Restraining Investments in Reliability
Tobias Whitney is the CEO of Cumulys, his cybersecurity software and energy services business. Early in his twenty-five-year career, at PwC, Tobias learned through system security auditing and penetration testing to build an understanding of how vulnerable operational systems are to cyberattacks. As leader of the CIP Standards & Compliance at NERC, Tobias broadened his capabilities in regulatory policy.
Cybersecurity regulation impacts nearly every aspect of an energy company’s operations and today’s senior leaders need to be prepared to successfully navigate these challenges. Due to the increasing number and complexity of cyber regulations, it is becoming more complicated than ever to plan for major innovative investments in grid technology.
There is a high risk of investing in solutions that appear viable in terms of business or operational value but ultimately may have to be scrapped due to unclear cybersecurity mandates. Most notably, the uncertainty in how to leverage off-prem cloud technology and service providers is causing asset owners and innovators to pause their plans to add value to the future of the power grid.
There are numerous services today that almost exclusively use cloud infrastructure to function. Today’s authentication services, ticket and change management services, and backup operational capabilities all utilize off-prem technology. While nearly all organizations now use the cloud, today’s regulated utilities are not able to maximize the use of these technologies due to the lack of clarity within the NERC CIP standards and NERC’s Rules of Procedure.
While the CIP standards do not explicitly disapprove of the use of cloud technology for grid-related operations, it is very unclear how a Registered Entity shall use the technology and how service providers can provide value in a transparent and compliant manner.