In my last post, I described twelve serious problems that I see with the draft NERC CIP “100 series” standards that were posted for comment in July by what I call the “Cloud CIP Standards Drafting Team (SDT)”. Every one of these problems is a show-stopper, meaning it needs to be fixed before the standards are put up for balloting by NERC entities.
However, there’s another problem, which I realized when I read the “unofficial comment form” that the SDT wants commenters to fill out. The form contains 20 questions that all follow a similar format. Here is the first question:
Each question asks for a Yes/No answer but also asks for alternative ideas. As you can see, the SDT is clearly saying they want to hear any and all ideas about alternatives to what they’re proposing.
Of course, it’s great that the SDT is soliciting alternatives, but I have one question for them: “Why are you just doing this now? After all, you started meeting in the summer of 2024. You spent the rest of that year rewriting the Standards Authorization Request (SAR) under which your SDT was constituted. You were allowed to do that, of course, but why didn’t you settle fundamental questions like these then?
Instead, you’ve waited until, by your own admission, you’re facing intense pressure to finalize all the new standards for the first ballot by the end of the year (although up until about six weeks ago, you were insisting that the first ballot would be in September. I always assumed you said that just to show you have a sense of humor). You have only developed five of the twelve or so new standards that you’re proposing, along with a number of definitions of new terms.
There are serious problems with all the standards and definitions you’re proposing, and you have yet to hear about those problems from anybody but me. I don’t recall any fundamental questions after the SDT’s webinar two weeks ago, probably because few NERC entities had invested much time in studying what was posted just a week or two previously. In fact, this is probably still true today. That’s what happens when you wait ‘til the second half of the summer to engage in a serious public discussion about anything other than sports, wildfires, or summer camp.
In the next couple of months, the NERC entities, the CIP auditors and the NERC lawyers are almost certain to bring up a lot of problems with the posted standards that I haven’t thought of. They always do. Yet, you seem to believe that by December you will fix all of those problems (plus any new ones you might create while fixing them), and in your spare time, draft the remaining six or seven new standards, put those up for comment, address the problems that come out of that comment period, fix those problems, put the fixes up for comment…rinse and repeat at least a couple more times.
While you’re at it, do you think you could also solve the problem of global hunger and invent a perpetual motion machine by the end of the year? Perhaps that’s too much to ask…
SDT, you’re not going to have your standards ready for ballot by the end of the year, and if you just throw something together that clearly has problems, you won’t even be allowed to put it up for ballot. The balloting process is for standards that have already been thoroughly vetted and in which no serious known problems remain – since, God knows, the NERC Ballot Body is sure to come up with lots of objections when they’re asked to vote on mandatory standards that carry significant penalties for non-compliance.
The CIP v5 SDT received two thousand pages of comments on just one of their four ballot postings over the twelve months of 2012. Four ballots were needed to get the required supermajorities in each of the NERC voting segments; I think you’ll be lucky if what you’re proposing now only takes four ballots (each ballot will take about three months, including the comment period, responding to the comments and making changes to the draft standards to address those comments). Of course, you will need to respond to every comment you receive during the balloting period and either make changes to the draft standards or explain why you didn’t. After all, this ain’t beanbag.
I suggest you stop trying to draft any new standards and instead ask yourselves the question: “How can we most efficiently fulfill the two deliverables that we included in our SAR?” I listed those two deliverables in my last post. BTW, those deliverables don’t include rewriting the current CIP standards or developing requirements that address both on premises and cloud-based systems, although you seem to think you’re obligated to do both of these things.
Last December, I identified eight small changes (almost all to definitions) that I think will fix the three main problems you need to fix (which I identified near the beginning of my last post). I doubt it will take more than two weeks to draft these changes; I also doubt there will be any strong objections to them, so approval should be quick. The changes could easily be effective next year. I suggest you at least take a close look at what I proposed (which you have never done); as it is, you’re wasting both your time and that of the NERC entities who are taking the time to pay attention to what you’re doing.
Of course, I may be wrong; you should certainly solicit other ideas as well. Above all, you need to remember the First Law of Holes: When in one, stop digging.
Tom Alrich’s Blog, too is a reader-supported publication. You can view new posts for three months after they come out by becoming a free subscriber. You can also access all of my 1300 existing posts dating back to 2013, as well as support my work, by becoming a paid subscriber for $30 for one year (and if you feel so inclined, you can become a founding subscriber for $100). Whether free or paid, please subscribe.
If you would like to comment on what you have read here, I would love to hear from you. Please comment in my chat or email me at [email protected].