Tom Alrich's Blog

Note: This post originally started out to be part II of II on lessons learned so far from the CIP-014 experience – that post covered the...

I was recently surprised to be caught in what appears to be an unannounced RIF at my former employer. While losing a job isn’t exactly n...

As usual, NERC’s annual GridSecCon conference, which was held last week in beautiful St. Paul, Minnesota, was a great success. Every year...

I have recently been wondering how CIP-013 will be enforced, since this is a non-prescriptive, objectives-based standard. I recently conc...

Once again, Lew Folkerth of RF has written a very good article about CIP. This time, it's about the meaning of the phrase (which I hadn...

I have more than a few times talked with someone from a large utility who assures me “We really believe in cyber security. We don’t need ...

In early 2014, soon after FERC had approved CIP version 5, a lot of people in the industry (including me) started taking a serious look a...