NERC CIP
US
3 source references
8 mapped control areas
Sovereign region
About this template
A registered entity on the bulk electric system works under audited reliability standards. An assistant near operational technology creates a new path toward equipment that must never move without authority. This starter closes the obvious paths and supplies evidence inputs for a compliance review.
Operational technology raises the cost of a wrong answer. A compliance owner needs assurance before an engineer asks a model about a live system. The controls below are deliberately blunt for that reason.
A facility claim is required with the user and organization claims, so a request is tied to a site. Operator and badge numbers, vendor contacts and reporter names are masked. Prompts that carry supervisory control configuration, a facility blueprint or controller ladder logic are blocked.
Tool access is the tightest part of this starter. Runbook search, ticket creation and status checks are allowed. Shell access, network scanning, controller writes and valve control are denied, and a session may take only two tool actions.
A safety term filter refuses the requests that could hurt somebody. Disabling an emergency shutdown, overriding a safety interlock and bypassing a protection relay are all blocked. So is forcing a valve open without a permit. The filter matches those configured phrases only, so extend the list to match the vocabulary at your site.
An operator never receives model text directly. Each response is held for a person and recorded as an escalation, which suits a control room but needs constant staffing. Answers must reach 0.85 combined and 0.85 accuracy. Physical security, recovery plans and vendor risk work under the standards remain program duties.
Source frameworks, standards and obligations
Control areas mapped by this template
Deployment options
Adapt the template in three steps
Review the scope
Confirm that the regions, source references, control areas and deployment options fit your use case.
Adapt the configuration
Open the template in the Verdictan console. Set its policies, thresholds, routing and review requirements for your environment.
Test before deployment
Test each policy outcome. Confirm that allowed, redacted, blocked and reviewed requests behave as expected.
Explore more Compliance & Audit templates
SOC 2 Type I
Map point-in-time control design to the AICPA Trust Services Criteria with this SOC 2 starter.
SOC 2 Type II
Map controls and evidence for a SOC 2 Type II review period with this starter.
ISO/IEC 27001
Map information security management, supplier, continuity and cloud privacy controls to ISO/IEC 27001.