ERCOT Seeks To Expand Requirement For Market Participants To Report Cybersecurity Incidents To ERCOT

ERCOT has filed a new Nodal Protocol Revision Request, NPRR 1334, which would expand the cybersecurity incidents which market participants must report to ERCOT

Currently, the reporting is limited to cybersecurity incidents at a Market Participant’s computer network or system that interfaces with an ERCOT computer network or system

NPRR 1334 would expand this reporting obligation to include incidents at the systems of a vendor, of a Market Participant, which interface with ERCOT's systems

Furthermore, in addition to cybersecurity incidents at a Market Participant’s or vendor's systems which interface with ERCOT, NPRR 1334 would require the reporting of cybersecurity incidents that would jeopardize the Market Participant’s reliable operation or performance in the ERCOT market, regardless of whether the affected systems interface with ERCOT's systems

NPRR 1334 would also specifically establish that a Market Participant must report the cybersecurity incident as soon as practicable "within the initial 24-hour period" after determination of a Cybersecurity Incident (the current protocols only require reporting "as soon as practicable")

Specifically, NPRR 1334 would provide that a Market Participant shall notify ERCOT as soon as practicable within the initial 24-hour period after determination of a Cybersecurity Incident on:

(a) The Market Participant’s or its vendor’s computer network or system that interfaces with the ERCOT Wide Area Network (WAN), the Market Information System (MIS), or any other ERCOT computer network or system; or

(b) The Market Participant’s or its vendor’s computer network or system that could foreseeably jeopardize the Market Participant’s reliable operation or performance of its obligations under the Protocols, an Other Binding Document, or Agreement.

As under the current protocols, a Market Participant’s agent may assume the reporting obligation