Topic:"Grid Modernization" in M12600

NS Power Cyber Incident Report Appendix B Page 1 of 7 Affected Regulatory Matters Report 2 - October 1 Report 3 - November 3 Report 4 - December 1 Latest update Forecast Restoration of Normal Activities Demand Side E1's Residential Behavio...

AI summary The cybersecurity incident at NS Power has disrupted the provision of customer data to EfficiencyOne (E1), impacting the Residential Behaviour Program. Data from AMI meters and the My Energy Insights platform is unavailable, and restoration is expected by the end of Q3 2026. NS Power is working with E1 to find interim solutions.

12. How many single-phase meters are currently in service? Single-phase meters currently service the over 550,000 service locations of all nondemand billing customers. They are also in service at the 1,454 meter locations discussed in this...

AI summary The text states that single-phase meters serve over 550,000 service locations for nondemand billing customers and are also in use at 1,454 meter locations discussed in this matter.

NS Power Cyber Incident Appendix C Page 4 of 5 REDACTED (CONFIDENTIAL INFORMATION REMOVED) rate class. Polyphase meters can only be installed at service locations requiring three-phase power supply. An AMI single-phase meter product with a...

AI summary The document discusses the limitations in procuring AMI single-phase meters with specific features for NS Power, highlighting the lead time and replacement timeline for existing meters.

15. Has NS Power found a long-term solution to this issue through consultation with the meter vendor? If not, please elaborate on any short-term solutions while long-term solutions continue to be investigated. A long-term solution is to pr...

AI summary NS Power is seeking a long-term solution by procuring a new single-phase meter with an external demand reset lever, but this product is not currently available. In the short term, they are re-establishing AMI systems to enable remote and on-site demand resetting and considering reclassifying impacted accounts to a non-demand rate class.

16. Please elaborate on any contingency planning associated with the loss of functionality of AMI meters. NS Power has activated contingency plans for key functions enabled by AMI. For remote meter reading enabled by AMI, a contingency pla...

AI summary NS Power has activated contingency plans for key functions enabled by AMI, including remote meter reading, which now uses field meter reading with internal and contractor resources to manually read meters and send data to billing systems.

NS Power Cyber Incident Appendix C Page 5 of 5 REDACTED (CONFIDENTIAL INFORMATION REMOVED) For remote connect / disconnect enabled by AMI, a contingency plan has been activated to have connects and disconnects dispatched as field work orde...

AI summary In response to the cyber incident, NS Power has activated contingency plans for AMI-enabled remote connect/disconnect and remote meter configuration changes. Connects and disconnects are now handled via field work orders, and bi-directional meters are installed for new solar customers when needed.

NON-CONFIDENTIAL 1 Request IR-13: 2 3 (a) Please explain the process by which the utility currently estimates a monthly bill? 4 5 (b) Please provide details about the design limitations and tuning of NS Power's system 6 for estimating bill...

AI summary The document outlines a request to NS Power regarding the process of estimating monthly bills, the design limitations of their system, and their ability to access historical meter readings. It also references a cyber incident that caused the estimation logic to revert to a seasonal logic subroutine.

systems. This risk is being mitigated through joint planning and work status update processes that have been put in place to identify and resolve timeline challenges should they arise. (b) Meter reading is being executed through the dispat...

AI summary NS Power is managing meter reading processes through service orders and tracking completion by meter cycle. If meters are not read, bills are estimated, and readings are attempted again before the next bill is due. Access issues and resource availability may affect meter reading schedules.

(c) Monthly breakdown of the total number of bills generated based on estimates is set out in the table below. All other bills would be based on true reads. Period Bills Issued Estimates % Estimates Pre-Cyber Incident 1,282,027 6,939 0.54%...

AI summary The text presents a monthly breakdown of the number of bills generated before and after a cyber incident, highlighting the significant increase in estimated bills post-incident. The data shows that the percentage of estimated bills rose from 0.54% pre-incident to 56.52% post-incident, indicating a major shift in billing practices.

CONFIDENTIAL (Attachmen Only) 1 (c) When NS Power lost the ability to communicate with the Advanced Metering 2 Infrastructure (AMI) network through the cyber incident, bill estimation logic reverted to 3 a contingency CIS subroutine which...

AI summary This text discusses how NS Power estimated missing meter readings during a cyber incident using seasonal logic, and how refunds are handled for overpayments. It also notes a decrease in refund requests over recent quarters. The cybersecurity accountability document is confidential and removed.

1 ccount Nur nber Amo unt due Jun 05 i $400 .24 Rates April per month Nov 23 1300 58 24. 1 2 (c) The CIS estimation subroutine was part of the original product implementation in 1997. 3 Any changes require custom development by a third-par...

AI summary The text discusses the CIS estimation subroutine, implemented in 1997, which uses historical data to estimate bills when meter readings are unavailable. It highlights that the subroutine is not trainable or capable of machine learning. The document also includes a request about how the subroutine works for customers with net-metering.

14 Project: AMI Headend System (HES) Restoration Task Name ▼ Duration ▼ Start → Finish → % Complete , ▲ AMI Headend System Restoration 239 days Thu 5/1/25 Tue 3/31/26 100% ▶ Initiation 5 days Thu 5/1/25 Wed 5/7/25 100% Release 1 - Rebuild...

AI summary The document outlines the timeline and progress of the AMI Headend System (HES) Restoration project, which is fully completed. The project includes multiple phases such as initiation, planning, design, execution, and build, with specific durations and completion percentages provided for each task.

1 Project: ADMS Resiliency Restoration Task Name ▼ Duration Start - Finish 🔻 % Complete 💌 △ ADMS Redundancy 260 days Thu 5/1/25 96% > Initiation 5 days Thu 5/1/25 Wed 5/7/25 100% ■ Release 1 - ADMS Redundancy Restored 255 days Thu 5/8/25 W...

AI summary The ADMS Resiliency Restoration project outlines the timeline and progress of restoring ADMS redundancy, with key tasks including initiation, planning, and execution phases. The project is currently at 96% completion for the main task, with subtasks at varying stages of completion.

NON-CONFIDENTIAL 1 Request IR A-6: 2 3 (a) NSP's Chief Operating Officer filed a report titled IT – OT Cyber Security Control 4 Implementation Phase 1 with the UARB on February 27, 2025, twenty days before the 5 Attack. With respect to tha...

AI summary The document discusses a cybersecurity control implementation plan filed by NSP's Chief Operating Officer with the UARB in 2025, twenty days before a cyber attack. The plan focused on OT systems and not IT systems, customer data systems, billing platforms, or AMI infrastructure. The IT systems were covered under a separate plan started in 2021. The scope of the OT plan was defined by Deloitte LLP and approved by NS Power's Director of Information Security and Risk Management.

Cybersecurity Accountability REDACTED each number. This was done to mitigate the risk of adverse impacts within CIS as the removal of the data / line-item could have broader implications within the system and result in catastrophic impacts...

AI summary NS Power addressed cybersecurity risks in its Customer Information System (CIS) by replacing SINs with zeros to mitigate data risks. The manual removal process was slow and resource-intensive, leading to the presence of customer data in the Azure Data Lake. The Data Lake was encrypted, but automatic data removal settings were not enabled for the affected area. Post-attack, the Data Lake is on legal hold and will be destroyed once released.

annual CEM EM&V report in May, which provides an evaluation of the CEM platform on various metrics from the prior year. The 2024 CEM EM&V report, submitted May 1, 2025, was unaffected by the Incident. However, due to the Incident, only AMI...

AI summary The 2024 CEM EM&V report was submitted without impact from the Incident, but AMI data for 2025 is limited to March 31, 2025, and the MEI platform is unavailable. NS Power is working to restore AMI data accessibility for future analysis.

— PROGRAM ST DUCTIOE — РКОВКА М ЗТ RUCIURE — The Restoration Program is structured into five (5) key portfolios of work – focusing on restoring business capabilities. Portfolio Scope Summary Enterprise Resource Planning (ERP) Recovery and...

AI summary The Restoration Program is divided into five key portfolios: Enterprise Resource Planning (ERP), Customer, Additional Capabilities, Cybersecurity, and Technology Enablement, each focusing on restoring critical business systems and operations.

2. That Nova Scotia Power also provide clarity on contingency plans related to smart meters, including:

AI summary The document requests Nova Scotia Power (NSP) to clarify contingency plans for smart meters. The focus is on ensuring preparedness for potential issues related to advanced metering infrastructure (AMI) deployment.

a. Steps to address potential failures or inaccuracies. - NS Power did act on contingency plans when billing resumed in June 2025. This included estimated billing, and the concurrent hiring, training and deployment of meter readers. - NS P...

AI summary NS Power implemented contingency plans, including estimated billing and meter reader deployment, after a 2025 billing system failure. Moving forward, they plan disaster recovery solutions for smart meters, enhanced monitoring, and CIS system modernization to improve bill accuracy and reliability.

IR B-5 — AMI and Smart Meter Infrastructure - (a) Describe the cybersecurity architecture of NSP's AMI system as of March 18, 2025, - including the network connectivity between field devices, head-end systems, and billing - platforms. - (b...

AI summary The document outlines questions regarding the cybersecurity architecture of NSP's AMI system, the impact of a ransomware attack on AMI connectivity, and the measures in place for cybersecurity risk assessment and segmentation controls.

Technology Enablement Foundational technology restoration continued through staged delivery and operational readiness activities across backup and disaster recovery, compute, and network domains. During the reporting period, infrastructure...

AI summary The Technology Enablement section outlines ongoing efforts in foundational technology restoration, including backup and disaster recovery, compute, and network domains. Activities such as infrastructure configuration, validation, and network modernization are progressing under established governance processes.

PROGRAM STRUCTURE The Restoration Program is structured into five (5) key portfolios of work – focusing on restoring business capabilities. Portfolio Scope Summary Enterprise Resource Planning (ERP) Recovery and restoration of core enterpr...

AI summary The Restoration Program is organized into five key portfolios: Enterprise Resource Planning, Customer, Additional Capabilities, Cybersecurity, and Technology Enablement, each focusing on restoring critical systems and operations.

Third-Party and Vendor Management IR-7. Regarding the Invoices on Hold report, identify any specific vendors or projects related to Vegetation Management or Grid Reliability that have had payments withheld for more than 90 days due to Admi...

AI summary The document includes two inquiries related to third-party and vendor management. IR-7 asks about payments withheld for over 90 days for vendors or projects related to Vegetation Management or Grid Reliability. IR-8 inquires about the number of invoice disputes linked to suppliers' non-compliance with new cybersecurity protocols.

Technology Enablement Foundational technology capabilities have progressed through staged enablement into full operational use, effectively supporting broader restoration and stabilization efforts across dependent services. Core infrastruc...

AI summary The document discusses the progress of foundational technology capabilities, which have moved into full operational use, supporting restoration and stabilization efforts. Core infrastructure services are established, and remaining capabilities have completed validation and transitioned into operational readiness. Integration and optimization activities are ongoing, with a focus on reliability and governance.

PROGRAM STRUCTURE The Restoration Program is structured into five (5) key portfolios of work – focusing on restoring business capabilities. Portfolio Scope Summary Enterprise Resource Planning (ERP) Recovery and restoration of core enterpr...

AI summary The Restoration Program is organized into five portfolios focusing on restoring business capabilities: Enterprise Resource Planning, Customer, Additional Capabilities, Cybersecurity, and Technology Enablement. Each portfolio outlines specific systems and operations to be recovered and restored.

PROGRAM STRUCTURE The Restoration Program is structured into five (5) key portfolios of work – focusing on restoring business capabilities. Portfolio Scope Summary Enterprise Resource Planning (ERP) Recovery and restoration of core enterpr...

AI summary The Restoration Program is organized into five key portfolios: Enterprise Resource Planning (ERP), Customer, Additional Capabilities, Cybersecurity, and Technology Enablement. Each portfolio focuses on restoring critical systems and capabilities to ensure business continuity and operational resilience.

OPENING STATEMENT 17 MR. DAVID MacLEOD 1 or security clearance. Thank you. 3 management and field resource allocation, asset 4 management, and IRP system and capital planning. These 5 roles included Director of Planning, Senior Director, T...

AI summary Mr. David MacLeod provides an overview of his professional background, including roles in management, asset management, and grid modernization at Nova Scotia Power. He also discusses his current role as Senior Vice President of Technology and the evidence submitted by Nova Scotia Power in the proceeding.

NOVA SCOTIA POWER PANEL 125 Cr-ex, (Roberts) 1 you were overbilling customers. 2 (Lanteigne) I think –– you're A. 3 absolutely right. So if we would have been 4 underestimating or overestimating, again, for many 5 customers those estimates...

AI summary The discussion addresses concerns about billing inaccuracies, particularly underpayment due to underestimated usage and seasonal fluctuations. Efforts to correct these issues involved deploying meter readers and using over-the-air data from AMI smart meters, leading to more accurate billing by March 31st and a return to normal billing processes.

INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 we took the right steps and we made the right decisions to 2 issue bills to our customers. I'm not saying it's 3 perfect. I don't want that to be the impression I'm 4 giving, but in...

AI summary The speaker acknowledges that while the decisions made to issue bills to customers were appropriate given the tools and resources available, the prolonged period of estimation due to system outages was a significant challenge. Lessons learned include the importance of robust redundancies in AMI systems to avoid future prolonged outages.

NOVA SCOTIA POWER PANEL 131 Cr-ex, (Roberts) - of trying to bring back the AMI systems with a bit more kind of robust business continuity protocols in place, if I could perhaps pass it over to Mr. MacLeod just to elaborate on that for a mi...

AI summary The discussion focuses on Nova Scotia Power's efforts to improve business continuity and resiliency, particularly in the context of AMI systems and cyberattack recovery. It also touches on the use of photo meters for billing and the challenges faced in implementing new processes post-cyber incident.

1 know, if especially if a customer had been under- 2 estimated, as I talked about yesterday, or they had 3 underpaid or seasonal usage drove the impact, that that 4 definitely caused concerns for our customers that we've 5 been supporting...

AI summary The discussion focuses on customer concerns related to estimated billing scenarios, particularly when customers have underpaid or seasonal usage has affected their bills. It also touches on how the CIS system handles multiple estimated bills and the impact of restoring AMI to provide more accurate readings.

1 to it in the rest of these four paragraphs, but so 2 just, I from the redline, it just sticks out, and 3 that's the only change in that first paragraph, I believe. 4 A. (Williams) Thank you, Mr. Deveau. 5 Just to reiterate what Ms. MacDo...

AI summary The discussion focuses on changes in the balance between reliance on cloud and service providers versus Nova Scotia Power personnel, with a new section introduced in the latest version of the document. The speaker emphasizes the shift in emphasis and the continued reliance on employee diligence.