Federal Communications Commission Washington, D.C. 20554 ‘ May 13, 2014 DA 14-643 Small Entity Compliance Guide Improving 911 Reliability Report and Order FCC 13-158 PS Docket Nos. 11-60 and 13-75 Released: December 12, 2013 This Guide is prepared in accordance with the requirements of Section 212 of the Small Business Regulatory Enforcement Fairness Act of 1996. It is intended to help small entities—small businesses, small organizations (non-profits), and small governmental jurisdictions—comply with the new rules adopted in the above-referenced FCC rulemaking docket(s). This Guide is not intended to replace the rules and, therefore, final authority rests solely with the rules. Although we have attempted to cover all parts of the rules that might be especially important to small entities, the coverage may not be exhaustive. This Guide may, perhaps, not apply in a particular situation based upon the circumstances, and the FCC retains the discretion to adopt approaches on a case-by-case basis that may differ from this Guide, where appropriate. Any decisions regarding a particular small entity will be based on the statute and regulations. In any civil or administrative action against a small entity for a violation of rules, the content of the Small Entity Compliance Guide may be considered as evidence of the reasonableness or appropriateness of proposed fines, penalties or damages. Interested parties are free to file comments regarding this Guide and the appropriateness of its application to a particular situation; the FCC will consider whether the recommendations or interpretations in the Guide are appropriate in that situation. The FCC may decide to revise this Guide without public notice to reflect changes in the FCC’s approach to implementing a rule, or to clarify or update the text of the Guide. Direct your comments and recommendations, or calls for further assistance, to the FCC’s Consumer Center: 1-888-CALL-FCC (1-888-225-5322) TTY: 1-888-TELL-FCC (1-888-835-5322) Fax: 1-866-418-0232 fccinfo@fcc.gov 2COMPLIANCE REQUIREMENTS Objectives of the Proceeding In this proceeding, the Federal Communications Commission (FCC or Commission) adopted rules to improve the reliability and resiliency of 911 communications networks nationwide by requiring that 911 service providers take “reasonable measures” to provide reliable 911 service. Providers, including small entities, that are subject to the new rules can comply with the reasonable measures requirement by either implementing certain specific industry “best practices”, or in some circumstances by implementing alternative measures that are reasonably sufficient to ensure reliable 911 service. The FCC also requires 911 service providers to provide public safety answering points (PSAPs) with timely and actionable notification of 911 outages. The Commission was spurred to adopt these rules following the devastating impact experienced as a result of the unanticipated “derecho” storm in June 2012. This storm swiftly struck the Midwest and Mid- Atlantic United States, leaving millions of Americans without 911 service and revealing significant, but avoidable, vulnerabilities in 911 network architecture, maintenance, and operation. After a comprehensive inquiry into the causes of 911 outages during the derecho, as well as 911 network reliability more generally, the FCC’s Public Safety and Homeland Security Bureau (PSHSB or Bureau) determined that many of these failures could have been mitigated or avoided entirely through implementation of network-reliability best practices and other sound engineering principles. The reliability rules apply to all “Covered 911 Service Providers.” These include any entity that (1) provides 911, E911, or NG911 capabilities such as call routing, ALI, ANI, or the functional equivalent of those capabilities, directly to a PSAP, statewide default answering point, or appropriate local emergency authority (as that term is defined elsewhere in the Commission’s rules); or (2) operates one or more central offices that directly serve a PSAP. For purposes of these rules, a central office “directly serves a PSAP” if it (1) hosts a selective router or ALI/ANI database (2) provides functionally equivalent NG911 capabilities, or (3) is the last service-provider facility through which a 911 trunk or administrative line passes before connecting to a PSAP. This definition encompasses entities that provide capabilities to route 911 calls and associated data such as ALI and ANI to the appropriate PSAP, but not entities that merely provide the capability for customers to originate 911 calls. Thus, generally, the reliability rules will not apply to wireless providers, VoIP providers, Internet service providers (ISPs), or commercial data centers – unless they provide any of the foregoing functions. Rules That the Commission Adopted 1) Circuit Diversity Covered 911 Service Providers must certify annually whether they have, within the past year, audited the physical diversity of critical 911 circuits or equivalent data paths to each PSAP they serve, tagged those circuits to minimize the risk that they will be reconfigured at some future date, and eliminated all single points of failure between the selective router, automatic location identification (ALI) / automatic number identification (ANI) database, or equivalent NG911 component, and the central office serving each PSAP. In lieu of eliminating single points of failure, they may describe why these single points of failure cannot be eliminated and the specific, reasonably sufficient alternative measures they have taken to mitigate the risks associated with the lack of physical diversity. 3Alternatively, Covered 911 Service Providers may certify that they believe this element of the certification is not applicable to their network, although they must explain why it is not applicable. Under these rules, all Covered 911 Service Providers must conduct annual audits of the physical diversity of their critical 911 circuits and tag those circuits to prevent rearrangement, but they may take a range of corrective measures most appropriate for their networks and PSAP customers. 2) Central Office Backup Power Covered 911 Service Providers must certify annually whether they have sufficient, reliable backup power in any central office that directly serves a PSAP to maintain full service functionality, including network monitoring capabilities, for at least 24 hours at full office load. In addition, especially critical central offices that host selective routers must be equipped with at least 72 hours of backup power at full office load. The specified level of backup power may be provided through fixed generators, portable generators, batteries, fuel cells, or a combination of those or other such sources so long as it meets the applicable certification standard. If that level of backup power is not feasible at a particular central office that directly serves a PSAP or hosts a selective router, the certification will be required to indicate this. The service provider must briefly state why it is not feasible and describe the specific alternative measures it has taken to mitigate the risk associated with backup power configurations that fail to satisfy the certification standard. Covered 911 Service Providers may also certify that they believe this element of the certification is not applicable to their network, although they must explain why it is not applicable. Service providers must also certify whether: (1) they test and maintain all backup power equipment in all central offices directly serving PSAPs in accordance with the manufacturer’s specifications, per Communications Security, Reliability, and Interoperability Council (CSRIC) best practice; (2) adhere to CSRIC best practices regarding fully automatic, non-interdependent generators that can be started manually if necessary; and (3) retain records of backup power deployment and maintenance for confidential review by the Commission, upon request, for two years. If the specified standards related to testing and tandem generator configurations cannot be met, the service provider must briefly state why it is not feasible to meet them and describe the specific alternative measures it has taken to mitigate the risk associated with the failure to satisfy the certification standards. Because different central offices present different backup power challenges and a single solution may not be suitable for all, Covered 911 Service Providers may certify and describe reasonable alternative measures on a case-by-case basis. For these reasons, rather than codifying existing best practices as prescriptive rules, the certification requirement better accommodates site-specific circumstances by giving 911 service providers the flexibility to maintain adequate central-office backup power based on best practices or reasonable alternatives. 3) Network Monitoring Covered 911 Service Providers must certify annually whether they have, within the past year: (1) audited the physical diversity of the aggregation points that they use to gather network monitoring data in each 911 service area and the network monitoring links between such aggregation points and their network operations center(s) (NOC(s)); and (2) implemented physically diverse aggregation points for network monitoring data in each 911 service area and physically diverse links from such aggregation points to at least one NOC or, in light of the required audits, taken specific alternative measures reasonably sufficient to mitigate the risk of insufficient physical diversity. They may also certify that they believe this element of the certification is not applicable to their network, although they must explain why it is not applicable. 4For purposes of the certification, network monitoring links transmit data about failed or degraded network equipment and facilities from monitoring points within the network to a NOC or other location where the data are analyzed and decisions made about corrective action. Links from multiple individual monitoring points may be routed through and aggregated onto common transport facilities at one or more hubs in each service area for distribution to remote NOCs, in which case those hubs are described as aggregation points for network monitoring data. “Physical diversity” applied to aggregation points refers to aggregation points that are not physically co-located. 4) Important Notes and Definitions Regarding “reasonable measures,” the record in this proceeding demonstrates a number of concrete and objective indications of whether a service provider’s practices with respect to 911 reliability are reasonable. For example, best practices are developed in a “consensus-based environment” reflecting the collective judgment of industry and other stakeholders. It follows that compliance with best practices is a strong indication that a service provider is taking reasonable measures to ensure reliable 911 service. While there may be situations in which it would be reasonable for a service provider to depart from best practices, there should be a reasonable basis for such decisions, coupled with appropriate steps to compensate for any increased risk of failure. Regarding “annual certification.” a Covered 911 Service Provider that performs and certifies all the specific certification elements outlined in the rules regarding 911 circuit auditing, backup power at central offices that directly serve PSAPs, and diverse network monitoring links, is not required to provide additional documentation to support its certification that it has met the reasonable measures requirement. These providers will be deemed to satisfy the obligation to take reasonable measures to provide reliable 911 service, provided that the certification is accurate and complete. In the alternative, if a Covered 911 Service Provider cannot certify affirmatively to every element in a substantive area, but believes that its actions are nevertheless reasonably sufficient to mitigate the risk of 911 service failure based on the configuration of its network and other factors, then it may certify that it has taken alternative measures in that substantive area. For each element where the Covered 911 Service Provider certifies to taking alternative measures, it must include with its certification a brief explanation of those alternative measures with respect to each PSAP, central office, or 911 service area where they are in use, and why those measures are reasonable under the circumstances to mitigate the risk of failure. Finally, a Covered 911 Service Provider may respond that certain elements of the certification do not apply to all or part of its network, but it must include with its certification a reasonable explanation of why those elements are not applicable. The FCC will require all Covered 911 Service Providers to certify annually to certain basic measures in the three substantive areas (i.e., circuit auditing, central office backup power, and network monitoring), and delegates to the Bureau the responsibility to review the certifications and take additional action as appropriate, and the authority and responsibility to develop the certification form and filing system. The reliability certifications will be subject to penalties for false or misleading statements both under the United States Code and the Commission’s rules. The certification shall also be accompanied by a statement explaining the basis for such certification and shall be subscribed to as true under penalty of perjury in substantially the form set forth in section 1.16 of the Commission’s rules. Certifying Official. To ensure accuracy and accountability, each certification must be made by a corporate officer responsible for network operations in all relevant service areas. Thus, the certifying 5official must have supervisory and budgetary authority over a Covered 911 Service Provider’s entire 911 network, not merely certain regions or service areas. Effect of Certification. Under the certification process, a Covered 911 Service Provider that performs all the certification elements in a substantive area will be deemed to comply with the requirement to take reasonable measures in that area. This result is subject only to any determination the Commission or as delegated, the Bureau, may make afterward, based on complaints, outage reports or other information, that the Covered 911 Service Provider did not, in fact, perform as claimed in its certification. If, however, a Covered 911 Service Provider certifies that it has taken alternative measures to mitigate the risk of failure, or that a certification element is not applicable to its network, its certification is subject to a more detailed Bureau review. In such cases, the Covered 911 Service Provider must provide an explanation of its alternative measures and why they are reasonable under the circumstances, or why the certification element is not applicable. The Bureau will consider a number of factors in determining whether the particular alternative measures are reasonably sufficient to ensure reliable 911 service. Such factors may include the technical characteristics of those measures, the location and geography of the service area, the level of service ordered by the PSAP, and state and local laws (such as zoning and noise ordinances). The Bureau may rely on information from a variety of sources, including: (1) the certifications and descriptions of alternative measures; (2) supplemental responses to Commission inquiries; (3) supporting records retained pursuant to the record retention requirement; (4) NORS and DIRS data; (5) formal and informal complaints; and/or (6) news reports or other information available to the Commission. If the Bureau’s review indicates that a provider’s alternative measures are not reasonably sufficient to ensure reliable 911 service, the Bureau will engage with the provider and other interested stakeholders (e.g., affected PSAPs) to address any shortcomings. To the extent that a collaborative process with a provider does not yield satisfactory results, the Bureau may order remedial action, consistent with the authority delegated in the Report and Order. Any service provider ordered to take remedial action may seek reconsideration or review of the Bureau’s decision in accordance with the Commission’s rules. In extreme cases, such as where a provider is not acting in good faith, the Bureau may also refer cases to the Enforcement Bureau for further action as appropriate. This approach will place the least burden on those Covered 911 Service Providers that provide consistently reliable 911 service, while allowing the Commission to focus its attention and resources where most needed. Certification Phase-In. The rules, including the underlying obligation to take reasonable measures to provide reliable 911 service, became effective on February 18, 2014. Although information collection requirements pursuant to those rules will not become effective until approval by the Office of Management and Budget (OMB) pursuant to the Paperwork Reduction Act, the substantive obligation to take such reasonable measures is not contingent on such approval. Rules That the Commission Amended Covered 911 Service Providers must notify PSAPs of outages potentially affecting 911 service to that PSAP within 30 minutes of discovering the outage and provide contact information such as a name, telephone number, and e-mail for follow-up. Whenever additional material information becomes available, but no later than two hours after the initial contact, the Covered 911 Service Provider must communicate additional detail to the PSAP, including the nature of the outage, its best-known cause, the geographic scope of the outage, and the estimated time for repairs. Impact on Small Business The rules’ certification requirement applies to all “Covered 911 Service Providers,” without exception. In developing the rules, the Commission declined to create a specific waiver procedure for entities, including small and/or rural entities, to seek exemption from the rules. While the Commission acknowledged that small or rural service providers may have limited resources or operate in remote areas, 6the Commission declined to establish two tiers of 911 reliability based on economics or geography. Moreover, the rules allow flexibility for small or rural providers to comply with those rules in the manner most appropriate for their networks, and certain requirements will, by their nature, only apply to larger providers. For example, some small service providers monitor their networks directly from a central office and may not have separate NOCs; in such cases, the provider could certify that, while it does not have diverse aggregation points supplying telemetry data to diverse NOCs, it has taken reasonable alternative measures to ensure that the monitoring network in its central office is diverse. The certification approach allows flexibility for small or rural providers to comply with the rules in the manner most appropriate for their networks, and certain requirements will, by their nature, only apply to larger providers. Moreover, the approaches proposed in the Report and Order are intended to complement and strengthen, not to replace, the Commission’s current approach of encouraging service providers to voluntarily implement best practices and measuring compliance through outage reporting. Thus, with respect to everyday commercial communications that do not impact public safety as much as 911, small entities with limited resources will continue to enjoy many of the benefits of the current regime, including a general focus on network performance and reliability rather than specific design requirements. Recordkeeping and Other Compliance Requirements The Commission will require Covered 911 Service Providers to maintain for two years the records supporting each annual certification and to make relevant records available to the Commission upon request. For providers with existing electronic recordkeeping capabilities, these records must be maintained in an electronic format for ease of access and review. While certifications require only a brief description of alternative measures, the Commission reserves the right to request additional information, at the time of certification or thereafter, to verify the accuracy of a certification or determine whether alternative measures are reasonable. This approach lessens the reporting burden on service providers while ensuring that supporting documentation is available when necessary. Examples of such records include diagrams of network routing, records of circuit audits, backup power deployment and maintenance records, and documentation of network monitoring routes and capabilities. Weblink Improving 911 Reliability, Reliability and Continuity of Communications Networks, Including Broadband Technologies, Report and Order, FCC 13-158 (adopted and released Dec. 12, 2013) http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-13-158A1.doc http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-13-158A1.pdf http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-13-158A1.txt