Getting ready for a Regional Entity CIP audit or other monitoring engagement: the notification timeline, the Evidence Request Tool, the audit period and evidence retention, Spot Checks and Self-Certifications, and how internal controls shape scope.
What to do between the 270-day audit notice and fieldwork: confirming scope, preparing Evidence Request Tool responses, covering the whole audit period, checking evidence against retention rules and vetting the audit team.
How the CIP Evidence Request Tool works: Level 1 detail tabs that become sampling populations, general program requests, Level 2 implementation evidence for sampled items, request IDs, and the submission schedule set by the audit notification letter.
Which evidence a CIP audit can ask for and how far back: the audit period that starts after the last audit, three-year retention in most standards, shorter retention for logs, and what to do when retention is shorter than the audit period.
How CIP Spot Checks, Self-Certifications and unscheduled audits work: notice periods, allowed responses, team disclosure and on-site review, and why a notification letter ends self-reporting credit for in-scope requirements.
How internal controls change a CIP compliance relationship: Inherent Risk Assessments and controls that tailor audit scope, eligibility for self-logging after a formal controls review, and penalty credit for an effective compliance program.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.