Energy Choice
                            

Matters

New York Utilities Say They'll Stop EDI Exchanges With ESCOs Absent New Vendor Risk Assessment, Data Security Agreement; RESA Seeks Administrative Process To Address Concerns

June 5, 2018

Email This Story
Copyright 2010-17 EnergyChoiceMatters.com
Reporting by Paul Ring • ring@energychoicematters.com

The following story is brought free of charge to readers by EC Infosystems, the exclusive EDI provider of EnergyChoiceMatters.com

The Retail Energy Supply Association asked the New York PSC to open a formal process to address risk and data sharing concerns raised by the joint utilities, who RESA said had previously informed ESCOs that the utilities would cease data exchange traffic with parties failing to sign new agreements proffered by the utilities

RESA stated in its request to the PSC that, "in April, New York Joint Utilities (the 'JU') reached out to NY Energy Service Companies (the 'ESCOs') and the Electronic Data Interchange ('EDI') vendors with regards to data security issues. In their correspondence, utilities asked the ESCOs and the EDI vendors serving in their territories to execute a Vendor Risk Assessment ('VRA'), as well as a Data Security Agreement ('DSA'). It is our understanding that the utilities’ actions were in response to a reported cyber event involving an EDI vendor that occurred in late March. The utilities also stated that they are requiring all ESCOs and the EDI vendors to sign the DSA as early as May 29, 2018, or they would cease the data exchange traffic with these parties."

"We want to acknowledge that RESA shares the same concerns as the JU and we are fully committed to protecting privacy of our customers, and keeping retail electric and gas services, as well as our networks safe from cyberattacks. However, any agreement between the JU and the ESCOs should be closely tailored to addressing this specific concern and should include input from all stakeholders," RESA said in its request

"Shortly after the JU distributed the DSA and the VRA to the ESCOs and EDI vendors, DPS Staff scheduled a roundtable discussion on May 31, 2018. While RESA greatly appreciated the opportunity to meet with the stakeholders, at the end of the meeting, it became evident that there are still many substantive issues for the stakeholders to work through and resolve. During our two-hour meeting, we heard many different viewpoints across multiple parties. RESA believes that the stakeholders need a formal process to collect comments that is publicly accessible under an official Commission docket. Moreover, all stakeholders should be afforded the same process to discuss relevant issues, rather than bilateral discussions between the JU and the ESCOs and/or EDI vendors," RESA said in its request

"Therefore, RESA respectfully requests that the Commission formalize a process for collaboration, allowing all the parties to provide information and comment in an orderly fashion regarding the finalization of the DSA and VRA. RESA believes that initiating a new proceeding with a new case number will serve that purpose in the most efficient and productive way. Without an official docket, administratively, it will be extremely complicated and burdensome for the interested parties to closely follow the comments provided with regards to the cyber security issues and the DSA," RESA said in its request

RESA said in its request that, during the meeting, the joint utilities agreed to create a unified VRA in order to reduce the burden on ESCOs and EDI vendors. "We understand the JU is committed to this task and we urge the Commission to formalize any process the JU undertake in creating a standard VRA," RESA said in its request

Additionally, RESA said that during such meeting, the joint utilities had noted that there was a formal comment period for a DSA in Case 14-M-0224, Proceeding on Motion of the Commission to Enable Community Choice Aggregation Program, which was later approved by the Commission. RESA said in its request that, "It is important to note that Docket 14-M-0224 was specific to the Community Choice Aggregation (CCA) programs. Although RESA provided comments in that docket, those comments were specific to the implementation of the necessary framework for the development of municipal CCA programs and RESA’s comments in that proceeding were limited to the issues regarding the CCA. Accordingly, RESA would like a similar opportunity to comment on the current DSA that is being discussed here."

RESA proposed in its request that, if the Commission agrees, and initiates a new matter, or gives official notice to the parties for providing comments on the cyber security issues in Case 14-M-0224, the Commission should follow the schedule that RESA proposed at the meeting and which RESA said, "we believe was accepted in principal by the stakeholders during yesterday’s meeting":

• Starting from the day of the initiation of a new Commission proceeding, a 60-day collaborative period between the stakeholders to work out the details of a standard VRA, as well as a final DSA;

• Stakeholder comments submitted to the JU and the Commission under the new docket by June 22, 2018;

• JU to provide a response to the stakeholder comments by July 13, 2018;6

• Schedule a meeting with all parties during the week of July 23, 2018 to finalize the DSA and the VRA;

• Finalize and execute the DSA by August 2018.

ADVERTISEMENT
NEW Jobs on RetailEnergyJobs.com:
• NEW! -- Sales Executive
• NEW! -- Direct Sales -- Retail Supplier
• NEW! -- Channel Sales - Associate -- Retail Supplier
• NEW! -- Operations Analyst -- Retail Supplier
• NEW! -- Sr. Business Development Manager -- Retail Supplier
• NEW! -- Sales Support Specialist -- Retail Supplier
• NEW! -- Natural Gas Operations Manager -- Retail Supplier
• NEW! -- Energy Consultant