Energy and Utilities Industry

As we move forward to our first audit after migrating to SailPoint, we are being challenged to provide audit reports for NERC/CIP auditing. The challenge we are facing is combining Entitlement data with personnel data. I.e. Was an identity terminated from the entitlement group between x date and x date. This is from the NERC personnel tab.  Question: Have other utilities managed to generate NERC CIP reports in SailPoint 8.1-3 that do not require additional hours of manipulation or multiple reports that must be combines to meet the NERC requirements.  ... View more

Hello everyone, I'm looking forward to connecting here with other utilities who are using or are planning to deploy IdentityIQ and/or File Access Manager.  For those who don't know my background, I've been responsible for identity governance at SMUD (Sacramento Municipal Utility District) for nearly 20 years now.  I guess I would call myself something of an Identity Evangelist.  Talk about an identity journey, I've only recently (past 3-4 years) become more heavily involved with NERC CIP.  It was particularly challenging from the outset because of having my feet set firmly in the SailPoint space on the corporate side, and although not too many utilities were using IdentityIQ for NERC CIP just a short time ago, I knew IIQ could handle CIP-004.  Why the challenge?  Convincing my management and peers in compliance that IdentityIQ could handle it with flying colors.  They had nothing to compare it to, and it was a matter of leveraging the trust I'd build up over the years at SMUD to convince them it would work.  Fortunately, we had a small but strong technical team with good access to resources on the compliance side.  We got our compliance system in place almost 3 years ago now, and it has proven very successful. Frankly, one of the best rewards for me personally in getting our NERC CIP compliance IIQ instance up and running was the success we had with our tri-annual audit last year.  Executive level visibility can put you on edge, but that just made the teamwork and the months of preparation leading up all the sweeter a success.  I can't help but remember the SailPoint competitor telling me flat out that I was going to fail when SMUD picked IdentityIQ instead of their niche solution.  I appreciate the nudge.  ;) I've enjoyed meeting and talking to so many of you in the industry over the last few years, and if you've chosen to partner with SailPoint for your NERC CIP compliance needs, but haven't quite yet initiated your compliance journey, I'm always willing to lend an ear and pass along what advice I can.  For those of you in the trenches like me, I'd love to hear what challenges you've come across, and maybe how you've been able to meet those challenges with all the creativity and integration possibilities that SailPoint's product offerings enable.   All the best,   John Peters ... View more

Hello all, I have this unique requirement to decouple the aggregation and provisioning of OOB AD connector for managing access for critical resources. I just want to do the provisioning using OOB connector, but aggregation using a flat file. Has anyone done something similar or any thoughts how to approach this. I appreciate your feedback. Thanks, Mamta ... View more

Please join Andrew Brorsen of Cirrus Cybersecurity as he moderates a discussion with John Peters of Sacramento Municipal Utility District as well as other private & public utility organizations who will discuss how they are assessing and improving their compliance and security programs as well as regulatory compliance using identity management. https://goto.webcasts.com/starthere.jsp?ei=1424037&tp_key=2b763bf89e&sti=sail Review approaches to NERC Critical Infrastructure Standards that protect the bulk electric system from cyber-attacks including insider threats. Detail evaluation criteria that can be used to assess identity governance tools. Delineate drivers that led to implementing identify management to mitigate cyber risk. ... View more

For those interested, Sacramento Municipal Utility District did a case study on extending identity to manage sensitive files a couple of years ago. Although the case study was published in 2018, it is still very relevant today so I thought I'd link it here. It's only two pages and easy to digest for those who are interested. ... View more