NERC CIP audit evidence management that finds the gaps before the auditor does
Audit binders built continuously, not in a 30-day scramble.
See one case, screen by screen ↓A Medium Impact entity has to prove it met each CIP requirement across a three-year audit period. The evidence is produced all the time — a patch evaluation every 35 days, a log review every 15 days, an access verification every quarter, tests and reviews every 15 calendar months — and each record lands in a different system: the patch tracker, change tickets, the identity directory, log monitoring, badge access, the training system. Then the notification letter arrives with the RSAWs and the request for information, and the CIP team spends weeks pulling screenshots, exports and signed reviews into folders arranged by requirement.
The failures are rarely missing controls. They are missing proof: a firmware install done in an outage whose work order was never attached, a quarterly review done but not signed, a tabletop held without an after-action record. Nobody reads the evidence against the requirement's own words until the mock audit or the auditor does. Found then, each gap is a possible violation. Found the day after its clock runs out, it is a request to an asset owner.
Estimated split per requirement tab, in hours, by hand and with the solution — about 60 hours each across 39 requirements in the last audit cycle, to be measured in the pilot.
Six agents file and read every record against the requirement's own words, name each gap and draft the request; the compliance manager sends it and the CIP Senior Manager signs.
Lumina Utilities is 13 days from its RSAW and evidence submission to the Meridian Reliability Council, with the on-site week on 9–13 November. The audit period runs 1 Oct 2023 – 30 Sep 2026 and covers 8 sites and 240 Cyber Assets. Here is Tuesday 13 October, screen by screen, in the working solution.
Thirty-nine divider tabs run down the left, grouped by standard from CIP-002-5.1a to CIP-013-2: 29 complete, 7 partial, 3 missing, readiness 89 % with 94 of 106 checks met. CIP-007-6 R2, Security patch management, is open and stamped Partial — 7 of 8 checks met. The requirement is printed in its own words, every testable phrase underlined and numbered, and one phrase is underlined in red and stamped “no record found”.
Part 2.3 · “within 35 calendar days of the evaluation completion” — no record found
The requirement reader read R2 as eight checks, one per phrase. The evidence collector filed 212 items from the document library, patch tracker and change tickets, each hashed. The checker's table shows what the auditor will test: 23 patch sources cover all 240 Cyber Assets, 34 evaluation cycles with a longest interval of 34 days, 409 patches applied within 35 days and two dated mitigation plans.
“411 of 412 applicable patches have an action within 35 days.”
E-2204, the patch tracker's evaluation record for cycle 2026-08, dated 4 Aug 2026: 61 patches released, 14 applicable, all 23 sources evaluated, signed by Priyanka Iyer. It meets part 2.2. It also shows gateway firmware 4.2.7 as applicable to KH-RTUGW-01 and -02, with an action due by 8 Sep 2026.
Never counts an unsigned or undated item.
The gap finder names exactly what is missing: the install record for gateway firmware 4.2.7 on the two Kestrel Hill RTU gateways, or a dated mitigation plan, dated on or before 8 Sep 2026. On the obligation clocks, the September square for patch action after evaluation is red: action due 8 Sep 2026, no record.
The gap finder never decides whether a gap is a violation — the compliance manager and the CIP Senior Manager decide on any self-report.
R-127 goes to Tomas Ferreira, Substation Automation Lead, quoting the phrase, the record wanted and the assets, due Fri 16 Oct once sent. It sits in the Drafted column beside the requests already out: an exercise log 5 days overdue, a relay destruction certificate 1 day overdue, a training record for one person.
The request drafter never sends a request — a person sends.
Mariana sends R-127 from the tab. Tomas answers the same day with work order WO-58231 from the field work system: firmware 4.2.6 to 4.2.7 installed on both gateways on 2 Sep 2026, during a planned Kestrel Hill outage, SCADA polls restored with no alarms, baseline updated on 3 Sep.
“Reply Tue 13 Oct: Work order WO-58231 (installed 2 Sep 2026)”
The checker reads WO-58231 against part 2.3: installed 29 days after evaluation, so 412 of 412 applicable patches now have an action within 35 days. The tab turns Complete, 8 of 8, and readiness moves to 90 % — 95 of 106 checks.
“Every phrase is met. The evidence covers the audit period 1 Oct 2023 – 30 Sep 2026.”
The RSAW narrative writer drafts the entity response part by part, citing E-2201 to E-2207: procedure LU-CIP-007-02 rev 6, 23 sources for 240 Cyber Assets, 34 cycles. Before the reply was checked, the Kestrel Hill sentence was marked in red as not yet evidenced, naming R-127. Priyanka accepts the narrative as SME, edits it or exports the RSAW.
“Request R-127 is with the asset owner; this paragraph is completed when the record is checked.”
Pre-audit readiness lists the eleven checks still open, each with its owner and request: the Wren Halvorsen training record with Hannah Brookes, the Saltmarsh visitor exit times with Luis Montague, the Marlow Fen vulnerability assessment with Owen Sato. When every open request is answered and checked, the binder reaches 106 of 106.
“When every open request is answered and checked: 106 of 106.”
Gideon signs the submission with the eleven open checks and their requests listed. The submission package freezes 1,284 items at their filed version, each with its SHA-256, and indexes 39 RSAW narratives by standard, requirement and part.
“Signed by Gideon Walsh, CIP Senior Manager … with 11 open checks and their requests listed”
The same binder, seen by the four people who answer for it — what audit season looked like, and what it looks like now.
Six agents file and read every record against the requirement's own words, name each gap and draft the request; the compliance manager sends it and the CIP Senior Manager signs.
Turns each RSAW requirement into testable checks, one per phrase: the clock, the scope, the sign-off, the record. On CIP-007-6 R2 it reads eight checks.
Pulls exports nightly from ten source systems — patch tracker, change tickets, configuration monitor, identity directory, log monitoring, badge access, training, firewall manager, field work and the document library — hashes each item with SHA-256 and files it to its tabs.
Reads each item against the exact phrase it must meet: the clock to the day, the scope against the asset inventory, the signature against the approver register, and coverage of the whole audit period. Every verdict cites the item and the fact.
Names, for each unmet phrase, the record that is missing, for which assets and dates, and who owns it.
Finds the owner of the asset or process and drafts a short request quoting the phrase, the record wanted, the assets and a due date three working days out, before the submission date.
Drafts the RSAW narrative part by part in plain, factual sentences, citing each evidence item by its ID, and marks any part not yet evidenced with its request.
Signs the submission and any self-report decision. The agents propose; a named person decides.
Ask in plain words — every answer cites the evidence item. A change to an evidence rule is saved as a draft for the CIP Senior Manager to approve.
Which tabs would the auditor find a gap in today?
Ten tabs have open checks; three have their core evidence missing: CIP-008 R2 — the 18 Jun 2026 exercise has attendance but no exercise records; CIP-010 R3 — the Marlow Fen vulnerability assessment was due by 20 Aug 2026; CIP-011 R2 — no destruction record for 3 retired Brackenford relays. Every open check has an owner and a request.
Why is CIP-007 R2 only partial?
Seven of eight checks are met. The missing one is part 2.3: gateway firmware 4.2.7 for KH-RTUGW-01 and -02 was evaluated as applicable on 4 Aug 2026, so an action was due by 8 Sep 2026, and the patch action report shows no install record or mitigation plan for it. Request R-127 to Tomas Ferreira is drafted.
When is the next 35-day patch evaluation due?
By Tue 3 Nov 2026 — the last cycle was completed on 29 Sep 2026. The actions for the 9 applicable patches from that cycle are due the same day. In the audit period there were 34 cycles and the longest interval was 34 days.
Send the CIP-007 R2 request to Tomas
Sent: R-127 to Tomas Ferreira, due Fri 16 Oct. It asks for the install record for gateway firmware 4.2.7 on KH-RTUGW-01 and -02, or a dated mitigation plan, dated on or before 8 Sep 2026. When the reply comes, the checker reads it against part 2.3 before it counts.
13 screens from the working solution, on its sample data. Pick one to see it large.
The audit dates, the evidence rules, the clock warnings and the approvers are settings — and changes are saved as drafts for the CIP Senior Manager's approval.
| Setting | Default | Choose from |
|---|---|---|
| Audit in scope | Meridian Reliability Council · 1 Oct 2023 – 30 Sep 2026 | Regional entity, lead auditor, notification letter, submission date, on-site week, audit period · 8 sites, 240 Cyber Assets, 39 requirements |
| Screenshots must show the system name, date and time | On | On · Off |
| Signed records need a named approver | On | On · Off |
| Unsigned or undated items never count | On | On · Off |
| Freeze every item with a SHA-256 hash at submission | On | On · Off |
| Accept evidence from personal email | Off | On · Off |
| Clock warnings | 7 days ahead for 35-day clocks · 3 for 15-day · 14 for quarterly · 60 for 15-month | Set per clock |
| Requests | Due 3 working days after sending | Remind after 2 · escalate to the CIP Senior Manager when overdue |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample audit data · “target” = the design goal, measured in the pilot · “estimated” = our estimate: ≈ $270k = 39 requirements × ≈ 60 h from the last audit cycle (≈ 2,300 h), ≈ 1,800 h avoided at a blended $150/h for staff and consultant mock-audit time; the hours split by task is estimated the same way · “typical” = published figures (SecurityWeek and Utility Dive, 2019 settlement of 127 CIP violations for $10M; Relia Magazine CIP guide, ≈ $379k to stand up a Medium Impact programme). Regulatory context: NERC CIP-002 to CIP-013 requirement text (CIP-007-6 R2: patch evaluation at least once every 35 calendar days, action within 35 calendar days of the evaluation). Lumina Utilities, the Meridian Reliability Council, their sites, assets and records, and the people named on this page are fictional — characters and sample data in the working solution.
Software that keeps the evidence for every CIP requirement in one binder, filed as it is produced, so a Medium Impact entity can show the regional entity it met each requirement across the audit period. NERC CIP Audit Evidence Management adds six agents that read each record against the requirement's own words, name each gap and draft the request and the RSAW narrative — people send, accept and sign.
The requirement reader turns each requirement into one check per testable phrase — the clock, the scope, the sign-off, the record. The evidence checker then reads each item against its phrase: the date to the day, the assets in scope, the signature and coverage of the audit period. On CIP-007-6 R2 that is eight checks, each with its evidence and a verdict.
The binder is checked every night, and the obligation clocks show every 35-day, 15-day, quarterly and 15-month occurrence for the audit period. A miss shows the day after its clock runs out, not at the audit. In the sample binder, the Kestrel Hill gateway firmware action due 8 Sep 2026 shows as missed, with a request drafted to the asset owner.
No. The evidence collector is read-only on all ten sources — patch tracker, change tickets, configuration monitor, identity directory, log monitoring, badge access, training, firewall manager, field work and the document library. Every item is hashed with SHA-256 when it is filed and frozen at its filed version when the submission package is built.
No. The gap finder names what is missing, for which assets and dates; it never judges a possible violation. The compliance manager and the CIP Senior Manager decide on any self-report.
Yes. Agents draft requests and narratives and never send or sign. The compliance manager sends requests and accepts evidence, each SME accepts the narrative for their requirement, internal audit samples evidence before submission, and the CIP Senior Manager signs. Changes to evidence rules are drafts until the CIP Senior Manager approves them.
Yes. The audit dates and scope, the evidence rules (screenshots with system name, date and time; named approvers; whole-period coverage; hashing at submission; personal email), the warning days for each clock, the request due date, reminders and escalation, and the approvers are all settings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your RSAWs, CIP procedures, source system exports and prior audit results — and it goes live once every quality gate has passed. We will walk you through it on the evidence from your last audit first.
Every supplier answer checked against its evidence before you sign.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoICS Vulnerability ManagementWhich advisories affect our substations? Answered today.
1-min demoWe'll run NERC CIP Audit Evidence Management on the RSAWs and evidence from your last audit.