Privilege in NERC Compliance Work

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs.

NERC enforcement is, procedurally, a civil enforcement regime. Registered entities often treat it as one more compliance process. That framing matters. The decisions made early in an enforcement matter bind the entity through every later stage, and many of them call for legal judgment that compliance teams are not trained to make alone. Recognizing this late is expensive. The cost rarely shows at the moment it is incurred, and most of it can be avoided with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to give registered entities integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and a growing focus on energy compliance representation. Together they offer an alternative to the usual model, where compliance consulting and legal counsel run as separate engagements and meet only after an enforcement matter has already arrived.

We wrote these references for compliance managers, in-house attorneys, senior leaders and outside counsel who need a practitioner's view of how NERC enforcement actually proceeds.

The references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have.

If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference has our contact information. If not, the reference still belongs to you.

Cara C. Passaro and Rob Smith

Shareholder and Firm President, Stich Angell, P.A.

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Privilege in NERC compliance and enforcement matters is one of the most consequential and most misunderstood legal questions in a registered entity's program. Attorney-client privilege and work-product protection both apply, but in narrower forms than registered entities commonly assume, and that narrowness produces a predictable set of expensive errors.

This reference explains how privilege actually operates around the NERC Compliance Monitoring and Enforcement Program (CMEP). It covers each doctrine and how to put it into practice, the consultant problem we see behind many privilege failures, the distribution discipline that decides whether privilege survives, the privilege log mechanics that protect the entity at production time, and the joint-defense questions that come up in multi-entity matters. It closes with the privilege-first operating posture that mature legal-compliance programs adopt before any matter requires it.

• Privilege in NERC matters is narrower than most entities assume. The gap between assumption and reality is where the most expensive errors happen.
• Confidential treatment under Section 1500 of the NERC Rules of Procedure is not privilege. It keeps information from the public. It does not keep information from the Compliance Enforcement Authority.
• Attorney-client privilege depends on confidentiality, and confidentiality depends on controlled distribution. Broad distribution can waive the privilege without anyone noticing.
• Work-product protection covers material prepared in anticipation of litigation. It is real, and it has to be claimed expressly when documents are withheld, not reconstructed afterward.
• Compliance consultants are not automatically inside the privilege circle. The engagement structure decides whether their work is protected or discoverable.
• Privilege logs are operating mechanisms. Kept in real time, they protect. Assembled after the fact, they invite challenge.
• A privilege-first posture is built before any matter requires it. Building it afterward costs more and protects less.

Chapter 1

Why Privilege Operates Differently in NERC Matters

NERC matters have features that make privilege analysis different from privilege analysis in other civil enforcement settings. Those differences should inform every program design choice.

1.1 Same Doctrines, Different Context

Privilege in NERC compliance and enforcement matters runs on the same legal doctrines that apply across civil enforcement. The context is what changes, and it makes routine assumptions risky.

1.2 Three Contextual Features

The first feature is the documentary intensity of NERC compliance work. Programs generate procedures, operating logs, evidence packages, training records, audit responses, Mitigation Plans and a great many other artifacts. Each one is a candidate for production in an enforcement matter. Deciding which artifacts are or could be privileged takes analysis at the moment of creation, not at the moment of production. A program that generates documents with no privilege framing produces a documentary universe that is largely discoverable, even where the underlying analysis would have qualified for protection had it been structured differently.

The second feature is the multi-party nature of the work. Compliance consultants, engineering consultants, IT vendors, training providers and outside auditors all take part in the entity's program. For any given communication, each of them is either inside the privilege circle or outside it. The default for most non-attorney participants is outside, which means a communication that includes them may not be protected even when counsel is on it. How these engagements are structured either preserves privilege or defeats it, and the structure has to be deliberate.

The third feature is the regulatory community itself. The same Regional Entity staff who work productively with the entity during routine monitoring may, in an enforcement matter, be the staff building the record. Informal exchanges that felt collegial during an audit become part of that record.

1.3 What the NERC Rules Actually Protect

Registered entities often confuse confidentiality under the NERC rules with privilege. They are different things.

FERC's regulations require each user, owner and operator of the Bulk-Power System to give FERC, NERC and the applicable Regional Entity the information needed to implement section 215 of the Federal Power Act, as set out in the ERO and Regional Entity rules (18 CFR 39.2(d)). Appendix 4C, Attachment 1, lays out the steps the Compliance Enforcement Authority (CEA) may take when requested information does not arrive by the required date.

What the rules give in return is confidential treatment, not privilege. Section 1500 of the NERC Rules of Procedure defines Confidential Information to include Critical Energy Infrastructure Information, Confidential Business and Market Information, work papers and records created in an evaluation or audit, investigative files, and Cyber Security Incident Information. The submitting entity must mark information it believes is confidential and identify the category (ROP Section 1502.1). Appendix 4C, Section 9.3, applies Section 1500 to everything generated or received in CMEP activities. Compliance Investigations are confidential unless FERC directs otherwise (Appendix 4C, Section 4.4), and under 18 CFR 39.7(b)(4) a violation or alleged violation stays nonpublic until it is filed as a notice of penalty or resolved by admission or settlement.

All of that protects information from the public. None of it protects information from the CEA. From the audit side, the practical rule is simple: a "confidential" stamp tells the Regional Entity how to handle a document, and it does nothing to keep the document out of the Regional Entity's hands.

Facts are never privileged. The Supreme Court said so directly in Upjohn Co. v. United States: "The privilege only protects disclosure of communications; it does not protect disclosure of the underlying facts." An entity cannot decline to give the CEA a relevant fact because the fact also appears in a memo to counsel.

From the Practice

Privilege in NERC matters runs on standard doctrines in a specific context: documentary intensity, many participants, and a regulator the entity works with every day.

Section 1500 confidentiality keeps information from the public, not from the CEA. Facts are not privileged.

The default state for non-attorney participants is outside the privilege circle. Engagement structure is what brings them inside, when that is appropriate.

Chapter 2

Attorney-Client Privilege: The Doctrine and the Operations

Attorney-client privilege is a familiar doctrine. Putting it into practice in NERC compliance work is where most errors arise.

2.1 The Doctrine

Attorney-client privilege protects confidential communications between counsel and the client made for the purpose of obtaining or providing legal advice. At the level of principle, the doctrine is well settled and widely understood. Each of the three elements below has to hold. Failure on any one defeats the privilege.

2.2 Between Counsel and the Client

The client in a corporate setting is the entity, acting through its officers, employees and agents within the scope of their duties. Upjohn rejected the narrow "control group" test and held that communications from employees to counsel in an internal investigation were privileged, because the employees who hold the facts are often well below senior management. That helps a registered entity: an interview of a system operator or a relay technician, conducted by counsel to give legal advice, can be privileged.

Communications that include people who are neither counsel nor part of the client generally fall outside the privilege. This is where it gets complicated, because NERC compliance communications routinely include consultants, contractors, vendors and other third parties whose participation is not automatically privileged. Chapter 4 deals with that problem.

2.3 For the Purpose of Legal Advice

The communication has to be made to obtain or provide legal advice. A communication about operational matters may not qualify, even with counsel copied, if its purpose was operational rather than legal. Courts do not all frame the test the same way. Many apply a "primary purpose" test to communications with both legal and business purposes. The D.C. Circuit, in In re Kellogg Brown & Root, Inc. (2014), applied that test and read it broadly: the question is whether obtaining or providing legal advice was a primary purpose of the communication, meaning one of the significant purposes. On that reading, an internal investigation can be privileged even if it was mandated by regulation. That holding matters to a regulated industry, but it is one circuit's rule, and counsel should confirm which test applies.

Framing matters either way. Counsel-led discussions framed as legal analysis are far more likely to be protected. Compliance-led discussions with counsel copied for visibility often are not. A program that routes every communication through counsel for completeness is not creating privileged records. It is creating discoverable records that happen to include counsel.

2.4 Kept Confidential

The communication has to stay confidential. Disclosure beyond the privileged circle, even unintentional disclosure, can waive the privilege over that communication and sometimes over related communications on the same subject. Confidentiality is a discipline maintained at every step, from creation through retention. Programs that treat counsel communications as broadcast vehicles can waive privilege without realizing it, and the waiver surfaces when the matter reaches discovery.

From the Practice

Communications must be between counsel and the client, for the purpose of legal advice, and kept confidential. All three requirements operate together. Failure on any one defeats the privilege.

Routing communications through counsel for completeness does not create privileged records. It creates discoverable records that include counsel.

Chapter 3

Work-Product Protection: Where It Applies

Work-product protection covers material prepared in anticipation of litigation. It is distinct from attorney-client privilege and is claimed differently.

3.1 What the Rule Covers

The doctrine traces to Hickman v. Taylor (1947) and is codified for federal civil cases in Federal Rule of Civil Procedure 26(b)(3). That rule protects "documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative," and the representatives it lists include the party's attorney, consultant and agent. FERC's own discovery rule says much the same: a participant may not obtain material another participant prepared in anticipation of litigation without showing substantial need and that it cannot get the substantial equivalent by other means without undue hardship (18 CFR 385.402(b)). The NERC Hearing Procedures in Appendix 4C, Attachment 2, incorporate FERC Rules 402 through 410 for discovery in CMEP hearings (Section 1.5.8).

It applies even when the document is not a communication between counsel and client, and it can reach material prepared by the client, by counsel, or by a consultant working for the party. Our read: it is real and underused in NERC compliance practice.

3.2 The Trigger Is Anticipated Litigation

The trigger is anticipation of litigation. In a NERC setting, a Compliance Investigation, a Notice of Alleged Violation, or circumstances that give the entity a reasonable basis to expect an enforcement proceeding can supply it. A routine compliance audit, by itself, is in our view a weaker footing; work done in the ordinary course of a compliance program to satisfy an audit looks like ordinary-course work. Documents prepared with a reasonably anticipated proceeding in mind can qualify even before anything has been filed. Programs that recognize this can structure investigation work, evidence development and analytical memoranda to qualify from the moment of creation.

3.3 The Limits

The protection has limits. Material prepared in the ordinary course of business, without anticipation of litigation, generally does not qualify. Material prepared partly for litigation and partly for other purposes gets a dual-purpose analysis that varies by circuit. The Second Circuit, in United States v. Adlman (1998), protects a document created "because of" anticipated litigation even if it also helps inform a business decision. As Adlman describes, Fifth Circuit cases have instead asked whether the primary motivating purpose behind the document was to aid in possible future litigation. Producing the underlying facts is still required; protection reaches the analysis, not the facts already in the record. Programs that want the most from work-product protection structure document creation deliberately, not retroactively.

3.4 Not Invulnerable

Work product can be overcome. Under Rule 26(b)(3) and FERC Rule 402(b), a party that shows substantial need and an inability to obtain the substantial equivalent without undue hardship can reach fact work product. Opinion work product, the mental impressions, conclusions, opinions and legal theories of counsel, gets stronger protection; both rules direct the tribunal to protect it even when it orders other material produced. The structural defense is to identify and claim the protection consistently and to be ready to defend the basis.

From the Practice

Work product covers material prepared in anticipation of litigation. It is distinct from attorney-client privilege and claimed differently.

An open Compliance Investigation or a reasonably expected enforcement proceeding can supply the anticipation. Ordinary-course audit work usually does not, as we read it.

Claim the protection consistently, log it correctly, and be ready to defend the basis.

Chapter 4

The Consultant Problem and Its Solution

In our experience, compliance consultants are a frequent cause of privilege failures, and the structural fix, though well known, is often skipped.

4.1 The Pattern

In the matters we have seen, many privilege failures trace to the involvement of compliance consultants. The pattern repeats. The entity engages a consulting firm to support compliance work. The consultant takes part in communications that include counsel. Without the right engagement structure, the consultant's participation defeats the privilege over those communications. The entity finds out at production time, when consultant-included communications turn out to be an unprotected universe of work the entity had assumed was privileged.

4.2 The Legal Framework

The framework for bringing a consultant inside the privilege comes from United States v. Kovel (2d Cir. 1961), where the court extended the privilege to an accountant employed by a law firm whose presence was "necessary, or at least highly useful," for effective consultation between client and lawyer. The same opinion drew the line that matters most here: "if the advice sought is the accountant's rather than the lawyer's, no privilege exists." Substitute "compliance consultant" for "accountant" and the risk is plain. If the entity is buying the consultant's compliance advice, counsel's presence on the email does not convert it into legal advice.

The consultant must be working as counsel's agent for the privileged work. In practice, the engagement should say so explicitly, usually through an engagement letter or an addendum that puts the consultant under counsel's direction for the matter, with the right confidentiality and work-product terms. Without that structure, the consultant is a third party whose presence can destroy privilege, however valuable the consultant's contribution.

4.3 Re-papering When a Matter Arrives

The structure is simple to put in place when planned and hard to retrofit. For routine compliance consulting that involves no enforcement matter, the entity can engage the consultant directly, without privilege framing, and the work product is generally not privileged. When an enforcement matter arises or is reasonably anticipated, the consultant's matter work should be re-papered through counsel, under a new engagement that brings it inside the privilege framework. The re-papering is administrative, and it is often the difference between protected and unprotected investigation work.

4.4 A Master Engagement Framework

Programs that work routinely with the same consulting firm benefit from a master engagement framework that anticipates both routine and matter-specific work. Routine work continues under the standard engagement. Matter-specific work, when triggered, falls under counsel's direction with the right privilege framing. The framework takes the friction out of re-papering at the moment a matter arises and protects the consultant's matter work from its first day.

From the Practice

Consultant involvement is a frequent cause of privilege failure in the matters we see, and the well-known fix is often skipped.

Under Kovel, the consultant must be helping counsel give legal advice. If the advice sought is the consultant's own, no privilege exists.

A master engagement framework that anticipates both routine and matter-specific work reduces re-papering friction and protects matter work from the start.

Chapter 5

Distribution Discipline: A Common Waiver

Privilege depends on confidentiality. Broad internal distribution, in our experience, is a frequent way it gets destroyed.

5.1 How Waiver Happens

We regularly see privilege lost in NERC compliance programs through broad distribution of counsel communications inside the entity. The communication starts as a privileged exchange between counsel and a defined client team. Someone forwards it to more people for awareness, with the original substance intact. Each forward widens the circle. At some point the distribution is broad enough that the communication has lost the confidentiality the privilege requires.

It is rarely intentional. Compliance teams share information across functions as a matter of habit. An update from counsel looks like operational information the team should have, and forwarding the email feels efficient. The legal consequence is invisible when the email goes out and surfaces only when the matter reaches discovery. By then the damage is usually done.

5.2 What the Law Does and Does Not Forgive

Federal Rule of Evidence 502 limits some of the damage, within its terms. For disclosures made in a federal proceeding or to a federal office or agency, an intentional waiver extends to undisclosed material only if it concerns the same subject matter and in fairness ought to be considered together (Rule 502(a)). An inadvertent disclosure is not a waiver if the holder took reasonable steps to prevent it and promptly took reasonable steps to fix it (Rule 502(b)). Whether and how Rule 502 reaches a disclosure made to a Regional Entity, rather than to FERC, is a question for counsel. Rule 502 is also no help with internal over-distribution, which erodes confidentiality without any disclosure to the other side at all.

5.3 Controlled Distribution

The discipline that prevents this is straightforward and uncomfortable. Treat counsel communications as a controlled distribution. Define the list when the communication is created, keep it narrow, and do not expand it without counsel's agreement. Discourage forwarding. When information from counsel needs to reach more people, summarize the substance in operational language, in a separate communication that is not framed as privileged, and leave the original where it is. This runs against entrenched habits, and it takes deliberate effort to make it stick.

5.4 Copies, Meetings and Notes

The same discipline covers internal copy practices. Counsel communications do not go to compliance distribution lists by default, even when the topic is relevant to those lists. When a meeting includes discussion of counsel's analysis, the attendance list is a privilege variable. Recording of meetings that include privileged discussion is controlled, and notes from those meetings are framed and distributed with privilege in mind. None of this is exotic in legal settings. In our experience, it is uncommon in compliance programs that have never had legal infrastructure built in.

From the Practice

From what we see, broad distribution is a frequent privilege failure, because it destroys the confidentiality that privilege requires. It is rarely intentional.

Counsel communications are a controlled distribution: defined at creation, narrow, and not expanded without counsel's agreement.

When information needs to travel, summarize the substance in operational language in a separate, non-privileged communication. Do not forward the original.

Chapter 6

Privilege Logs and Production Mechanics

Privilege logs are the mechanism that protects privilege at production time. Logs kept in real time work. Logs assembled after the fact often do not.

6.1 What the Rules Require

When a matter reaches formal document production, the entity withholds privileged documents and identifies them on a log. In a NERC hearing, Appendix 4C, Attachment 2, Section 1.5.8(b)(7) requires any participant producing documents to provide a list of withheld documents, at the time the documents are required to be produced, to the Hearing Officer and each participant entitled to the production. On review, for good cause shown, the Hearing Officer may order a withheld document made available. FERC Rule 410(a)(2), which the Hearing Procedures incorporate, requires a schedule of items withheld stating the character and specific subject matter of each item and the specific objection asserted for it. Federal civil practice is similar: Rule 26(b)(5)(A) requires the party to make the claim expressly and describe what is withheld in a way that, without revealing the protected information, lets the other side assess the claim.

Appendix 4C does not set out a privilege-log procedure for audits, spot checks or other monitoring activities; its privilege and withholding provisions sit in the Hearing Procedures. In our view, when an entity believes a document responsive to a monitoring request is privileged, counsel should raise it with the CEA in writing when the response is due, rather than simply leaving the document out.

6.2 Real-Time Logs

A real-time log is built as documents are reviewed for production, with counsel making and recording privilege determinations as they go. The entries reflect the actual reasoning at the moment of decision. The log is internally consistent, and it holds up under challenge because each entry can be supported by the document itself and by the record of the determination.

6.3 Retroactive Logs

A retroactive log is assembled after production is otherwise complete, usually under deadline pressure. Determinations are made quickly, sometimes by people who had nothing to do with the underlying work. The reasoning is reconstructed rather than recorded, and the entries may not line up cleanly with the documents they describe. Such a log is harder to defend, and in our view a regulator that sees one is more likely to challenge the claims on it.

6.4 Production Mechanics

Production mechanics matter beyond the log. Stage the production so privilege review can happen in real time. Define and maintain the privilege circle. Run document collection under counsel's direction, so privileged documents are identified and segregated before anything goes out. When a Compliance Investigation opens, the CEA instructs the entity to preserve all records and information relevant to it (Appendix 4C, Section 4.4.1); collection under counsel's direction should start from that preservation instruction. Identify in advance the categories of documents likely to need privilege review. This is the operating discipline that separates productions that protect privilege from productions that give it away, often in matters where the underlying privilege analysis was entirely sound.

From the Practice

In a NERC hearing, the list of withheld documents is due when the documents are due. Build the log as you review, not after.

Real-time logs record the reasoning. Retroactive logs reconstruct it, and they are easier to challenge.

Production mechanics matter beyond the log: staged production, a defined privilege circle, counsel-directed collection, and advance identification of likely-privileged categories.

Chapter 7

Privilege Across Multi-Entity Matters

Some NERC matters involve several registered entities or industry coordination. Privilege in those settings needs added structural protection.

7.1 When More Than One Entity Is Involved

Some NERC compliance and enforcement matters involve more than one registered entity. Joint owners of a generating facility. Members of a regional reliability initiative. Industry working groups responding to a common audit theme or enforcement trend. Coordinated responses to a FERC order that affects many entities. Each raises privilege questions a single-entity matter does not, and the protections they need differ from the standard single-entity framework.

7.2 The Common Interest Doctrine

The legal basis for protection here is the joint-defense privilege, now generally treated as part of a broader common interest (or community-of-interest) doctrine. In In re Teleglobe Communications Corp. (3d Cir. 2007), the court described it as allowing attorneys representing different clients with similar legal interests to share information without disclosing it to others, in civil, criminal and even transactional settings. The court stressed two conditions: the members must share a common legal interest in the shared communication, and the communication must be shared with the attorney of the member. Sharing it directly with another member, without counsel, may destroy the privilege. The doctrine varies across jurisdictions. Apparent joint defense without the structure in place can produce communications that are not protected at all, and the parties may learn that only when one of them must produce them in a separate matter.

7.3 The Joint Defense Agreement

The structural protection is a joint defense or common interest agreement, signed by the participating entities through their respective counsel. It establishes the common interest, defines the scope, and covers confidentiality, communication protocols and the handling of joint work product. It should be drafted for the specific matter, parties and jurisdictions. Without it, in our view, communications among the parties that include counsel are at risk of being treated as third-party disclosures that defeat the privilege over the underlying analysis.

7.4 What Stays Inside Each Party

Even within a joint defense framework, each party keeps its own privilege over its own underlying work, and the framework does not extend one party's privilege to the others. Communications about a party's internal matters stay inside that party's own privilege circle. The joint framework covers the shared interest, not each party's separate work. Entities that work on common industry matters benefit from explicit structure at the outset, including counsel-led documentation of the common interest and of who sits inside it.

From the Practice

Multi-entity NERC matters raise privilege questions that single-entity matters do not. A common interest framework, put in place through counsel, is the structural protection.

Share through counsel. Under Teleglobe, a communication shared directly with another member, without counsel, may lose protection.

Each party keeps its own privilege over its own work. The joint framework covers the shared interest, not party-specific matters.

Chapter 8

Building a Privilege-First Operating Posture

Programs with mature privilege protection do not assemble it when a matter arises. They build it in advance and operate under it routinely.

8.1 Built Before It Is Needed

Programs that protect privilege well in NERC matters share one trait. The privilege framework is documented and part of the operating posture before any matter requires it. Its structural elements, the privilege circle definition, the consultant engagement framework, the distribution discipline and the privilege log mechanics, are in place at all times rather than assembled when a matter arises.

8.2 What It Takes

Building the framework takes deliberate effort and senior commitment. The compliance team has to understand what privilege is, when it applies, and how daily habits preserve or defeat it. Counsel has to be reachable for privilege questions as they come up. Consultant engagements have to be structured with privilege in mind from the start. Document creation and distribution have to follow the framework consistently. Training has to reach the right people and be refreshed periodically. All of it takes the discipline to put into practice what counsel already knows in principle.

It also settles the weekly questions in advance. When does a compliance question warrant a call to counsel? Who is inside the circle for a given topic, and how does a consultant come inside it? How are decisions documented when they may later matter in enforcement? Who keeps the privilege log? The answers stay consistent across the program instead of being improvised.

8.3 The Economics

Building the framework costs counsel time and design effort. Operating without it costs the privilege failures in whatever matter arrives, plus an enforcement posture weaker than the matter requires. We think the investment pays for itself the first time a matter reaches document production with the framework already in place.

From the Practice

Build the framework before any matter requires it and run it routinely. Start with two documents: a written privilege circle for each compliance topic, and a consultant engagement addendum that counsel can trigger when a matter opens.

Glossary

Glossary

Attorney-client privilege. Protection for confidential communications between counsel and client made to obtain or provide legal advice. It protects communications, not the underlying facts.

Work-product protection. Protection for documents and tangible things prepared in anticipation of litigation or for trial by or for a party or its representative (Fed. R. Civ. P. 26(b)(3); for FERC proceedings, 18 CFR 385.402(b)).

Opinion work product. Counsel's mental impressions, conclusions, opinions and legal theories. Protected even when other work product is ordered produced.

Kovel arrangement. An engagement that places a non-lawyer, such as an accountant or consultant, under counsel's direction so that the non-lawyer's help in giving legal advice falls within the privilege. Named for United States v. Kovel (2d Cir. 1961).

Common interest doctrine. The rule that lets attorneys for different clients with a common legal interest share privileged communications without waiving the privilege. Also called the community-of-interest or joint-defense privilege.

Subject-matter waiver. Extension of a waiver to undisclosed communications on the same subject. Under Fed. R. Evid. 502(a), for a disclosure made in a federal proceeding or to a federal office or agency, it applies only to an intentional waiver, on the same subject matter, where fairness requires the material be considered together.

Privilege log. The list of documents withheld from production, with enough description for the other side to assess each claim. In NERC hearings, a list of withheld documents is due when the documents are due (Appendix 4C, Attachment 2, Section 1.5.8(b)(7)).

Confidential Information. Under Section 1501 of the NERC Rules of Procedure, information including Confidential Business and Market Information, Critical Energy Infrastructure Information, personnel information, audit work papers, investigative files and Cyber Security Incident Information. Confidential treatment limits public disclosure; it is not privilege.

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in its role of monitoring and enforcing compliance with the NERC Reliability Standards (ROP Appendix 2).

Compliance Investigation. A comprehensive investigation, which may include an on-site visit with interviews of personnel, to determine whether a Reliability Standard violation occurred (ROP Appendix 2). Confidential unless FERC directs otherwise (Appendix 4C, Section 4.4).

Hearing Procedures. Attachment 2 to Appendix 4C, which governs CMEP hearings, including document production and discovery under FERC Rules 402 through 410.

How Energy Compliance Can Help

How Energy Compliance Can Help

Every Legal Series engagement is led by a named senior practitioner on the compliance side and a named partner at Stich Angell on the legal side, scoped to the entity's role, function, regulatory posture and the procedural stage of the matter.

Legal Series services with Stich Angell, P.A.

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

The practice is organized in four areas: Enforcement Defense (Notice of Penalty response and settlement strategy); Privilege Counsel (internal investigation and document production under privilege); Regulatory Advisory (FERC submissions and Regional Entity counsel engagement); and Legal-Compliance Integration (operating frameworks built before enforcement arrives).

Energy Compliance services and platforms

• Data request strategy: facts go to the Regional Entity on time; privileged analysis stays with counsel.
• Audit defense: audit responses and interviews that keep ordinary-course work apart from matter work under counsel.
• Compliance program management: the privilege circle, consultant engagements and distribution rules, built in before a matter arrives.
• WattOps Compliance: EC's NERC compliance evidence platform (wattopscompliance.com). It keeps ordinary-course evidence organized and apart from privileged analysis. EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).
• RenewOps: EC's renewable operations monitoring and analytics platform, with a Data Center module. Operations data from wind, solar and storage facilities is fact, not privilege; have it ready before the request arrives.

If an investigation has opened, or you want the framework in place first, call or write.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A. She has represented clients throughout the upper Midwest since 2001 and has tried to verdict, won on dispositive motion, or favorably settled hundreds of cases. Her practice covers construction, premises liability, products liability, transportation and energy compliance representation. She is licensed to practice in the Minnesota and North Dakota state and federal courts and is recognized as a Super Lawyer.

Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

About Stich Angell, P.A.

About Stich Angell, P.A.

Stich Angell, P.A. is a Minnesota civil litigation firm. Since 1971, its lawyers have represented businesses, individuals and organizations across civil litigation, with a long-established practice in insurance defense. The firm's practice areas include products liability, construction, transportation, professional negligence and appellate practice. Although it is a Minnesota firm, it represents clients throughout the country.

Stich Angell has extended its civil litigation practice into energy regulatory legal services, including NERC and FERC enforcement defense, and partners with Energy Compliance, Inc. to give registered entities integrated legal and compliance support across the NERC enforcement lifecycle.

Stich Angell, P.A. is located in Bloomington, Minnesota. To engage the integrated legal-compliance practice, contact Energy Compliance, Inc. at 763.438.4427 or Stich Angell at 612.333.6251. Online at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and meet only when a matter has already escalated.

Engagements are overseen by a senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity. Learn more at energycomplianceinc.com, and about Stich Angell at stichlaw.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Section 1500, Confidential Information (effective November 28, 2023). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program, including Sections 4.4, 4.4.1 and 9.3, Attachment 1, and Attachment 2, Hearing Procedures, Section 1.5.8 (effective May 19, 2022). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• 18 CFR 39.2, Jurisdiction and applicability, eCFR (as of October 22, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.2
• 18 CFR 39.7, Enforcement of Reliability Standards, eCFR (as of October 22, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.7
• 18 CFR 385.402, Scope of discovery (Rule 402), eCFR (as of October 22, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-X/part-385/subpart-D/section-385.402
• 18 CFR 385.410, Objections to discovery, motions to quash or to compel, and protective orders (Rule 410), eCFR (as of October 22, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-X/part-385/subpart-D/section-385.410
• Federal Rules of Civil Procedure, Rule 26, Duty to Disclose; General Provisions Governing Discovery, Rules 26(b)(3) and 26(b)(5) (Legal Information Institute, accessed October 25, 2026). https://www.law.cornell.edu/rules/frcp/rule_26
• Federal Rules of Evidence, Rule 502, Attorney-Client Privilege and Work Product; Limitations on Waiver (Legal Information Institute, accessed October 25, 2026). https://www.law.cornell.edu/rules/fre/rule_502
• Upjohn Co. v. United States, 449 U.S. 383 (1981). https://www.law.cornell.edu/supremecourt/text/449/383
• Hickman v. Taylor, 329 U.S. 495 (1947). https://www.law.cornell.edu/supremecourt/text/329/495
• United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), Caselaw Access Project. https://static.case.law/f2d/296/cases/0918-01.json
• In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), Caselaw Access Project. https://static.case.law/f3d/756/cases/0754-01.json
• United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998), Caselaw Access Project. https://static.case.law/f3d/134/cases/1194-01.json
• In re Teleglobe Communications Corp., 493 F.3d 345 (3d Cir. 2007), Caselaw Access Project. https://static.case.law/f3d/493/cases/0345-01.json
• Stich Angell, P.A., Cara C. Passaro, Shareholder and Firm President, attorney profile. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., About Us. https://stichlaw.com/about-us/
• Stich Angell, P.A., Expertise. https://stichlaw.com/expertise/