 0 0

F800268 PERSONNEL AND PAYROLL 22 0 0 0 0

F900000 SOUTHERN CALIFORNIA EDISON - 0 0 0 0 3MISCELLANEOUS







$ (000)* S e e A ppendix C for Su m m ary Final C o st C en ters 2008 2009 2010 2011 2012

F905693 TRANSMISSION IT INTERNAL MARKET MECHANISM (IMM) HARDWARE / SOFTWARE / COMMUNICATION

0 402 0 0 0

Total 25,523 25,093 28,775 29,762 22,781

* * D ue to rounding, totals m a y not tie to o th er w orkpaper p a g e s .



FERC Account:

Activity:

Witness:



Bradley K. Sweetser

APPENDIX B






Activity: C L I E N T SERVICES & PLANNING 920-921


Detail of Total Company Adjus tments to Recorded Expenses

Adjs - (Nominal $) $ (000)2008 2009 2010 2011 2012 2013 2014 2015

Labor (2,484) 1,342 (5,543 ) (4,468) 5,454 (1,912) (3,359) (3,827)Non-Labor 3,088 7,528 4,584 3,103 (6,209) (554) (1 ,002) (1,138)Other 0 0 0 0 0 0 0 0Total 604 8,870 (959) (1,365) (755) (2,466) (4,361) (4,965)


This adjustment reverses the non-utility affiliate credits related to ex penses recorded in one or more of the final cost centers included in this activity and charged to non-utility affiliates. These adjustments are appropriate because all recorded non-utility affiliate credits were refunded to customers through the Base Revenue Requirement Balancing Account (BRRBA) pursuant to D.99-10-057. If these adjustments were not made, non-utility affiliate credits would be refunded to customers twice: (1) through adjustments to the BRRBA; and (2) through reductions to rates.

Labor 121 6 4 7 6 0 0 0 Non-Labor 617 221 141 159 145 0 0 0 Other 0 0 0 0 0 0 0 0Total 738 227 145 166 151 0 0 0

Company Wide Adjustment 2 GRC-KBS-CW-FYA OP EX SEVERANCE

This adjustment reflects anticipated severance expenses in 2015.


Company Wide Adjustment 3 GRC-KBS-CW-FYA OPX REDUCTIONS CENTRALIZATION

This future year adjustment reflects the anticipated savings from the centralization of the finance and job skills trainingfunctions.


Company Wide Adjustment 4 GRC-KBS-CW-FYA OP EX SAVINGS

This adjustment reflects anticipated Operational Excellence savings .








Adjs - (Nominal $) $ (000)2008 2009 2010 2011 2012 2013 2014 2015

Organizational Unit Adjustment 1 TDBU-IDP.KWK-OUX-REVERSEJTJMM

This adjustment reverses Information Technology (IT) expenses.

LaborNon-LaborOther

02,151

0

0 0 8,234 12,465

0 0

012,660

0

5,199 0 12,132 0

0 0

0 0 0 0 0 0

Total 2,151 8,234 12,465 12,660 17,331 0 0 0

Organizational Unit Adjustment 2 A&G IT-KWK-OU-923TO920921-IT

This adjustment transfers expenses from various IT packages from FERC 923 to FERC 920-921 to reflect current charging practices.

LaborNon-LaborOther

0909

0

1 0 228 0

0 0

000

0 0 0 0 0 0

0 0 0 0 0 0

Total 909 229 0 0 0 0 0 0

Organizational Unit Adjustment 3 A&G HRBEN-WLS.KWK-OUX-ACE TRANSFER - IT

This adjustment transfers July through December 2008 Awards to Celebrate Excellence (ACE) costs that were charged in error to Miscellaneous Benefits to the appropriate business units.

LaborNon-LaborOther

0402

0

0 0 0 0 0 0

000

0 0 0 0 0 0

0 0 0 0 0 0

Total 402 0 0 0 0 0 0 0

Organizational Unit Adjustment 4 CSBU-KMM.KWK-OUX-902TOITF525644_525724

Customer Service transfer accounting adjustment to appropriately map expenses - This adjustment transfers expenses from FERC 902 Meter Reading Operations to Information Technology FERCs 920/921.

LaborNon-LaborOther

300

273 0 6 0 0 0

000

0 0 0 0 0 0

0 0 0 0 0 0

Total 3 279 0 0 0 0 0 0

Organizational Unit Adjustment 5 A&G FINC-RSL.KWK-OUX-CNTRLS-TRANSFER LABOR TO IT

This adjustment transfers Information Technology labor costs incorrectly recorded in Financial Services Miscellaneous 930 to the Client Services & Planning 920-921.

LaborNon-LaborOther

000

0 0 0 0 0 0

000

3 0 0 0 0 0

0 0 0 0 0 0

Total 0 0 0 0 3 0 0 0







Adjs - (Nominal $) $ (000)2008 2009 2010 2011 2012 2013 2014 2015

Organizational Unit Adjustment 6 A&G IT-KWK-OU-FERC6 6 8 .RECLASS NONLABOR TO LABOR

This adjustment classifies labor expenses correctly as a result of FERC 668 Adjustment.

Labor 645 0 3,739 3,798 0 0 0 0Non-Labor (645) 0 (3,739) (3,798) 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 0 0 0

Organizational Unit Adjustment 7 A&G IT-KWK-OU-NLTOL

This adjustment moves historical non-labor dollars to labor for software development to reflect the fact that theseamounts will record as labor in the future.

Labor 0 3,681 0 0 0 0 0 0Non-Labor 0 (3,681) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 0 0 0

Organizational Unit Adjustment 8 A&G IT-KWK-OU-REMOVE.OVHRESIDUALS

This adjustment removes overhead residuals from Capital that have a net offset between labor and non-labor.

Labor (1,972) (1,895) (4,798) (3,560) 6,238 0 0 0Non-Labor 1,629 1,860 4,736 3,455 (6,238) 0 0 0Other 0 0 0 0 0 0 0 0Total (343) (35) (62) (105) 0 0 0 0


This adjustment transfers 2008 employee reward (ACE) points to re spective IT Activities.

Labor 0 0 0 0 0 0 0 0Non-Labor (245) 0 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total (245) 0 0 0 0 0 0 0

Organizational Unit Adjustment 10 A&G IT-KWK.IDP-OUX-ITFACILTY.TO.CORPFACILITY

This adjustment transfers historical facility related expenses as a result of reorganization from Client Services and Planning FERC 920-921 to Transmission Grid Engineering and Tec hnology FERC 560.

Labor (180) (141) (184) 10 0 0 0 0Non-Labor (45) (3) (28 ) (33) 0 0 0 0Other 0 0 0 0 0 0 0 0Total (225) (144) (2 1 2 ) (23) 0 0 0 0







Adjs - (Nominal $) $ (000)2008 2009 2010 2011 2012 2013 2014 2015

Organizational Unit Adjustment 11 A&G IT-KWK.MAR-OUX-ITSAFETY.REORG

This adjustment transfers IT safety expenses from Client Services & Planning 920-921 to Corporate Safety 925 to align with reorganization.

Labor (456) (583) (565 ) (925) (793) 0 0 0Non-Labor (179) (185) (265 ) (478) (116) 0 0 0Other 0 0 0 0 0 0 0 0Total (635) (768) (830 ) (1,403) (909) 0 0 0

Organizational Unit Adjustment 12 A&G FINC-RSL.KWK-OUX-TRANSFERTOIT

This adjustment transfers amounts between the Financial Services Miscellaneous Expenses 920-921 and ClientServices & Planning 920-921 related to compliance of FERC Order 668 for the Regional Transmission Organization(RTO)/California Independent System Operator (ISO).

Labor (645) 0 (3,739) (3,798) (5,199) 0 0 0Non-Labor (1,506) 848 (8,726) (8,862) (12,132) 0 0 0Other 0 0 0 0 0 0 0 0Total (2,151) 848 (12,465) (12,660) (17,331) 0 0 0



FERC Account:

Activity:

Witness:



Bradley K. Sweetser

APPEN DIX C

F in a l C o s t C e n t e r s







Final Cost Centers included in this activity:

*Summary Final Cost Centers:

AFFILIATE CREDITF525404 F525407 F525408

DIRECT CHARGES TO FERC ACCOUNTF900920 F900921

DIVISION SUPPORTF300133 F300153

OUTSIDE SERVICES EMPLOYEDF516562 F516563






Individual Final Cost Centers:

F300121 F300122

F300200 F300290

F300313 F300314

F503004 F515376

F525406 F525526

F526819 F526820

F526980 F527228

F800238 F800240

F905693

F300123 F300124

F300291 F300292

F300317 F300318

F515378 F515379

F525527 F525528

F526821 F526822

F527245 F527838

F800242 F800246

F300129 F300138

F300293 F300294

F300322 F300323

F516511 F525030

F525644 F526271

F526955 F526956

F527853 F527901

F800247 F800249

F300139 F300147

F300295 F300305

F300324 F300325

F525091 F525096

F526450 F526660

F526957 F526958

F527999 F528064

F800256 F800263

F300195 F300197

F300306 F300312

F300326 F401195

F525099 F525405

F526742 F526809

F526959 F526960

F800227 F800228

F800268 F900000





Activity:

Witness:


Bradley K. Sweetser




FERC Account: 923 Outside Services Employed

Activity: CLIENT SERVICES & PLANNING 923



2012$ (000)

Recorded2012

Forecast2015

Labor N/A 0 0Non-Labor N/A 0 0Other N/A 0 0Total 0 0


This activity is used to record costs associated with maintenance activities provided by Client Services and Planning. Costs recording in FERC Account 923 are SCE labor, office supplies, travel, and training. This activity is not forecast.










Labor 0 0 4 2 0Non-Labor 898 (1,371) 65 519 166Other 0 0 0 0 0Total 898 (1,371) 69 521 166

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 0 0 (4) (2) 0Non-Labor ( 898) 1,371 (65) (519) (166)Other 0 0 0 0 0Total (898) 1,371 (69) (521) (166)


E scalation :Labor 1.1414 1.1070 1.0701 1.0327 1.0000

Non-Labor 1.0932 1.0743 1.0518 1.0240 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000



2008 2009 2010 2011 2012


0 0 0 0 0

6



FERC Account

Activity:

Witness:

923 Outside Services Employed

CLIENT SERVICES & PLANNING 923

Bradley K. Sweetser

APPENDIX A









$ (000)* S e e A ppendix C for Su m m ary F inal C o st C en ters 2008 2009 2010 2011 2012

*SUMMARY OUTSIDE SERVICES EMPLOYED 0 0 0 0 0

F516511 SERVER MANAGEMENT/HARDWARE MANAGEMENT (SM/HM ) - SUPPLEMENTAL - CONTRACT

0 0 0 0 0

F525030 ENTERPRISE FUNDS 0 0 0 0 0

F525408 AFFILIATE CREDIT 0 0 0 0 0

F800227 DEPARTMENT FINANCE 0 0 0 0 0

F800228 DEPARTMENT SUPPORT 0 0 0 0 0

F800238 INFORMATION TECHNOLOGY MANAGEMENT 0 0 0 0 0

F800240 INFORMATION TECHNOLOGY - GENERAL RATE CASE

0 0 0 0 0

F800242 INFORMATION TECHNOLOGY BUSINESS PROCESS INTEGRATION (BPI) - DIRECTOR

0 0 0 0 0

F800246 INFORMATION TECHNOLOGY BUSINESS READINESS DIVISION SUPPORT

0 0 0 0 0

F800247 INFORMATION TECHNOLOGY BUSINESS READINESS RELATIONSHIP MANAGER

0 0 0 0 0

F800249 INFORMATION TECHNOLOGY CONTRACT GOVERNANCE

0 0 0 0 0

F800256 INFORMATION TECHNOLOGY/FINANCE DIRECTOR

0 0 0 0 0

F800263 MISCELLANEOUS OPERATIONS 0 0 0 0 0

F800268 PERSONNEL AND PAYROLL 0 0 0 0 0

Total 0 0 0 0 0

* * D ue to rounding, totals m a y not tie to o th er w ork p aper p a g e s .



FERC Account:

Activity:

Witness:

923 Outside Services Employed


Bradley K. Sweetser

APPENDIX B






Activity: C L I E N T SERVICES & PLANNING 923



| Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Labor 0 0 (4) (2) 0 0 0 0Non-Labor (898) 1,371 (65) (519) (166) 0 0 0Other 0 0 0 0 0 0 0 0Total (898) 1,371 ( 69) (521) (166) 0 0 0


This adjustment reverses the non-utility affiliate credits related to expenses recorded in one or more of the final cost centers included in this activity and charged to non-utility affiliate s. These adjustments are appropriate because all recorded non-utility affiliate credits were refunded to customers through the Base Revenue Requirement Balancing Account (BRRBA) pursuant to D.99-10-057. If these adjustments were not made, non-utility affiliate credits would be refunded to customers twice: (1) through adjustments to the BRRBA; and (2) through reductions to rates.

Labor 10 1 0 (46) 4 0 0 0 Non-Labor 0 18 3 29 2 0 0 0 Other 0 0 0 0 0 0 0 0Total 10 19 3 (17) 6 0 0 0

Company Wide Adjustment 2 GRC-JAB-CW-LABORTONONLABOR-923

This adjustment moves labor costs recorded as outside service costs to non-labor so that those costs areappropriately reflected.

Labor (10) 0 0 0 0 0 0 0Non-Labor 10 0 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 0 0 0 0 0 0 0

Organizational Unit Adjustment 1 A&G IT-KWK-OU-BOM-STLMNT RECD

This adjustment removes one time receipt of legal settlement from Microsoft.

Labor 0 0 0 0 0 0 0 0Non-Labor 0 1,890 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 1,890 0 0 0 0 0 0

Organizational Unit Adjustment 2 A&G IT-KWK-OU-BOM.12.09.AP.COR

This adjustment is a one time correction of December 2009 accrual to correct operating unit that was incorrectlyaccrued to Client Services & Planning 923.

Labor 0 0 0 0 0 0 0 0Non-Labor 0 (10) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total 0 (10) 0 0 0 0 0 0




Activity: C L I E N T SERVICES & PLANNING 923



| Adjs - (Nominal $) $ (000)2008 2009 201 0 2011 2012 2013 2014 2015

Organizational Unit Adjustment 3 A&G IT-KWK-OU-BOM.OVPYMT

This adjustment is to record a one time removal of an overpayment of Convasys which was subsequently refunded in 2009.

LaborNon-LaborOther

000

0(300)

0

000

000

000

000

0 0 0 0 0 0

Total 0 (300) 0 0 0 0 0 0

Organizational Unit Adjustment 4 A&G IT-KWK-OU-923CONS.REMOVE

This adjustment removes costs associated with one time consulting expenses.

Labor 0 0 (4) 44 (4) 0 0 0Non-Labor 0 0 (6 8) (548) (168) 0 0 0Other 0 0 0 0 0 0 0 0Total 0 0 (72) (504) (172) 0 0 0

Organizational Unit Adjustment 5 A&G IT-KWK-OU-923TO920921-IT

This adjustment transfers expenses from various IT packages from FERC 923 to FERC 920-921 to reflect currentcharging practices.

Labor 0 (1) 0 0 0 0 0 0Non-Labor (909) (228) 0 0 0 0 0 0Other 0 0 0 0 0 0 0 0Total (909) (229) 0 0 0 0 0 0





Activity:

Witness:


Bradley K. Sweetser



INCREMENTAL O&M FOR NEW SOFTWARE PROJECTS FERC Account 920/921





Activity: INCREMENTAL O&M FOR NEW SOFTWARE PROJECTS 920-921



2012$ (000)

Recorded2012

Forecast2015

Labor Itemized Forecast 0 5,222Non-Labor Itemized Forecast 0 3,682Other N/A 0 0Total 0 8,904


This activity is used to record costs associated with certain capitalized software project-related costs which are expensed. These costs include activities performed during the preliminary project stage, data conversion activities, activities performed during the post-implementation/operation stage, vendor maintenance and licensing contracts not covered by the capitalized software projects and system decommissioning activities.


F000000



FERC Account: 920,921 Administrative and General Salari es/Office Supplies and Expenses

Activity: INCREMENTAL O&M FOR NEW SOFTWA RE PROJECTS 920-921





Labor 0 0 0 0 0Non-Labor 0 0 0 0 0Other 0 0 0 0 0Total 0 0 0 0 0

Adjustments- (Nominal $) - see Appendix B for additional detailLabor 0 0 0 0 0Non-Labor 0 0 0 0 0Other 0 0 0 0 0Total 0 0 0 0 0



Non-Labor 1.0932 1.0743 1.0518 1.0240 1.0000

Other 1.0000 1.0000 1.0000 1.0000 1.0000

Recorded/Adjusted (Constant 2012$)Labor 0 0 0 0 0Non-Labor 0 0 0 0 0Other 0 0 0 0 0Total 0 0 0 0 0


6 I----------------------------------------------------------------------------------------------------------------------------------

4 ------------------------------------------------------------------------------------------------

2 ---------------------------------------------------------------------------------------------------------------------------------

0 ---------------------------------------------------------------------------------------------------------------------------------

-2 ---------------------------------------------------------------------------------------------------------------------------------

-4 ---------------------------------------------------------------------------------------------------------------------------------

-6 , , , ,-----------------2008 2009 2010 2011 2012




FERC Account: 920,921 Administrative and General Salarie s/Office Supplies and Expenses



Forecasting Methods - Summary of Res ults of all Methods Studied - 2012$ (000)

2 Recorded Years (2011 - 2012):_____________________________________________________________Results of Averaging (A2)

COoCM ^roCM 2015 | sd** 1ChosenLabor 0 0 0 0 noNon-Labor 0 0 0 0 noOther 0 0 0 0 noTotal 0 0 0 n/a n/a


2013 | 2014 1 2015 | r2* | Chosen 2013 | 2014 | 2015 | sd** 1ChosenLabor 0 0 0 0.00 no 0 0 0 0 noNon-Labor 0 0 0 0.00 no 0 0 0 0 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 0 0 0 n/a n/a 0 0 0 n/a n/a


2013 | 2014 1 2015 | r2* | C hosen 2013 | 2014 | 2015 | sd** 1ChosenLabor 0 0 0 0.00 no 0 0 0 0 noNon-Labor 0 0 0 0.00 no 0 0 0 0 noOther 0 0 0 0.00 no 0 0 0 0 noTotal 0 0 0 n/a n/a 0 0 0 n/a n/a


COoCM roCM 2015 1 r2* | Chosen

COoCM roCM 2015 | sd** | Chosen0 0 0 0.00 no 0 0 0 0 no0 0 0 0.00 no 0 0 0 0 no0 0 0 0.00 no 0 0 0 0 no0 0 0 n/a n/a 0 0 0 n/a n/a

Other Methods:


COoCM roCM 2015 1 | Chosen

COoCM roCM 2015 | | Chosen0 0 0 no 0 2,487 5,222 yes0 0 0 no 0 1,754 3,682 yes0 0 0 no 0 0 0 no0 0 0 n/a 0 4,241 8,904 n/a

Forecast Adjustments:Base Forecast Method Adjustments***

Method

COoCM roCM 2015 |

COoCM roCM 2015 | |IF 0 2,487 5,222 0 0 0IF 0 1,754 3,682 0 0 0

N/A 0 0 0 0 0 00 4,241 8,904 0 0 0

* r2 = R S q u a re d (B a s e d on record ed y e a r s data)

* * s d = s tan d ard deviation (B a s e d on rec ord ed y e a r s data)








Method SelectedLOoCM^

r

oCMCOoCM

Labor Itemized Forecast 0 2,487 5,222Non-Labor Itemized Forecast 0 1,754 3,682Other N/A 0 0 0Total 0 4,241 8,904


Analysis of Linear Trending Method:Linear trending is not the appropriate forecasting methodology because the Incremental O&M for New Software Projects activity has no recorded adjusted data to produce a linear trend that is re presentative of future expenses required.

Analysis of Averaging Method:Averaging is not the appropriate forecasting methodology because the In cremental O&M for New Software Projects activity has no recorded adjusted data to produce an average that is representative of future expenses required.

Analysis of Last Recorded Year (2012):Last recorded year is not the appropriate forecasting methodology because the Incremental O&M for New Software Projects activity has no recorded adjusted data to produce an estimate that is representative of future expenses required.

Analysis of Itemized Forecast Method:An itemized forecast method derived from project estimates was chosen for the forecast as no historical data exists. We have allocated the recurring and one time expenses to labor and non-labor ba sed on overall 2012 recorded data.




Activity: INCREMENTAL O&M FOR NEW SOFTWAR E PROJECTS 920-921



10,000

8,000

6,000

4.000

2.000

02008 2009 2010 2011 2012 2013 2014


2015

1 Recorded Period$ (000)

Forecast Expenses (constant 2012$) 2008 | 2009 | 2010 | 2011 | 2012 2013 | 2014 | 2 0 15Labor (standard escalation) 0 0 0 0 0 0 2,487 5,222Non-Labor (standard escalation) 0 0 0 0 0 0 1,754 3,682Other (not escalatable) 0 0 0 0 0 0 0 0Total 0 0 0 0 0 0 4,241 8,904

Labor Prior year Total 0 0 2,487Change 0 2,487 2,735Total 0 0 2,487 5,222

Non-Labor Prior year Total 0 0 1,754ChangeTotal

0 1,754 1,9280 0 1,754 3,682


Total ChangeLabor 0 2,487 2,735Non-Labor 0 1,754 1,928Other 0 0 0Total N/A 0 4,241 4,663




Activity: INCREMENTAL O&M FOR NEW SOFTWAR E PROJECTS 920-921



2012 - 2013

Labor: 0

Not applicable.

Non-Labor: 0

Not applicable.

Other: 0

Not applicable.






This page shows the changes in Labor, Non-Labor, and Oth er expenditures forecast during 2013 through 2015, including reasons for the addition of personne l (labor), increased office supplies required due to an increase in activity (non-labor).

2013 - 2014

Labor: 2,487

The increase in labor is driven by new software projects which are detailed in testimony (SCE-05, Vol 1).

Non-Labor: 1,754


Other: 0

Not applicable.







2014 - 2015__________________________________________________________________________________

Labor: 2,735

The increase in labor is driven by new software projects wh ich are detailed in testimony (SCE-05, Vol 1).

Non-Labor: 1,928


Other: 0

Not applicable.



FERC Account:

Activity:

Witness:

920,921 Administrative and General Salar ies/Office Supplies and Expenses

INCREMENTAL O&M FOR NEW SOFTWA RE PROJECTS 920-921

Jay A. Castleberry

APPENDIX A




199Workpaper - Southern California Edison / 2015 GRC - APPLICATION____________________





F000000 DIRECT CHARGES TO FERC ACCOUNTExpenses charged directly to the Federal Energy Regulatory Commission (FERC) account and not to a specific final cost center.



920,921 Administrative and General Salarie s/Office Supplies and Expenses

INCREMENTAL O&M FOR NEW SOFTWAR E PROJECTS 920-921

Jay A. Castleberry


$ (000)2008 2009 2010 2011 2012

F000000 DIRECT CHARGES TO FERC ACCOUNT 0 0 0 0 0

Total 0 0 0 0 0

* * D u e to rounding, totals m a y not tie to o ther w ork p aper p a g e s .

FERC Account:

Activity:

Witness:



FERC Account:

Activity:

Witness:


INCREMENTAL O&M FOR NEW SOFTWA RE PROJECTS 920-921

Jay A. Castleberry

APPENDIX B






Activity: I N C REMENTAL O&M FOR NEW SOFTWARE PROJECTS 920-921


Detail of Total Company Adj ustments to Recorded Expenses

| Adjs - (Nominal $) $ (000)2008 2009 2010 2011 2012 2 0 1 3 2014 2015




2015 GRC SCE-05 Vol. 1 -Capital Projects Used for O&M

Analysis



Cap

ital

Proj

ects

Use

d Fo

r Ana

lysi

s of

Tes

t Yea

r Fo

reca

st O

&M

(C

apita

l in

Nom

inal

$00

0)

De

sc

rip

tio

n

Ca

pit

al

Fo

rec

as

t

20

13

- 2

01

7

Re

cu

rrin

g O

&M

T

es

t-Y

ea

r

Fo

rec

as

t

1S

CE

.com

/CR

M I

nteg

ratio

n$

38,7

00.0

$25

9.8

2in

terio

r D

efen

se$

34,7

60.5

$50

6.7

3eD

MR

M (

Ent

erpr

ise

Doc

umen

t Man

agem

ent/R

ecor

ds M

anag

emen

t)$

32,6

04.0

$13

0.0

4N

ER

C C

IP$

28,2

25.8

$47

5.0

5G

eogr

aphi

c In

form

atio

n S

yste

m (G

iS)

$27

,595

.1$

1,32

0.0

6C

omm

on C

yber

Sec

urity

Ser

vice

s (2

015

- 20

17)

$25

,371

.0$

1,12

0.0

7P

erim

eter

Def

ense

$25

,328

.8$

230.

58

Dat

a P

rote

ctio

n$

23,0

61.5

$43

6.8

9M

SO

Inte

grat

ed W

ork

Man

agem

ent

$21

,666

.3$

367.

210

Ren

ewab

le C

ontr

act M

anag

emen

t Sys

tem

$20

,520

.0$

530.

011

CR

AS

App

licat

ion

$18

,872

.0$

125.

8

12C

ell R

elay

s$

17,3

00.0

$26

.313

Enh

ance

d M

eter

and

Usa

ge C

apab

ility

$16

,600

.0$

70.0

14C

onso

lidat

ed M

obile

Sol

utio

n (C

MS

)$

16,0

32.0

$22

0.0

15C

omm

on C

yber

Sec

urity

Ser

vice

s (2

013

- 20

14)

$15

,239

.3$

1,10

4.0

16D

istri

butio

n M

anag

emen

t Sys

tem

(DM

S)

$13

,144

.0$

175.

0

17P

haso

r Adv

ance

d A

naly

tics

$13

,100

.0$

131.

718

Mas

ter A

cces

s P

roje

ct U

mbr

ella

$12

,356

.0$

210.

019

Cus

tom

er S

ervi

ce S

yste

m E

nhan

cem

ents

$12

,000

.0$

136.

520

Veg

etat

ion

Man

agem

ent

$10

,500

.0$

105.

0

21E

lect

roni

c W

ork

Ord

er P

acka

ge$

10,0

00.0

$16

6.7

22G

rid C

ontr

ol C

ente

r Cyb

er S

ecur

ity$

9,00

0.0

$30

0.0

23S

ecur

ity O

pera

tion

Cen

ter (

SO

C)

$7,

688.

7$

128.

224

SO

NG

S C

yber

secu

rity

$7,

500.

0$

83.3

25P

ole-

Load

ing

App

licat

ion

Rep

lace

men

t (P

oLA

R)

$7,

067.

8$

118.

0

26E

nter

pris

e C

ompl

ianc

e M

anag

emen

t Sys

tem

$7,

000.

0$

87.5

27G

RC

Pha

se II

Non

-Dyn

amic

Pric

ing

Rat

es$

6,50

0.0

$49

.028

Pro

tect

ion

Sys

tem

Mai

nten

ance

Pro

gram

(PS

MP

)$

6,20

0.0

$85

.029

Sto

rm A

naly

tics

$5,

900.

0$

78.7

30G

rid V

isua

lizat

ion

- B

uild

ing

the

GC

C D

igita

l Wal

l$

5,90

0.0

$20

.0

31S

mar

tCon

nect

Mon

itor&

Ana

lysi

s (S

CM

AS

)$

5,10

0.0

$39

.732

FAS

B P

roje

cts

(Mul

tiple

)$

5,04

0.0

$67

.4

$50

5,8

72

.6$

8,90

3.6

K> O CD

Cap

ital

Pro

ject

s D

etai

ls F

or A

naly

sis

of T

est

Yea

r Fo

reca

st O

&M

(C

apita

l in

Nom

inal

$00

0)

CIT

De

sc

rip

tio

n a

nd

De

tails

20

15

20

16

20

17

To

tal

CIT

-00-

DM

-DM

-000

032

SC

E.c

om/C

RM

int

egra

tion

267.

851

1.6

779.

4C

IT-0

0-T

R-R

M-0

0000

4In

terio

r Def

ense

49

3.0

49

3.0

534.

11,

520.

1C

IT-0

0-S

D-P

M-0

0014

4eD

MR

M (

Ent

erpr

ise

Doc

umen

t Man

agem

ent/R

ecor

d:13

0.0

130.

013

0.0

390.

0C

IT-0

0-TR

-RM

-000

001

NE

RC

CIP

450.

045

0.0

525.

01,

425.

0C

IT-0

0-S

D-P

M-0

0000

9G

eogr

aphi

c In

form

atio

n S

yste

m (G

iS)

1,32

0.0

1,32

0.0

1,32

0.0

3,96

0.0

CIT

-00-

SD

-PM

-000

175

Com

mon

Cyb

er S

ecur

ity S

ervi

ces

1,09

0.0

1,12

0.0

1,15

0.0

3,36

0.0

CIT

-00-

TR

-RM

-000

002

Per

imet

er D

efen

se2

09

.72

09

.727

2.1

691.

5C

IT-0

0-T

R-R

M-0

0000

3D

ata

Pro

tect

ion

436.

843

6.8

436.

81,

310.

4C

IT-0

0-D

M-D

M-0

0002

5M

SO

Inte

grat

ed W

ork

Man

agem

ent

473.

862

7.8

1,10

1.5

CIT

-00-

SD

-PM

-000

112

Ren

ewab

le C

ontr

act M

anag

emen

t Sys

tem

530.

053

0.0

530.

01,

590.

0C

IT-0

0-S

D-P

M-0

0010

2C

RA

S A

pplic

atio

n12

5.8

125.

812

5.8

377.

4C

IT-0

0-O

P-N

S-0

0038

3C

ell R

elay

s78

.878

.8C

IT-0

0-S

D-P

M-0

0010

5E

nhan

ced

Met

er a

nd U

sage

Cap

abili

ty10

5.0

105.

021

0.0

CIT

-00-

SD

-PM

-000

041

Con

solid

ated

Mob

ile S

olut

ion

(CM

S)

220.

022

0.0

220.

066

0.0

CIT

-00-

SD

-PM

-000

103

Com

mon

Cyb

er S

ecur

ity S

ervi

ces

1,07

9.0

1,10

4.0

1,12

9.0

3,31

2.0

CIT

-00-

SD

-PM

-000

140

Dis

tribu

tion

Man

agem

ent S

yste

m (D

MS

)17

5.0

175.

017

5.0

525.

0C

IT-0

0-S

D-P

M-0

0020

2P

haso

r Adv

ance

d A

naly

tics

395.

039

5.0

CIT

-00-

SD

-PM

-000

136

Mas

ter A

cces

s P

roje

ct U

mbr

ella

210.

021

0.0

210.

063

0.0

CIT

-00-

DM

-DM

-000

017

Cus

tom

er S

ervi

ce S

yste

m E

nhan

cem

ents

204.

820

4.8

409.

5C

IT-0

0-S

D-P

M-0

0015

4V

eget

atio

n M

anag

emen

t31

5.0

315.

0C

IT-0

0-S

D-P

M-0

0018

9E

lect

roni

c W

ark

Ord

er P

acka

ge25

0.0

250.

050

0.0

CIT

-00-

CC

-CC

-000

027

Grid

Con

trol

Cen

ter C

yber

Sec

urity

450.

045

0.0

900.

0C

IT-0

0-S

D-P

M-0

0013

8S

ecur

ity O

pera

tion

Cen

ter (

SO

C)

128.

212

8.2

128.

238

4.6

CIT

-00-

CC

-CC

-000

028

SO

NG

S C

yber

secu

rity

125.

012

5.0

250.

0C

IT-0

0-S

D-P

M-0

0013

7P

ole-

Load

ing

App

licat

ion

Rep

lace

men

t (P

oLA

R)

118.

011

8.0

118.

035

4.0

CIT

-00-

SD

-PM

-000

064

Ent

erpr

ise

Com

plia

nce

Man

agem

ent S

yste

m87

.587

.587

.526

2.5

CIT

-00-

SD

-PM

-000

170

GR

C P

hase

ii N

on-D

ynam

ic P

ricin

g R

ates

73.5

73.5

147.

0C

IT-0

0-S

D-P

M-0

0015

3P

rote

ctio

n S

yste

m M

aint

enan

ce P

rogr

am (

PS

MP

)85

.085

.085

.025

5.0

CIT

-00-

SD

-PM

-000

195

Sto

rm A

naly

tics

236.

023

6.0

CIT

-00-

SD

-PM

-000

203

Grid

Vis

ualiz

atio

n -

Bui

ldin

g th

e G

CC

Dig

ital W

all

60.0

60.0

CIT

-00-

SD

-PM

-000

172

Sm

artC

onne

ct M

onito

r&A

naly

sis

(SC

MA

S)

59.5

59.5

119.

0C

IT-0

0-S

D-P

M-0

0014

1F

AS

B P

roje

cts

(Mul

tiple

)67

.767

.267

.220

2.1

6,9

55

.79

,01

9.5

10,7

35.5

26

,710

.7


new 2015 general rate case application · 2013. 11. 13. · 2015 general rate case - application...

Documents