The NERC SCWG supply chain webinar recordings are up!

If you’re looking for today’s pandemic post, go to my new blog. If you’re looking for my cyber/NERC CIP posts, you’re come to the right place.

NERC put out an updated webinar announcement for the Supply Chain Working Group’s ongoing webinars on supply chain security risk management, which are being provided every Monday afternoon from 1-2 PM ET. The URL for the meeting is different from the original one, so it would be good to put this information on your calendar. No pre-registration is required.

The webinars so far have been very good. Fortunately, the recordings for the first three webinars are available now, at the URL’s shown below. I know Steve Brigg’s webinar last week was terrific, and the previous one was also pretty good, although I didn’t get to listen to the speaker very much (I'll have to listen to the recording to figure out what the guy said). I missed George Masters’ webinar (the first one), but I’m sure it was good, too. I’ll listen to that sooon, as well.

Wally Magda’s webinar this afternoon was excellent, but of course the recording isn’t available yet. You can check on the NERC web site to see if it’s up soon (and don’t even ask me to tell you how to find the white papers and webinar recordings on NERC’s site. I’m not smart enough to be able to explain complicated subjects like that).

My second webinar will be next Monday at the regular time, on the topic of Vendor Risk Management Lifecycle. I hope you’ll listen, and I hope you’ll ASK QUESTIONS. So far, nobody has asked a single question during the three webinars I’ve attended or presented, although questions did come in after the webinars ended. BTW, the answers to those questions will be compiled and issued as a FAQ or Papal Encyclical – something like that.

Update Webinar Announcement Supply Chain Working Group Security Guidelines for the Electricity Sector – Supply Chain When it's time, join your meeting here: Join Meeting Teleconference: 1-415-655-0002 | Access Code: 735 632 114

The Supply Chain Working Group (SCWG), part of the Reliability and Security Technical Committee (RSTC), is presenting a series of webinars to elaborate on security guidelines that address cyber security supply chain risk management issues. The hour-long webinars will broadcast weekly on Mondays at 1:00 p.m. Eastern, beginning on March 23, 2020. All webinars will be recorded and subsequently available on the Supply Chain Risk Mitigation Program page. No preregistration is necessary; click the link above to attend each webinar. Before and during each webinar, submit questions about the supply chain security guidelines to SCWGWebinars@nerc.net with “SCWG Webinars” in the subject line. Topic Team Lead Webinar (Mondays, 1:00 PM Eastern) Supply Chain and Risk Considerations for Open Source Software George Masters, Schweitzer Engineering Laboratory, Inc. March 23 Recording Supply Chain Cyber Security Risk Management Lifecycle Tom Alrich, Tom Alrich LLC March 30 Recording Vendor Identified Incident Response Measures Steven Briggs, TVA April 6 Recording Secure Equipment Delivery Wally Magda, Wallydotbiz, LLC April 13 Vendor Risk Management Lifecycle Tom Alrich, Tom Alrich LLC April 20 Procurement Language (under development) Dan Wagner, WECC April 27 Frequently Asked Questions: Small Group Advisory Sessions Brian Allen, NERC May 4 Provenance David Steven Jacoby, Boston Strategies International May 11 Risks Related to Cloud Service Providers Brenda Davis, CPS Energy May 18 Reliability guidelines are not binding norms or parameters that directly support compliance to NERC’s Reliability Standards, so their use is not monitored or enforced. While applying the recommendations from a guideline is highly encouraged and is expected to improve the security posture of an organization, their incorporation into industry practices is strictly voluntary.

Any opinions expressed in this blog post are strictly mine and are not necessarily shared by any of the clients of Tom Alrich LLC. If you would like to comment on what you have read here, I would love to hear from you. Please email me at tom@tomalrich.com. Are you working on your CIP-013 plan and you would like some help on it? Or would you like me to review what you’ve written so far and let you know what could be improved? Just drop me an email!