NERC CIP Reporting

[JeffreyBMarquez]

As we move forward to our first audit after migrating to SailPoint, we are being challenged to provide audit reports for NERC/CIP auditing. The challenge we are facing is combining Entitlement data with personnel data. I.e. Was an identity terminated from the entitlement group between x date and x date. This is from the NERC personnel tab. 

Question: Have other utilities managed to generate NERC CIP reports in SailPoint 8.1-3 that do not require additional hours of manipulation or multiple reports that must be combines to meet the NERC requirements. 

[phodgdon]

We offer an audit history plugin that may be of help. In 8.4 they also introduced access history. Let me know if you would like more information.

[JeffreyBMarquez]

Yes, is there documentation I can review?

[JeffreyBMarquez]

We will be moving to 8.4 in the future, however, the audit history in 8.3p3 could help us get over the hump. We are working with Sushil, Tony Ly, and Eli Anderson on the current 8.3 reporting issue and the 8.4 redesign. I would like to have this information to pass along in our discussions. 

[LynnBales]

Hi Jeffrey,

Since we are role based for NERC CIP, there were several reports that we needed. We required our integrator to create custom reporting which STILL requires manipulation and combining several reports to show complete evidence. We are on 8.2P6 and have a project started to move to 8.4 next year. Hoping for completion by mid-year. We'd be happy to discuss further. I have a SME on my team who worked through all the requirements with the report creators.

I'd also like to let you know we are kicking off a user's forum in January and I just posted about that. Please let me know if you are interested in joining us.

Lynn