Moving NERC CIP evidence off spreadsheets: a practical migration plan

If your NERC CIP program lives in spreadsheets, shared folders and a calendar full of reminders, it can work. Many programs start that way, and a spreadsheet is a perfectly good place to think. The trouble starts when the spreadsheet becomes the evidence: the thing an auditor has to trust.

This post is a plan for moving a CIP program to a proper system of record without breaking what already works, and without losing the records you have built up. It is written mainly for low impact generation sites (solar, wind and battery storage). Sites that are BES facilities are under CIP, and CIP-002 usually rates them low impact. Category 2 inverter-based resources newly registered with NERC are not BES facilities and are not under CIP today.

What the spreadsheet is really holding

Before moving anything, write down what the spreadsheet is doing for you today. For a low impact program under CIP-003-9, it usually covers:

• The cyber security plan required by R2, organized around the sections of Attachment 1: security awareness, physical security, electronic access controls, incident response, Transient Cyber Assets and Removable Media, and vendor electronic remote access.
• Dates and intervals: security awareness reinforced at least once every 15 calendar months, and the incident response plan tested at least once every 36 calendar months.
• Evidence by asset: the site, not the device. CIP-003-9 notes that an inventory of low impact BES Cyber Systems is not required, so the records are organized around each asset that contains them.
• Pointers to evidence kept somewhere else: firewall exports, access logs, visitor sign-in sheets, training records, photos of locks and signs.

That last item is the important one. In most spreadsheet programs the spreadsheet is an index, and the real evidence is scattered across email, file shares and laptops.

Where spreadsheets get hard

None of these is a reason to panic. Each is a reason to plan.

• Intervals drift. A 15-month or 36-month clock is easy to miss when it lives in one person's calendar.
• "When was this made?" is hard to answer. A spreadsheet cell can be edited at any time, and the file's modified date only tells you about the last change.
• Evidence is collected late. Records rebuilt before an audit are much harder to defend than records captured as the work happened.
• Retention is long. CIP-003-9 asks you to keep evidence for three calendar years unless your Compliance Enforcement Authority asks for longer. That is a long time for a file share to stay tidy.
• Knowledge sits with one person. If the person who built the workbook leaves, the logic behind it often leaves too.

Step 1: map evidence to requirements and assets

Make one list: for each requirement section, and for each asset, what evidence proves it, where it lives today, who produces it and how often. Keep it plain. This list is the design for whatever you move to, and it is useful even if you never move.

Use the NERC Reliability Standard Audit Worksheet (RSAW) for the standard as a checklist, so the list follows the questions an auditor will actually ask.

Step 2: separate collected evidence from attestations

Evidence comes in two kinds:

• Collected evidence comes from systems: firewall rule exports, remote access logs, configuration snapshots, badge reader records. It can be gathered on a schedule.
• Attestations and decisions come from people: approving a plan, signing off an incident response test, deciding a vendor's access is still needed.

Automate the first kind. Keep a person responsible for the second, and make the system record who decided what and when.

Step 3: freeze what you already have

Do not retype old records into a new tool. Export them as they are, keep the originals read-only, and record when you exported them. If you can, take a cryptographic hash of each file so you can show later that it has not changed since the move.

Your three years of history is part of your compliance record. Moving it should not rewrite it.

Step 4: start collection where the evidence is generated

For a low impact site, the easiest wins are usually:

• Electronic access controls (Section 3): dated copies of the firewall or access-control rules, collected on a schedule, so a change shows up next to the rule it changed.
• Vendor electronic remote access (Section 6): a log of each vendor session (who, when, to what, and when it was switched off), kept by you rather than by the vendor.
• Reminders on the real intervals: awareness every 15 calendar months, incident response test every 36 calendar months, with the evidence attached to the reminder when it is done.

If you also have medium impact BES Cyber Systems, for example at a control center, the requirements there are device-level and include configuration baselines and patching. That is where automated collection saves the most work, and also where a mistake costs the most, so migrate it after the low impact program is settled.

Step 5: run both for one cycle

Keep the spreadsheet running alongside the new system for one full cycle of your shortest interval, or one internal review. Compare the two. Where they disagree, find out why before you retire the spreadsheet. A difference is either a gap in the old process or a gap in the new one, and both are worth knowing about before an auditor finds them.

What not to automate

• CIP-002 impact ratings. These are engineering judgments about your assets. A tool can hold the reasoning, but a person should own the decision.
• The plan itself. A tool can store the CIP-003-9 plan section by section; it cannot decide what your physical security or vendor access controls should be.
• Approvals. Automation should make approvals faster to find, not skip them.

A short checklist

• Evidence list by requirement section and by asset
• Each item tagged "collected" or "attested"
• Old records exported, read-only, dated (and hashed, if you can)
• Collection running for access rules and vendor sessions
• Interval reminders with evidence attached
• One cycle in parallel, differences explained
• Spreadsheet retired, and kept read-only as history