NERC Enforcement: A Legal Field Guide

Foreword

Foreword

This reference is part of the Legal Series that Energy Compliance, Inc. publishes in partnership with Stich Angell, P.A. It is written for registered entities and for the people who run their compliance and legal programs.

NERC enforcement is, procedurally, a civil enforcement regime. Registered entities often treat it as a compliance process. That framing matters. The decisions made early in an enforcement matter carry through every later stage, and many of them call for legal judgment that compliance teams are not trained to make alone. Recognizing this late is expensive. The cost is rarely visible when the decision is made, and most of it can be avoided with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to give registered entities integrated legal and compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil trial and appellate depth and a growing energy compliance representation practice. Together they offer an alternative to the usual model, where compliance consulting and legal counsel run as separate engagements and only meet once an enforcement matter has already arrived.

We wrote these references for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told the enforcement matter is under control and suspects it is not. And for the outside counsel asked to advise on a NERC matter for the first time, who needs a practitioner's view of the procedure.

These references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have.

If the integrated approach we describe is what your entity needs, the closing pages tell you how to reach us. If not, the reference is still yours. Take what is useful and apply it well. The structural decisions made before an enforcement matter arrives are almost always worth more than the ones made after.

Cara C. Passaro, Shareholder and Firm President, Stich Angell, P.A.

Rob Smith, Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Most registered entities treat NERC enforcement as a compliance process run by compliance professionals. That view is incomplete, and at the moments that matter most it is expensive. Under Section 215(e) of the Federal Power Act, the ERO may impose a penalty only after notice and an opportunity for a hearing, and FERC may review it. The Compliance Monitoring and Enforcement Program (CMEP), Appendix 4C to the NERC Rules of Procedure, fills that framework in with investigations, document requests, interviews and testimony under oath, contested hearings, appeals, and negotiated settlements. Those are the working parts of a civil enforcement regime.

The decisions made early in that process carry through every later stage, and many of them involve legal judgment. This reference lays out the legal architecture of NERC enforcement, the role counsel should play at each stage, the privilege questions registered entities most often get wrong, and the operating framework that joins legal and compliance work before a matter arrives rather than after.

• NERC enforcement is procedurally a civil enforcement regime. Treating it as a compliance process leaves the entity exposed when it matters most.
• The decisions made in the first days after a potential noncompliance surfaces shape every later stage. The CMEP itself moves quickly: a Preliminary Screen is due within ten business days of identification.
• Privilege in NERC matters does not work the way most compliance teams assume. A privilege lost through careless handling is hard to recover.
• Counsel does not replace compliance. Counsel runs the legal layer that compliance is not trained to run.
• A Self-Report is a legal document that compliance teams routinely draft as a compliance document. Its wording matters at audit and at settlement.
• Settlement can begin earlier than most entities realize. Under the CMEP either side may raise it at any time, including before an Alleged Violation is issued.
• A legal-compliance operating framework built before enforcement arrives costs far less than one assembled after.

Chapter 1

Why NERC Enforcement Looks Like Compliance and Behaves Like Civil Enforcement

Registered entities treat NERC enforcement as a compliance process. The procedure is closer to civil enforcement, and the consequences follow the procedure, not the framing.

1.1 The Presentation and the Procedure

NERC enforcement presents itself as compliance work. The vocabulary is compliance vocabulary. The people in the room are compliance people. The documents look like compliance documents.

The statute says so plainly. Section 215(e)(1) of the Federal Power Act lets the ERO impose a penalty on a user, owner or operator of the bulk-power system only after notice and an opportunity for a hearing, and only after it files notice and the record of the proceeding with FERC. Section 215(e)(2), mirrored in 18 C.F.R. § 39.7(e), provides that a penalty cannot take effect before the 31st day after that filing, and that FERC may review it on its own motion or on application by the penalized entity. Section 215(e)(3) also lets FERC itself order compliance and impose a penalty after notice and an opportunity for a hearing.

1.2 What a Civil Litigator Recognizes

Look at the CMEP the way a civil litigator would, and the familiar elements appear quickly:

• A triggering event. A compliance audit, spot check, self-certification, Self-Report, periodic data submittal, complaint, or Compliance Investigation surfaces a potential noncompliance.
• An investigation. Sometimes formal, as a Compliance Investigation under Section 4.4 of Appendix 4C, and sometimes formal in everything but name.
• A factual record. It is built from document production, interviews, and the entity's own written statements. In a Compliance Investigation, the Compliance Enforcement Authority (CEA) may require a verification under oath of the entity's responses and may require officers or employees to give testimony under oath.
• A charging instrument. The CEA notifies the entity of an Alleged Violation through an offer of settlement or a Notice of Alleged Violation and Proposed Penalty or Sanction (NAVAPS).
• A resolution. The matter ends in a settlement, an accepted NAVAPS, or a contested hearing before a Hearing Body with appeal to NERC. NERC then files a Notice of Penalty with FERC, which may review it.

Each step carries procedural rights, evidentiary consequences, and strategic choices that compliance practice alone does not surface.

1.3 Where the Mismatch Shows Up

The gap between the framing and the procedure produces predictable mistakes. Statements made in informal conversations end up in the record. Documents go out in volume without privilege review. Self-Reports are drafted in compliance language that undercuts the entity's later settlement position. Internal interviews happen without counsel, producing accounts the entity later has to defend instead of develop. None of these mistakes looks like a mistake when it happens. Each one binds the entity when it surfaces.

Treat NERC enforcement as the procedural regime it is, and the entity prepares differently. Counsel comes in earlier. Privilege is protected from the start. Statements are made deliberately. Documents are produced after review. Settlement posture is protected in every interaction. In our experience, entities that work this way have a very different enforcement experience from those that treat the process as compliance work that happens to involve regulators.

From the Practice

NERC enforcement looks like compliance and behaves like civil enforcement. The procedure controls the consequences, not the framing. The mistakes registered entities make in enforcement matters are usually invisible when they happen, and counsel is the one positioned to see them in real time.

Chapter 2

The Procedural Architecture: From Self-Report to Settlement

The enforcement lifecycle has identifiable stages, each with distinct legal considerations. Mapping them in advance lets the entity prepare for the decisions each stage will demand.

2.1 The Stages Under the CMEP

The boundaries blur in practice, but the CMEP sets out a recognizable sequence.

Minimal-risk and some moderate-risk matters can leave this path early. Compliance Exceptions address minimal-risk noncompliance and are not counted in compliance history for penalty purposes unless an unremediated exception contributes to a later serious or substantial noncompliance, and Find, Fix, Track and Report (FFT) addresses minimal or moderate risk noncompliance. In both processes the entity must mitigate and may object to the treatment (Sections 4A.1 and 4A.2). Those exits are good outcomes. They are also outcomes the entity's early characterization of the facts helps decide.

2.2 The Legal Work at Each Stage

Each stage raises legal questions a compliance-only response will not address. The Self-Report decision involves judgment about characterization, scope, supporting evidence, and the framing the entity wants in the record. The investigation stage involves production decisions, privilege calls, and witness preparation that compliance personnel should not make alone. The NAVAPS stage calls for legal analysis of the regulator's theory, the factual disputes worth contesting, and the entity's settlement position. The settlement stage calls for negotiating discipline, precise drafting, and an understanding of how the agreement will read when NERC reviews it for consistency and files it with FERC.

2.3 Map the Stages Before You Need the Map

This is not a hypothetical exercise. Before any enforcement matter arises, the entity should have a written framework that names who owns each stage decision, what counsel's involvement looks like at each stage, and what documentation discipline applies. Entities that wait until enforcement arrives make the early decisions under pressure and without coordination, and the early decisions are the ones that bind everything after.

Compliance keeps ownership of the facts and the operational work throughout; counsel's role grows by stage and leads from the Alleged Violation onward. Counsel does not displace compliance in the procedure. Counsel runs the legal layer alongside compliance and protects the entity's legal position at each stage. In our view that division of labor holds up better, in front of the regulator and inside the entity, than either function working alone.

From the Practice

The enforcement lifecycle has identifiable stages, and the CMEP spells most of them out, with deadlines. Mapping them in advance is the cheapest preparation available. Compliance keeps ownership of the facts and the operational work throughout; counsel's role grows by stage and leads from the Alleged Violation onward. That is a division of labor.

Chapter 3

Evidentiary Posture in the NERC Process

Evidence in NERC matters is created, produced, and characterized at every stage. Each evidentiary decision affects what can be argued later.

3.1 The Evidentiary Universe

Evidence in a NERC matter is not only what the entity produces in response to a Regional Entity request. It includes every record the entity has created or kept that the CEA could later ask for: procedures, operating logs, email, internal investigation memoranda, audit response material, settlement drafts. The CEA has authority to collect documents, data, and information in the manner it considers most appropriate (Appendix 4C, Section 5.0). Once a Compliance Investigation or Preliminary Screen notice arrives, the entity is instructed to preserve all relevant records (Sections 4.4.1 and 5.2). The evidentiary universe is much larger than the production universe, and the entity's posture toward each is different.

3.2 Decision One: What to Create

Internal documents created during a compliance event will become evidence if the matter proceeds. A factual investigation memorandum written by compliance staff without counsel's direction is generally not privileged, and the Regional Entity will read it if it is produced. The same memorandum, prepared at counsel's direction for the purpose of giving legal advice, has a much stronger claim to protection. The Supreme Court's decision in Upjohn Co. v. United States (1981) is the leading authority: it held that communications from employees to counsel, gathered during an internal investigation so counsel could advise the company, were protected by the attorney-client privilege, and that counsel's notes and memoranda of those interviews were work product.

The difference is decided when the document is created, not when it is produced. Many entities create these documents the wrong way and learn the consequence months later.

3.3 Decision Two: How to Produce

Productions in NERC matters can be large and time-pressured. The temptation is to produce broadly to show cooperation. Broad production without privilege review can surrender attorney-client and work-product material that would otherwise be protected. A responsive production with documented privilege review and a current privilege log protects the entity's legal position without sacrificing cooperation.

Cooperation does count. The NERC Sanction Guidelines treat the degree and quality of cooperation as a mitigating factor, and treat concealment, resistance, or non-responsiveness as aggravating factors. Privilege review is not resistance. If the entity believes a request is unreasonable, Section 5.0 of Appendix 4C lets it ask NERC's general counsel for a written determination. Counsel manages the production decisions; compliance manages the document logistics. Define those roles before the request arrives.

3.4 Decision Three: How the Entity Describes Its Own Facts

A Self-Report, a response to a request for information, and a NAVAPS response are formal submissions that become part of the record. Appendix 4C requires a Self-Report to include a risk assessment, a description of the extent of the noncompliance, its cause, and the mitigating actions taken or planned. A contesting response to a NAVAPS must be signed by an officer, employee, attorney, or other authorized representative. In a Compliance Investigation the CEA may require a verification under oath of the entity's responses.

The wording binds the entity for the rest of the matter. In any matter with material consequences, counsel should be involved in drafting these submissions, because the words chosen become the framing the regulator, NERC, and FERC use to evaluate everything that follows.

3.5 Confidential Is Not Privileged

Section 1500 of the Rules of Procedure protects Confidential Information submitted to NERC or a Regional Entity, and Section 1502 requires the submitting entity to mark it. That marking keeps the information out of public view. It does not keep it away from the people evaluating the entity's compliance. A confidentiality label is not a privilege claim, and it is no substitute for one.

From the Practice

Evidence is created at every stage, not only produced at the production stage. Investigation memoranda prepared at counsel's direction stand on firmer ground than the same memoranda written by compliance staff on their own. Self-Reports and information responses are record evidence. Counsel shapes the wording. Compliance supplies the facts.

Chapter 4

The Privilege Question (Where It Applies and Where It Does Not)

Attorney-client privilege and work-product protection apply in NERC matters, but in narrower forms than registered entities often assume. That narrowness is the source of most privilege errors.

4.1 The Two Protections

Privilege in NERC enforcement works much as it does in any civil enforcement setting, with features that make routine assumptions risky. The attorney-client privilege protects confidential communications between counsel and client made for the purpose of obtaining legal advice. Work-product protection covers materials prepared in anticipation of litigation; in federal civil practice the rule is Federal Rule of Civil Procedure 26(b)(3), which traces back to Hickman v. Taylor (1947). Both protections exist. Both can be waived. Both are narrower than compliance teams tend to think.

4.2 Error One: The Inclusive Distribution

The most common privilege error is the wide distribution. A privileged communication gets forwarded around the entity, copied to consultants who have no engagement structure that supports privilege, or sent to operations staff for their information. Each widening risks waiver. Privilege depends on confidentiality, and confidentiality depends on controlled distribution. An entity that uses counsel's email as a broadcast channel can waive the privilege without knowing it, and finds out when the document is requested.

4.3 Error Two: The Consultant in the Thread

The second error involves consultants and other non-attorney advisors. A consultant can be inside the privilege, but only when working as counsel's agent, helping counsel give legal advice, under an engagement structure that says so. The leading case is United States v. Kovel (2d Cir. 1961), which extended the privilege to an accountant employed by a law firm to help the lawyer understand the client's situation. The court was explicit about the limit: if the advice sought is the accountant's rather than the lawyer's, no privilege exists.

An entity that hires a compliance consultant and a separate attorney often writes to both in the same email. The entity sees efficiency. A regulator or court may see a waiver. How the engagement is structured, and how each communication is framed, both matter.

4.4 Error Three: The Late Claim

The third error is the late privilege claim. Assert privilege at the time of production, not after the regulator has read the document. Once a document is produced without a claim, it is in the record and getting it back is an uphill fight. Federal Rule of Evidence 502(b) limits waiver for some inadvertent disclosures made in a federal proceeding or to a federal office or agency, if the holder took reasonable steps to prevent the disclosure and promptly took reasonable steps to fix it. Do not assume that rule reaches a production to a Regional Entity, and do not plan around it. A privilege log, prepared during production and kept current through the matter, is the working tool that protects the entity's privilege rights.

From the Practice

Privilege in NERC matters is narrower than registered entities assume. Wide distribution destroys the confidentiality the privilege depends on, so treat every counsel communication as a controlled distribution. Assert privilege at the time of production and keep a privilege log. Late claims are hard to win.

Chapter 5

The Role of Counsel Across the Enforcement Lifecycle

Counsel's role changes by stage. Many entities treat it as all or nothing, with active outside counsel for serious matters and counsel as backup for routine ones. That fails because every matter looks routine at the start. Define counsel's role for each stage in advance and engage at the level the stage calls for.

5.1 The Potential Noncompliance Stage

At the potential noncompliance stage, counsel's role is advisory and structural. Counsel reviews the facts, advises on whether and how to Self-Report, frames any internal investigation, and puts privilege protections in place from the outset. The hours are few and the influence on the outcome is large.

5.2 The Investigation Stage

In the investigation stage, counsel's role grows. Counsel directs document production, prepares witnesses and attends interviews, drafts or reviews every submission to the Regional Entity, and keeps the privilege log. In a Compliance Investigation, Appendix 4C expressly allows counsel for a person being interviewed, or giving testimony, to be present, whether or not that counsel also represents the registered entity, although the CEA decides whether other entity representatives may attend (Section 4.4.1). The hours grow because the stakes grow.

5.3 Alleged Violation, Hearing, and Settlement

Once a NAVAPS or settlement offer arrives, counsel takes the lead, and the regulator's legal theory becomes the central question. If the matter goes to a hearing, the Hearing Body record largely becomes the record for appeal: ROP Section 409 bars factual material on appeal to NERC that was not first presented to the Hearing Body. An entity applying for FERC review, by contrast, may support its application with information that is not in the record NERC filed (18 C.F.R. § 39.7(e)(2)). Counsel negotiates the settlement, drafts or reviews its terms, and manages the statement the entity may submit with the Notice of Penalty. Compliance supplies facts and context; the legal strategy is counsel's. In our view this produces better settlements and cleaner filings than the alternative, where compliance runs the negotiation and counsel reviews drafts.

From the Practice

Define counsel's role by stage, in advance. Most entities under-engage counsel early, which is where expensive choices get locked in. From the Alleged Violation onward, counsel leads.

Chapter 6

Common Legal Mistakes Registered Entities Make

In our experience, a short list of recurring legal mistakes accounts for a disproportionate share of avoidable consequences in NERC enforcement. Naming them gives compliance a checklist to run when a potential matter arises.

None of these mistakes is exotic. Each is the predictable result of treating enforcement as compliance and applying compliance procedures to legal questions.

6.1 Drafting the Self-Report in Compliance Language

The Self-Report is a formal submission that becomes record evidence. Compliance language tends to lead with corrective action, framed in operational terms, while underplaying or misdescribing the underlying facts. A counsel-reviewed Self-Report protects the entity's settlement position by being precise about what happened, why, and what was done about it, in language that concedes nothing the entity has not actually conceded. Timing matters too. The Sanction Guidelines give self-reporting credit for a report made reasonably promptly and before detection by a compliance monitoring engagement, and say a Self-Report should be submitted as soon as practical, typically within three months of discovery. An audit notification letter generally ends eligibility for that credit on the in-scope Requirements until the engagement is over.

6.2 Investigating Without Counsel's Direction

Without counsel's direction, investigation memoranda are generally discoverable and interview notes read like testimony. The entity has built a factual record that may not match the legal position it later wants to take. A counsel-directed investigation stands on much firmer ground for privilege and work-product protection.

6.3 Producing Broadly Without Privilege Review

Producing broadly is sometimes the right cooperative posture and sometimes a waiver problem. That is a legal decision. Counsel should make it with full knowledge of the matter, not compliance staff trying to show cooperation under deadline pressure.

6.4 Preparing Witnesses Without Counsel

Employees who have been through compliance training may not know how to take part in an interview that becomes part of the record, or in testimony under oath, which the CEA may require in a Compliance Investigation. Preparation by counsel closes that gap.

6.5 Negotiating Without Authority to Commit

Appendix 4C requires the CEA to have the registered entity designate the individual or individuals authorized to negotiate settlement on its behalf (Section 5.6). When compliance personnel without real authority to commit run the talks, the result is either uncoordinated positions or reversals of apparent agreements. Both damage the relationship with the Regional Entity's enforcement staff and complicate the resolution.

From the Practice

In our view, a Self-Report drafted in compliance language without counsel review is the most common of them and the most expensive at settlement. Internal investigations without counsel's direction create discoverable records; counsel-directed investigations stand on much firmer ground for privilege and work-product protection.

Chapter 7

When to Engage Counsel (and When Counsel Should Lead)

Trigger counsel's involvement with structural criteria, not perceived severity. Severity is hard to judge in real time and easy to judge in hindsight.

7.1 The Problem With Severity

Entities usually decide when to bring in counsel by how serious the matter looks. It looks small, so counsel stays out. Later it turns out to be larger than it looked, and the entity tries to rebuild early decisions counsel could have shaped. That rarely works, because those early decisions already made the record the entity is now trying to reframe.

7.2 Structural Triggers for Engagement

A more defensible framework engages counsel on observable events:

• A Self-Report is being considered.
• The Regional Entity asks for information beyond a routine request.
• An internal investigation begins.
• The entity receives notice of a Preliminary Screen or of a Compliance Investigation. A Compliance Investigation notice also opens a ten-business-day window to object to an investigation team member on conflict-of-interest grounds (Appendix 4C, Section 4.4.1).
• Anyone asks to interview staff, formally or informally, or to take testimony.

Each trigger is observable. None requires the entity to have judged severity correctly in advance.

7.3 When Counsel Should Lead

Counsel should lead, not support, once the legal stakes cross certain thresholds:

• A NAVAPS or settlement offer has been received.
• The potential penalty exceeds a threshold the entity set in advance.
• The matter involves more than one Regional Entity or several standards.
• The matter is likely to be cited as precedent or has industry visibility.
• The matter involves cybersecurity exposure that could draw in other regulators or law enforcement.

In each case counsel runs the matter and compliance carries out the operational work. The role flip is uncomfortable for compliance teams used to ownership. It is still the right structure once a matter has crossed into legal territory.

7.4 Engage Early Enough to Make the Handoff Smooth

The move from counsel supporting to counsel leading is not always clear in the moment. The defensible posture is to engage counsel early enough that the transition is collaborative rather than abrupt. Entities that wait until it is obvious counsel should lead have usually waited too long, and counsel inherits a record they would not have built.

From the Practice

Engage counsel on structural triggers, not on a guess about severity. Counsel leads once the legal stakes cross thresholds you defined in advance. Engaging early keeps the option to lead later.

Chapter 8

Building a Legal-Compliance Operating Framework

The framework that joins legal and compliance work is built before enforcement arrives. Building it afterward costs more and works worse.

8.1 What the Framework Covers

Most registered entities have a compliance program, and most have access to counsel. Far fewer have a framework that defines how the two work together across the enforcement lifecycle. The absence of that framework is what produces the mistakes described in the earlier chapters. Its presence lets an enforcement matter proceed with discipline.

All of it takes deliberate effort to write down and to make stick across the compliance team and the legal function.

8.2 The Outside Counsel Relationship

The framework also settles the relationship with outside counsel. Which firm handles NERC enforcement matters. Who at the firm is the named lead. What the engagement letter covers and excludes. How the firm coordinates with any other counsel the entity uses. How fees are structured and approved. These questions are easy to answer in a calm month and much harder once an enforcement matter has arrived.

8.3 What the Framework Buys

With the framework in place, an enforcement matter is a managed procedure rather than a crisis. The internal teams know their roles, and the right people make the decisions. Documents are privileged where they should be and produced where they should be. The settlement position stays intact, and the matter resolves on terms that reflect the entity's actual exposure rather than terms inflated by avoidable mistakes.

From the Practice

Build the legal-compliance operating framework before enforcement arrives. It defines triggers, stage responsibilities, privilege protocols, production discipline, settlement authority, and the escalation path. Entities that have it handle enforcement as a procedure. Entities without it handle the same matters as crises.

Glossary

Glossary

Alleged Violation. A potential noncompliance for which the Compliance Enforcement Authority has determined, based on an assessment of the facts and circumstances, that evidence exists to indicate a Registered Entity has violated a Reliability Standard, and that will be resolved outside the Compliance Exception or FFT processes (NERC ROP Appendix 2).

CMEP. The Compliance Monitoring and Enforcement Program, Appendix 4C to the NERC Rules of Procedure, which sets out how NERC and the Regional Entities monitor and enforce compliance with Reliability Standards.

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in their respective roles of monitoring and enforcing compliance with NERC Reliability Standards.

Compliance Exception. A noncompliance addressed under Appendix 4C that is not pursued through an enforcement action under Section 5.0. Used for minimal-risk noncompliance; not included in compliance history for penalty purposes (subject to the Section 4A.1 exception).

Compliance Investigation. A comprehensive investigation, which may include an on-site visit with interviews of the appropriate personnel, to determine whether a violation of a Reliability Standard has occurred.

Confirmed Violation. An Alleged Violation that the Registered Entity has accepted or not contested, that a final order of NERC or a Hearing Body has found, for which the period to request a hearing or appeal has expired, or that the entity has resolved by executing a settlement agreement.

Find, Fix, Track and Report (FFT). A streamlined process under Appendix 4C to resolve minimal or moderate risk, remediated noncompliance that is not assessed a financial penalty.

Hearing Body. The body designated by the Compliance Enforcement Authority to conduct hearings and issue decisions on disputed compliance matters under Attachment 2, Hearing Procedures, of Appendix 4C.

Mitigation Plan. An action plan developed by the Registered Entity to correct a noncompliance with a Reliability Standard and prevent its recurrence.

NAVAPS. Notice of Alleged Violation and Proposed Penalty or Sanction, issued by the Compliance Enforcement Authority to a Registered Entity under Section 5.3 of Appendix 4C.

Notice of Penalty. A notice prepared by NERC and filed with FERC, after NERC approves a notification of Confirmed Violation or a settlement agreement, stating the penalty or sanction imposed or agreed to.

Preliminary Screen. The Compliance Enforcement Authority's initial evaluation of evidence of potential noncompliance, limited to whether the entity is registered, whether the Requirement applies and is in effect, and whether the matter duplicates one already in process.

Privilege log. A record, kept during document production, that identifies each document withheld or redacted on grounds of privilege or work product and the basis for the claim.

Self-Logging. A process by which Registered Entities found eligible by a Compliance Enforcement Authority, after a formal review of internal controls, record potential noncompliance on a log instead of submitting individual Self-Reports.

Self-Report. A report by a Registered Entity stating that it believes it has, or may have, violated a Reliability Standard.

Work product. Materials prepared in anticipation of litigation by or for a party or its representative, generally protected from discovery unless the requesting party shows substantial need and cannot obtain the equivalent without undue hardship (Fed. R. Civ. P. 26(b)(3)).

How Energy Compliance Can Help

How Energy Compliance Can Help

Energy Compliance, Inc. and Stich Angell, P.A. support registered entities across the full NERC enforcement lifecycle, from the first sign of a potential noncompliance through settlement and the Notice of Penalty. The work is built for operational execution and legal defensibility. Every engagement is led by a named senior practitioner on the compliance side and a named Stich Angell partner on the legal side.

Legal Series Services

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

Each engagement is scoped to the entity's registered functions, regulatory posture, and the procedural stage of the matter.

The Four Practice Areas

• Enforcement Defense. Notice of Penalty response and settlement strategy.
• Privilege Counsel. Internal investigation and document production under privilege.
• Regulatory Advisory. FERC submissions and Regional Entity counsel engagement.
• Legal-Compliance Integration. Operating frameworks built before enforcement arrives.

Compliance Support Before and Around the Matter

On the compliance side, Energy Compliance brings audit defense, data request strategy, and compliance program management. Many enforcement matters start at an audit or in a data request, and the framework in Chapter 8 lives inside the compliance program.

WattOps Compliance

Enforcement outcomes rest on evidence. WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). EC will run one standard at one facility through WattOps at no cost, so you can see your evidence the way a CEA will see it. CIP standards are excluded from the free offer.

RenewOps

Many Self-Reports start with operations data: an alarm, an availability gap, a SCADA record that does not match the procedure. RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module.

Start the Conversation

If you have a potential noncompliance on your desk, or want the framework in place before you do, call us. We will tell you where you stand.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

Stich Angell, P.A.: stichlaw.com · (612) 333-6251

About the Author

About the Author

Rob Smith, Founder and Principal, Energy Compliance, Inc.

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

Cara C. Passaro, Shareholder and Firm President, Stich Angell, P.A.

Cara C. Passaro has represented clients throughout the upper Midwest since 2001. She is licensed to practice in the Minnesota and North Dakota state and federal courts and is recognized as a Super Lawyer. Her practice includes construction, premises and products liability, transportation and energy compliance representation. Cara is the named legal author of the Energy Compliance, Inc. Legal Series and leads the Stich Angell side of the integrated practice. She holds a B.A. from Barnard College, Columbia University, and a J.D. from Brooklyn Law School.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

We support registered entities across NERC Reliability Standards, FERC orders, RTO/ISO market rules, Regional Entity oversight and state frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters that arise in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the legal-compliance operating frameworks registered entities need before enforcement arrives.

We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Our Legal Partner: Stich Angell, P.A.

Stich Angell, P.A. is a full-service civil litigation firm in Bloomington, Minnesota. Since 1971 its lawyers have handled products liability, construction, transportation, retail and hospitality, and catastrophic injury matters. Stich Angell is in Bloomington, Minnesota, and can be reached at (612) 333-6251 or stichlaw.com.

Energy Compliance, Inc. is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Sources and Authorities

Sources and Authorities

• Federal Power Act § 215, 16 U.S.C. § 824o (Electric reliability), including subsection (e), Enforcement. https://www.law.cornell.edu/uscode/text/16/824o
• 18 C.F.R. § 39.7, Enforcement of Reliability Standards (eCFR). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.7
• NERC, Rules of Procedure, effective November 28, 2023, including Section 409 (Appeals from Final Decisions of Hearing Bodies) and Section 1500 (Confidential Information). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
• NERC, Rules of Procedure Appendix 4C, Compliance Monitoring and Enforcement Program, effective May 19, 2022, including Attachment 2, Hearing Procedures. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• NERC, Rules of Procedure Appendix 4B, Sanction Guidelines of the North American Electric Reliability Corporation, effective January 19, 2021. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4b.pdf
• NERC, Rules of Procedure Appendix 2, Definitions Used in the Rules of Procedure, effective June 27, 2024. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• Upjohn Co. v. United States, 449 U.S. 383 (1981). https://www.law.cornell.edu/supremecourt/text/449/383
• Hickman v. Taylor, 329 U.S. 495 (1947). https://www.law.cornell.edu/supremecourt/text/329/495
• United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). https://law.resource.org/pub/us/case/reporter/F2/296/296.F2d.918.168.27207.html
• Federal Rules of Civil Procedure, Rule 26(b)(3), Trial Preparation: Materials. https://www.law.cornell.edu/rules/frcp/rule_26
• Federal Rules of Evidence, Rule 502, Attorney-Client Privilege and Work Product; Limitations on Waiver. https://www.law.cornell.edu/rules/fre/rule_502
• Stich Angell, P.A., Cara C. Passaro attorney profile. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., Energy Compliance Legal Services. https://stichlaw.com/energy-compliance/