Скачать или смотреть Basin Electric’s first NERC CIP audit completed

Basin Electric’s first-ever compliance audit for Critical Infrastructure Protection (CIP) was conducted by the Midwest Reliability Organization (MRO) in August.

The audit looked at the cyber and physical security initiatives Basin Electric has in place, focusing on five North American Electric Reliability Corporation (NERC) reliability standards and 18 of the 39 NERC CIP requirements.

The audit covered the following areas:
•Cyber security
•Physical security
•System security management
•Change management
•Transmission substation physical security

This was Basin Electric’s first CIP audit because prior to 2016 the co-op had not identified any “critical” CIP assets, Dave Rudolph, manager of NERC compliance, says.

Basin Electric’s CIP team was notified about the audit in May. The notification also outlined the timeline of data deliverables leading up to the onsite audit, which happened Aug. 20-22.

Various level one and level two data requests were due to auditors in June and early August for their review before coming onsite to Basin Electric. Leading up to the onsite audit, auditors also conducted interviews with Basin Electric subject matter experts and requested additional data.

The onsite audit included tours of Basin Electric Headquarters, substations, and a backup data center. The onsite portion concluded with auditors presenting their findings.

Results

“Overall, Basin Electric’s CIP team did a great job,” Rudolph says. “For being our first audit and having heard stories from other entities, it went as well as can be expected.”

The audit identified three results:
•Two issues of potential non-compliance (PNC). Lower risk non-compliance with mitigation strategies already being developed.
•One area of concern (AOC).

Internal CIP audit team reaches co-op wide

The CIP audit is broad-reaching and touched many areas in Basin Electric.

The following areas within Basin Electric participated in the MRO CIP Compliance Audit:
•NERC Compliance (Transmission division of Transmission, Engineering & Construction)
•IS&T (Operational Technology, Network & Telecom divisions of Finance/IS&T)
•SRS-Physical Security
•Transmission System Maintenance (division of Operations)

Senior Vice President of Operations John Jacobs served as the designated CIP senior manager.

“This was a broad-reaching audit. In the months leading up to it, all of the employees involved spent a significant amount of time outside of normal business hours – weekends and evenings – to prepare,” Rudolph says.

Aside from the months of preparation leading up to the August audit, Basin Electric’s CIP team has been meeting regularly for the past six years to prepare the program.

Next steps

The auditors will provide Basin Electric a written report to review.

Rudolph says NERC will also inform Basin Electric within the next six months to one year about the timing of future audits, which he anticipates happening more frequently.

“Previously, we were on a six-year audit schedule because we don’t have real-time system operators,” he says. “Since we’ve gone to a risk-based profile, we can be audited more, or possibly less, often.”