METROPOLITAN EDISON COMPANY - Pennsylvania Public Utility ...

Finding and Conclusion No. VIII-1 – The FE-PA Companies have developed andmaintain comprehensive emergency response, physical security, cyber securityand business continuity plans.FirstEnergy maintains an electronic version of the Emergency Response Plan(ERP) which it utilizes for system outages and responding to other emergency eventssuch as natural disasters, terrorist threats, vandalism, etc. The ERP is FirstEnergy wideand covers all three FE-PA Companies. State, local, and emergency contact numbersare maintained in the plans. Met-Ed, Penelec and Penn Power perform summer andwinter readiness drills annually. Network and tabletop exercises are also performed onan annual basis.FirstEnergy’s Corporate Security maintains a combined or Corporation widePhysical Security Plan (PSP) for Penelec, Met-Ed, and Ohio Edison/Penn Power. ThePSP includes cyber asset identification, maintenance and testing programs, NorthAmerican Electric Reliability Corporation critical infrastructure protection computersecurity training, and Federal Energy Regulatory Commission standards of conducttraining. The Penelec and Met-Ed PSP’s are similar to the FirstEnergy Corporate PSP.The Met-Ed PSP includes plans for the Regional Dispatch Office (RDO) and the SystemControl Center (SCC). All facilities inspected by the Audit Staff appeared to beadequately secured. Additionally, as indicated in Finding and Conclusion No. IX-3,FirstEnergy has implemented a computer based training program to educate itsemployees regarding IT security issues.FirstEnergy has a corporate wide Cyber Security Disaster Recovery Plan. Theplan includes procedures for every application in the system (approximately 183).FirstEnergy has a separate plan for different functions such as Geographic InformationSystem (GIS), customer outage reporting system, energy management system, etc. Allplans are reviewed and updated annually. FirstEnergy also has a Disaster RecoveryPlan for the Information Security Operations Center which is located approximately fivemiles from the Akron headquarters.The Company has a corporate wide Business Continuity Plan (BCP) but alsomaintains individual BCP’s for Met-Ed’s Reading SCC and RDO, and Penelec’s RDO.All the BCP’s cover business recovery and business resumption and includecontingency planning. Each of the BCP’s also includes a Pandemic Health EmergencyResponse Plan. All BCPs and related plans are reviewed and updated annually.In 2009, a consultant performed a Critical Infrastructure Protection (CIP)assessment of FirstEnergy’s cyber and physical security. A total of 119 substationswere reviewed in three states. Vulnerability Assessments (VA’s) were performed onfour substations in Penn Power’s service territory, 25 substations in Met-Ed’s serviceterritory and 22 substations in Penelec’s service territory. There were three substationsthat had security issues at the time of the assessment, but upon review by the AuditStaff it appeared that all security issues have been appropriately rectified.- 52 -