You should assume the CIP-013 date will be pushed back

If you want to see my post today on the pandemic, go here. And I recommend you do! It’s disturbing, but people need to be very disturbed by the pandemic – not just as a group but individually.

Last Thursday, I posted that NERC should push back the CIP-013 compliance date to October 1. I haven’t heard anything more about that idea, but I was told yesterday that NERC is considering relaxing the 15-month requirements in the other CIP standards; this probably won’t be far behind.

So I’m sure the CIP-013 date will be pushed back, but I don’t think any staff member at a NERC entity should be working on CIP-013 unless they’re not needed to keep the lights on or help the entity prepare for the full onslaught of the virus, which will be in 2-3 weeks (and the beginning of total Covid-19-related deaths so far in the high hundreds, if not thousands). And also to be prepared for the certainty (in my opinion) of a national lockdown next week, or at the very latest the following week (as I said in my pandemic post today – see above for the link – the national lockdown should start tomorrow, since every day it’s delayed will almost certainly end up costing hundreds and likely thousands of lives). Of course, if all non-essential employees at your employer haven’t already been told to work from home, you need to go bang on somebody’s desk and demand this. Today, not tomorrow.

But what if NERC (or FERC) still doesn’t agree with pushing the date back, and CIP-013 compliance is actually enforced starting July 1? And if they don't agree, what are the chances that an auditor a couple years from now will give you a PNC for not being fully compliant on that date? And if the auditor does this, what are the chances it’s upheld?

In my opinion, the chances of the above all happening are very small now, but with each week they will be smaller, so that in a month they’ll be indistinguishable from zero. I say this because of two words: exponential growth. And if you wonder what I mean by that, see today’s pandemic post.

Note on 3/18: Literally 15 minutes after I put up this post, NERC sent out an announcement saying that entities need to inform their Regional Entities if they won't be able to comply with any periodic requirements (not just CIP) between now and July 31. And they said any on-site audits, etc. will all be postponed until July 1 (that will be a moot point soon, since I think all utilities will send all non-essential staff to work from home by next week, and I expect the entire air travel system, foreign and domestic, will be shut down for at least a couple weeks - along with a lockdown for the entire US population. Again, see today's pandemic post).

Any opinions expressed in this blog post are strictly mine and are not necessarily shared by any of the clients of Tom Alrich LLC.