Mitigation Plan Negotiation: Legal Strategy

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs.

In our view, NERC enforcement is procedurally a civil enforcement regime that registered entities frequently treat as a compliance process. The framing matters. The decisions made early in any enforcement matter bind the entity through every later stage, and many of those decisions call for legal judgment that compliance teams are not trained to make alone. Recognizing this late is expensive. The cost is rarely visible at the moment, and most of it can be avoided with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to provide registered entities with integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and increasing focus on energy compliance representation. Together they offer an alternative to the usual model, where compliance consulting and legal counsel run as separate engagements and meet only after an enforcement matter has already arrived.

These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told that the enforcement matter is under control and suspects it is not. For the outside counsel who has been asked to advise on a NERC matter for the first time and needs a practitioner's view of the procedural reality.

The references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system actually works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have.

If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference contains contact information. If not, the reference still belongs to you. Take what is useful, apply it well, and remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the decisions made after.

Cara C. Passaro, Shareholder and Firm President, Stich Angell, P.A.

Rob Smith, Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

In our view, the Mitigation Plan is often the most operationally consequential element of a NERC enforcement resolution. The penalty is paid once. The plan governs what the entity must do, milestone by milestone, until the Compliance Enforcement Authority (CEA) tracks it to completion and the entity certifies that every required action is done. Under the NERC Rules of Procedure, the plan is the registered entity's own document: the entity writes it, signs it, and submits it, and the CEA accepts or rejects it. That makes it a negotiation, whether or not the entity treats it as one.

Entities that treat mitigation as paperwork pay for that through the whole implementation period. This reference covers the plan as a negotiation instrument, the regulator's theory that drives the changes it asks for, the difference between operationally executable and legally defensible language, scope, depth and timeline discipline, the implementation burden, the reporting tail, closure terms, and the way a plan becomes a variable in the next audit.

• The plan governs the entity's obligations until it is verified complete. Drafting it well is the difference between a closed matter and a continuing one.
• The regulator's theory of the case is rarely stated outright. Reading it accurately is the foundation of the negotiation.
• Operationally executable and legally defensible are different tests. The plan has to pass both.
• Scope, depth and timeline discipline produce mitigation the entity can deliver. Loose language produces obligations it cannot.
• The implementation burden belongs to the entity, in real staff hours and cost. Negotiate it rather than accept it as proposed.
• Every milestone and progress update is a recurring compliance event. Appendix 4C warns that additional violations could be determined for work not completed on accepted milestones.
• Closure terms need to be settled explicitly. A plan with no defined finish line tends not to finish.

Chapter 1

The Mitigation Plan as a Negotiation Instrument

The Mitigation Plan is widely treated as the regulator's prescription. It is in fact a negotiated document that shapes the entity's compliance obligations long after the penalty is paid.

1.1 Whose Document It Is

Registered entities often treat the Mitigation Plan as something the Regional Entity hands them. The regulator marks up the plan, the entity accepts the changes with little pushback, the plan is folded into the settlement, and the organization spends the next stretch of time living with it. That treatment gets the document backwards.

The NERC Rules of Procedure define a Mitigation Plan as "an action plan developed by the Registered Entity" to correct a noncompliance and prevent its recurrence (Appendix 2). Appendix 4C, Section 6.2, lists what the plan must contain: a point of contact, the noncompliance it corrects, the cause, the Mitigating Activities that correct the noncompliance, correct its cause and prevent recurrence, the anticipated impact on Bulk Power System reliability and an action plan to mitigate any increased risk while the plan is under way, a completion date, a timeline of implementation milestones, and any other information deemed necessary or appropriate. An officer, employee, attorney or other authorized representative of the entity signs it.

1.2 How the Process Runs

Appendix 4C, Section 6, sets the mechanics. Several of them matter in negotiation.

• Submitting a Mitigation Plan does not constitute an admission of a violation (Section 6.1).
• Where the entity does not contest the Alleged Violation and penalty, the plan is due within 30 days of the notification of Alleged Violation, or it is reflected in a settlement agreement or Notice of Penalty (Section 6.3).
• The CEA has 60 days to accept or reject the plan in writing, unless it extends the review period. If it does neither, the plan is deemed accepted (Section 6.4).
• A rejection comes with a written statement of reasons and a Required Date for a revised plan. The CEA then has 30 days on the revision. A second rejection opens the door to a hearing (Section 6.4).
• After the Regional Entity accepts a plan, NERC has 60 days to approve or disapprove it (Section 6.4).

Each of those steps is a point where the entity's position is either presented with care or simply conceded.

1.3 Why the Plan Outweighs the Penalty

In our view, the Mitigation Plan often carries more long-term consequence for the entity than the penalty set in the same resolution. The plan runs continuously, and the CEA tracks it to completion (Section 6.6). Plans that are overly broad, vaguely scoped, or loosely defined at closure produce continuing obligations with no clear endpoint. Plans that are precisely scoped, operationally bounded and explicitly closeable produce a finite obligation that the entity discharges and exits.

1.4 Counsel and Compliance, Together

Negotiating the plan this way takes both counsel and compliance. Counsel is responsible for the legal characterization, the precision of the language, the closure terms, and protection against forward-looking exposure. Compliance is responsible for whether the remediation can actually be done, on what realistic timeline, and with what resources. The two develop the entity's position together and present it to the regulator as a considered counterproposal, not as line edits to someone else's draft.

In our view, entities that work this way produce plans that reflect what the remediation actually requires rather than the regulator's first position. Those plans can be carried out and defended, they have an end date, and the entity can deliver on schedule and exit cleanly. Entities that accept the first position tend to operate under broader and longer obligations than the matter required, and often find at closure that the finish line is further away than they assumed.

From the Practice

The plan is the entity's document, not the regulator's prescription. Counsel owns characterization, precision and closure terms. Compliance owns executability and resources. Negotiated plans are more likely to close on schedule than accepted first positions.

Chapter 2

Reading the Regulator's Mitigation Theory

The changes a regulator asks for reflect a theory about what the underlying issue requires. Reading that theory accurately is the foundation of the negotiation.

2.1 The Theory Behind the Markup

When the Regional Entity pushes back on a proposed plan or asks for specific Mitigating Activities, its position reflects a theory about the underlying compliance issue. It is rarely stated outright and usually has to be inferred from the requested language and the regulator's practice in similar matters. The entity is not really negotiating text. It is negotiating against the theory underneath the text.

2.2 Three Common Theories

• Control failure. A specific control did not work as designed, and targeted repair of that control will address the matter.
• Programmatic weakness. The control failure was a symptom of broader program weaknesses that call for comprehensive program updates.
• Cultural cause. The entity's compliance culture let the issue develop, and training, governance or leadership attention is required.

Each produces different language, scope and burden. Respond to the theory actually in play, not only the words on the page.

2.3 Watching the Theory Move, and Moving It

Reading the theory is iterative. The regulator may start with one theory, hear the entity's position, and shift, and the shift shows up in revisions to the requested language. Counsel who track the movement can engage the real theory at each stage. Counsel who read only the text end up with a plan built for the regulator's first theory.

The entity can also argue at the theory level. If the regulator's theory is too broad for the facts, the entity can make the case for a narrower one, supported by facts the regulator may not have fully weighed. In our view, a regulator persuaded by the narrower theory will often accept narrower language, and this kind of engagement is uncommon enough to stand out.

From the Practice

Requested language reflects an underlying regulator theory. Read it first. Control failure, programmatic weakness and cultural cause each drive different scope and burden. Engage at the theory level, not only the language level.

Chapter 3

Operationally Executable vs. Legally Defensible

Loosen either of the two tests below and the failure shows up during implementation.

3.1 Two Tests at Once

Mitigation language has to be operationally executable: the entity can actually do what it commits to, within its resources and operating reality. It also has to be legally defensible: precise enough to show completion, and bounded enough that a dispute about completion can be settled by reading the language.

3.2 What Executable Looks Like

Executable language keeps actions within the entity's control, fits the timeline to the work, and assumes only resources and verifiers the entity has or will hire. None of this is automatic when the language comes from the regulator's comments, because the regulator does not know the entity's resource limits or competing priorities. Compliance owns the translation into language operations can deliver.

3.3 What Defensible Looks Like

Defensible language describes actions specifically enough to show completion, with objective rather than discretionary criteria. It commits the entity to no more than the underlying Requirement requires, creates no dependencies the entity cannot control, and leaves no ambiguity to be resolved against the entity later.

This matters because Appendix 4C, Section 6.6, requires the entity to certify that "all required actions described in the Mitigation Plan have been completed" and to keep enough documents and data for the CEA to verify it. Vague actions are hard to certify and harder to prove.

3.4 When the Tests Pull Apart

Operations wants flexibility. Defensibility wants specificity. The negotiation has to find language that satisfies both. In our view, programs that run both reviews on every draft tend to close cleanly. Programs that run only one tend to fail the other during implementation.

From the Practice

Mitigation language must be both executable and defensible. Compliance owns executability. Counsel owns defensibility. Both review every draft. When the two pull apart, keep drafting until both are satisfied.

Chapter 4

Scope, Depth, and Timeline Discipline

Scope, depth and timeline are where the entity usually has the most room to negotiate. Each needs its own discipline.

Scope is what the mitigation covers: which systems, processes and personnel. Depth is how thoroughly each element has to be addressed. Timeline is how fast each element must be finished and how long the plan runs. Progress on one does not carry over to the others.

4.1 Scope

Requested scope is sometimes broader than the violation warrants. A documentation gap in three procedures can become mitigation covering every procedure of that type, or a failure in one operating area can reach areas where nothing failed. Bound scope to what the matter requires, with a fact-based argument. In our view, bounded scope is often achievable, and it shrinks the burden.

4.2 Depth

Requested depth often defaults to comprehensive review and reconstruction. The entity can propose a depth that matches what the issue revealed and what reasonable assurance against recurrence requires. "Comprehensive program update" and "targeted update with periodic verification" are very different commitments.

4.3 Timeline

Appendix 4C, Section 6.2, provides that the CEA may agree to a mutually acceptable milestone schedule, "typically no more than three (3) months for each milestone," with discretion to adjust for complexity or risk. That spacing is negotiable.

Realistic milestones produce plans the entity can deliver. Aggressive ones produce missed dates and sometimes a revised plan on worse terms. When a milestone is at risk, timing matters. Under Section 6.5, an extension request must reach the CEA before the original date, though the CEA may accept a late request for good cause. Separately, the CEA may extend the implementation deadline for good cause, including an outage that cannot be scheduled or construction that takes longer than planned.

From the Practice

Scope, depth and timeline are where the entity has the most room to negotiate. Argue scope from the facts, not from comfort with the regulator's framing. Milestone spacing is negotiable. Request extensions before the date passes.

Chapter 5

The Implementation Burden: What You Are Committing To

The Mitigation Plan is an operating obligation for its full duration. Understanding the burden before signing is the entity's job.

5.1 What the Burden Is Made Of

The implementation burden is what the entity lives with until the plan is complete. Staff hours. Documentation. System changes. Training. Internal reviews. Verification. Progress updates. Entities that never estimated it before signing can find themselves short-staffed for the work.

5.2 Estimating It Before Signing

The regulator cannot see the entity's resource picture or competing priorities. Compliance has to model it realistically: who does the work, how long it takes, and what verification and reporting add on top.

5.3 Negotiating the Burden

When the estimate exceeds what the entity can credibly deliver, the move is to seek changes in scope, depth or timeline that bring the burden within reach. This is not a request for a favor. The entity is presenting the estimate, the implementation plan behind it, and the changes that would produce a plan it can execute. In our view, regulators often respond to that kind of engagement, because their interest is mitigation that actually happens, not mitigation that is promised and missed.

5.4 Committing the Resources

Where changes cannot be obtained, the entity has to commit enough internal resources to deliver the plan as agreed. That can mean added staff or contractors. The decision belongs before signature, with senior leadership aware of it and the resource commitment documented. The stakes are spelled out in Appendix 4C, Section 6.6: if required actions are not completed by the deadline, including any extensions, the violations covered by the plan "will be enforced immediately," a new plan must be submitted, and the CEA may conduct a Compliance Audit or issue a Remedial Action Directive.

From the Practice

Estimate the burden before signing. That is the entity's job. If it exceeds capacity, negotiate scope, depth or timeline with the estimate in hand. Otherwise commit the resources. A missed deadline means immediate enforcement and a new plan.

Chapter 6

Reporting Obligations and Their Long Tail

Every progress update and milestone notice is a recurring compliance event. The cumulative effect across the life of a plan is significant.

6.1 What the Rules Require

Appendix 4C, Section 6.6, requires the entity to "provide updates as requested by the CEA on the progress of the Mitigation Plan." The CEA tracks the plan to completion and may review status on site or during a Compliance Audit. Cadence and content are therefore set largely by the CEA's requests and the plan's own terms, which is why they are worth negotiating.

6.2 The Compliance Exposure in Each Report

Each update, milestone notice and certification takes preparation, documentation, legal review and timely submission, and each carries its own exposure. Appendix 4C, Section 6.2, states that "additional violations could be determined for not completing work associated with accepted milestones." An update that overstates progress or misdescribes what was done damages credibility and invites follow-up that can stretch the matter past its original scope. Each report deserves the care the original matter received.

6.3 Negotiating Cadence and Content

More frequent updates mean more preparation cycles and more chances for error. Content requirements should be specific enough that the entity knows what to provide, and bounded enough that it is not certifying to matters outside the report's scope. An agreed reporting template reduces ambiguity.

6.4 Variances and Cure

Counsel should also try to define how variances are handled. Appendix 4C already provides one relief valve: extensions of milestones or completion dates requested before the original date (Section 6.5). In our view, it is also worth asking for agreed handling of minor variances, such as a short window to correct an incomplete submission. It will not always be granted.

From the Practice

Every update and milestone is a compliance event in its own right. Missed milestone work can produce additional violations under Appendix 4C. Negotiate cadence, content and how variances are handled.

Chapter 7

Negotiating the Closure Criteria

A Mitigation Plan needs a defined finish line. Without one, closure happens when the regulator gets to it.

7.1 How Closure Works Under Appendix 4C

Under Appendix 4C, Section 6.6, the entity certifies to the CEA that all required actions in the plan are complete and retains enough documents, data and information for the CEA to verify that. The CEA may request those records and conduct follow-up assessments, Spot Checks or Compliance Audits. The Regional Entity notifies NERC when each plan is verified complete; Section 6.6 does not set a deadline for that verification.

7.2 Why Explicit Criteria Matter

Explicit criteria let the entity plan toward closure and certify against defined terms. Without them, closure depends on how the CEA reads loose language, and in our view the matter can stay open long after the remediation is done.

Pressing on closure is asking for clear standards against which the work will be judged. In our view, a regulator that resists defined criteria is signaling that closure will turn on its discretion, and that is a problem to surface before signing.

7.3 The Elements of Closure Language

Each of these elements can be negotiated:

1. The substantive milestones the entity must complete.
2. The evidence that will demonstrate each milestone was met.
3. The content and format of the completion certification package.
4. Any agreed timeframe for the CEA's review of the certification, since Appendix 4C does not set one.
5. The standard the CEA will apply in deciding whether the plan is complete.
6. The procedure for addressing any deficiencies the CEA identifies.

Plans that close cleanly let the entity exit, archive the record, and feed the lessons back into its operating framework. Plans that stay open after the work is done keep consuming attention and block the lessons-integration step described in EC-WP-801 and EC-WP-804.

From the Practice

Closure criteria should be explicit, objective and verifiable. Resistance to defined criteria usually signals discretionary closure. Clean closure lets the entity exit, archive and integrate lessons.

Chapter 8

The Mitigation Plan as a Future Audit Variable

Future auditors will read the plan. Its wording, its closure history and its implementation evidence all shape the entity's next audit.

8.1 Part of the Regulatory Record

A Mitigation Plan becomes part of the entity's regulatory record. Appendix 4C, Section 4.1.5, requires each Compliance Audit report to identify any Remedial Action Directives, Mitigation Plans or other Mitigating Activities reviewed during the audit, and Section 6.6 allows the CEA to review plan status during a Compliance Audit. Where a plan is agreed as part of a settlement, NERC publicly posts a copy of it or a description of the Mitigating Activities, with confidential and critical infrastructure information redacted (Section 5.6). NERC also submits approved plans to FERC as non-public information (Section 6.5).

A plan that closed cleanly with documented evidence helps in later audits. One that never closed, or closed without solid documentation, can become an audit problem years later.

8.2 Preserving Implementation Evidence

Section 6.6 requires the entity to retain documents, data and information sufficient for the CEA to verify completion. Treat it with the same discipline as substantive compliance evidence: document each milestone when completed, and keep each verification record and progress update with its workpapers. Programs that lose track of this evidence end up reconstructing it when an auditor asks, and reconstructed evidence is much weaker than contemporaneous evidence.

8.3 What the Plan Leaves Behind

Remediation done under the plan often becomes standard practice. The new procedures, controls and training stay. That is the right outcome when the mitigation reflects real program improvement. It is a problem when the plan included elements the matter never required, which the entity now maintains indefinitely because the language said so. Counsel should weigh that forward effect while negotiating.

From the Practice

Audit reports identify the plans reviewed, and settled plans are posted publicly with redactions. Keep mitigation evidence contemporaneous. Reconstructed evidence is weaker. Avoid language that locks in structures the matter did not warrant.

Glossary

Glossary

Alleged Violation. A potential noncompliance for which the CEA has determined, based on the facts and circumstances, that evidence exists to indicate a Registered Entity has violated a Reliability Standard, and that will be resolved outside the Compliance Exception or FFT processes (NERC ROP Appendix 2).

Completion certification. The entity's certification to the CEA, on completing a Mitigation Plan, that all required actions described in the plan have been completed (Appendix 4C, Section 6.6).

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in their respective roles of monitoring and enforcing compliance with the NERC Reliability Standards (Appendix 2).

Milestone. An interim implementation step in a Mitigation Plan with its own completion date. Appendix 4C notes that milestones are typically no more than three months apart, subject to CEA discretion (Section 6.2).

Mitigating Activities. Actions taken by a Registered Entity to correct and prevent recurrence of a noncompliance, whether or not the actions are embodied in a Mitigation Plan (Appendix 2).

Mitigation Plan. An action plan developed by the Registered Entity to correct a noncompliance with a Reliability Standard and prevent re-occurrence of the violation (Appendix 2).

Notice of Penalty. A notice prepared by NERC and filed with FERC, following NERC approval of a notice of Confirmed Violation or a settlement agreement, stating the penalty or sanction imposed or agreed to (Appendix 2).

Regional Entity. An entity having enforcement authority under 18 C.F.R. § 39.8 (Appendix 2).

Remedial Action Directive. An action, other than a penalty or sanction, required by a CEA to bring a Registered Entity into compliance or avoid a violation, where immediately necessary to protect Bulk Power System reliability from an imminent or actual threat (Appendix 2).

Required Date. The date given a Registered Entity in a CEA notice by which some action by the entity is required (Appendix 2).

How Energy Compliance Can Help

How Energy Compliance Can Help

A Mitigation Plan is won or lost in the drafting, then again in the evidence. EC and Stich Angell work both halves as one team.

Legal Series services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

The practice is organized around four areas: Enforcement Defense (Notice of Penalty response and settlement strategy), Privilege Counsel (internal investigation and document production under privilege), Regulatory Advisory (FERC submissions and Regional Entity counsel engagement), and Legal-Compliance Integration (operating frameworks built before enforcement arrives). Each engagement is scoped to the entity's role, posture and procedural stage.

On the compliance side, EC provides compliance program management to track milestones, audit defense for the audit that will read the plan, and data request strategy when the CEA asks for verification records.

WattOps Compliance

WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). Mitigation evidence deserves the same standard as the rest of the program's evidence. EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module. Where Mitigating Activities touch renewable or storage operations, RenewOps keeps the operations data behind each milestone in view.

Looking at a proposed Mitigation Plan, or the regulator's comments on yours? Call before you sign.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A., where she has practiced civil trial and appellate law since 2001. She is licensed in the state and federal courts of Minnesota and North Dakota and has been recognized as a Super Lawyer. Her practice covers construction, premises liability, products liability and transportation matters, and now includes energy compliance representation. She has tried cases to verdict, and her representative matters include decisions of the Minnesota Court of Appeals and the Minnesota Supreme Court.

Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

About Stich Angell, P.A.

About Stich Angell, P.A.

Stich Angell, P.A. is a Bloomington, Minnesota civil litigation firm that has practiced since 1971. Its practice areas include catastrophic injury and wrongful death, products liability, construction, retail and hospitality, transportation, sexual abuse and intentional torts, alternative living and long-term care facilities, and energy compliance legal services.

The firm describes its trial and appellate attorneys as among the most highly respected civil trial attorneys in the state. Although the firm is based in Minnesota, it represents clients throughout the country.

Stich Angell has expanded its civil litigation practice into energy compliance representation, partnering with Energy Compliance, Inc. to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle. The combined practice brings civil litigation discipline, appellate strength, and senior regulatory experience to a category of matters that has historically lacked that combination.

Stich Angell, P.A. is located in Bloomington, Minnesota. To engage the integrated legal-compliance practice, contact Energy Compliance, Inc. at 763.438.4427 or Stich Angell at 612.333.6251. Online at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and converge only when a matter has already escalated.

Engagements are overseen by a senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity. Learn more at energycomplianceinc.com and stichlaw.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (effective May 19, 2022), Sections 4.1.5, 5.6 and 6.0 to 6.7; accessed October 25, 2026. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024); accessed October 25, 2026. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• North American Electric Reliability Corporation, Rules of Procedure, "Rules of Procedures in Effect" table listing appendix effective dates; accessed October 25, 2026. https://www.nerc.com/who-we-are/rules-of-procedure
• Stich Angell, P.A., Cara C. Passaro attorney profile; accessed October 25, 2026. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., firm home page and practice areas; accessed October 25, 2026. https://stichlaw.com/
• Stich Angell, P.A., Contact Us; accessed October 25, 2026. https://stichlaw.com/contact-us/
• Energy Compliance, Inc., EC-WP-801, Notice of Penalty Response Strategy, Legal Series. https://energycomplianceinc.com
• Energy Compliance, Inc., EC-WP-804, The Legal-Compliance Interface in Audit Defense, Legal Series. https://energycomplianceinc.com