POWER April 2013 - 28

REGULATORY
Preparing for a NERC CIP Audit
Undergoing a NERC CIP audit is an ordeal, particularly when the ground rules
are not clearly spelled out in advance. An experienced NERC CIP auditor
lays out a comprehensive five-step plan that will show you how to prepare
for a successful audit.
By James E. Chance, Corporate Risk Solutions Inc.
I
t's no surprise that a North American Electric
Reliability Corp. (NERC) Critical Infrastructure
Protection (CIP) audit generates plenty
of anxiety during the weeks preceding one.
However, there is a preparation strategy that will
allow you to get those emotions under control.
This article presents a detailed analysis of a
five-step audit preparation strategy, followed
by its application to a specific NERC CIP task.
The strategy, based on real-world NERC CIP
audit experiences, is a useful guide for those
responsible for audit documentation preparation.
Next, the entire five-step process is applied
to a single NERC CIP sub-requirement
as an example. You also will find some suggestions
on where to seek additional help.
The NERC CIP audit environment is changing.
Regional Entities (REs) are doing more
work upfront and less on site. There are eight
REs representing, according to NERC, " virtually
all the electricity supplied in the United States,
Canada, and a portion of Baja California Norte,
Mexico. " If the Entity (essentially any company
that generates or manages power flow on a
transmission and distribution network) submits
a clear Reliability Standard Audit Worksheet
(RSAW) with good supporting evidence, most
of the audit can be done before the Regional
Auditors (RA) arrive at the Entity's site. Every
requirement the RAs check off before arriving
on site means one less activity that you need to
interrupt your subject matter expert's (SME's)
schedule for, which is always a good thing.
Step 1: Understand the
Requirements
The NERC CIP Reliability Standards (CIP
Standards) were written by committee and,
generally, without the benefit of a technical
writer. The result is that they are not extremely
clear and are often confusing. Although
understanding the current version is vital, it is
also useful to review the next version that is
in draft form. Review your registration status
against the requirements so that you are addressing
the proper version and constraints.
The key sections in each of the eight CIP
Standards are the two sections entitled Requirements
and Measures. The Requirements
describe what the Entity needs to do, and the
28
Measures describe what evidence the auditors
will be checking, although the section is
written at a summary level.
The first step in understanding the Requirements
within any of the CIP Standards is to
review the language. Two especially interesting
concepts are presented in the Requirements section
that require close interpretation.
The first interpretation problem involves
the use of technical and/or procedural controls.
These require documentation, and when
technical controls cannot be implemented, a
technical feasibility exception (TFE) is required.
Sometimes written with an " and " and
sometimes with an " or, " the documentation
requirements of the two cases are different.
CIP-005 R2 uses the phrase " organizational
processes and technical and procedural
mechanisms, " whereas CIP-007 R5 uses the
phrase " technical and procedural controls. "
What is the difference between the two
phrases? You need to understand this because
it affects your procedures and the evidence
you provide for the auditors. Note that Compliance
Application Notice-0017 provides
the interpretation that every technical control
implies a procedural control, the process that
implements the technical control. It also provides
guidance on when either technical or
procedural controls or both are applicable.
Another interesting interpretation problem
concerns the collection of terms that
show when documentation is required. The
following words listed throughout the Requirements
require the Entity to provide a
document of some sort as evidence: policy,
methods, processes, procedures, identify,
maintain, document, list, approve, develop,
review, implement, assign, assess, establish,
controls, perform, update, retain, create, deploy,
exercise, use, and test. Every one of
these words indicates a document or task that
is required by the standards. Eventually, you
will need evidence (documents) each time
one of these words appears.
Go through the Requirements one by one
and read them carefully. Make a note of anything
that you don't understand. Create an
outline of the significant statements or start a
spreadsheet to track your information.
www.powermag.com
The Requirements themselves can be very
confusing. As the example using CIP-005
R2 and CIP-007 R5 demonstrates, it can be
daunting to untangle the true intent without
help from those more experienced in the
audit documentation process. Fortunately, a
number of sources can help you understand
the Requirements (see sidebar).
Step 2: Know What Auditors Are
Looking For
Auditors are looking for just one thing-the
opportunity to verify that you are " auditably
compliant " with the CIP Standards. The auditors
look for documentation of procedures, and
verification that you are executing them (as referenced
in Federal Energy Regulatory Commission
[FERC] Order Docket No. RM06-22-008).
This will include both the RSAWs and the associated
evidence for each requirement.
The RSAWs used during the actual audit need
to present two types of evidence, as referenced
in FERC Order Docket No. RM06-22-008:
In critical infrastructure protection, and especially
in the cyber security environment,
the implementation of security measures is
largely dependent on complex plans, policies
and procedures that must be repeatable
and verifiable. This necessitates documentation
of both (1) the procedures to be followed
and (2) verification that the procedures
were followed as directed. These complex
procedures require clear and consistent instructions
(documentation) and consistent
execution (implementation). Further, these
procedures also require a method for reporting
their completion.
To address this requirement, each Entity has
processes, procedures, and policies that describe
how the Entity meets the requirements of a RS,
the means that the Entity uses to meet the requirement.
The second type of evidence is used
to show that the Entity is using these processes,
procedures, and policies. This evidence is typically
screen shots, lists, reports generated by
applications, logs, or other evidence generated
from the devices themselves.
Auditors also look for enforcement. If a
POWER | April 2013
http://www.powermag.com
POWER April 2013

Table of Contents for the Digital Edition of POWER April 2013
