How much of your IT can a customer see? An IT compliance audit of a contractor can begin as a short list of security questions from a utility. The thinking behind those questions comes from rules the power company itself has to follow.
NERC sets standards for the North American power grid. The companies it covers must document how they manage supply chain risk, and that’s where the questions start. Before work starts, those answers shape how much trust a contractor earns.
What Does a Utility Customer Want to Know About Your IT?
Four areas draw most of the attention from customers. Each one mirrors a NERC rule or a piece of its guidance, so a plain question sits behind every single area. They cover who has access and when it ends, plus how you protect logins. Then come remote connections and incident notifications. A customer asks all of this to decide how far it can trust an outside company with a login to its systems. Your answers reveal how the business operates day to day.
Where Do a Utility’s Questions Come From?
The standard behind them, NERC’s CIP-013, binds the utility and reaches a contractor through contract terms and questionnaires. It requires covered power companies to document a plan for managing supply chain risk. The plan has to cover six items in how they buy. In plain terms, the six items are:
- Vendor notice of incidents that put the utility at risk
- Coordinated responses to those incidents
- Vendor notice when a representative should lose remote or onsite access
- Disclosure of known weaknesses in the products and services provided
- Verification that software and patches are genuine and unaltered
- Coordinated controls on remote sessions that vendors start
NERC’s own rationale limits the word vendor to organizations contracted to supply the digital systems that run the grid. Related services count as well. Manufacturers, resellers, and system integrators can qualify, so a line or civil contractor may fall outside that definition. Whether a contractor counts depends on its contract. A questionnaire that does reach you may follow those six items closely. For that reason, the list makes a useful guide to what you should prepare.
The standard is being revised after FERC directed NERC to update its supply chain rules. Contractors on defense work will know the pattern, since CMMC requirements reach subcontractors through contract terms too.
How Do You Grant and End Access to Customer Systems?
One of the six items covers departures. It asks for notice when one of your representatives should no longer have remote or onsite access. That puts a direct question to you. When someone on your team leaves, changes roles, or finishes a job, how does the power company find out? A current inventory of everyone with a login, tied to whoever approved it, makes that straightforward to answer. In the week someone leaves, update it so the record matches the people working on site. The item covers onsite access too, which reaches beyond IT.
Whose MFA Does the Utility Mean?
Two separate sources touch multi-factor logins, and they sit on opposite sides of the same connection. One is a requirement, and the other is guidance. MFA stands for multi-factor authentication. It requires a second proof of identity beyond a password, such as a code from a phone.
MFA on the Utility’s Side
CIP-005 sets a requirement for multi-factor authentication on interactive remote sessions into the covered grid equipment. The rule applies where technically feasible. The duty sits with the utility, so your login runs into a second step on the way in.
MFA on Your Own Accounts
NERC’s Vendor Risk Management Lifecycle guideline says utilities should ask vendors how they protect remote access. The guideline says a company without MFA should verbally set a date for adding it. That date goes into the next contract revision. NERC states that its guidelines aren’t Reliability Standards and don’t bind anyone, which makes this guidance. No rule applies to you because of it. Even so, your own logins can come up in conversation. The guideline also gives an example of what to check once a provider agrees. It’s a policy to notify the buyer when it terminates an employee who has access.
How Do You Control Remote Access for Subcontractors?
The utility has to keep a way to see a vendor’s live session and a way to shut it down. When subcontractors connect through you, the questions come down to who can see a session and end it. CIP-005 requires both methods for the systems in scope. CIP-013 adds an item on coordinated controls when vendors start a connection to the systems in scope.
When Do You Tell the Utility About an Incident?
Two of the six items cover security events. One covers notice when a provider spots an incident that puts the utility at risk. The other covers coordinated responses to that incident. Neither item sets a deadline, so any clock for you would come from the contract or the questionnaire. The items reach only incidents tied to what you supply. A problem in an unrelated part of your organization falls outside their wording. Before anybody asks, settle who decides that something counts as an incident and who makes the call. With a short note naming that person, the call is less likely to slip.
How Can You Check Your Own Answers Before the Review?
Seven questions cover all four areas, and each yes should come with a record you could show on request.
- Do you keep a current list of everyone on your team who holds a login to a customer’s systems?
- When someone leaves or changes roles, who tells the customer, and how soon?
- Does every account that reaches those systems ask for a second proof of identity?
- Which outside people connect through your company, and who approved each one?
- Can you see when a session is active, and can someone end it?
- Who decides that something counts as an incident, and who makes the call?
- Could you point to a record behind each of your answers?
As you go, write each answer down. FERC chose not to require validation of vendor data but encouraged it voluntarily. So a customer may ask what sits behind a yes. These questions don’t score your company, and each buyer sets its own standard. Contractors who also handle defense contracts can run a comparable check for CMMC and NIST 800-171 readiness.
Talking Through Your Answers With Our Team
Documentation behind each yes beats a quick answer. We help contractors read what a buyer is asking and find the gaps in their own setup. You can talk through your answers with our team whenever a second set of eyes would help.
