(a) The Electric Reliability Organization and each Regional Entity shall have an audit program that provides for rigorous audits of compliance with Reliability Standards by users, owners and operators of the Bulk-Power System.

(b) The Electric Reliability Organization and each Regional Entity shall have procedures to report promptly to the Commission any self-reported violation or investigation of a violation or an alleged violation of a Reliability Standard and its eventual disposition.

(1) Any person that submits an application to the Commission for certification as an Electric Reliability Organization shall include in such application a proposal for the prompt reporting to the Commission of any self-reported violation or investigation of a violation or an alleged violation of a Reliability Standard and its eventual disposition.

(2) Any agreement for the delegation of enforcement authority to a Regional Entity shall include a provision for the prompt reporting through the Electric Reliability Organization to the Commission of any self-reported violation or investigation of a violation or an alleged violation of a Reliability Standard and its eventual disposition.

(3) Each report of a violation or alleged violation by a user, owner or operator of the Bulk-Power System shall include the user's, owner's or operator's name, which Reliability Standard or Reliability Standards were violated or allegedly violated, when the violation or alleged violation occurred, and the name of a person knowledgeable about the violation or alleged violation to serve as a point of contact with the Commission.

(4) Each violation or alleged violation shall be treated as nonpublic until the matter is filed with the Commission as a notice of penalty or resolved by an admission that the user, owner or operator of the Bulk-Power System violated a Reliability Standard or by a settlement or other negotiated disposition. The disposition of each violation or alleged violation that relates to a Cybersecurity Incident or that would jeopardize the security of the Bulk-Power System if publicly disclosed shall be nonpublic unless the Commission directs otherwise.

(5) The Electric Reliability Organization, and each Regional Entity through the ERO, shall file such periodic summary reports as the Commission shall from time to time direct on violations of Reliability Standards and summary analyses of such violations.

(c) The Electric Reliability Organization, or a Regional Entity, may impose, subject to section 215(e) of the Federal Power Act, a penalty on a user, owner or operator of the Bulk-Power System for a violation of a Reliability Standard approved by the Commission if, after notice and opportunity for hearing:

(1) The Electric Reliability Organization or the Regional Entity finds that the user, owner or operator has violated a Reliability Standard approved by the Commission; and

(2) The Electric Reliability Organization files a notice of penalty and the record of its or a Regional Entity's proceeding with the Commission. Simultaneously with the filing of a notice of penalty with the Commission, the Electric Reliability Organization shall serve a copy of the notice of penalty on the entity that is the subject of the penalty.

(d) A notice of penalty by the Electric Reliability Organization shall consist of:

(1) The name of the entity on whom the penalty is imposed;

(2) Identification of each Reliability Standard violated;

(3) A statement setting forth findings of fact with respect to the act or practice resulting in the violation of each Reliability Standard;

(4) A statement describing any penalty imposed;

(5) The record of the proceeding;

(6) Other matters the Electric Reliability Organization or the Regional Entity, as appropriate, may find relevant.

(e) A penalty imposed under this section may take effect not earlier than the thirty-first (31st) day after the Electric Reliability Organization files with the Commission the notice of penalty and the record of the proceedings.

(1) Such penalty will be subject to review by the Commission, on its own motion or upon application by the user, owner or operator of the Bulk-Power System that is the subject of the penalty filed within thirty (30) days after the date such notice is filed with Commission. In the absence of the filing of an application for review or motion or other action by the Commission, the penalty shall be affirmed by operation of law upon the expiration of the thirty (30)-day period for filing of an application for review.

(2) An applicant filing an application for review shall comply with the requirements for filings in proceedings before the Commission. An application shall contain a complete and detailed explanation of why the applicant believes that the Electric Reliability Organization or Regional Entity erred in determining that the applicant violated a Reliability Standard, or in determining the appropriate form or amount of the penalty. The applicant may support its explanation by providing information that is not included in the record submitted by the Electric Reliability Organization.

(3) Application to the Commission for review, or the initiation of review by the Commission on its own motion, shall not operate as a stay of such penalty unless the Commission otherwise orders upon its own motion or upon application by the user, owner or operator that is the subject of such penalty.

(4) Any answer, intervention or comment to an application for review of a penalty imposed under this part must be filed within twenty (20) days after the application is filed, unless otherwise ordered by the Commission.

(5) In any proceeding to review a penalty imposed under this part, the Commission, after public notice and opportunity for hearing (which hearing may consist solely of the record before the Electric Reliability Organization or Regional Entity and the opportunity for the presentation of supporting reasons to affirm, modify, or set aside the penalty), will by order affirm, set aside, or modify the penalty or may remand the determination of a violation or the form or amount of the penalty to the Electric Reliability Organization for further consideration. The Commission may establish a hearing before an administrative law judge or initiate such further procedures as it determines to be appropriate, before issuing such an order. In the case of a remand to the Electric Reliability Organization, the Electric Reliability Organization may remand the matter to a Regional Entity for further consideration and resubmittal through the Electric Reliability Organization to the Commission.

(6) The Commission will take action on an application for review of a penalty within sixty (60) days of the date the application is filed unless the Commission determines on a case-by-case basis that an alternative expedited procedure is appropriate.

(7) A proceeding for Commission review of a penalty for violation of a Reliability Standard will be public unless the Commission determines that a nonpublic proceeding is necessary and lawful, including a proceeding involving a Cybersecurity Incident. For a nonpublic proceeding, the user, owner or operator of the Bulk-Power System that is the subject of the penalty will be given timely notice and an opportunity for hearing and the public will not be notified and the public will not be allowed to participate.

(f) On its own motion or upon complaint, the Commission may order compliance with a Reliability Standard and may impose a penalty against a user, owner or operator of the Bulk-Power System, if the Commission finds, after public notice and opportunity for hearing, that the user, owner or operator of the Bulk-Power System has engaged or is about to engage in any acts or practices that constitute or will constitute a violation of a Reliability Standard.

(g) Any penalty imposed for the violation of a Reliability Standard shall bear a reasonable relation to the seriousness of the violation and shall take into consideration efforts of such user, owner or operator of the Bulk-Power System to remedy the violation in a timely manner.

(1) The penalty imposed may be a monetary or a non-monetary penalty and may include, but is not limited to, a limitation on an activity, function, operation, or other appropriate sanction, including being added to a reliability watch list composed of major violators that is established by the Electric Reliability Organization, a Regional Entity or the Commission.

(2) The Electric Reliability Organization shall submit for Commission approval penalty guidelines that set forth a range of penalties for the violation of Reliability Standards. A penalty imposed by the Electric Reliability Organization or a Regional Entity must be within be within the range set forth in the penalty guidelines.

[Order 672, 71 FR 8736, Feb. 17, 2006, as amended by Order 737, 75 FR 43404, July 26, 2010]