"AVAILABLE COMPLIANCE MANAGEMENT SYSTEMS The TOP 10 Ways the Industry can improve their CompliancePrograms. These are:# 10 ?Not performing a comprehensive Gap Analysis on all at risk assets and functions?# 9 ?Delaying Self-Reports in effort to fix the problem before you are audited.?# 8 ?Owning and Operating a multi-functional electric power organization without a dedicatedCompliance Manager# 6 ?Purchasing a compliance management system before determining compliance workflowactivities?# 5 ?Determining that market systems are not critical cyber assets?# 4 ?Defining electronic security perimeter without security for each external interactive accesssession?# 3Implementing a background check policy without determining what constitutes a failedbackground check# 2 Sharing assets and facilities with other NERC entities without a joint registration or operatingagreement in place.# 1 Allowing utilities to determine their own Risk-based methodology for determining criticalassets.• Critical Cyber Methodology7 • Critical Cyber Asset Methodology• Organizational Challenges• Should Compliance be performed by current operational departments or shouldCompliance Activities be managed centrally.• Each organization should have a dedicate Compliance Manager that manages allcommunication the NERC entities• Compliance Manager should be high enough in the organization to stimulate a change inoperational practices.• Developing Compliance Documentation• Compliance Management Systems• Things to Remember1. The are many Vendors that make tools to help automate compliance2.2. The most important ingredient is defining how you want to use thesystem. Determine the following…• Business rules and workflow tools vs. document management• Organizational structure of compliance…who will use the system• Cost (system, on-going, updates, work-flow changes)• General Technical Requirements• Web Interface8 ? Interfaces:– Maintenance & Testing Systems Database– SCADA Operator Logs– Vegetation Management– Voice Logs– Sequence of Event Recorder, DMEs, – Work Order Management/Maintenance ? RECOMMENDED MANAGEMENTSYSTEMStandard Compliance management systems— Guidelines AS ISO 19600:2015 has beenpublished and supersedes AS 3806—2006, Compliance programs. The objective of the Standardis to provide guidance for establishing, developing, implementing, evaluating, maintaining andimproving an effective and responsive compliance management system within an organisation.The Standard expressly links an organisation’s compliance system to good governance, riskmanagement and leadership.Significantly, the Standard states:The organisation should establish, develop, implement, evaluate, maintain and continuallyimprove a compliance management system, including the processes needed and their9 "