Tom Alrich's Blog

In this post from early October, I mentioned (toward the end of the post) a conference I’d just attended outside of Washington DC, cal...

I have been working this year with two organizations that are getting ready for CIP compliance at the Medium impact level, as well as a...

I must admit that Las Vegas isn’t my favorite city. In fact, I don’t think it makes my top 100 or even top 500. Tha...

I have pointed out many times in this blog that by far the best coverage of cyber security issues in the energy industry is that p...

FERC approved CIP-013 this morning. You can find the press release here and the Order here . The only change they ordered was that E...

The first item on the just-released agenda for FERC’s monthly Sunshine Meeting this Thursday reads “RM17-13-000 Supply Chain Rise Man...

In a recent post , I pointed out that CIP-013 R1.1 is close to un-auditable. This is because it requires the entity to develop (and imple...