Date of Eversource Energy Service Company Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018

NCR ID : 07176

Registered Entity Name: Eversource Energy Service Company

Registered Entity Acronym: Eversource

Reliability Standards Scope: Operations & Planning Standards

Compliance Monitoring Process: Compliance Audit

Distribution: Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Regional Entity:

Northeast Power Coordinating Council, Inc. (NPCC)

Date of Opening Presentation: July 20, 2018 Date of Closing

Presentation: October 25, 2018

Date of Report: 10/29/2018 IP Year: 2018

Potential Noncompliance: None (zero)

Jurisdiction: United States

Table of Contents

I. Executive Summary ................................................................................................................................. 1

II. Compliance Audit Process ....................................................................................................................... 2

Objectives ......................................................................................................................................... 2

Scope ................................................................................................................................................ 2

Internal Compliance Program .......................................................................................................... 3

Controls ............................................................................................................................................ 3

Confidentiality and Conflict of Interest ............................................................................................ 3

Methodology .................................................................................................................................... 3

Company Profile ............................................................................................................................... 4

III. Compliance Audit Findings...................................................................................................................... 5

IV. Recommendations and Positive Observations ....................................................................................... 6

Recommendations............................................................................................................................ 6

Positive Observations ....................................................................................................................... 6

V. Compliance Culture ................................................................................................................................. 8

Northeast Power Coordinating Council, Inc. (NPCC) Contact Information ............................................ 8 Appendix 1 ..................................................................................................................................................... 9

Compliance Audit Participants ......................................................................................................... 9

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 1

I. Executive Summary Northeast Power Coordinating Council, Inc. (NPCC) conducted a Operations & Planning Standards Compliance Audit of 2018 Eversource, NCR ID 07176, from July 20, 2018 to October 25, 2018. At the time of the Compliance Audit, Eversource was registered for the functions of Distribution Provider (DP), Transmission Operator (TOP), Transmission Owner (TO), Transmission Planner (TP), and Transmission Service Provider (TSP). The Reliability Coordinator (RC), Balancing Authority (BA), Planning Authority (PA) and Resource Planner (RP) for Eversource is ISO-NE. The Compliance Audit team “team” evaluated Eversource for compliance with twenty three (23) requirements for the 2018 ERO Enterprise Compliance Monitoring and Enforcement Program (CMEP). The team assessed compliance with the NERC Reliability Standards for the periods noted as follows: for TO, TOP, TP, TSP: 05/21/2016 – 9/24/2018; for DP: from the previous audit date for each company under Eversource to 9/24/2018. Eversource submitted evidence for the team’s evaluation of compliance with requirements. The team reviewed and evaluated all evidence provided to assess compliance with Reliability Standards applicable to Eversource at this time. Based on the evidence provided, the team’s findings are summarized in Table 1 below

Table 1: Summary of Compliance Audit Findings

Reliability Standard Requirement(s)

Registered Function No Finding

Potential Noncompliance

(PNC)

Open Enforcement Action (OEA)

4 TO 3 0 1

13 TOP 13 0 0

5 TP 5 0 0

1 DP 1 0 0

The team notified Eversource of six (6) Recommendations. There was one open Mitigation Plan; therefore, it was reviewed by the team.

The Compliance Audit Team Lead certifies that the team adhered to all applicable requirements of the NERC Rules of Procedure (ROP) and Compliance Monitoring and Enforcement Program (CMEP).1

1This statement replaces the Regional Entity Self-Certification process.

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 2

II. Compliance Audit Process

The compliance Compliance Audit process steps are detailed in the NERC ROP. The Compliance Monitoring and Enforcement Program generally conforms to the United States Government Auditing Standards and other generally accepted audit practices.

Objectives All registered entities are subject to compliance assessments with all Reliability Standards applicable to the functions for which the registered entity is registered2 in the Region(s) performing the assessment. The Compliance Audit objectives are to:

• Provide reasonable assurance of compliance to the identified applicable Reliability Standards;

• Review compliance with applicable NERC Reliability Standards identified for 2018 ERO Enterprise CMEP;

• Review evidence of self-reported violations and previous self-certifications;

• Review Eversource’s internal compliance program and controls for requirements in scope;

• Review the status of open Mitigation Plans.

Scope The scope of this Compliance Audit considered the NERC Reliability Standards from 2018 ERO Enterprise CMEP Implementation Plan, Inherent Risk Assessment (IRA) and Internal Control Evaluation (ICE) of Eversource completed by Northeast Power Coordinating Council, Inc. (NPCC). In addition, the scope of the Compliance Audit included a review of Mitigation Plans or Remedial Action directives that were open during the Compliance Audit.

The Reliability Standards and Requirements in-scope for this Compliance Audit are illustrated in Table 2 below:

Table 2: Compliance Audit Scope Registered Function Standards Requirement(s)

TOP COM-002-4 R4 TO, TOP EOP-005-2 R1

TOP EOP-010-1 R3 TO FAC-003-4 R6, R7 TO FAC-008-3 R6

TOP PER-005-2 R1 TOP PRC-001-1.1(ii) R3, R4, R5 TO PRC-005-6 R3 DP PRC-006-NPCC-1 R4

TOP TOP-001-4 R14, R15, R16 TOP TOP-010-1(i) R1, R3, R4 TP TPL-001-4 R1, R2, R3, R4 TP TPL-007 R1

The team did not expand the scope of the Compliance Audit beyond what was stated in the notification package. 2NERC Rules of Procedure, Appendix 4C, Section 3.1, Compliance Audits.

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 3

Internal Compliance Program Within the scope of the Compliance Audit, Eversource’s compliance program was reviewed.

Controls The team reviewed Eversource’s related internal controls associated with NERC Reliability Standards in scope.

Confidentiality and Conflict of Interest Confidentiality and conflict of interest of the team are governed under the Regional Delegation Agreements with NERC and Section 1500 of the NERC Rules of Procedure. Eversource was informed of Northeast Power Coordinating Council, Inc. (NPCC)’s obligations and responsibilities under the agreement and procedures. The work history for each team member was provided to Eversource, which was given an opportunity to object to a team member’s participation on the basis of a possible conflict of interest or the existence of other circumstances that could interfere with a team member’s impartial performance of duties. Eversource had not submitted any objections by the stated objection due date based on the ROP and accepted the team member participants without objection. There were no denials or access limitations placed upon this team by Eversource.

Methodology The ERO Compliance Monitoring and Enforcement Manual (Manual)3 documents the ERO Enterprise’s current approaches used to assess a registered entity’s compliance with the NERC Reliability Standards. The ERO Enterprise uses, “to the extent possible, the Generally Accepted Auditing Standards (GAAS), the Generally Accepted Government Auditing Standards (GAGAS), and standards sanctioned by the Institute of Internal Auditors, as guidance for performing activities under the Compliance Monitoring and Enforcement Program (CMEP).”4 While the ERO Enterprise does not necessarily perform compliance monitoring activities that must be in accordance with these standards recognized in the United States, the ERO Enterprise uses these standards as framework to conduct compliance monitoring activities under the CMEP, and recognizes that these standards provide information used in oversight, accountability, transparency, and improvements in ERO Enterprise operations. The Northeast Power Coordinating Council, Inc. (NPCC) provided Eversource with a Compliance Audit notification package to commence the Compliance Audit. Eversource provided evidence at the time requested, or as agreed upon, by Northeast Power Coordinating Council, Inc. (NPCC). The team reviewed the evidence submitted by Eversource and assessed compliance with the requirements of the applicable Reliability Standards. Additional evidence could be submitted until the agreed-upon deadline prior to the exit briefing. After that date, only data or information that was relevant to the content of the report or its finding could be submitted with the agreement of the team lead. The team reviewed documentation provided by Eversource and requested additional evidence and sought clarification from subject matter experts during the Compliance Audit. The evidence submitted in the form of policies, procedures, emails, logs, studies, data sheets, etc. was validated, substantiated, and cross-checked for accuracy as appropriate. Where sampling was applicable to a requirement, the sample set was determined by a statistical methodology, along with professional judgment as mentioned in the Manual.

3http://www.nerc.com/pa/comp/ERO%20Enterprise%20Compliance%20Auditor%20Manual%20DL/NERC_Compliance_Monitoring_and_Enforcement_Manual_v3_0.pdf 4NERC Rules of Procedure, Section 1207 and 126 FERC 61,038, Paragraph 3

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 4

The findings were based on the facts and documentation reviewed, the team’s knowledge of the Bulk Electric System (BES), the NERC Reliability Standards, and professional judgment. All findings were developed based upon the consensus of the team.

Company Profile Eversource Energy is the owner and operator of Transmission and Distribution electric systems within the three-state region of Connecticut, New Hampshire, and Massachusetts. Eversource Energy is a Fortune 500 and Standard and Poor’s 500 energy company, which operates New England’s largest energy distribution system, serving more than 3.6 million electric and natural gas customers. In addition to its two gas companies, NSTAR Gas Company and Yankee Gas Services Company, Eversource Energy owns and operates the following five electric utility companies: Eversource Energy Service Company (Eversource Service), the Connecticut Light and Power Company (CL&P), Western Massachusetts Electric Company (WMECO), Public Service Company of New Hampshire (PSNH) and NSTAR Electric. Each electric utility owns transmission and distribution facilities in their respective states. Eversource Energy Service Company is a subsidiary of Eversource Energy that provides services to its operating companies, CL&P, WMECO, NSTAR, and PSNH. Eversource Energy owns and operates three Local Control Centers (LCCs) that act as the TOP under the purview of ISO-NE (TOP). The LCCs are the Connecticut Valley Exchange (CONVEX), Electric System Control Center (ESCC) in New Hampshire (a.k.a. PSNH) and Eastern Massachusetts (EMA) region (a.k.a. NSTAR).

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 5

III. Compliance Audit Findings Based on the results of this Compliance Audit, no findings of non-compliance were noted for the Reliability Standards and applicable Requirements in scope for this engagement. There is one open enforcement action listed in table 3 below:

Table 3: Findings and Supporting Evidence Standard Req. Registered Function Category of Finding FAC-008-3 R6 TO OEA

NERC Tracking ID – NPCC2018019893 NPCC Tracking ID – NPCC2018-201628

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 6

IV. Recommendations and Positive Observations

Recommendations The team identified and informed Eversource of six (6) recommendations. The specific details of each recommendation are described below. 1. COM-002-4, R4 Formalize Eversource’s internal process for assessing the effectiveness of its documented communications protocol every twelve calendar months. 2. FAC-003-3, R7 When conditions impact the ability to implement 100% of the workplan, the workplan should be reevaluated / modified and document any changes. 3. PER-005-2, R1.4 Develop and implement a common Eversource annual training program evaluation report format that includes both initial and refresher training. 4. TOP-001, R14 When developing a common “Eversource” procedure associated with the Operating Plan, maintain documentation of the Operating Plan. Continue to include the log entries confirming the discussion with ISO-NE. 5. PRC-006-NPCC-1, R4 Develop a tracking sheet that provides for the logging of each UFLS feeders relay test time, aux relay time, breaker operating time and total operating time to insure an accurate accounting of the total operating times of all the UFLS circuits. 6. PRC-006-NPCC-1, R4 Continue to look for ways to improve the WMASS load shedding plan so that the required load shed percentages are respected.

Positive Observations The team identified and informed Eversource of five (5) positive observations. The specific details of each positive observation are described below. General 1. Eversource has addressed the Recommendations from prior Audits. 2. Simulation load shedding page in EMS (PSNH) used during monthly load shed test to prepare System

Operators for an actual load shedding event. 3. Dual authentication required (verbal / alarm) when receiving an Operating Instruction from ISO-NE to

implement load shedding.

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 7

4. EOP-005-2 SRWG monthly meetings review outages to restoration paths to ensure at least one good path is available at all times.

5. PRC-005-6, R3 CONVEX and PSNH employ a process, TD718, where they perform a verification of the

Protection System database by having the Engineering Department create a list of Protection System Components from reviewing substation drawings, then compare the lists to the Cascade database list, resolve discrepancies, and track changes in devices. In addition, on an annual basis, a list of Protection System Components from the Cascade database is printed out and distributed to the Field Engineering group to perform a field inventory check at the substations, verifying the Cascade database.

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 8

V. Compliance Culture The team performed an assessment of Eversource’s compliance culture in conjunction with the Compliance Audit process. The assessment was accomplished through a review of responses to the Internal Compliance Survey questionnaire and additional information that was gathered during interviews and observations. This included an assessment of factors that characterize vigorous and effective compliance programs including:

• Active engagement and leadership by senior management; • Effective, in-practice preventive measures appropriate to the circumstances of the company; • Prompt detection of problems, cessation of misconduct, and reporting of a violation; and • Remediation of the misconduct.

Northeast Power Coordinating Council, Inc. (NPCC) Contact Information Any questions regarding this Compliance Audit report can be directed to: Northeast Power Coordinating Council, Inc. (NPCC) 1040 Avenue of the Americas 10th Floor New York, NY 10018-3703 On behalf of Northeast Power Coordinating Council, Inc. (NPCC), this report was prepared and reviewed by:

Compliance Audit Team Lead Date

John Muir 11/19/2018

Management Representative Date

Sal Buffamante 11/19/2018

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 9

Appendix 1

Compliance Audit Participants Following is a list of all personnel from the team and Eversource who were directly involved during the meetings and interviews.

Role Title Entity Compliance Audit Team Lead Director of Compliance Monitoring NPCC Lead Auditor Compliance Auditor NPCC Auditor Compliance Auditor NPCC Auditor Compliance Auditor NPCC Auditor Compliance Auditor NPCC Auditor Compliance Auditor NPCC Auditor Compliance Auditor NPCC Auditor Compliance Engineer NPCC

Title Entity

Director, Reliability, Compliance & Implementation Eversource Energy Service Co. Program Manager-Reliability Compliance Eversource Energy Service Co. Program Manager-Reliability Compliance Eversource Energy Service Co. Manager, System Operations ESCC Eversource Energy Service Co. Manager, System Operations, CONVEX Eversource Energy Service Co. Manager, System Operations, EMA Eversource Energy Service Co. System Operations Supervisor Eversource Energy Service Co. Supervisor, Transmission System Eversource Energy Service Co. Supervisor, System Operations Eversource Energy Service Co. Supervisor, System Operations Eversource Energy Service Co. Manager, System Ops Train & Procedures Eversource Energy Service Co. Team Lead, System Operations Training Eversource Energy Service Co. Trainer, System Operations Eversource Energy Service Co. Trainer, System Operations Eversource Energy Service Co. Trainer, System Operations Eversource Energy Service Co. Senior Engineer System Planning Eversource Energy Service Co. Manager, System Planning Eversource Energy Service Co. Director, System Planning and P&C Engineering Eversource Energy Service Co. Manager, System Planning Eversource Energy Service Co. Manager, P & C Engineering Eversource Energy Service Co. Lead Engineer Eversource Energy Service Co. Engineer Eversource Energy Service Co. Senior Engineer System Planning Eversource Energy Service Co. Engineer, Transmission Planning Eversource Energy Service Co. Manager, Substation Design Engineering Eversource Energy Service Co. Director, Business & Quality Assurance Eversource Energy Service Co. Director, Transmission Line Engineering Eversource Energy Service Co.

Public Version. Confidential Information Has Been Removed, Including Privileged and Critical Energy Infrastructure Information.

Dates of 2018 Compliance Audit: July 20, 2018 – October 25, 2018 Date of Report: 10/29/2018 Page 10

Title Entity Engineer Eversource Energy Service Co. Manager, Substation Design Engineering Eversource Energy Service Co. Senior Engineer Eversource Energy Service Co. Manager, Substation Operations & Maintenance Eversource Energy Service Co. Senior Coordinator, Outage Transmission Eversource Energy Service Co. Senior Engineer System Planning Eversource Energy Service Co. Engineer Eversource Energy Service Co. Manager, Protection & Controls, Engineering Eversource Energy Service Co. Senior Engineer Eversource Energy Service Co. Supervisor-ESCC Operations Eversource Energy Service Co. Technologist, Engineering Eversource Energy Service Co. Supervisor, Operations, Convex Eversource Energy Service Co. Principal Engineer Eversource Energy Service Co. Lead Engineer Eversource Energy Service Co. Manager, Protection & Controls, Engineering Eversource Energy Service Co. Senior Engineer System Planning Eversource Energy Service Co. Director Vegetation Management Eversource Energy Service Co. Manager, Vegetation Management Eversource Energy Service Co. Manager, Reliability Compliance Eversource Energy Service Co. Senior Analyst Eversource Energy Service Co. Director, Field Engineering & Communications Eversource Energy Service Co. Manager, Field Engineering Eversource Energy Service Co. Manager, Field Communications Eversource Energy Service Co. Senior Supervisor, Field Engineering Eversource Energy Service Co. Supervisor, Substation Operations Eversource Energy Service Co. Supervisor, Transmission System, EMA Eversource Energy Service Co. Senior Supervisor, Transmission System, EMA Eversource Energy Service Co. Senior Supervisor, Transmission System, ESCC Eversource Energy Service Co. Senior Engineer, CONVEX Eversource Energy Service Co. Senior Engineer, CONVEX Eversource Energy Service Co. IT Consultant– EMS, ESCC Eversource Energy Service Co. Director-Transmission Ops & Reliability Compliance Eversource Energy Service Co. Director, System Operations, NH Eversource Energy Service Co. Supervisor, Substation Operations, NH Eversource Energy Service Co.