J.01_Service_for_Compliance_of_the_TRE.pdf

STATEMENT OF WORK

FOR

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

NERC AND TEXAS RELIABILITY ENTITY

COMPLIANCE SERVICES CONTRACT

I. Introduction

The U.S. Section of the International Boundary and Water Commission (USIBWC) is a Federal Government Agency and the U.S. component of the International Boundary and Water Commission (IBWC), which applies the boundary and water treaties of the United States and Mexico. Our mission is to provide binational solutions to issues that arise during the application of United States‐Mexico treaties regarding boundary demarcation, national ownership of waters, sanitation, water quality, and flood control in the border region.

Amistad and Falcon Dams are on the Rio Grande River between the U.S. and Mexico along the Texas border. The United States and Mexico operate separate power plants on each side of the Rio Grande River. The USIBWC operates the U.S. power plants. The combined capacity of the power plants provide WAPA with 98 MW of hydropower to market to two south Texas cooperatives over Central Power and Light Company's transmission system.

II. Description of Service The USIBWC, Amistad and Falcon Hydroelectric Power Plants are located at 670 Texas Spur 349, Del Rio, TX 78840 and FM2098, 1 Reservoir Rd. Falcon Heights, TX. 78545, respectively.

Both Power Plants have a requirement under this Statement of Work (SOW) for a qualified Contractor with extensive experience (5 years or more) in North American Electric Reliability Corporation (NERC) Reliability Standards identified in Federal Energy Regulation Commission

(FERC).

The Contractor shall assist USIBWC to resolve the current NERC possible violations and comply with federal and regional reliability standards for two hydroelectric plants: Falcon and Amistad Dams. These two hydroelectric plants are located in the state of Texas and monitored by Texas Reliability Entity, Inc. (Texas RE). Texas RE is the regional entity served by the Electric Reliability Council of Texas (ERCOT) through a Delegation Agreement with the North American Electric Reliability Corporation (NERC), approved by the Federal Energy Regulation Commission (FERC).

Texas RE is authorized to develop, monitor, assess, enforce compliance with NERC Reliability Standards, develop regional standards, assess and periodically report on the reliability and adequacy of the bulk power system (BPS). Texas RE complies with the NERC Reliability Standards through various compliance monitoring tools. One of these compliance monitoring tools is an annual audit in which USIBWC experienced in 2016. During the audit, Texas RE documented various possible noncompliance standards listed as possible violations in Attachment A (Table 1A: Summary of Possible Violations Compliance). USIBWC is currently working to resolve these possible noncompliance standards, using a mitigation process detailed in a milestone plan with activities to resolve each specific possible violations.

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

The Contractor will assist USIBWC to develop, implement policies, processes, and procedures to prevent recurrence. This will include training employees as required by the mitigation plan.

The Contractor will provide all labor, software recommendations, material, equipment, supervision, and management to comply with this Statement of Work (SOW). To access both Hydroelectric Power Plants, vendors need to cross through the United States Port of Entry and must comply with proper documentation (passports or other) as required by U.S. Customs and Border Protection officials.

III. Background

The United States Section of the International Boundary and Water Commission (USIBWC), Amistad and Falcon Hydroelectric Power Plants are located at 670 Texas Spur 349, Del Rio, TX 78840 and FM2098, 1 Reservoir Rd. Falcon Heights, TX. 78545, respectively. To access both Hydroelectric Power Plants, vendors need to cross through the United States Port of Entry and must comply with proper documentation (passports or other) as required by U.S. Customs and Border Protection officials.

As a Hydroelectric Power Plant generator owner, USIBWC is required to meet federal and state mandated requirements, including the North American Electric Reliability Council (NERC), Texas Reliability Entity (Texas RE), and the Electric Reliability Council of Texas (ERCOT) Standards and Requirements. USIBWC is registered with NERC as a Generator Owner (GO), and a Generator Operator (GOP). USIBWC does not own/operate any transmission or distribution lines.

IV. Scope The Contractor shall support USIBWC’s in mitigating several possible violations pertaining to NERC Compliance Standards for the two hydroelectric power plants. The Contractor will conduct an extensive review of the possible violations identified during the 2013 audit and closely work with USIBWC to complete the activities for each of the possible violations and to prevent recurrence.

USIBWC is mandated to file a formal Mitigation Plan and Milestone Activities. As part of this mandate, USIBWC has a draft Mitigation Plan and Milestone Activities proposed by Texas RE, provided in Attachment B. The Mitigation Plan and Milestone Activities is in Microsoft Excel format and contains: 1) description of the violation; 2) cause of the violation; 3) plan to correct the violation and prevent recurrence; 4) milestone schedule; 5) expected completion date; and

6) contact information. Tasks 1 through 6 below establishes a sequential order for this SOW.

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

Task 1‐Review and Finalize Mitigation Plan and Milestone Activities The Contractor shall review the current Mitigation Plan and Milestone Activities containing preliminary dates to resolve the violations, and in conjunction with USIBWC Compliance Committee, determine a timetable for completion of the Mitigation Plan including the completion date by which the Mitigation Plan will be fully implemented and the corrected.

Implementation of the activities for each milestones will not be more than three (3) months apart with expected completion dates no more than three (3) months from the date of submission. The Contractor shall be familiar with the forms required to address the possible violations for each Reliability Standard and in conjunction with USIBWC complete the forms.

Once the forms are completed and signed, USIBWC will submit to Texas RE and NERC.

After the timetables are finalized for each milestone, the Contractor shall submit a final Mitigation Plan to USIBWC ready for submittal to Texas RE and NERC as confidential information in accordance with Section 1500 of the NERC Rules of Procedures.

Once the Mitigation Plan and Milestone Activities are submitted for approval to Texas RE and NERC, the Contractor will commence on completing the activities in the Mitigation Plan for each of the violations. USIBWC has completed the first milestone activity for all the possible violations which is establishing a Compliance Committee. This Compliance Committee will review and approve submittals pertaining to the possible violations by the Contractor.

Overview for Tasks 2 through 5 The Facility (FAC) Reliability Standards ensures the reliable planning and operations of the Bulk Electric System (BES) are determined based on technical sounds principles. During the compliance audit by Texas RE it was identified that USIBWC failed to have documentation for its Facility Ratings as required by FAC‐008‐3 Reliability Standard. USIBWC worked with Texas RE to determine what mitigation activities were needed to end the possible violations and prevent recurrence. These activities are as follows: 1) establish a compliance committee and schedule regular meetings (as mentioned above); 2) develop a FAC‐008‐3 facility rating and methodology document; 3) develop a FA‐008‐3 process document; 4) develop a comprehensive internal compliance program (ICP) that addresses compliance with NERC Reliability Standards;

and 6) conduct training for both power plant personnel on the FAC‐008‐3 compliance process and training on the ICP.

The Contractor will refer to Attachment C where all these milestone activates are listed as 1 through 8 for Standard FAC‐008‐3 for subpart R1, R2, and R6. A mitigation activity shall not be more than a three (3) months apart from each of the eight (8) milestones as required by Section

6.2 of the NERC CMEP. The Contractor shall provide experienced personnel, materials (training manuals, forms, etc.), and equipment (computer and projector for training, etc.) to complete

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

the work in accordance with the SOW and the schedule specified in the approved Mitigation Plan and Milestone Activities.

Task 2‐Inventory, Develop, Draft, and Finalize Milestone Activities for FAC‐008‐3 R1, R2, R6 Under this FAC‐008‐3 subpart R1, R2, and R6, the Contractor shall perform the following:

Conduct a FAC‐008 inventory and shall develop inventory asset list for Amistad and Falcon. These will include the following 1) equipment rating for each asset; and 2) identify the source for each rating.

Develop a draft FAC‐008‐3 Facility Rating and Methodology Document addressing the requirements R2 of the Standard.

Develop a draft internal compliance program (ICP) document and develop a draft process document for identifying applicable current and new NERC Standards.

Finalize FAC‐008‐3 Facility Rating and Methodology Document addressing requirements R2 of the Standard.

Finalize the ICP document and the Standard Process Document for identifying applicable current and new NERC Standards. If at this point, there are any changes to the Facility Ratings that require a change to the Resource Asset Registration Form (RARF), the Contractor will assist USIBWC to make the changes on the RARF.

Conduct training on internal compliance program, details are assigned to Task 4 below.

Develop a draft FAC‐008‐3 process document that includes a periodic review of asset inventory and update of Facility Ratings and one‐line diagrams.

Finalize the FAC‐008‐3 process document.

Conduct employee training on FAC‐008‐3 process, details are assigned to Task 4 below.

The Facility Reliability Standards which are issued as Protection and Control (PRC‐) ensures all transmission and generation Protection Systems affecting the reliability of the Bulk Electric System (BES) are maintained and tested. During the compliance audit, Texas RE identified that USIBWC failed to have a Protection System maintenance and testing program for Protection Systems affecting the reliability of the BES as required by PRC‐005‐1b R1 Reliability Standard.

Again, USIBWC worked with Texas RE to determine the mitigation activities required to resolve identified possible violations and prevent recurrence. These activities were: 1) establish a compliance committee and schedule regular meetings (as mentioned above); 2) develop a Protection System Maintenance Program; 3) identify upcoming testing deadlines; 4) conduct training on its Protection System Maintenance Program (PSMP); 5) develop a NERC internal compliance program (ICP); and 6) develop a process for identifying applicable current and new NERC Reliability Standards; and 7) conduct training on the ICP.

The Contractor will refer to Attachment C where all these milestone activities are listed as 1

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

through 7 for Standard PRC‐005‐1b subpart R1 and 1 through 13 for Standard PRC‐005‐1b subpart R2. A mitigation activity shall not be more than a three (3) months apart from each of the thirteen (13) milestones as required by Section 6.2 of the NERC CMEP. The Contractor shall provide experienced personnel, materials, and equipment to complete the work in accordance with the SOW and the schedule specified in the approved Mitigation Plan and Milestone Activities.

Task 3‐Inventory, Develop, Draft, and Finalize Milestone Activities for PRC‐005‐6 R1 Under PRC‐005‐1b, subpart R1, the Contractor shall perform the following:

Conduct an inventory of applicable PRC‐005‐6 R1 asset and develop an inventory asset lists for Amistad and Falcon in preparation for drafting a Protection System Maintenance Program.

Develop a draft PSMP in compliance with PRC‐005‐6 R1.

Finalize the PSMP.

Identify and provide a document with deadlines for upcoming testing as required by PRC‐005‐6. Conduct training on PSMP, details are assigned to Task 5 below.

Develop a Draft Internal Compliance Program Document and develop a draft process document for identifying applicable and new NERC Reliability Standards.

Conduct training on the internal compliance program, details are assigned to Task 5 below.

Finalize the internal compliance program document and finalize process document for identifying applicable current and new NERC Reliability Standards.

Task 4‐Inventory, Develop, Draft, and Finalize Milestone Activities for PRC‐005‐2(i) R2 Under PRC‐005‐1b, subpart R2, the Contractor shall perform the following:

Conduct an inventory of applicable PRC‐005‐6 R1 asset and develop an inventory asset lists for Amistad and Falcon. Create a tracking system to: 1) document testing and maintenance as required by PRC‐005‐6‐R2; and 2) coordinate with USIBWC to identify upcoming testing deadlines.

USIBWC will provide the most recent testing information to the Contractor and the Contractor will compile this on a document as required by PRC‐005‐6 Assets for Amistad and Falcon.

Identify and formulate a list of assets that need to be tested based on the Protection System Maintenance Program for Amistad and Falcon.

Conduct research and provide a list of vendors that USIBWC may contact to obtain quotes for performing the Protection System Testing.

Conduct training on PRC‐005‐6 R2 Standard in order to comply with the testing deadlines. Details are assigned to Task 5 below.

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

Develop a draft internal compliance program document. Develop a draft process document for identifying applicable current and new NERC Reliability Standards.

Finalize the Internal Compliance Program Document and final NERC Standard Process Document.

Conduct Training on the Internal Compliance Program, details are assigned to Task 5 below.

Contractor will coordinate with USIBWC to determine dates to perform the Protection System Testing for Falcon and Amistad. Once the dates are determined, USIBWC will procure a vendor to perform the Protection System Testing.

Participate with USIBWC and vendor during the Protection System Testing for Falcon.

Participate with USIBWC and vendor during the Protection System Testing for Amistad.

Contractor will work jointly with USIBWC to review the vendor’s work of Protection System testing for Amistad and Falcon and review of the testing documentation provided by the vendor.

Contractor will assist USIBWC to update the testing tracking system for Amistad and Falcon to: 1) enter dates of the Protection System Testing; and 2) revise the next due dates for the testing of the equipment tested previously for Falcon and Amistad.

Task 5‐Develop, Implement, and Conduct Training for the USIBWC Internal Compliance Program (ICP) and Other Standards In the transition of properly mitigating noncompliance issues, USIBWC is required to develop, implement, and conduct training for the Internal Compliance Program for the noncompliant standards, Protection System Maintenance Program (PSMP), and testing

The Contractor shall develop, implement and conduct specific NERC FAC‐008‐3 and PRC‐005‐2 Internal Compliance training, processes, testing deadlines, and PSMP classes at both Falcon and Amistad Hydroelectric Power Plants for approximately 25 employees using the guidance established by NERC, FERC and the Regions. The Contractor will provide an instructor or instructors who will travel to Falcon and Amistad and conduct the corresponding training at each site. This will include training manual or manuals and materials.

The Contractor will implement a detailed comprehensive compliance training program as included in the Compliance Plan under Tasks 2 through 4.

The Contractor will coordinate with the Power Production Manager for the time and dates for the following training schedule shown on Table 1:

Table 1

Type of Training Date Time Falcon Dam Amistad Dam

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

ICP for Standard

FAC‐008‐3

TBD TBD 1 day 1 day

ICP for Standard PRC‐005‐1b

TBD TBD 1 day 1 day

FAC‐008‐3 Process TBD TBD 1/2 day 1/2 day

PRC‐005‐6 R2

Testing Deadlines

TBD TBD 1/2 day 1/2 day

PSMP Training TBD TBD 1 day 1 day

CIP Cyber Security TBD TBD 1 day 1 day

Task 6‐Develop and Implement Procedures for Standard PRC‐001.1.1(ii) System Protection Coordination USIBWC is required to establish procedures under Requirements R2, R3, and R5.

1. R2: The Contractor shall assist USIBWC in developing and implementing policies to clearly instruct operating personnel on responding to a protective relay or equipment failure requiring communications with its Transmission Operators (TOP).

2. R3: The Contractor shall assist USIBWC in developing procedures to guide personnel in how to notify its TOP in the event of any changes or additions to its protective systems.

The Contractor shall include a fault analysis, letters of agreement on settings, logs with information to record when TOP was notified of any changes such as new protective systems.

3. R5: The Contractor shall assist USIBWC in developing procedures to guide personnel on how to notify its TOP in advance of any changes in generation or operating conditions that could require changes in the TOP’s Protection System.

Task 7‐Develop, Implement, and Conduct Training on Cyber Security and BES Cyber System Categorization (CIP‐002‐5.1) USIBWC is required to implement the NERC Standard CIP‐002‐5.1a Cyber Security, and Bulk Electric System (BES) Cyber System Categorization. As stated in the CIP‐002‐5.1 Standard Application Guide, “The purpose of this requirement is to identify and categorize BES Cyber Systems and their associated BES Cyber Assets for the application of cyber security requirements commensurate with the adverse impact that loss, compromise, or misuse of those BES Cyber Systems could have on the reliable operation of the BES.”

USIBWC is responsible for implementing a process under CIP‐002‐5.1 Requirement 1. The Contactor shall assist USIBWC in establishing a process organized in three sections: 1) Applicability; 2) Requirements; and 3) Attachment 1 Impact Rating Criteria.

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

The Contractor shall assist USIBWC to select one of the two approach methods: Cyber Asset (Top‐Down Method) or Cyber System (Bottom‐Up). The following steps described below are based on the Cyber Asset approach. However, either approach may be used if USIBWC determines the Cyber System is more adequate.

Applicability Section‐The Contractor shall have full understanding of Section 4 of the CIP‐002‐

5.1 Standard and assist USIBWC to determine and document if USIBWC is a functional entity as defined in Section 4.1; and if USIBWC owns Facilities as defined in Section 4.2. The results of Section 4 will be documented in a report with a list of applicable Functional Entities and types of Facilities.

Requirement Section‐The Contractor shall assist USIBWC to build an initial list to identify the BES Cyber System considering each of the six type of assets:

1. Control Centers and backup Control Centers;

2. Transmission stations and substations;

3. Generation resources;

4. [S]systems and facilities critical to system restoration, including Blackstart

Resources and Cranking Paths and initial switching requirements;

5. Special Protection Systems that support the reliable operation of the Bulk

Electric System; and

6. Distribution Providers, Protection Systems specified in Applicability section

4.2.1 of the CIP‐002‐51a Standard.

The Contractor shall assist USIBWC to review the list obtained above and determine which assets are out of scope or do not meet the NERC Glossary definitions. All the items will be marked as “Yes” or No” and a justification as to why an asset is or not within scope will be documented on this list (Use the supplemental worksheets (Attachment 1) as recommended in the Standard Application Guide CIP‐002‐5.1).

A refined list will be produced, BES Facilities list, it will only contain assets that are within scope and meet the Glossary definition. The new list of BES Facilities will be used for the Impact Rating Criteria for each of the six refined categories:

1. Control Center or Backup Control Centers that meet the NERC Glossary definition of Control Center

2. Transmission stations and substations that meet the BES definition;

3. Generation resources that meet the BES definition;

4. [S]systems restoration systems or facilities that meet the NERC Glossary definition, of

Blackstart Resources and Cranking Paths;

5. Special Protection Systems that act upon BES Facility or Elements;

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

6. Distribution Providers Protection Systems that meet the criteria of Applicability 4.2.1.

Attachment 1 Impact Rating Criteria‐The Contractor will assist USIBWC in categorizing the identified BES Facilities (the new list derived from the exercise above) as follows:

Medium Impact Rating‐Generation and Transmission facilities criteria 2.1 through 2.10

High Impact Rating ‐Control Center or Backup Control Center under criteria 1.1 through 1.4

Medium Impact Rating‐Selected Control Center Criteria under criteria 2.11 through 2.13

Low Impact Rating‐BES Cyber System not categorized as High or Medium Impact Rating under criteria 3.1 through 3.6

Note: The Contractor should note the identification of the control centers draws from assets that meet certain Medium Impact ratings, therefore, the Medium Impact Rating assessment should be performed before the High Impact Rating assessment.

Inventory of Cyber Assets or Cyber Systems The Contractor shall assist USIBWC to inventory Cyber Asset/Cyber System candidates and evaluate to identify BES Cyber Assets for High and Medium BES Facilities:

1. Inventory of candidate Cyber Assets at High Medium category BES Facilities;

2. Focused Inventory of Cyber Assets associated to Medium category BES Facilities;

3. Identification of Cyber Assets that meet the NERC Glossary definition of BES Cyber

Assets.

Identify BES Reliability Operating Services (BROS) for BES Cyber Asset/Systems After the inventory of the Cyber Assets/Systems has been completed, USIBWC and the Contractor shall identify the BROS for High and Medium category for the nine reliability operating services per BES Cyber Assets:

1. Dynamic Response to BES conditions

2. Balancing and Load Generation

3. Controlling Frequency (Real Power)

4. Controlling Voltage (Reactive Power)

5. Managing Constraints

6. Monitoring and Control

7. Restoration

8. Situational Awareness

9. Inter‐Entity Real‐Time Coordination and Communication

Determination of BES Cyber Systems/Assets for High and Medium Category BES Facility

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

The Contract shall assist USIBWC in identifying BES Cyber Systems/Assets for High and Medium category BES Facilities:

1. BES Cyber Asset groups and associated BES Reliability Operating Services (if using optional BROS concept) per BES Facility

2. List of Low Impact BES assets

Final List of Qualifying BES Facilities and BES Cyber System USIBWC with the Contractors assistance will finalize the list of qualifying BES Facilities and BES Cyber Systems and implement applicable protective measures of the following CIP Standards:

CIP‐003‐5 to CIP‐009‐5

CIP‐010.1 to CIP‐011‐1

Training The Contractor shall provide training to both Amistad and Falcon Power Plants using the requirements under CIP‐004‐6 Standard. The Contractor shall refer to Task 5, Table 1 and coordinate with the Power Production Manager the date and time. The Contractor shall provide all training materials, handouts, and presentations.

Risk Assessment The Contractor shall conduct a risk assessment of cyber threats to identify initial weaknesses or vulnerabilities present at Amistad and Falcon Power Plant infrastructure. The purpose of the risk assessment will be to 1) identify clear cybersecurity goals, 2) make informed decision, and

3) establish steps to reduce threats. Identified threats shall accompanied with corrective recommendations in line with best practice standards including the NIST Cybersecurity Framework and North American Electric Reliability Corporation's (NERC) Critical Infrastructure Protection (CIP) version 5 standards. Using the sample approach in NIST‐SP1800‐7 (draft attached), the Contractor will provide information, design drawings, and a complete inventory of the SCADA Systems currently in place at Amistad Power Plant. Falcon Power Plant does not have a SCADA System. The Contractor will provide responses to the presence of controls listed within Table 3.1 Security Characteristics and Controls Mapping and Table 3.2 Products and Technologies. Once the responses are provided, USIBWC Information Technology Security personnel will implement a CyberSecurity program to protect the critical infrastructure at Falcon and Amistad Power Plants.

Other Requirements USIBWC Compliance Committee shall review and provide comments or modifications to the draft submittals for all Cyber Security program and standards.

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

The Contractor shall be responsible for preparing all documentation for USIBWC to submit to Texas RE for the all Cyber Security program and standards using the terminology and standard forms required by NERC.

The Contractor shall be responsible for submitting final certifications to USIBWC and USIBWC will be responsible for submittal of these certifications to NERC for both Amistad and Falcon Power Plants.

Contractor shall conduct a mock or pre‐audit for both Amistad and Falcon Power Plants for internal review of all possible violations and CIP‐002‐5.1a Cyber Security program prior to a new NERC’s audit.

V. Objective

Successful completion of the mitigation plan and all the activities for Tasks 1 through 7 will prevent or minimize the probability of further possible violations of the same or similar reliability standards.

VI. Schedule

Table 2 contains the schedule for the Contractor (Tasks 1 through 7).

Table 2 Task 1

Mitigation Plan

Task 2

FAC‐008‐3

R1,R2,R6

Task 3 PRC‐005‐1b

R1

Task 4 PRC‐005‐2(i)

R2

Task 5 Training

Task 6

PRC‐

001.1.1(ii) R2,R3,R5

Task 7

CIP‐002‐

5.1a

1 month from KM for review and develop a final draft plan with projected dates

3 months for Activity 1 N/A 1 month from KM 1st draft submittal for R2, R3, R5

4 months from KM to Finalize list of Qualifying

BES

Facilities

3 months for Activity 2 N/A

3 months for Activity 3 N/A

2 weeks for finalize

3 months for Activity 4 1 month for final

4 months to Finalize 3 months for Activity 5 N/A

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

KM=Kickoff Meeting

VII. Deliverables

The Contractor will review the Draft Mitigation Milestones Activity Plan provided by the Texas RE and provide recommendations for any changes that will be proposed to Texas RE within 30 calendar days of contract award date.

The Contractor shall submit a final milestone plan to USIBWC Compliance Committee for final review and approval.

The Contractor shall submit all final correspondence to the USIBWC Compliance Committee that will be submitted to TRE for each of the Mitigation Milestones.

The Contractor will provide a monthly status report due the 4th day of every month addressing status of the Mitigation Milestone Activity schedule. The status report will include recommendation and conclusions for the USIBWC Compliance Committee to evaluate and approve within 15 days.

Assisting USIBWC Compliance Committee with internal reviews and/or audits

Assisting USIBWC Compliance Committee with periodic reporting or self‐logging

Assisting USIBWC Compliance Committee with implementing new or revised standards in advance of the effective date, including developing process/procedures and ensuring USIBWC has a full understanding of Standards and Requirements.

comments from the final draft plan

3 months for Activity 6 draft submittal for R2, R3, R5 list of Qualifying

BES

Facilities and BES Cyber Systems

3 months for Activity 7 N/A

3 months for Activity 8

N/A N/A 1 month for Activity 9 N/A

N/A N/A 1 month for Activity 10 N/A

N/A N/A 1 month for Activity 11 N/A

N/A N/A 1 month for Activity 12 N/A

2 weeks for any additional comments and to submit final plan

2 weeks for final for R2, R3, R5

4 months to implement protective measures and implement all applicable

CIP

standards

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

Provide guidance to USIBWC Compliance Committee on other NERC, Texas RE, and ERCOT activities as appropriate and requested.

Provide training to USIBWC personnel on NERC, Texas RE, and ERCOT activities, standards, and guidelines.

Table 3 – Schedule of Deliverables

On‐site Project Kick‐Off Meeting Within 15 calendar days of NTP

Draft and Final Kick‐off Meeting Minutes Within 2 and 4 calendar days of Kick‐off Meeting

Draft Work Plan/Project Schedule Within 30 calendar days of NTP

Status Report 4th day of every month to start within 30/31 days of NTP

Final Work Plan /Project Schedule Within 10 calendar days of receipt of USIBWC comments on draft report

USIBWC Compliance Committee Review and Response to Contractor

7 working days from report receipt

VIII. Assumptions

The Contractor shall work closely with USIBWC Compliance Committee, and both Amistad and Falcon Hydroelectric Power Plant personnel.

IX. Monitoring Progress/Compliance

The Contractor shall be available to participate once a month via teleconference meetings to address questions or concerns between Texas RE and the USIBWC Compliance Committee.

X. Other

A SITE VISIT IS HIGHLY RECOMMENDED PRIOR TO SUBMISSION OF AN OFFEROR’S QUOTE. A

site visit may be scheduled by contacting the Contracting Officer, Lanisa McCollum at 915‐832‐ 4120 or by e‐mail at Lanisa.McCollum@ibwc.gov or Alberto Hinojosa at 956‐844‐9296 or by e‐ mail at alberto.hinojosa@ibwc.gov

The technical point of contact for this project while working at the Amistad facility is Juan Escobar at 830‐774‐5519 or by e‐mail at juan.escobar@ibwc.gov The Technical POC may coordinate site visits, meetings, delivery, and pick up of items or equipment at the work site.

The technical point of contact for this project while working at the Falcon facility is Raul Salinas

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

at 956‐848‐5265 or raul.salinas@ibwc.gov The Technical POC may coordinate site visits, meetings, delivery, and pick up of items or equipment at the work site.

Non Disclosure All aspects of this work are considered property of the Government. The Contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of his contract or any program related to this contract, unless the Contracting Officer has given prior written approval.

Pricing The Contractor shall provide a detailed estimated cost for the work required with this Statement of Work.

Salaries and Benefits The Contractor and all Subcontractors shall comply with all U.S. Department of Labor requirements and labor wage determinations.

XI. Payments

Payment shall be made in accordance with contract clause 52.232‐1

The Contractor shall invoice no more than once a month for services provided in accordance with this SOW.

All invoices shall be sent to the Contracting Officer, Lanisa McCollum at 915‐832‐4120 or by e‐ mail at Lanisa.McCollum@ibwc.gov and the Contracting Officer Representative (COR) Alberto Hinojosa, alberto.hinojosa@ibwc.gov with a copy to invoices@ibwc.gov. Invoices may be sent on monthly/quarter/semi‐annually basis. Final payment of invoice must be marked “FINAL.”

Failure to adhere to these invoice instructions can result in late payment rejection.

XII. Period of Performance

Period of performance shall be 36 months.

XIII. Information to be Furnished by the USIBWC All information provided is categorized as Sensitive But Unclassified (SBU). The Contractor will be required to sign a non‐disclosure agreement to ensure release of this information is only available to individuals performing the tasks under this SOW. In addition, a Non‐Disclosure

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS

Agreement for SBU and Non‐Disclosure Agreement and Conflict of Interest (Attachments 4 and

5) will be required before the use of any information under this contract.

List of Attachments:

Attachment A contains a summary of the possible violations:

1. FAC‐008‐3 R1

2. FAC‐008‐3 R2

3. FAC‐008‐3 R6

4. PRC‐005‐1b R1

5. PRC‐005‐1b R2

Attachment B (Mitigation Plan and Milestones Activity and Status)

Attachment C (Possible Violation Schedule)

Attachment D (Non‐Disclosure Agreement (NDA) for SBU)

Attachment E (Non‐Disclosure Agreement and Conflict of Interest)

END OF SOW

AMISTAD AND FALCON HYDROELECTRIC POWER PLANTS