NST began work in 2021 upon request from a small organization building a Generation Control Center to provide GOP services to renewable GOs. NST was hired to support the ground-up development of a low impact NERC CIP program. The organization needed to move quickly to support services to their low impact generation clients but also expected that their growth would eventually exceed 1500 MW in a single interconnection, leading to the asset being categorized as medium impact and subject to significantly more NERC CIP Requirements. As such, the development of their low impact compliance program was a top priority and required immediate attention.
In order to limit disruptions to the organization’s workflow, NST first worked with SMEs to determine how individual responsibilities contributed to the performance of necessary activities and evidence creation. With a clearer picture of the organization, NST began writing the low impact program documentation to address both the NERC CIP Standards and existing day-to-day operations. NST invited input from across the organization, including SMEs, management, and senior leadership.
During the development process, NST also played a role in communicating with third-party stakeholders, including walking the organization through the NERC registration process. Additionally, NST oversaw the development of technical specifications for vendors providing software, hardware, and security monitoring services as a “buyer’s representative” to ensure vendor solutions aligned with applicable CIP Requirements. Throughout the project, NST bridged the gap between NERC CIP and all other aspects of the organization and educated SMEs and upper-level management alike about their responsibilities in the bigger picture.
The low impact development concluded in late 2021, less than a year after the effort began. With a “teach a SME to CIP” attitude, NST trained client SMEs on the newly developed processes to ensure that roles were well-understood and no tasks went unaddressed. The collaboration across the organization during the development process ensured that the program was aligned with existing responsibilities, and as such, the handoff effort went without a hitch.
Additionally, NST has supported development of program documentation and controls necessary to support medium impact to ensure that if (when!) the client’s generation control footprint expands they will be able to transition to medium impact without interruption.
Following the low impact program development, NST was contracted by a subsidiary of the organization, a small generator with a Network Operations Center (NOC). The Facility, bound by contract, was required to comply with medium impact NERC CIP requirements as well as select IEC 62443 as well as ISO 27002 and 27019. NST was requested to perform a Gap Analysis across these standards. As they addressed many common control topics, albeit with differing focuses, NST noted the “high watermarks”, the most stringent or prescriptive version, across them. The mapping allowed SMEs to rest easy knowing their controls aligned with all the standards / frameworks by addressing the most scrutinous requirements.
