The effect of North American Electric Reliability Corporation critical infrastructure protection standards on bulk electric system reliability

Compliance with regulations may not automatically produce a secure infrastructure. In the United States energy critical infrastructure sector, compliance with regulatory cyber security standards may not necessarily mean that an entity would be able to withstand a cyber attack on critical assets potentially supporting the reliability of the Bulk Electric System (BES). This qualitative exploratory inquiry study researched technical opinions of cyber security professionals in the energy critical infrastructure industry regarding the effect of the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards on the reliability of the BES. NERC entities had been required to be compliant with the standards for several years at the time this study was undertaken. There has been speculation regarding the efficacy of the standards to impact the reliability of the BES. However, there was a lack of scholarly or professional literature confirming assumptions concerning BES reliability. In this study, data was gathered through interviews with individuals who were CIP implementation experts. The purpose of this study was to identify a theme or themes regarding changes in the reliability of the BES as a result of the NERC CIP standards implementation. Interview data from the study generated 9 themes including a theme for the research question indicating that reliability of the BES had improved as a result of the implementation and enforcement of the CIP standards. Some of the more prominent themes included NERC fines having influenced entities in the implementation of the standards; entities have been more concerned about CIP compliance than securing their equipment; and entities have removed equipment from their facilities in order to avoid the requirements, and the associated expense, the standards would demand.