NERC CIP compliance: We’ve identified our critical assets, now what?”

As we move through the NERC CIP compliance timeline toward ldquoauditable compliancerdquo, utilities are struggling to find reasonable solutions to meet compliance expectations. By now, most utilities have developed a risk-based assessment methodology, identified the relevant critical assets, and the design and implementation of technical solutions is well underway. Unfortunately, technical solutions cannot solve some of the most difficult challenges associated with compliance. Like many standards, the NERC CIP requirements tell only the ldquowhatrdquo, and offer little in the area of ldquohowrdquo. The following paper will identify some of the early compliance barriers and provide some recommendations for those on the front lines of compliance.