I am in regular conversations with utilities, consultants, and experts regarding NERC CIP version 5. Those conversations continue to be part of my daily life, but recently the essence of those conversations has fundamentally changed.
Last year the majority of the CIP v5 conversation focused on standards interpretation. The v5 standards have presented us with a lot of new information (and compliance expectations) that needed to be hashed out. I think that most of us have done a good job of engaging in those conversations. We’ve debated a lot of points, and a good number of those have bubbled up to NERC with the result that additional guidance has cleared much of the murky waters.
Now, as the effective date for NERC CIP version 5 draws ever closer, the conversations are switching from “what does this mean?” to “how do I get compliant?” Suddenly, many people are finding that while their understanding of v5 is solid, their preparation for compliance is woefully lacking. That is triggering more and more fear and anxiety. How will I get there? The race is on!
Of course, there is no silver bullet or magic faerie dust that will solve all of your compliance woes. That’s completely unrealistic, and the people in utility compliance are far more pragmatic than that. That said, I am definitely in regular conversations about v5 compliance, driven by the need to understand what tools are needed and how long it will take to set up an end-to-end CIP v5 compliance program.
The good news is that it doesn’t have to take years. In fact, there is no reason that it should take an entire year – period. Oh, but wait a minute. That’s probably too broad of a statement, because I do know of several utilities that will be taking at least a year and probably more to become v5 compliant (and at least one of them is just starting.) Why the difference? Different tools require different approaches!
The most significant tool variation that is driving this is the difference between technology that “can” do what we need for compliance, and technology that “does” what we need. Using technologies that “can” requires us (the utility) to understand, translate, design, and build every aspect of CIP v5 into the tool. For technologies that “do” CIP v5 compliance, preconfigured functionality jumps the process ahead to validating the program. In the other approach, that can’t happen until the program is built. Someone starting right now in this approach will be lucky if they can start validating before the year runs out.
With these fears and stresses, utilities want to know just how long it will take them to fully deploy a CIP V5 program, because, you know, the race is on! With the SigmaFlow solution, that program can be consistently deployed and validated in less than six (6) months.
And yes, I do enjoy the collective sigh of relief when I outline deployment expectations and timelines. I mean, isn’t that what we are here for? Solving the tough problems so that our customers don’t have to? Is the race starting for you? No problem, bring it on!
Check out the recording of our recent webinar with EnergySec on NERC CIP Version 5 and process driven compliance: