Built-in metrics, robust help files and an easy dashboard-centric user interface require minimal training to get up and running quickly.

AssurX One system consistently tracks, measures and demonstrates compliance for an array of NERC and regional standards and requirements, including annual policy reviews, to asset and cyber security management, and document control.

Included in the AssurX One program:

1. Best practices, pre-configured workflows (NERC gap analysis, self-certification schedules/calendars, document control, cyber security management), dashboards and metrics.
2. Hosted on a secure, OnDemand system with preloaded NERC and regional standards and automatic regulatory updates.
3. Web-based implementation and training. Tutorials provided for each workflow.
4. Exclusive industry focused compliance Webinars and workshops.

For more information, download the detailed brochure (PDF):

Trey Kirkpatrick, Vice President, Energy and Utilities Compliance, AssurX

AssurX is pleased to announce the appointment of Trey Kirkpatrick as Vice President, Energy and Utilities Compliance.  Prior to joining AssurX, Trey served as Manager, Compliance Implementation and Registration for the Northeast Power Coordinating Council (NPCC) where he was responsible for registering all entities that met the requirements of the NERC Statement of Registry Criteria. NPCC has over 305 companies registered that are responsible for over 600 functional responsibilities as owners, operators and users of the bulk-power system.

While at NPCC, Trey was chairman of the NPCC Compliance Committee (CC) reporting directly to the NPCC Board of Directors.  As chairman, he worked closely with NPCC staff and stakeholders to continuously improve the compliance monitoring and enforcement process at NPCC.  He was also chairman of the NERC and Regional Entities – Registration and Certification Working Group (RCWG) where he worked with the eight (8) regional entities and NERC on setting strategic priorities for registration and certification within North America.

Prior to NPCC, Trey served as Manager, Reliability Compliance at Northeast Utilities where he was the lead manager representing Northeast Utilities’ Operating Companies’ strategic and operational interests with the North American Electric Reliability Council (NERC). While at Northeast Utilities, he was in charge of oversight of all matters related to reliability rules, including rules development, internal compliance assessments, compliance reporting, compliance audits conducted by sanctioned regulatory authorities, and developed and maintained all necessary records demonstrating Northeast Utilities’ compliance on a system-wide basis.   Trey was also a representative on the NERC Compliance and Certification Committee (CCC), which is a stakeholder body working closely with NERC and Regional Entities.

Trey comes to AssurX with an extensive background in energy and utilities having spent the past 20 years in various engineering and compliance positions in the industry; including in nuclear power generations and transmission. He will contribute his leadership skills in expanding AssurX’s compliance products and services in North America’s energy and utilities industry.

You can follow Trey on Twitter: http://twitter.com/CATSWebER

According to Trey Kirkpatrick, VP, Energy and Utilities Compliance for AssurX, “With the emergence of the CIP standards into the NERC and Regional Entities CMEP program, registered entities are self-reporting more CIP violations.  The entities are finding that documentation of personnel training and system security management continue to be an area for improvement. The registered entities are taking action with proper mitigation plans that are approved by the Regional Entities and NERC. They are also continuing to learn from other areas such as; nuclear power and health sciences how to instill a ‘Culture of Compliance’ in their workforce.”

And, as stated in NERC’s February 2011 Newsletter:

The Department of Energy (DOE) is launching an initiative to enhance cyber security on the electric grid. The initiative, led by the Department¹s Office of Electricity Delivery and Energy Reliability (OE), the National Institute of Standards and Technology (NIST), and the North American Electric Reliability Corporation (NERC), will be an open collaboration with representatives from across the public and private sectors to develop a cybersecurity risk management process guideline for the electric sector.

The Regional Entities and NERC are also performing more on-site audits and spot-checks. They are discovering implementation inconsistencies between entities and are sharing those lessons learned with FERC and the registered entities.  NERC has standard teams currently revising the next version of the CIP standards.  AssurX will continue to follow these revisions in updates to our readers in future blogs.

James Holler, Founder, Abidance Consulting

As is evident by the latest round of financial penalties (February 23, 2011) from NERC, the time for forgiveness is over. $1,145,500 in financial penalties were handed down to 24 organizations according the latest statistics — and none were zero dollar fines.

With penalties ranging from $3,000 all the way up to a whopping $450,000, and with the average penalty at just under $48,000, now is the time to ensure that your NERC compliance program is tightened down.

In the past, we have stressed the importance of training your staff; testing your various procedures as well as maintenance programs for completeness and accuracy; and, using different methods and methodologies to ensure your NERC compliance program is complete and ready to be audited by your Regional Entity and/or NERC at a moment’s notice.

So, with that said, let’s go back over a check-list of the areas that you will need to ensure are addressed in order to keep from having your organization’s name listed on the NERC Enforcement Actions Web page.

The following list is in no particular order, so don’t think you need to follow this in chronological order.

• Internal Compliance Program (FERC Required — FERC released a guidance document on this back in 2008 — use it!)
• Pandemic (Critical Assets Only — Use the CIKR documentation on the DHS website as guidance)
• Facility Ratings Methodology (it better be more than one or two pages — ours average 39 pages)
• Maintenance and Testing programs for PRC-005 (don’t forget to include the basis for your testing AND the intervals — if in doubt, use the ANSI or IEEE standards as your basis)
• CIP-001 training for your staff (having your staff sign a piece of paper that they may or may not have read isn’t going to cut it, use a real training program)

This is a partial list of what needs to be addressed so that you don’t become a statistic. As I stress to our clients, don’t overlook anything. If in doubt, ask someone who knows what they are doing and preferably someone who has been down the audit path before. Always remember, just because you passed your last audit, doesn’t mean you are going to pass your next one. Stay alert, stay focused and above all, stay calm, it’s not as bad as it seems.

James Holler is founder of Abidance Consulting.

James Holler, Founder, Abidance Consulting

Last time we made the argument that advanced energy storage has a demonstrable track record of positive environmental and economic benefits. Now let’s look at some of the energy storage technologies available in today’s marketplace:

Dynamic Power Resources (DPR)

• Ramp Rate Control: DPRs monitor output from a renewable generation source on a microsecond basis and automatically responds by either absorbing renewable output or supplying additional power so that the grid receives smooth, clean power at a desired MW/minute rate.

• Firming/Shaping: Coupling a DPR with a renewable generation forecast allows the utility to organize other generation resources to meet expected demand based on its guaranteed day-ahead renewable output schedules, as well as reshape output to deliver power during peak demand times regardless if the renewable asset is generating power or not.  If a forecast is inaccurate, the DPR automatically supplies or absorbs power on a microsecond basis to ensure the day-ahead output schedule is met.

• Curtailment Mitigation: if there are times when the utility needs to curtail renewable output, the DPR can take advantage of all of the as-available fuel by storing curtailed power and redistributing it at other times throughout the day, whenever the grid needs excess energy.

• Ancillary Services:  the speed and accuracy of the full four-quadrant DPR are unparalleled to that of typical generation resources.
  • Voltage Support: the DPR has the ability to supply and absorb reactive power (VARs) while simultaneously supplying real power (Watts). This allows the system to maintain a target power factor while continuing to provide other functions that require real power management such as services mentioned in this section.
  • Frequency Regulation: the DPR can respond to both AGC signals and/or frequency deviations with sophisticated control algorithms to help maintain nominal grid frequency. The DPR is capable of providing the frequency support during loss of generation or system disturbance, as well as address less severe frequency deviations due to normal grid operations throughout the course of each day.
  • Spinning Reserve: the unique sizing scheme of the DPR allows the customer to add more energy storage (MWh) and act as a back-up power reserve for extreme generation trip scenarios by providing power while offline generation units ramp up to replace lost generation.

• Transmission and Distribution Upgrade: Deferral: instead of undertaking costly T&D upgrades, utilize DPRs to supply power for incremental increases in load, as well as to enhance grid reliability for weak and/or congested T&D lines.

• Peak-Shaving/Load-Leveling: Similar to ramp rate control, but for longer periods of time, a DPR can absorb and provide power, charging during off-peak times for use during on-peak times. Peak loads are lessened, which ultimately enables traditional generation to run more efficiently.

James Holler is founder of Abidance Consulting.

James Holler, Founder, Abidance Consulting

Advanced energy storage has proven that it delivers significant environmental and economic benefits as well as superior Bulk Electric System (BES) reliability. Let’s look at some of its key benefits:

Reduces the Need for Reserve Power Plants: Electricity storage technologies provide effective methods of responding to daily fluctuations in demand. Electricity produced at off-peak hours is now capable of being stored and used later to meet demand spikes, thereby reducing the need for expensive, aging, and carbon emitting fossil-fired reserve generation plants.

Cuts the Cost of Power Failures: As a result of the aging U.S. electricity grid, the DOE estimates that electricity outages and interruptions cost the U.S. approximately $150 billion annually.  Electricity storage technologies can provide power to the grid to “bridge” gaps and smooth out short-term fluctuations until backup generation sources can be brought online.

Boosts Renewable Energy Integration: Wind and solar power are the two largest sustainable sources of carbon-free natural resources. But both are intermittent, varying widely in the energy that they can provide at any one time during the day due to fluctuation in the wind patterns and intermittent cloud cover for solar panels. Power storage technologies can smooth out this variability and allow unused electricity to be dispatched at a later time when it is needed at peak times. In addition, paired with renewables, energy storage can provide regulation services such as ramp control, curtailment mitigation, firming/shaping of power and other grid reliability services.

Currently there are about six energy storage technologies available in the market today: pumped hydropower, batteries, compressed air energy storage, flywheels, superconducting magnetic energy storage, and electrochemical capacitors.  Solid state battery technologies are suited to quick, modular, scalable deployments with few environmental risks. We’ll survey each in our next blog tomorrow.

James Holler is founder of Abidance Consulting.

James Holler, Founder, Abidance Consulting

There is a new concept emerging within the NERC Compliance arena called NERC Compliance Managed Services. The managed services concept is nothing new to the business community, but it has not yet taken hold in the NERC arena. One of the main reasons is that there are only one or two companies that competently perform this service.

If you do decide to pursue a managed service provider, keep in mind that there are five things you must make sure the managed service provider you choose adheres to.

Customer Service: Your managed service provider must commit to giving you better customer service than the next guy. Everyone provides customer service. Make sure your managed service providers’ customer service is exceptional. Your managed service provider must let you know that they are truly committed to doing whatever it takes to make your NERC compliance program successful. Be sure that your managed service provider doesn’t make customer service an afterthought, but a part of their business strategy.

Understand Your Business Culture: Your managed service provider must get to know your way of doing business so that they can deliver you services in a manner that best meets your needs. A good managed service provider doesn’t deliver cookie cutter services. The managed service provider must know how to tailor and execute their services in a way that is compatible with your unique way of doing business.

By having a laser focus on your needs, the managed service provider can offer higher premium services that add the most value to your business.

Education: A good managed service provider will educate your staff on everything NERC related…not just one or two particular areas. Your managed service provider must show a value every step of the way. Your managed service provider is providing a valued-added service and they should be able to give you a ROI that will show you why they are the best choice for your business. If the managed service provider can’t show you the metrics, they don’t deserve your business.

Ongoing Communication: In order to retain your business over time, your managed service provider needs to maintain constant communications with you and your staff. Whether it’s phone calls, social media, or on-site visits, your managed service provider needs to build a rapport with you and your staff so that you will eventually see your managed service provider as a trusted business advisor rather than just a vendor.

Commitment: Commitment from your managed service provider is the key to growing your trust and adding value to your business. If developed properly, an managed service provider relationship is a sophisticated business model that needs to be given adequate dedication and resources from both sides.

Bottom-line: Make the investment in the right managed service provider, staff and the right technology in order to deliver the best value to your business. Don’t do it halfway; you will only end up with poorly constructed NERC compliance program…and possibly some heavy monetary fines.

James Holler is founder of Abidance Consulting.

James Holler, Founder, Abidance Consulting

With more and more emphasis being placed on the CIP requirements, some NERC registered entities may be tempted to “relax” and decide that  they are not deemed classified as a Critical Asset. A word of advice: Take a deep breath and think carefully. If you think that it is just too hard to get compliant and the easiest solution is to just declare that you are not critical, you are very mistaken.

Several attorneys that work in the NERC space have commented that those who deliberately or appear to have otherwise deemed themselves to not be critical simply to avoid having to comply, will most likely face egregious fines from NERC…and we’re talking in the millions of dollars. On the same side of this coin, if your CIP program is so weak that you are judged to not be in compliance, you could suffer much larger financial losses, in addition to any fines, if you are the victim of a cyber attack or an interruption due to your failure to comply.

NERC and FERC have made it very clear from the beginning that they are serious about having registered entities comply with their rules and regulations. Since June 2007, NERC fines total more than $35 million and the FERC fines are almost $120 million.

If your organization doesn’t have the appropriate staff on hand to get the job done, then you have two valid options: 1) hire the appropriate staff, or  2) hire a competent consulting firm. Don’t think that you, as a registered entity, are going to be able to “slip one by” the auditor. The eight RRO’s as well as NERC and FERC have hired on some very skilled cyber security auditors that know what to look for and also where to look. These auditors are very good and the only way to “beat them” is to have a great CIP compliance program in place.

You may ask, “how long does it take to get compliant…and for how much”. This is not an easy question to answer as there are numerous variables that determine the answers to these questions. A few variables are…what is your current state of readiness; have you leveraged from other compliance effort areas such as Sarbanes-Oxley, HIPPA and PCI; have you tested your current state of readiness against a mock audit? There are dozens of factors that must be considered before you can even guess at the timeframe and associated costs. One thing is for sure though…it will cost you a lot less money to get compliant than it will for you to “keep your head in the sand”.

James Holler is founder of Abidance Consulting.

James Holler, Founder, Abidance Consulting

H.R. 5026 Grid Reliability and Infrastructure Defense Act or the ‘‘GRID Act” as is it known, is setting the table to allow the current Administration to nationalize the grid. There, I said it!

This piece of legislation passed the House Energy & Commerce Committee unanimously 47-0. Apparently no sane person on the committee read this document as it allows the President to declare an “emergency” – (Page 6, Lines 10-18) Whenever the President issues and provides to the Commission (either directly or through the Secretary) a written directive or determination identifying an imminent grid security threat, the Commission may, with or without notice, hearing, or report, issue such orders for emergency measures as are necessary in its judgment to protect the reliability of the bulk-power system or of defense critical electric infrastructure against such threat. That applies to the entire grid, an RRO or even a single facility – (Page 7, Lines 9 – 15) An order for emergency measures under this subsection may apply to —

(A)  the Electric Reliability Organization;

(B)  a regional entity; or

(C) any owner, user, or operator of the bulk-power system or of defense critical electric infrastructure within the United States.

The GRID Act requires a facility to protect against Electromagnetic Weapons (non-nuclear), Geomagnetic Storms, a direct attack on a facility or its systems using an electromagnetic weapon and/or a geomagnetic storm causing adverse effects on the reliability of the Bulk Electric System.

Um, if you plan on monitoring the sun for storm activity and have a “Magic 8-Ball”, you might be able to figure out how to detect and protect against these issues. If you don’t happen to possess these monitoring abilities, then just plan on getting fined or having an “emergency” declared against you.

Oh, and just in case you weren’t aware, if an emergency is declared against your facility, FERC will step in and take control of your facility(ies) until the President has determined that the emergency is over. This is the same President who recently said at Hampton University that he did not know how to use an iPod, iPad, Xbox or a PlayStation. This is the very same President who wants the ability to declare an emergency on the grid!

There is one shining light in all of this. That light is your ability as a registered entity to recover your expenses in getting compliant either through rate increases or, if that’s not possible, Congress will put in place a “mechanism” (new taxes) so that you can recover your costs. The other light…I think this light is from an oncoming locomotive…is one that allows Congress to force you to turn over all of your documentation, regardless of its sensitivity, for their full review. Mmmmm makes me feel all warm and fuzzy to think that Congress will now be able to review and, at their whim, make all of our power producers documents a matter of public record. Check Please!

Read the entire ruling here.

Lucky for us we’ve got Paul Fricke, Quality Manager with AssurX, to act as our interpreter.

His overall take? “We got some clarification and some elaboration, but bottom-line there really is not that much in these new issues,” Paul says. Paul cites a few relatively minor changes that are worth taking a quick look at, e.g., what are “appropriate parties” in CIP-001-1a, clarification about “end points” in CIP-005-1a and CIP-005-2a and Electronic Security Perimeters/Physical Security Perimeters in CIP-006-1c and CIP-006-2c.

Paul elaborates on what it all means, “the big take away is that NERC is active in adding interpretations to NERC Standards to aid in ensuring that registered entities understand the intent of the requirements and how they expect them to be applied.”

It’s also important to note that these new issues aren’t exactly a done deal. They are issued by NERC but are waiting for regulatory approval, with a “TBD” effective date.

Stay tuned.

Editor’s Note: Got a question about all of this? Reach out to Paul at pfricke@assurx.com

Click here for more information about NERC compliance.