Enhancing User Security and Management in Renewable Energy Credit Project

Renewable Energy Credit Project Update Don Tucker Manager Settlements Metering March 2021 RMS & WMS

Quick Overview Meaning of terms used in this presentation User login a specific user REC account a specific company Relationship - the link between a user login and REC account User login to a REC account is through the use of a login name and password Many login names use the same email for a different user login Multifactor Authentication is part of the project User login name is changing to the users email Each user login will be required to have a unique email Some new functionality on the horizon 2 PUBLIC

Multifactor Authentication for User Login Multifactor authentication is needed to maintain higher security standards Auth0 is the chosen multifactor authentication solution User login will be managed separately from the REC application User access to a REC account will be managed in the REC application Account admin will set up users & user privileges in each REC account Creation of user login name for REC accounts Currently user name is created by account admin Same email can be associated to multiple user login names New process user login name is created during AUTH0 registration User login name will be the user s email address Ability for the same email address to be associated to multiple user names will no longer exist 3 PUBLIC

User Login & Relationship with REC Accounts User logins will be managed through the AUTH0 application Account admin role/privilege is automatically assigned to the user login that creates the REC account There is only one account admin role/privilege for each REC account Account admin establishes users that have access to the REC account Unique email address is used to define a user Each user is assigned a role/privilege (User or View Only) User logins are fundamentally separate from REC accounts A user login can now have a relationship with one or multiple REC Accounts Replaces the need for 1 person to have multiple user logins User roles for each account are assigned by the admin for each account A user role/privilege can be different for different REC accounts Access in each REC account is limited by the assigned role/privilege 4 PUBLIC

REC System Generated Emails Current system System generated emails go to the REC account admin email New process Account admin will define the email used for system generated emails Set up during the account registration process Can be different than the admin email Multiple emails can be specified Minimum of one Maximum of four What happens at production go-live for existing accounts The account admin email will be used for system generated emails Account admin can update the email after prod go-live 5 PUBLIC

The Ask - Mapping of User Name to Email Current system has many login names associated to the same email address New process requires login name to be the user email address Existing user login names must be mapped to a unique email address ERCOT will provide each REC account admin with a list of active user names Targeting to provide list by mid-March REC account admin will be asked to Map each user name to a unique email address Mark any user name that needs to be deleted (no mapping required) Provide response within a couple of weeks ERCOT will manage the transition of user names into the new prod system Replace the existing user name with the mapped email address Existing user name role/privilege will be maintained Remove inactive users and the user names marked for deletion 6 PUBLIC

Mapping of User Name to Email REC accounts where mapping is not provided by the account admin User names will be removed from the account Account admin will need to reach out to ERCOT to gain access to the account New users created in the existing application prior to go live New users can be added using the users email as the user name Prior to go live ERCOT will take a second snapshot to capture new users created in prod after the initial mapping effort ERCOT will send follow up requests to account admins as required Account admins will need to provide a quick response on any requests Should a user login be missed for any reason during the mapping process the account admin can add the user back after go live 7 PUBLIC

Some Project Dates Production go live targeted for August 2021 Investigating a limited duration market facing I-test prior to production go live Targeting late June or early July Market Participants Trial run with new user login process View changes prior to production release Verify mapping of users to email was as expected Provide feedback on anything that looks like a defect or appears to be out of place 8 PUBLIC

Stay Tuned More to Come with Some Examples AUTH0 initial user login and set up Auto retire Integrated help User multiple account relationship access New look and feel Downloading reports in excel format New URL 9 PUBLIC

Questions or Discussion 10 PUBLIC