Regional Entities send a compliance audit notice at least 90 days before the audit. That notice lists the standards in scope, the audit period and the initial Requests for Information (RFIs). Ninety days sounds like a lot until you start chasing evidence from three years ago. Here is a plan.
Days 1–10: scope and organize
- Read the notice carefully. Note the audit period, the standards and requirements in scope, the RFI due dates and whether the audit is onsite or remote.
- Name owners. Assign one subject matter expert (SME) per standard and one coordinator for the whole audit.
- Pull the RSAWs. The Reliability Standard Audit Worksheets for each standard show exactly what auditors will test. Fill in the narrative sections early.
- Build the evidence index. One row per requirement part: evidence file names, dates covered, owner and status.
Days 11–40: gather and test evidence
- Sample like an auditor. For each periodic requirement, pull evidence for the whole audit period: every 15-month approval, every quarterly access verification, every 35-day patch evaluation.
- Check the dates. Line up consecutive dates and look for gaps longer than the allowed interval. This is where most findings come from.
- Check populations. Auditors ask for lists (all personnel with access, all BES Cyber Assets, all changes) and then sample from them. Make sure your lists are complete and consistent across standards.
- Trace a few items end to end. Pick a person, an asset and a change and follow them through every standard. Do CIP-004 access, CIP-006 badge lists and CIP-007 accounts agree?
Days 41–60: close gaps honestly
If you find a possible violation, don’t hide it. Talk to your compliance and legal leads about self-reporting or self-logging through your Regional Entity’s process. Self-identified issues with prompt mitigation are treated far better than issues found by auditors. Meanwhile, fix the underlying process so the gap doesn’t recur.
Days 61–80: prepare people
- Brief each SME on the RSAW, the evidence and likely follow-up questions.
- Rehearse. Run a mock interview: “Walk me through how a change to this RTU is authorized.” Answers should match the documented process.
- Plan logistics. Evidence sharing method (Regional Entities provide secure portals), rooms, network diagrams ready to present, and who attends which sessions.
Days 81–90: submit and stay calm
Submit RFI responses on time, clearly labeled and indexed to requirement parts. Keep a log of every request and response during the audit. After the audit, capture lessons learned while they’re fresh.
The real lesson
Audit preparation is easy when evidence is created as the work happens and stored against the requirement it proves. It is painful when evidence has to be reconstructed. The best time to prepare for your next audit is the day after this one ends.
Want a quick read on where you stand? Take the free NERC CIP audit readiness self-assessment. CIP Sentry’s Audit Center keeps a requirement catalog, evidence vault, audit trail and 51 ready-made reports in one place. Request a quote.