Automating NERC Compliance—USA

This utility provides reliable, low-cost power for more than 800,000 customers in a service area that covers more than 750 square miles. Their CIP compliance team is responsible for ensuring the organization maintains a good compliance and security posture. They see compliance with NERC regulations as an integral part of security and operations—not an additional task. That’s why they measure success by the integration of NERC compliance activities into daily work.

The Challenge

Inconsistent, time-consuming manual processes and a lack of compliance visibility.

Even with a team dedicated to the compliance activity of their subject matter experts (SMEs), the utility organization still struggled to execute and monitor calendar-based tasks in a consistent, repeatable manner. They also lacked quick visibility into their NERC compliance posture. That’s because their processes were resource intensive and relied heavily on manual data entry and notifications. The compliance team had built templates for their SMEs in an effort to capture more consistent evidence, and they were using spreadsheets to manually track progress on activities with associated due dates. But different business units still created their own templates, which led to inconsistent data across the organization. And it took the compliance team hours to sort through that data. The team had no easy way to evaluate or escalate compliance activities without comparing their spreadsheets to their ticketing system and then emailing their SMEs. After investing significant resources in tracking and monitoring, the compliance team was looking for a way to automate these activities.

SigmaFlow allows us to focus more on improving the quality of our evidence than struggling to meet compliance. We’ve become less reactive and more proactive.”

When a trusted consultant recommended SigmaFlow over the other CIP compliance tools the team was evaluating, the organization decided to move forward with the platform. It was the most user-friendly of all the options, and their top priority was a usable tool for their SMEs.

The Solution

A comprehensive system for workflow management and process automation.

The compliance team initially began working to automate their current processes with SigmaFlow, but quickly learned that the platform could help them accomplish their tasks more efficiently and collect cleaner data, leading to better NERC compliance. They relied on the SigmaFlow team’s knowledge of CIP standards and valuable experience to help them change and implement processes in a way that made sense for their organization’s goals.

With SigmaFlow, they were able to move away from their manual ticketing system and set up automated evidence collection workflows that allowed them to do the following:

• Control the values available to the SMEs with dropdown menus and templates, which made data more complete and consistent.
• Schedule calendar-based tasks based on the feedback, schedules, and needs of each business unit rather than forcing the SMEs to follow the same schedules.
• Easily track calendar-based tasks without relying on reminders and manually revising spreadsheets for pending due dates.
• Complete compliance tasks quicker since SigmaFlow automatically assigns tasks to the next person in the workflow, ensuring timely NERC compliance.

The organization’s other departments were initially apprehensive about using the tool—they wouldn’t have the same freedom to change templates and provide evidence in different formats. But they quickly adapted to the SigmaFlow workflows and now appreciate the structure and consistency brought by adhering to NERC compliance.

The Results

Before SigmaFlow, the compliance team had struggled to show other business units value and spent a lot of time on meetings and touch points with SMEs to make sure compliance-based work was getting done. Now that SigmaFlow communicates work activities and due dates, allowing SMEs to determine their own schedules and perform the work on their time, the relationship between the compliance team and the SMEs has significantly improved. Conversations focus less on people and more on the processes, and the SMEs have gained an appreciation for the compliance’s team’s work.

They see SigmaFlow as a platform that helps them do their jobs more efficiently and accurately. Prior to SigmaFlow, the organization also faced many challenges maintaining compliance with CIP-007 and CIP-010 (two of the most violated standards) and had to self-report with their ERO a few times. They’d struggled significantly with their CIP-007 and CIP-010 audits—from finding and presenting evidence to knowing if they would make it through their audit without a violation.

We were surprised at the value SigmaFlow provided in such a short period of time, and we know that we can do a lot more with the tool.

They now have complete confidence in their compliance with CIP-007 and CIP-010 and can see their current and past NERC compliance status with just a few clicks. During their last audit, they received high praise on their level of automation. Instead of struggling to meet compliance, the team is able to focus more energy on improving the quality of their evidence and developing new internal controls to test effectiveness.