NERC publishes a monthly Key Compliance Trends presentation that has interesting statistical detail on NERC violations, about half of the violations are CIP. This is actually good, detailed info that someone who is immersed in the NERC CIP could really use to track the program and draw some data-based conclusions.
Here are some of the key data points from the February data:
- The trend is about 100 new CIP violations per month. If the number of auditors and audits, as well as the audit procedure, are consistent then this is a useful statistic to track.
- Over half of the violations have not yet been mitigated / fixed. NERC suggests the regions re-evaluate if the mitigation plans are aggressive enough. The six month average time to mitigate is 274 days, but only half of these items are CIP violations.
- NERC is still seeing more new violations than those processed. So the backlog is increasing. The new “Administrative Action Process” is designed to address this.
- In the last year CIP-7 and CIP-4 had the most violations.
Image by torugatoru