As the electric grid becomes increasingly digital, the need for robust cybersecurity protocols is more important than ever. The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) compliance standards were established to maintain the reliability and security of the bulk power system.

Utilities are required to have CIP compliance programs in place that addresses all NERC CIP standards.

Non-compliance with NERC standards may put the grid at risk and have significant impacts on companies through monetary fines, penalties, and reputational harm.

Our experience has shown that leading practice NERC CIP compliance programs have:

• A clear accountability model and ownership of NERC reliability standards
• Programs and procedures which define how NERC compliance-related work is performed
• Training for personnel who perform work and others who need to be aware of NERC compliance
• Work management and tool integration that supports timely completion of work
• Oversight practices that ensure the work is performed according to standards and quality evidence is collected
• Continuous monitoring of cybersecurity risks and vulnerabilities
• Implementation of security controls commensurate with the risk level
• Development of incident response plans

By taking a proactive approach to cybersecurity, utilities can not only meet their compliance obligations but also strengthen the overall security posture for their bulk electric system.

Case Studies