NST began work in 2024 with the development of custom CIP training modules to boost the Entity’s culture of compliance across a variety of business units. The Entity had recently implemented several new processes, including an Incident Response Plan (IRP) and a CIP-002 methodology which streamlined the process of BES Cyber Asset identification. As such, many SMEs were still wrapping their heads around the changes.
NST presented the client with four options for NERC CIP training from “100s” to “400s”, each representing a higher degree of granularity and customization:
CIP 100 - Intro to CIP + running a program
CIP 200 - Deep Dive into the Standards
CIP 300 - Customized Deep Dives
CIP 400 - CIP 300 + Interactive learning modules
The CIP 300 training provided the perfect balance between foundational review of the NERC CIP Standards and the client’s interpretation and implementation of processes to support compliance.
Prior to the project, the SMEs had a stellar culture of compliance. However, they desired a deeper understanding of the letter and spirit of the CIP Standards to double-check their compliance posture. Using the Entity’s RSAWs, NST produced and delivered presentations across the full suite of NERC CIP Standards. Each presentation incorporated unique aspects from the Entity’s compliance program - this included document names and examples, points of contact, process flow diagrams, and a narrative on how the Entity’s program ties back to the Standard.
Throughout the development process, NST suggested updates to RSAWs to ensure that narratives accurately reflected the controls in new and updated documentation. The “Deep Dive” approach provided an opportunity for SMEs to see the “Why?” behind their compliance responsibilities and to engage in discussions to better understand their roles in the bigger picture. The Entity recorded all training sessions and has since deployed those recordings across all CIP-responsible business units as a resource for new hires and anyone in the mood for a refresher.
