The long awaited approval of CIP version 5 by FERC has now happened.
Now the question becomes, what does this mean to you? Will the impact be significant? If so, how significant will it be?
For starters, there is going to be a lot of work expended to properly prepare for compliance under the new version of CIP because almost everything has changed to some degree. Requirements have been rewritten or updated. They have been reorganized. New Standards and Requirements have been added.
Transitioning from a currently stable and well-understood CIP version 3 practice to CIP version 5 will require work to gain the same level of internal mastery of the standards, followed by a lot of education to help the rest of the organization prepare itself to be part of an effective and successful compliance program. In many ways it is “ground zero” for CIP compliance. Programs, policies, procedures, and compliance practices will all need to be reviewed and updated to ensure the compliance program meets the Requirements in CIP version 5. That’s the first challenge.
The second challenge is evidence. While some of the evidence already being gathered under version 3 will suffice for version 5, much of it has moved due to the reorganization of CIP. Other evidence will suffice, but only after being updated to include new terms that have been introduced in the new version. There will be new evidence that will need to be collected as well.
Finally, there are the concepts within the Reliability Assurance Initiative. I’ll be talking more about this in the coming weeks but suffice it to say that assessing compliance on an annual or by audit basis, and attempting to correct issues then instead of when the issues occurred, is not a sustainable practice in CIP version 5.
No matter how you slice it, CIP version 5 is going to require each Utility to make a lot of changes. As a NERC compliance vendor, there are steps we can (and are) taking to reduce the burden on our Utility customers. Stay tuned for future blog articles as we work to unravel the implications of CIP version 5 and discuss the steps we are taking to eliminate and simplify as much of the work it represents as possible.