run Jun: :1?th Lu 

 

 

 

ELECTRICEMERGENCY INCIDENT 
DISTURBANCE REPORT

   

 

i CHI - .Thxs IS mandatory undo: Public law 93?275, Failure to comply may result 131 manual lions, anvil penaloos and other sanctions as providod by
law.- For the sanctions and tho provisions concealing the con?dtn?ality ofinformation sobmittod on this fowl, one Gotcha! lhfommion platoon of tho msuuctions.
Title-18 USC 1001 makes is. criminal offense for any person knowingly and willingly to make. to any. Agent-v. or Department of the Union! States any, false,
?ctitious, or fraudulent statements as to an} miter within its jurisdiction

 

RESPONSE DUE: .

Within 1 hour ofthehlcidont, submit Sohcclule 1 and lines in Schedule 2 as an Emmgenoy Aim-report ifc?tom 1?8 are met

Within 6 hours of the h1cident,submit Schedule 1 and lines- in Schedule 2 as a Normal Report'if only criteria 9-12 are met.

By?m later (Ii-?24 bouts a?crthe recogtition (tithe inddent OR by ?le and ofthn next business day submit. Schedule 1 Rhos as a 
1f mm 13- 24 are met A?bto 4 00pm local rim-c will be cmmidgrod the end ofrho business do?

Submit updates as needed landlord ?nal report (all of Schedules I and 2) within 72 houmof the incident.
repelling entities regiment}. in the Unixod States; NERC has approved that tho form meets'thc submi?al worms Then: may
be other applicable regional, state and local reporting Watts.

 

METHOBS MG RESPONSE
(Retain-a copy of this'fonn fox your ?les)

Galina: Submit form via aniline submission at: himsz?moonotl doe.oovaE4l 7! 
FAX: FAX Form 05417 to the following naming numhoz: (2035363435.

'Alternnt?: Ifyoo are: unable to submit coho: or by ?zz, {wins-may be e-mailed to or call and new: the information to the:
following telephono number. (202) 5363100.

 

SCHEDULE 1 t? ALERT CRITERIA

(Page 1 of4)

 

Criteria for Filinngheck all, that apply)
See Instructions For Eliot's Information

 

I- :1 l?hysical attack that causes major intmuptions or impacts to critical in?nstzuchnc ?xdh'ties or to opaations

2. event that causm interruptions of electrical system operations

EMERGENCY ALERT

File Within 1-Hour 3. I 3 Complete operational failure or shut-down of the transmission andfor distribution electrical system

4. I Electxical System Separation (1351:111de when: part or parts of a power grid rcmninls) operational in an otherwise

Han!" 5? 1?3 ?m ?35? ?5 blacked out area or within the parlial failure ofan integrated etemcaz system

checked this form mt be
hired within .1 hon: of the . .
incl! check E.- may 5. Unorgollod loss (?300 Megawatts or more af?rm system loads for 15 moles or more ?om a smgle
Ale-11(forthcAlm Status) on. 

Luna A below. 6. Firm load shodding of 100 Megawatts or more implemenlcd under magency operational policy

7. Systemawido voltage reductions of 3 percent or more

8. Public appeal to reduce the use of Electricity for purposes of mahnaining the continuity of the Bulk System

 

 

NGRMAI. REPORT 
File within 64mm 9. 3 Physical attack that could potentially impact electric power system adequacy or reliability; or vandallsan which

targets components of any security systems
33:13be 942 on the right is
checked AND non: of the 10- event that could. potentially impact electn'c power system adequacy or reliability
boxes 1?8 are ducked, this
form must he ?led within? 11. I If Loss of clect?c scxvice to more than 50,000 01511013155 for 1 hour or more
houxsof'thn incident; check
Kama] Report (for the Alert 12. i: Fuel supply emergencies that could impact electric power system adequacy or reliability
Shams) on Line A below-

 

 

 

 

 . . 

 

SCHEDULE 1 -- ALERT CRITERIA -- CONTINUED

(Page. 2 of 4)

 

.SYSTEEVI REPORT
File within Laniness Day

IfanyiboxlB?TZIE on the right-is
chnakedANI} none of the.
boxeridlarecl?cked, ?ns
fol-in must be ?led'by the later
of24 hours a?er the
recognition of theinmdenr '93 
by the end of the next business
day.Note. 4:00pm local lime
will be considered dae'end of
:rhe'bu?ness- day Chock
System Report (for {he Alert
Status) on Line A be1ow..

 

13-[

14. 
15.{

1H



18.[

214

22-[

23. i

24. 

Damage or clenfruction of a Facility within its Reliability Coordinator Area, Balancing Authority Area or
Transmission Operator Area that results in action(5) to avoid a Bull; Electric System Emergency.

Damage or damm?on of its Facility that results ?om actual or suspected intentional human action.

1 Physical threat to its Facility excluding weather (xi-natural disaster related threats, which has the po?entiai to
degrade the ammo! operation of the Facility. Or suspicious device or activity at its Facility.

3 Physical threat. to its Bulk Electric System control center, excluding weenie: or natural disaster related (locate, which
has the potential to tinged: the normal operation ofthe comm! center. Or suspicious device or activity at its Bulk
Electric System control center.

3 Bulk Electric System Emergency resulting in mirage deviation on a Facility; A voltage deviation equal to or
greater than 10% of nominal voltage sustained for greater than or equal to 15 continuous minutes-

I Uncontrolled loss of 200 Megawatts or more of ?rm system loads for 15 minutes or more from a single incident for
entities with previous year?s peak denmmi less than or equal to 3,000 Megawatts

Total generation loss, within one minute of: greater than or equal to 2,000 Megawatts in the Eastern or Western
Interconnection or genie: man or equal to 1,400 Megawatts in the ERCOT Interconnection

Complete loss of o??wsile power (3.0013) af?rming a nuclear generating station per the Nuclear Plant Interface
Requirements.

1 Unexpected Transmission loss within its area, contrary to design of three or more Bull: Electric System
Facilities caused by a common disturbance (excluding success?rl automatic enclosing).

1 Unplanned evacuation from its Bulk Electric System control center facility for 3G continuous minutes or more.

I Complete loss of Interpersonal Communication and Alternative Interpersonal Commication' capability affecting
its sta??ed Bulk Electric System control center for 30 continuous minutes or more.

Complete 1055 ofmonitoting or control capability at it stn??ed Bulk Hectic System control center for 30
continuous mnmres or more.

 

Ifsigm'?cant changes haire ocmnred after ?ling ?anir?tial Input-t, re~?1e the form with the and check Update (for the'Alcrt Stems) on'Line A below.

Alert Status (check one)

  

   
  


1 Hour

 

B. Organization Name

sPoWer

 

 

C. Address of Principal Business Of?ce

 

2183 South 1300 East Suite 680 Salt Lake City Utah 34106

 

 

 

 

 

 9111.49 3343M rm euumlueu uua:

 
  
 
  

 

 

 

 

     

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

a 
ELECTRIC EMERGENCYINCIDENTAM
DISTURBANCE REPDRT
SCHEDULE- 1 -- ALERT 
3' of 4 
Area(5_) A?em myng?. Angeies Couniy; Utah: Salt Lake Cennty; Wymning: Converse Gamay;
(Comty, State)
DalefTime Incident Began {33 - [15 - 2mg} {33 12 )Eastem Him} Mountain
)usiug 24?hour clock mo dd yy hh mm 1Paci?c }A}aska 1 Hawaii
:33 135 ~2?19j jg 52f ]Eastem )Cenmi Mmmtain
{muddy}? usmg 244mm clock mo dd yy 11!: Paci?c lAlaaka if 'i Hawaii
Did the incidenifdishubanee 
6' systemfaiee? (cheek one) Yes}: I No I 3 Unknown 
Estimate of Amman efDemand 'Invoive?
Ho . - (Peak Megawatts) . Zero ?nknawn 
I. . Estimate ofNumber of {Immune A?eciaed 2m Unknown I
I I I Check aili that apply
J. Cause K. Impact: L. Adina Taken
a None
C3 Control center loss, Mm, or evacuation
CE Loss at degradatio? of control center monitori?g
er comaaicaiim systems
CI Unknown Damage 0: of a facility
5 PhySical a 115 ck CI Electing} system sepexaiinn (islanding) None
meat attack ?1mm?! 5mm? :1 Shed Firm ma: Load sham ef 100
3:1 Vandalism WW and!? dmb?mm mm or were implemented under
C1 Theft Ci Map): transmumon system mtermpuon (three or $3913? operatimm} policy (1mm ualiy
Suspicious activity more BR) Elements) or ausonmtically via UPLS or media!
CI Cyber event (m?anna' tion technology) Major system mtermpuon action scheme)
a Cyber event (operational techn. elegy}- Uncontroiled 1055 Of 200 MW at more Of ?rm CI Public appeal to reduce the use of
Ci Fuel emugencies, intemmtion, or system loads for 15 minutes or more elasticity for the purpose of minim ?ng
de?ci . 5 Loss of eiectnc senate to more than 50,001} the can . . of the dc: ?it: pawn"
CI Generator 1035 or faiiure not due to fuel mm for 1 hour ?mm system
interruption or de?ciency or transmission :1 System-wide voltage or 3 percent or C1 Implemenmd a naming, ain't! or
failure more contingency plan
Trans . ion equipment failure (not in :1 Voltage demtxon on an ?32:th of 13 Voltage 1- .m
substation or switchyard) 310% f? ?5 ms Shed lutumptible Lead
Ci Fem at high voltage substation or switchde 0 Inadequate elecmc resources to same load Repel} ed 01' restored
13 Weather 01? natural disaster :1 mm? ?f L400 MW .Mtigatien implemen' ted
[j 0 . tor ac?on?) Generating capacity 1055 of2,000 MW or more Other
:1 Other [3 Comglete loss of off-site power to a nuciea: Additional Inf ti :3 eats
Additional Information/Comments: ?mm mm ?f ijm ?fn?f?f?f 
Initial assessment mwaked that firewal! exploit Mas ?ay utilized to a Oth?? whem??ly
exeu?eadet?aefsewiee 
leading to an appmxitnaeey 5 minute Wm outage Addition-'11 Infoma?eu/Comments:
Fire-ya! reheat; mt?ted in hie! mm outages
(mwximieiy 5 {linden} WMG Mm aim Bid hem
the sites and W8 Cmifd Center

 

 

 

 

 

 

 

 

 

 

 

 
 
 

ELECTRIC A289)
REPORT

 

 

 

 

 

SCHEDULE 2 NARRATIVE DESCRIPTION
(Page 4 of 4)
fight-mafia}! m: Scheduie 2 will not be dis-timed to rim public. to the grim: mat it satis?es the crite?afqr exemption rmder the Fir-mam of?t?m?m Act, ag 
can?dantiaf commercial in?ma?on and nude 5mm, csr'fam mfommtfon that maid endanger the :qfegv afar: individual or
information deg: axed a: Cdficaf Energy Infoma?or:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document 2

B. 0" 4-94.! .7 EV 

   

 

?221.15 6? TRI CY INCEENTAND
DISTURBMCE REPORT

   

 

This repoxt 15 mandatory antler Public Law 93-2?5. Failure to comply may maul: in cnminal ?nes, civil penalties and other sanctions as provided by.
law.-' For the sanctions and the provisions coaeuning the con?dentiality ofinfonnatim Submitted on this fomi, see Genetic} Infotmationpmtion ofthe instructions;
Title 13 USC l??l Makes it'a criminal offense {ne'anypersou knowingly and willingly to make to aey'Agency or Maximal of the United States any false,
?ctitious, or fraudulent statements as- to any matter Within its jurisdiction-

RESPONSE nae:

Within 1 hour ofihe ineld?nt,? mm Schetiule I3 and lines in Schedule 2 as an Emergendy Aim repo? if mm 1?8 are met.

Within 6 hours oft?e incident, submit-Schedule I: and lines: - in Salami: ?2 as a Normal Room ifonly czitezia 9-12 are met.

Bythe latest of24 11mm; a?e?he recognition ofthe-incideat @by the end ofthe stem business day submit Schedule} lines in Schedule 2 as a System
Repo?-ifcxite?a- 13~24 are met Note 4 00pm local time Will'be con?dent! the and offhabusinass day-

 

Submit updates as needed aadlor a ?nal report (all of Schedules 1' and 2) within 72 hows of the incident.

FoiNERC'repm?ng entities registered in the Ultimo States; NERC has approved that the ?rm 05417 mist-ho submirlal mis?ts. ?at NERC. There may
be other applicable regional, state. and local reporting requirements.

METHODS OF FILING RESPONSE

{Retain a completed copy of this font: forryour ?les.)

 

Oil-line; Submit font: via ooiine solmaission at: OE41 7!
FAX 2am; to the ?yllowing facsimile number. (202)-53678435.
Alteriiate: lfyolu are unable to submit online or by fax, foam-may be e-mailed to doelzgeoc@gzg.dma.gov= or call and taped the in?smation to the

follOwiag telephone number: (202) 536-3100;

 

SCHEDULE 1 ALERT CRITERIA.

(p391 

 

Criteg'a in; Etling (Check all that'appiy)
See Instructions For Rial-e Inform-lion

 

1.. Phyaical attack that causes major intmaptions or magmas to critical facilities or to operations
2. Cyber event that causes interruptions of electrical system opemtions
EMERGENCY ALERT . . . . . . . -
A File. with-in 1~Honr 3. Complete operational fadure or shut?down of the transmumon andJor distribution electrical system
4. I Electrical System Separation (Islanding) where pan or parts of a power grid remain(s) Operational in an otherwise

 

 

1:13:13; ngilliisg Eon Maggi? blacked out area or within the partial failure of an integrated electrical system
?led within 1 hour ofthe . 
incident", checkE' . 33::an loss (?300 Megawatts annexe of?xm 15 minute-sermon: fromasmgle
Alexi-{for the Alexi Slam) on
Line-A bolowload sheddmg of 100 Megawatts or more mder mnergency operational policy
7, i System-wide voltage reductions of 3 percent or more
3. I Public appeal? to reduce the use of electxicity for purposes of maintaix?ng the continuity of the Bulk Electric System
NORBIAL REPGRT
"File Within 6-Hours. 9. Physical attack that could. potentially impact electric power system adequacy or reliability; or vandalism which

. targets components ofaay security systems
Ifany box 9-12 oathe tight is
checked none of the 10. Cyber event that could potentially impact electn?e power system adequacy ?reliability
boxes 1-3 axe checked, this
form must be ?led within 6 11. i Loss of electric service to more than 50,000 customers for 1 how or more
boils of the incident; check
Norma-l- Repott (for the Alert 12. I 1 Fuel supply emergencies that could impact electric power system adequacy or mliability
Status) 01': Line A below-

 

 

 

 

 

 231 4:91.? 92:??st .WF . . . 1

SCHEDULE 1 ALERT CRITERIA CONTINUED
(PagoZ of 4)
I3- Damagc or destruction of a Facility within its Rcliability Coordinator Area, Balaucing Authority Area or
Tmsmissim Operator Area that realms io actioo?z) to avoid a Bull: Electric System Emergency.

 

 

l4. Damage or destruction of its Facility that results from actual or suspected iotomional human action.

15. 1 Physical tints?: to its Facility excluding weather- or natural disaster related threats, which has tho potential to
degrade the normal opemtion of the Facility. 0: suspicious dovico or activity at its Facility.

16- 1 Physical throat to its Bulk Electric System control center, excluding weather or natural disaster related threats, which
SYSTEM WQRT. has the pom-mini lo degrade the normal opmtioo of the control confer. Or suspicious device or activity at its Bulk
Filo within. Lanioess Day Electric System control coma-r.

Ifanyhox 1334.011 $132 right is 17, 1 Bulk Beside System Emergency resulting in voltage deviation on a Facility; A voltage deviation equal to or
chockcd AND none oftho greater than 10% of nominal voltage mmined for greater than: or equal to 13 continuous minutes.

this

foam must be ?led by the later 13, l: Uncontrolled loss of 290 Megawatts or more of final system loads fox 15 minutes or more from a single incidm: fox

 

of 24 hours after 1132' entities with previous year?s peak demand loss than or equal to 3,000 Megawatts
rocogoition of tho incident 
bY 'tho codjofthc 19. Total generation loss, within one minute of: greater than or equal to ZGOO Megawatts in the Boston or Western
day. Nor-e 4:09pm local tune . Interconnection or greater than or equal to 1,400 Megawatts in the ERCOT Interconnection
will is: considered the'cnd of
the 20, Complete loss of oE-si'te power (LOOP) affecting a nuclear galemting station ?le Nuclear Plant {tn-1131c:
- Roport (for tho Aim Requirements.
Stains) col-inc A b?low,

21. Unexpected Transmission loss within its area, contrary to design, of three or more Bulk Electric Systom
Facilities caused by a common (excluding successful automatic rcclosing).

22- I Unplanned evacuation from its Bulk Electric System control center ?icil?y for 30 contimmus minutes or more.

23. Complex: loss of Interpersonal Communication and Alternative Incapersoml capability affecting
its sta??ed Boll: Electric Systan control center for 30 commoous minutes or more.

24. Complete 1055 ofmoniton?ng or control capability at its sta?'od Bulk Electric System comm! for 30
continuous minutes or more.

 

 

Ifsiggzi?cant changcs have courted after ?ling the initial reportro??lc the foam with the chaogcs and check Update (for tho Ala-{rt Sam) on Lino A below.

?on: than must be ro??lod wit?in 72 horas 0mm smegma, the latest information and Piml'wim Siam) checkout: Line A bolow, unless ?Fem.

     
 

 

 

Emgency Alexi. Normal Report Report Update Final
A. Alert Sam (checkms) 
1 Hour 6 Hours 1 Business Day As required 72 Hours
sPower

B. Organization Now: i

 

2180 South 1300 East Suite 600 Sail Lake City Utah 84105

C. Address of Principal Businoss. O?ice

 

 

 

 

 

 

g?iwzp if." ?iht?IUU I0 U-UE:

 

 

 

ELECTRIC EMRGENCYINCIDENTAM
DISTURBANCE. REPOR 

 

SCHEDULE ALERT NOTICE

   

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3 .Of 4
Cal??omia: KernCounty, Les Angeies County Utah: Salt Lake County; Wyoming: Converse County;
. -- (Camry, State) 
DatefTime IncidentBegan . 93 335 - mi 2 12 IEasfem }Cmt1?a1 Mountain
using 24?hour clock mo dd yy i111 mm 1 Paci?c 1 Alaska 1 Hawaii
Datefl'imelnsidem Ended .. {13 - (15 #mi 33 52 ]Eastmn 1Cmml Mmmtain
(nun?dxi-w? hhamm) using 24?11mm: clock mo dd yy 11]: mm I Paci?c }Alaska Hawaii
Did the originate inyour
sysf?nfafca? (check one} Yes}: I NO: 1 Unknown 
Estimate of Demand Involve_d_
H. (Peak Mtgawatts) Zem Unknown 
- I. Estimate ofNum-ber of Castomm's Affectcd' 2510 Unknown 
Check all that apply I
J. Cause 1C Impact L. Ac?an.Takaen'
13 None
[3 Control center 1055, failnra, or Evacuation
Loss a: degradation of control acute:- monitoring
or communication 5375th
Unknown 5 Damage or destruction ofa facility
Physical attack [3 Electical system separation (islanding) E3 None
Ct Threat attack emit/?5 {mm 5mm? ?f m? a Shed Finn Load: Load shedding of 190
CI dealism {13115111159103 and/er dmmbuhon MW at more impiemmted under
The? Cl Magur system (three or gens}! operational policy (manualiy
Suspicious activity mm BBS dame-mg) or automa' ?cally via oa- remedied
CI Cybet evcnt (mfmmatx' ?on technology) 3 d?mmtm? mm action scheme)
Cyber event (mational techn. elegy) Uncanno?ed 1mg of200 or more Of ?rm Public appeal to reduce the use of
E3 Fad 58;)pr emergencies, or system imds for 15 mm or more electricity for the W56 of mm? mnmg? 
de?ciency Ci Loss of eiecmc mice ta more than 50,000 the continuity of the eiectxic power
Gimm- {or loss or failure not due to fuel supply customm for 1 hour or 11101": system
in or de 1.1de or tm ?ssion CI System-wade voltage reductions or 3 percent or Impfailure more contingency pkan
E: equipment mm (110: including a wage demu?m ?n 3? mm?! tam?? ?f Voltag? 
substation a: gamma) 210% f? 15 mm? a Shed Intermptible Load
Failure at high voltage substatimz or snitchyard Inadequate electm: resources to sew: load Repaired or restated
Weather or natural disaster Genexatmg capaczty loss of 1,400 MW or more Mitigation imp! . ted
CI aim actian(s) Ci Generating capacity 1053 (?2,000 MW or more 3 0th?
Other Ci Complete 1055 of off-site pnwer to a nuciear Additional Inf tiam?C cuts
Additional ?f ?1f f: ?f ?fm?mm?m
{115831 835mm revealed mat a 319603 was We?! utiis?zed to Other expand wkm?ty

heading to {in npwax?nawy 5 mimic amnica?m outage Additionai InfomatianfCommth:
?rewall whom ma?adin brie! mm mnaqea
(apprm?maieiy 5 ninuies) We! devices at site: and hem
. the sites and W8 Central Ceniar

 

 

 

  
 

 

 

 

 

 

PM. Submitteci tome

 

 

ELK IRIC EJIERGENCY INCIDENT 
DIST ?513,le CE REPORT

   

 

SCHEDULE 2- - NARRATIVE DESCRIPTION
(Page 4- of 4)
Inj?mafionqn Schedule 2 will not. be disciosgd {q the public {a the extent that it satis?es {its c?fm'fafor exemption under the Freedom oflufomm?mr Act, 
armp?am?r Con?der: rial commercfai? and knife: warms, certain :?n?matian {hat-amid endanger ?ts physical safety of an .asr
fnfonnm?ion designated as Critical Emma}! In?nshucmminfonna?on.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Document 3

 

 

From: Tarduggno, Matdiew

To: Evans Karen Lotto, Adrienne

Cc: Kenneth Bueii {Kenneth?ueii?mdoegov}; Kumar esh
Subject: Foilow?Up on Dania! of Service-Incident

Date: Friday, March {38, 2019 5:59:89 PM

USE ONLY

All,

i wanted to quickiy foliow~up on the d-enial-of-service- (DOS) incident experienced by sPower, a
company that owns and operators soiar and wind generation assets in several states, that we noted
this morning. i spoke with the operations manager of sPower this morning and the has also
been in contact with the company. 

On March 5, sPower noted a series of brief communication outages between their control center
and their remote sites. Upon further investigation, the communications outages were determined to
have been caused by firewall reboots. After consulting with Cisco, the firewall manufacture, it was
determined that the firewall reboots were caused by a Dos attack exploding a known vulnerability.
Cisco recommended a firmware update, which sPower has been deploying across their system, after
testing for compatibility. The 005 incdent was observed intermittently over a 3.2 hour period and no
further activity has been observed since this time. sPower has reviewed log files and has found no
evidence of a breach beyond the DOS attack. Additionally, the incident did not have any impacts on
operations.

When i spoke with sPower they did? not expect to need any additional support or have any ongoing
concerns; however, they will contact us if the-re are any issues. (13) (7X5)

We have been providing Office of intelligence and
Counterinteliigence with updates and they are ready to investigate any indicators, as appropriate,
and have been checking for any related incidents. We wiil work with and the to provide
appropriate information to the sector as availabie.
Please let me know if you have any questions.
Best Regards,
-Matt
Matthew T. Tard uogno
infrastructure Security 8: Energy Restoration
Office of Cybersecurity, Energy Security, at Emergency Response
US. Department of Energy
Office: 2025862892 Mobile: (6)
Matthew.Tarduogno@hq.doe.gov
USE ONLY

 

 1.7.. 

 

Document 4

 

51.38 TRI EMERGENCY INCIBENT AND
DISTURBANCE REPORT

   

 

This report is mandatory under Public Law 93 275 Fallow to comply may result to criminal ?nes? civil penalties and other sanctions as provided by
law For the sanctions can the provisions concerning the con?dentiality ofiofoonatioo submitted on this form, see General information portion oftlic instructions.
Title 13 USC l?fil makes it a criminal offense for any person knowingly and willingly to make to any Agency or- Bepartment of the United States any false,
?ctitious, or fraudulent statements as to any matter Within its jurisdiction

RESFONSE DUE:

Within 1 hour of?ine incident. sobmit Schedule 1 and lines M- in Schedule 2 as an Emergency Alert report if criteria 1?8 are met

-Within. 6 hours ofthe otcidoot. Submit Schehle and lines to Schedule 2 as a Normal Report ifonly criteria 9 l2 are-met

By the later of24_ hour's a?uthe recognition ofthe incident OR by the end ofthe next business day- submit 1 lines in Schedule ?3 as a System
Report if criteria 13424 are met. Note 4 Own: local time will be cansm?amd the and oft?o business day

 

Submit updates as needed earlier a ?nal report (all of I and 2) Within 72 hours oftlte mcidout.
For NERO reporting entities registered in the {holed States; NERC has approved that the them: meets the submittal rcquiremcots for NERO There may

be other applicable regional, state and local reporting requirements
METHODS OF FILING-RESPONSE

(Retaio'a completed copyloft-his form for your ?les.)

 

'Online: Submit form via polioc submission at: hmg: do oetldoc aovaE4l 7f
FAX Porto 013?41? to the followiog ?resirnile number. {202) 586-8485-
Alternate: - Ifyou are unable to submit saline or by fax, forms may be mailed to doegeoc'? 119. doe. or call 311d report the information to the

following telephone number {202) 58?- 8100.

SCHEDULE 1 ALERT CRITERIA
(Page 3. of4)

Criteria for Filing (Check all that agility)
See Instructions For More Information
1. 1 Physical attack that causes major interruptions or impacts to critical facilities or to operations

 

 

 

2. Cyber event that causes interruptions of electrical system operations

EMERGENCY ALE-RT

File within 3. Complete operational failure or shut?down of the transmissxoo anilfor distribution electrical system

 

4. Electrical System Separation (lslanding) where part or parts ofa power grid remain(s) operational in an otherwise

{Ely} berg?: Eon blacked out area or within the partial ?tilorc of an integrated electrical system 
g?mwg?iia thourof?jy Exiled loss (?300 Megawatts or more of ?rm system loads for 15 mimics or more from a single I

Alert Alert Status) on 
Line A below.-

6. Firm load shedding of 100 Megawatts or more implemented under emergency operational policy
7. 1 System-wide- voltage reductions of 3 percent or more

8. l: 1 Public appeal to reduce the use of electricity for purposes of mahztairmrg the cootimtity of the Bulk Electric System

 

 

REPORT
the within {Sf-Hoots 9L thsical attack that could potentially impact electric power system adequacy or reliability; or vandalism which
targets comments of any security systems
Ifaoy box 9-12 on the rightist
checked AND none of the 10. event that could potentially impact electric power system adequacy or reliability
boxa; 1.3 are checked, this
form must be ?leci within 6 ll. Loss of electric service to more than 50,000 customers for 1 hour or more
hours of the 
Normal Report (for the Alert 12. 1 Fuel Simply emergencies that could onpact electric power system adequacy or reliability
Status) on Line A below.

 

 

 

 

 .. ..

 

SCHEDULE 1 ALERT CRITERIA CONTINUED

(Page 2 of 4)

 

SYSTEM REPORT
File within Lanimass Day

Ifany box 1334.01: the right is
checked Whom: ofthe
M35: 1712 are this
?rm mast be ?ledby the 131m"
of?! hours afterthe
:ecogmtion of 11m incident 
by'the cad-af?x: 11m Business
day. Note. 4:50pm local time
considuod the end of
the'business day. 
system Most the Alan
Sums) on Line A lac-low?

 

131

Damage or of a Facility within its Rcliability Coordinamr Area, Balancing Authority Area 01?
Transmission Operator Area that msults in actiun(s) to avoid a Bull: Elccu?ic System Emergency.

14. i Damage or o? its Facility that results {mm actual or suspected intentional human action.

15.{

16.[

1H

mi

19.{

:20. 

21-1

22- 

23. 1

24. 

3 Physical threat to its Facility excluding madam"- ar natural disaster related threats, which has the: potential to
?14:de the normal (mention of the Fadlily. Or mmpicieus device or ac?vity at its Facility.

1 Physical threat to its Bull: El-ecuic System control earner, excluding weather or natural disaster related tincats, which
has the patential to dagade the nonnal apemtim ofthc control center. 01? suspicious device or activity at its Bulk
Electn'c System control center.

Bulk Elect-it: Sysl'em Emergency resulting in. voltage deviation on a Facility; A voltage deviation equal to or
greata? than 10% ofnuminal voltage sustained for greater than on" equal to 15 cm?nnous mm

{Jasmin-oiled loss of 200 Megawatts or more of ?rm system loads for 15 minutes or more from a single: incidm: for
entities with previous year?s peak demand 1:35 than 01' equal to 3 ,000 Megawatts

I Tami genmtion loss, within one minute of: greater than or equal to 2,000 Megawam in the Eastcm at Western
Interconnection or greater than or equal to 1,400 Megawatts in the ERCOT Interconnection.

I Complete lass of off-site power (LOOP) a??ec?iing a nuclear gwerating station pet the Nuclear Plant lulu-face


Unexpected Tmn?ssion lass witl?n its great contrary to dwigm of three or mote Bull: Electtic System
Facilities caused by a-cormnon distuxbancc (excluding success?ii automatic mlosing).

Unplanned evacuation ?-mn its Bulk Electric System central center facility far 30 continuous minutes or more.

I Complete loss of Enigma! and Alm?ve Intapmonal Cemunication capability affecting
its ata??ed 13qu Electric System comm} center 30 continuum; 13mm; or mom.

3 Complete 1055 ofnmm'tming or control capability at its sta?'ed Bulk Eleciric 23mm control emit: for 38
continuous Mates or more.

 

If signi?cant changes have beam a?er ?ling the repent; rte-file dad form With the changes and check Update (f6: Aim on Line A belbw.

The form must be tea??led within ?12 hours 0mm in?dmt-W?h the 13m in?nma?an and Final (Alan 'm Line A mm, updated

 

Emcrgency Alert Normal Report System Up?ate Final

 

B. Organiiatiou Name

Hour 6 Ham 1 Business Day As reqn??ed 7?2 Hams
SPower

 

 

 

C. Addre?s of Principal Busing?. Of?ce,

2181] South 1300 Easl Suite 600 Salt Lake City Utah 84106

 

 

 

 

 

E31 3! 4'93 3. 9.31.3..3umm??q IQ. WC.

  
   

 

 

 

 

 

    

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

ELECTRIC EEHERGENCYINCIDENTM
REPORT
SCHEDULE 1 -- ALERT NOTICE.
1) Geographic Area(s) Wed Caiifomia: KerewEoumy, Lee Angeies County; Utah: Salt Lake County; Wyoming: Omvezse County;
(County, State)
Date?imehmd' entBegm 133 1939 {19 32 ]Easiem 3Centra3 Mountain
:15ng 24?11013: clock mo dd yy hi1 nan Paci?c Maska I Hawaii
'Datef'?memuden'_ tEnded' H5 -2?39! 38 52 I ]Eastem jCen?al {)Qantain
(m?dd?yyf 1x11111111) using 24-hour clock mo dd yy hh mm Paci?c Alaska 1Hawaii
Did the incidentfdisnubance originate in your
G. . 3 due) Yesf No I 1 Unknown 
H. Estimate of Maggi? Involved Zero Union-9% 1
I. Estimte of Number of Customers A??eeted Zeno Uninxmm i
I Check all that. apply I I I
1. Cause. K. Impact L. Action Taken .
8 None
[3 Control cenier loss, failuse. or evacuation
:1 Loss or degradation of control center monitoring
or communication system:
CI Unknown CE Damage or destruction of a facility
Physical a 1 {3 Electrical system separation 6st 33 None
Threat of physical attack ?3 (:um mama? 5mm? 13 Shed Finn Load: Load madam of 100
Vandalism and!? dmb?m?m 53mm MW 01? more .impiemented under
I: Theft E3 Major trammission system iniemxption (three or ope-ratimlai 1705(1)? (manua?y
:1 Suspicious activity ?we RES amen?) or automatically via ms at medial
C3 Cybet event (13' {urination technology) :1 Major distribution 33mm mtemzpn? action scheme)
Cyber event- (operatioxial technology) Uncauto?ed 3955 Of 200 MW 0? mom of?un Public appeal to reduce the use of
Fuei supply emergencies, 51m ?an, or system but? for 15 mmutes urmore electricity for The purpose of maintaining
de?ci [3 Loss of ?eeing me to more than 50,000 the can . of the electric WW5
E3 Generator loss or fa?ure not due to fuel supply was ?x 1 hour or more system
mmaou or de?ciency or transmission System~mde voltage mimnms or 3 patent or Implemem ed a waning, ate-rt, or
- failure more contingency plan 
Ci equipment failure (not including Voltage demuon on an fatality 0f Voltage reduction
substation or snitchyard) 210% for 15- mutes or mom Ci Shed Interruptible Load
C3 Failure at high voltage substati-oa or switchyard E3 Inaciequate electric resources to serve load Repaired or restored
Weather or nature} disaster Cl Generating capacity 1055 of 1,400 MW 01? more [3 Mitigation imp] . ted
ate: a chic 11(5) Generating capacity less of 2,030 MW or more IC 1
Other Complete 1055 of off?site power to a nuclear Additiona} Inf tim?Comme-nts
Additional 3?3ng ?no? f?dh 
gamma! {weaned that a ?rewall exploit was 1&er utilized in Ogle-r mm mm?

leading to an mmimsaeiy 5 minute a: less maximums outage Additionai 'hlfomationfComments:
?rewall reboots testi?ed in brief Micah-as mirage:

we ?ies and W?s CM CM

 

 

 

 

 

 

 

 

 

5319/29.} 9 12:53?00m Submitted 

 

 
 
 

ISLE TRICEMERGENCY INCIDENT AND
DISTURBANCE REPORT

  

 

 

 

. SCHEDULE 2 VARRATIVE DESCRIPTION
(Page A uf 4) -
Infoma?onon S?hedug?? 2 n9! 53 10-51:; public to theatre": that it saris?g; ?re. c?fez?afor mmp?on Nada? Fmdom aflnfam?m Act, 9,32,
?xgmp?ans?r and made'sxrem, certain inflame-rim: that maid endangm? the physical sa?zt}! 'afan individual, or
frgfoma?on d?esfgnared as Energy In?rma?an.

 

 

 

gt:
9?