POWER April 2013 - 30

REGULATORY
policy says employees " should " follow a procedure,
the auditor will want to know what action
you took when an employee didn't follow
the procedure. Find out what the auditors consider
" good " documentation versus " weak " or
" poor " documentation. Note that your experience
based on a " spot check " will most likely
not be a good indicator of readiness for an
audit because a spot check does not have the
Where to Find Help
The first resource is the North American
Electric Reliability Corp. itself (www.nerc
.com). Check the Compliance Application
Notices to see if one of them addresses your
questions. You can also check the balloting
comments; there may be useful information
there also. The next place to check is the
Regional Entities' websites. The Regional
Entities also hold seminars and webinars
where you can get additional information
and ask questions. You may also email them
with general questions. Finally, various industry
forums allow Entities to exchange
information and ask questions. Helpful resources
include those that follow.
NERC
■ CIP Standards: http://bit.ly/ptjUG
■ Compliance Application Notices:
http://bit.ly/abVoyr
■ Compliance Application Notice-0017:
http://bit.ly/12cXWHT
Regional Entities
■ Florida Reliability Coordinating Council
(FRCC): www.rfirst.org
■ Midwest Reliability Organization
(MRO): www.midwestreliability.org
■ MRO guide to compliance: http://bit.
ly/12cY75T
■ Northeast Power Coordinating Council
(NPCC): www.npcc.org
■ ReliabilityFirst Corp. (RFC): www.rfirst.
org
■ SERC Reliability Corp. (SERC): http://
bit.ly/GWSLfD
■ Southwest Power Pool, RE (SPP):
http://bit.ly/UbJlJ2
■ Texas Reliability Entity (TRE): www.
texasre.org
■ Western Electricity Coordinating Council
(WECC): www.wecc.biz
Other Government Resources
■ RAT-STATS, Statistical Software:
http://1.usa.gov/WHqJAS
30
same requirements as an audit. A spot check
is much less rigorous than an actual audit, so
evidence that was sufficient for a spot check
may not be adequate for an actual audit.
Usually, the auditors will not want to look
at all of your evidence. Instead they will use
a program called RAT-STATS (available for
download, see sidebar) to select a statistically
representative random sample. No one wants
to look at 90 days of firewall logs (especially
if there are thousands of pages in the logs).
They will want to take a small sample, just
enough to show that your process is retaining
90 days of logs. RAT-STATS will allow them
to select a statistically accurate sample. This
will also be used for personnel risk assessments,
training, and access changes.
In summary, auditors want to see a procedure
that meets the Requirement and evidence
that you are following the procedure.
Step 3: Analyze Your Evidence
A documentation spreadsheet is very helpful
for tracking your compliance. For each
Requirement and sub-requirement, create a
column, and then use a row for each piece of
evidence. Each row should have a file name
or document title. You can use a comments
column to provide additional details (perhaps
how to access the data). As each piece of
evidence is analyzed, update the spreadsheet.
Even if all pieces of evidence are not used for
the RSAW, you may need them if the auditors
ask for additional evidence during the audit.
This spreadsheet will be very useful when
packaging your evidence.
Analyzing your evidence is a three-part
exercise:
■ First, determine what processes and procedures
you have that demonstrate compliance.
Use the documentation spreadsheet
to track these documents. Your SMEs
should be able to identify all these policies,
procedures, and processes.
■ Second, for each process and procedure
identified, find the supporting evidence
that shows you are executing processes
and procedures properly. This must be
carefully done, or you will miss some
of the evidence. Consider the size of the
evidence. Typically, firewall logs contain
huge amounts of data, but auditors will
only want to see a sample. Have a plan for
how to extract the sample.
■ Third, verify that your evidence is complete
and sufficient. This is best done by a different
person (not the one who created the
evidence) to demonstrate a more objective
analysis of the sufficiency of the evidence. If
you are missing evidence, go back over the
previous step and see if the evidence can be
located or generated.
www.powermag.com
The third step can require a lot of work,
as there may be dozens of documents to review.
Also, associating documents with Requirements
can be confusing, especially as a
single document may be referenced in several
different Requirements. The key is your
document map that cross-references Requirements
with the evidence.
When analyzing procedures and processes,
you should also review them for compliance.
Typically, one procedure will meet several
sub-requirements. Note the specific sections
that demonstrate compliance.
When you package your evidence, you
will need this information for the bookmarks.
Carefully consider the language in
your procedures. Words like " should, " " generally, "
and " typically " should be avoided.
Use " must " or " shall " instead. Look for clear
instructions and positive statements in your
documents. See if reviewers can understand
the document or if they need to ask for an
explanation, especially for a process or procedure.
If they need an explanation, then this
is a good time to rewrite the document to
provide clarity to show that it meets the requirement.
Doing this early gives you time to
update the document before your audit.
Review your definitions and look for any
cases where you do not use industry references
but redefine terms. If a term is in the
NERC glossary and you define it differently,
expect to be asked to defend your definition.
It is best to simply reference the NERC glossary
itself in your documents rather than repeat
the definition.
Step 4: Package Your Evidence
The fourth step requires you to take the raw
evidence (data) and package it into a format that
makes it easy for the auditor to verify compliance.
In most cases, the auditor will only want to
see a sample of your evidence, so make sure you
have internal procedures defined for extracting
those samples. Remember that searchable PDFs
are the form of evidence preferred by most auditors,
but other formats (such as Excel spreadsheets)
are acceptable.
The first step in packaging your evidence
is to create a folder for each Requirement.
You can also put the document reference in
the folder. This gives you a good place to
track your progress in preparing the evidence.
In this folder, create a copy of your files and
use the actual file names you will supply to
the auditors. This will allow you to leave
the originals untouched and available if you
need them. The first file in the folder should
be the RSAW. You will update the RSAW as
you package your evidence and decide what
should be directly referenced in the RSAW
and what will be held back until it is needed
or requested by the auditors.
POWER | April 2013
http://www.nerc http://www.bit.ly/ptjUG http://www.bit.ly/abVoyr http://www.bit.ly/12cXWHT http://www.rfirst.org http://www.midwestreliability.org http://bit http://www.npcc.org http://www.rfirst http://http:// http://www.bit.ly/GWSLfD http://www.bit.ly/UbJlJ2 http://www.texasre.org http://www.wecc.biz http://1.usa.gov/WHqJAS http://www.powermag.com
POWER April 2013

Table of Contents for the Digital Edition of POWER April 2013
