POWER October 2016 - 42

REGULATORY COMPLIANCE
Is an Automated Compliance
Tracking Solution Right for You?
Like so many other power plant functions these days, regulatory and standards
compliance can be automated. Know what you want an automated system
to do before you make a vendor decision.
Mark Gollini
A
s North American Electric Reliability
Corp. (NERC) Critical Infrastructure
Protection (CIP) enforcement deadlines
and audit dates loom-notably, CIP003-6
in April 2017, which addresses the
development and implementation of cyber
security policies, procedures, processes and
plans-each " responsible entity " faces the
daunting task of ensuring compliance and
maintaining evidence of that compliance.
Transparency is critical: Compliance teams
must not only meet deadlines but also ensure
that their efforts are auditable. This requires
considerable attention to organizing, maintaining,
and revising evidence (Figure 1).
Often this task falls in the laps of multiple
employees, each of whom has additional responsibilities
outside of compliance. Using
the traditional hands-on approach, compliance
involves spreadsheets, databases, digital
documents, binders of paper, and various
calendaring techniques. While these " manual "
processes have gotten the job done for
years, they eat up numerous labor hours and
pose a number of other pitfalls. This reality
has compliance managers asking, " What if
we could automate our processes and have
a central repository for reporting and auditing-and
would the benefits of an automated
tracking system justify the costs? "
Before you jump on the bandwagon, it's
best to gather your team, weigh the options,
and cover the due diligence.
What an Automated Compliance
Solution Offers
More than a few vendors offer automated solutions,
some with more functionalities than
others. Typical functions include:
■ Creation of Reliability Standards Audit
Worksheets (RSAWs) that are routed
among subject matter experts (Figure 2).
■ Creation of actionable workflows that
are routed to appropriate employees and
programmed to launch by either a date
or an event.
■ Escalation to management of workflows not
completed within allotted timeframes.
42
www.powermag.com
POWER | October 2016
■ Document management, including revisions
and review/approval cycles (Figure 3).
■ Asset management.
■ Access management.
■ Change control management.
■ Training and testing.
■ Reporting of selected documents and evidence
for audits.
■ Custom application programming interface
(API) integration into control network
tools.
Note that, although the software images
shown in this article are from Qualtrax, other
vendors offer the same or similar functions.
Here are six widely used out-of-the-box solution
providers:
■ 360factors-http://www.360factors.com
■ AssurX-http://www.assurx.com
■ GenSuite-http://www.gensuite.com
■ MetricStream-http://www.metricstream.
com
■ Qualtrax-https://www.qualtrax.com
■ SigmaFlow-http://www.sigmaflow.com
Determining Real Costs and
Benefits
A compliance tracking system can range from
$30,000 to well into six figures, depending
on implementation and functionality. Some
tools address NERC compliance specifically,
while others can be used enterprise-wide. In
addition to purchasing the tool itself, you'll
need to factor in costs for training employees,
loading your current evidence and documents,
and customizing the tool.
As for the benefits, you'll realize them primarily
over the long-term use of the system.
A resource determination for maintenance
of a standard NERC Reliability Compliance
Program showed that a compliance solution
could directly save an entity the equivalent of
up to 2.5 full-time employees. It could also
save indirectly on potential fines you'll avoid
by having an auditable trail for every notification,
revision, change, upload, and action
within the system.
1. The case for simplification. Automated tracking systems eliminate countless laborhours
and many of the pitfalls associated with ensuring compliance and maintaining evidence
of that compliance. A document tree assembles documents in a single repository for easy
management. Courtesy: Qualtrax
http://www.powermag.com
POWER October 2016

Table of Contents for the Digital Edition of POWER October 2016
