DOE-417 Electric Emergency Incident and Disturbance Report

U.S. Department of Energy Form DOE-417		ELECTRIC EMERGENCY INCIDENT AND DISTURBANCE REPORT	OMB No. 1901-0288 Approval Expires: XX/XX/2027 Burden Per Response: 1.8 hours
NOTICE: This report is mandatory under Public Law 93-275. Failure to comply may result in criminal fines, civil penalties and other sanctions as provided by law. For the sanctions and the provisions concerning the confidentiality of information submitted on this form, see General Information portion of the instructions. Title 18 USC 1001 makes it a criminal offense for any person knowingly and willingly to make to any Agency or Department of the United States any false, fictitious, or fraudulent statements as to any matter within its jurisdiction.
RESPONSE DUE: Within 1 hour of the incident, submit Schedule 1 and lines N - S in Schedule 2 as an Emergency Alert report if criteria 1-9 are met. If criterion 2 is met, also submit the Cyber Attributes on line T in Schedule 2. Within 6 hours of the incident, submit Schedule 1 and lines N - S in Schedule 2 as a Normal Report if only criteria 10-13 are met. By the end of the next calendar day after a determination, submit Schedule 1 and lines N – S and the Cyber Attributes on line T in Schedule 2 as an Attempted Cyber Compromise if criterion 14 is met. By the later of 24 hours after the recognition of the incident OR by the end of the next business day submit Schedule 1 and lines N - S in Schedule 2 as a System Report if criteria 15-26 are met. Note: 4:00pm local time will be considered the end of the business day Submit updates as needed and/or a final report (all of Schedules 1 and 2) within 72 hours of the incident. For NERC reporting entities registered in the United States; NERC has approved that the form DOE-417 meets the submittal requirements for NERC. There may be other applicable regional, state and local reporting requirements.
METHODS OF FILING RESPONSE (Retain a completed copy of this form for your files.) Online: Submit form via online submission at: https://www.oe.netl.doe.gov/OE417/ FAX: FAX Form DOE-417 to the following facsimile number: (202) 586-8485. Alternate: If you are unable to submit online or by fax, forms may be e-mailed to doehqeoc@hq.doe.gov, or call and report the information to the following telephone number: (202) 586-8100.
SCHEDULE 1 -- ALERT CRITERIA (Page 1 of 4)
Criteria for Filing (Check all that apply) – See Instructions For More Information
EMERGENCY ALERT File within 1-Hour If any box 1-9 on the right is checked, this form must be filed within 1 hour of the incident; check Emergency Alert (for the Alert Status) on Line A below.	[ ] Physical attack that causes major interruptions or impacts to critical infrastructure facilities or to operations [ ] Reportable Cyber Security Incident (as defined in the NERC Glossary of Terms) [ ] Cyber event that is not a Reportable Cyber Security Incident that causes interruptions of electrical system operations. [ ] Complete operational failure or shut-down of the transmission and/or distribution electrical system [ ] Electrical System Separation (Islanding) where part or parts of a power grid remain(s) operational in an otherwise blacked out area or within the partial failure of an integrated electrical system [ ] Uncontrolled loss of 300 Megawatts or more of firm system loads for 15 minutes or more from a single incident [ ] Firm load shedding of 100 Megawatts or more implemented under emergency operational policy [ ] System-wide voltage reductions of 3 percent or more [ ] Public appeal to reduce the use of electricity for purposes of maintaining the continuity of the Bulk Electric System
NORMAL REPORT File within 6-Hours If any box 10-13 on the right is checked AND none of the boxes 1-9 are checked, this form must be filed within 6 hours of the incident; check Normal Report (for the Alert Status) on Line A below.	[ ] Physical attack that could potentially impact electric power system adequacy or reliability; or vandalism which targets components of any security systems [ ] Cyber event that could potentially impact electric power system adequacy or reliability [ ] Loss of electric service to more than 50,000 customers for 1 hour or more [ ] Fuel supply emergencies that could impact electric power system adequacy or reliability
ATTEMPTED CYBER COMPROMISE File within 1-Day If box 14 on the right is checked AND none of the boxes 1-13 are checked, this form must be filed by the end of the next calendar day after the determination of the attempted cyber compromise; check Attempted Cyber Compromise (for the Alert Status) on Line A below.	14. [ ] Cyber Security Incident that was an attempt to compromise a High or Medium Impact Bulk Electric System Cyber System or their associated Electronic Access Control or Monitoring Systems

			SCHEDULE 1 -- ALERT CRITERIA -- CONTINUED (Page 2 of 4)
SYSTEM REPORT File within 1-Business Day If any box 15-26 on the right is checked AND none of the boxes 1- 14 are checked, this form must be filed by the later of 24 hours after the recognition of the incident OR by the end of the next business day. Note: 4:00pm local time will be considered the end of the business day. Check System Report (for the Alert Status) on Line A below.			[ ] Damage or destruction of a Facility within its Reliability Coordinator Area, Balancing Authority Area or Transmission Operator Area that results in action(s) to avoid a Bulk Electric System Emergency. [ ] Damage or destruction of its Facility that results from actual or suspected intentional human action. [ ] Physical threat to its Facility excluding weather or natural disaster related threats, which has the potential to degrade the normal operation of the Facility. Or suspicious device or activity at its Facility. [ ] Physical threat to its Bulk Electric System control center, excluding weather or natural disaster related threats, which has the potential to degrade the normal operation of the control center. Or suspicious device or activity at its Bulk Electric System control center. [ ] Bulk Electric System Emergency resulting in voltage deviation on a Facility; A voltage deviation equal to or greater than 10% of nominal voltage sustained for greater than or equal to 15 continuous minutes. [ ] Uncontrolled loss of 200 Megawatts or more of firm system loads for 15 minutes or more from a single incident for entities with previous year’s peak demand less than or equal to 3,000 Megawatts [ ] Total generation loss, within one minute of: greater than or equal to 2,000 Megawatts in the Eastern or Western Interconnection or greater than or equal to 1,400 Megawatts in the ERCOT Interconnection. [ ] Complete loss of off-site power (LOOP) affecting a nuclear generating station per the Nuclear Plant Interface Requirements. [ ] Unexpected Transmission loss within its area, contrary to design, of three or more Bulk Electric System Facilities caused by a common disturbance (excluding successful automatic reclosing). [ ] Unplanned evacuation from its Bulk Electric System control center facility for 30 continuous minutes or more. [ ] Complete loss of Interpersonal Communication and Alternative Interpersonal Communication capability affecting its staffed Bulk Electric System control center for 30 continuous minutes or more. [ ] Complete loss of monitoring or control capability at its staffed Bulk Electric System control center for 30 continuous minutes or more. [ ] Uncontrolled loss of a total of 500 MW or more from inverter-based resource(s) for greater than 30 minutes at a common point of interconnection to the bulk electric system.
If significant changes have occurred after filing the initial report, re-file the form with the changes and check Update (for the Alert Status) on Line A below. The form must be re-filed within 72 hours of the incident with the latest information and Final (Alert Status) checked on Line A below, unless updated.
LINE NO.
A.	Alert Status (check one)		Emergency Alert [ ] 1 Hour	Normal Report [ ] 6 Hours	Attempted Cyber Compromise [ ] 1 Calendar Day	System Report [ ] 1 Business Day	Update [ ] As required	Final [ ] 72 Hours
B.	FOIA Exemption(s)		Information on Lines C and D of Schedule 1 will not be disclosed to the public to the extent that it satisfies the criteria for exemption under the Freedom of Information Act (FOIA), e.g., exemptions for confidential commercial information and trade secrets, certain information that could endanger the physical safety of an individual, or information designated as Critical Electric Infrastructure Information. If box 2, 3, 11, or 14 above is checked, identify (by checking all that apply) whether Line C and D combined with box 2, 3, 11, or 14 contains: [ ] Privileged or confidential information, e.g., trade secrets, commercial, or financial information [ ] Critical Electric Infrastructure Information [ ] Other information exempt from FOIA (include a description of the exemption in Schedule 2, on line T)
C.	Organization Name
D.	Address of Principal Business Office

U.S. Department of Energy Form DOE-417

ELECTRIC EMERGENCY INCIDENT AND DISTURBANCE REPORT

OMB No. 1901-0288 Approval Expires: XX/XX/XXXX Burden Per Response: 1.8 hours

SCHEDULE 1 -- ALERT NOTICE (Page 3 of 4)

INCIDENT AND DISTURBANCE DATA

E.

Geographic Area(s) Affected (County, State)

F.

Date/Time Incident Began (mm-dd-yy/hh:mm) using 24-hour clock

- - / : mm dd yy hh mm

[ ] Eastern [ ] Pacific [ ] Atlantic

[ ] Central [ ] Alaska [ ] Chamorro

[ ] Mountain [ ] Hawaii

G.

Date/Time Incident Ended (mm-dd-yy/ hh:mm) using 24-hour clock

- - / : mm dd yy hh mm

[ ] Eastern [ ] Pacific [ ] Atlantic

[ ] Central [ ] Alaska [ ] Chamorro

[ ] Mountain [ ] Hawaii

H.

Did the incident/disturbance originate in your system/area? (check one)

Yes [ ]

No [

]

Unknown [ ]

I.

Estimate of Amount of Demand Involved (Peak Megawatts)

Zero [

]

Unknown [ ]

J.

Estimate of Number of Customers Affected

Zero [

]

Unknown [ ]

SCHEDULE 1 – TYPE OF EMERGENCY Check all that apply
K. Cause	L. Impact	M. Action Taken
Unknown Physical attack Ballistic Arson Explosive device Other Threat of physical attack Vandalism Theft Suspicious activity Aircraft or Unmanned Aerial System (UAS) Trespassing or non-destructive intrusion Surveillance Other Cyber event Information Technology Operational Technology Fuel supply emergencies, interruption, or deficiency Generator loss or failure not due to fuel supply interruption or deficiency or transmission failure Transmission equipment failure (not including substation or switchyard) Failure at high voltage substation or switchyard Weather or natural disaster Operator action(s) Other Additional Information/Comments:	None Control center loss, failure, or evacuation Loss or degradation of control center monitoring or communication systems Damage or destruction of a facility Electrical system separation (islanding) Complete operational failure or shutdown of the transmission and/or distribution system Major transmission system interruption (three or more BES elements) Major distribution system interruption Uncontrolled loss of 200 MW or more of firm system loads for 15 minutes or more Loss of electric service to more than 50,000 customers for 1 hour or more System-wide voltage reductions or 3 percent or more Voltage deviation on an individual facility of ≥10% for 15 minutes or more Inadequate electric resources to serve load Generating capacity loss of 1,400 MW or more Generating capacity loss of 2,000 MW or more Complete loss of off-site power to a nuclear generating station Loss of a total of 500 MW or more from inverter-based resource(s) Other Additional Information/Comments:	None Shed Firm Load: Load shedding of 100 MW or more implemented under emergency operational policy (manually or automatically via UFLS or remedial action scheme) Public appeal to reduce the use of electricity for the purpose of maintaining the continuity of the electric power system Implemented a warning, alert, or contingency plan Voltage reduction Shed Interruptible Load Repaired or restored Mitigation implemented Other Additional Information/Comments

U.S. Department of Energy Form DOE-417		ELECTRIC EMERGENCY INCIDENT AND DISTURBANCE REPORT			OMB No. 1901-0288 Approval Expires: XX/XX/XXXX Burden Per Response: 1.8 hours
SCHEDULE 2 -- NARRATIVE DESCRIPTION (Page 4 of 4) Information on Schedule 2 will not be disclosed to the public to the extent that it satisfies the criteria for exemption under the Freedom of Information Act (FOIA), e.g., exemptions for confidential commercial information and trade secrets, certain information that could endanger the physical safety of an individual, or information designated as Critical Electric Infrastructure Information.
N. FOIA Exemption(s)			Identify (by checking all that apply) whether Schedule 2 – Narrative Description contains: [ ] Privileged or confidential information, e.g., trade secrets, commercial, or financial information [ ] Critical Electric Infrastructure Information [ ] Other information exempt from FOIA (include a description of the exemption on line T below)
NAME OF OFFICIAL THAT SHOULD BE CONTACTED FOR FOLLOW-UP OR ANY ADDITIONAL INFORMATION
O.	Name
P.	Title
Q.	Telephone Number			( )-( )-( )
R.	FAX Number			( )-( )-( )
S.	E-mail Address
Provide a description of the incident and actions taken to resolve it. Include as appropriate, the cause of the incident/disturbance, change in frequency, mitigation actions taken, equipment damaged, critical infrastructures interrupted, effects on other systems, and preliminary results from any investigations. Be sure to identify: the estimate restoration date, the name of any lost high voltage substations or switchyards, whether there was any electrical system separation (and if there were, what the islanding boundaries were), and the name of the generators and voltage lines that were lost (shown by capacity type and voltage size grouping). Cyber Attributes: For cyber events, including attempted cyber compromises, provide the following attributes (at a minimum): (1) the functional impact, (2) the attack vector used, and (3) the level of intrusion that was achieved or attempted. If necessary, copy and attach additional sheets. Equivalent documents, containing this information can be supplied to meet the requirement; this includes the NERC EOP-004 Disturbance Report. Along with the filing of Schedule 2, a final (updated) Schedule 1 needs to be filed. Check the Final box on line A for Alert Status on Schedule 1 and submit this and the completed Schedule 2 no later than 72 hours after detection that a criterion was met.
T. Narrative:
U. Estimated Restoration Date for all Affected Customers Who Can Receive Power			- - mm dd yy
V. Name of Assets Impacted

W. Notify NERC, E-ISAC, or CISA Central

Select the appropriate box(es) if you approve of all of the information provided on this form being submitted to the North America Electric Reliability Corporation (NERC), the Electricity Information Sharing and Analysis Center (E-ISAC), or DHS CISA Central or their successor(s). NERC is an entity that is certified by the Federal Energy Regulatory Commission to establish and enforce reliability standards for the bulk power system but that is not part of the Federal Government. The information submitted to NERC, E-ISAC, or CISA Central can be submitted to help fulfill the respondent’s requirements under NERC’s reliability standards. If approval is given to alert NERC, E-ISAC, or DHS CISA Central, then this form will be emailed to systemawareness@nerc.net, operations@eisac.com, and/or central.cyber@cisa.dhs.gov when it is submitted to DOE. DOE is not responsible for ensuring the receipt of these emails by NERC, E-ISAC, or CISA Central. □ Notify NERC | □ Notify E-ISAC | □ Notify CISA Central