WECC Reliability & Security Workshop Day 2 - NERC Information Command Center - NextEra Energy | WECC

The Gist

NextEra Energy built a dedicated NERC Information Command Center and leveraged an in house AI auditor named AVA to automate evidence generation and validation, reducing audit preparation time from six weeks to five days.

Quick Overview

NextEra Energy completely transformed its NERC CIP and OandP compliance operations by moving away from a reactive, spreadsheet heavy manual process toward continuous monitoring and automated evidence generation. By establishing a dedicated Information Command Center and implementing an AI tool named AVA, the company dramatically reduced audit preparation time and achieved significant cost savings across all its business units.

Key Points: NextEra Energy manages NERC compliance across six different regions and multiple subsidiaries including FPL and NextEra Energy Transmission. Prior to the new compliance model, the company relied on over 10,000 manual spreadsheets and a reactive audit response approach that cost up to one million dollars per audit. The newly established NERC Information Command Center functions as a centralized hub built on three main pillars: Information Management, Program Management, and Risk Management. The custom AI tool named AVA automates data collection, validates timestamps and software versions against service request tickets, and detects off normal conditions. The automated patch management process reduced the average completion time for patch assessments to 24 days, achieving a 41 percent decrease. Time to complete NERC data requests tied to patch management dropped from six weeks to five days, representing over an 80 percent improvement. The NERC Information Command Center physical space is currently being doubled in size to support both CIP and upcoming OandP compliance obligations by 2025.

Context: Bulk electric system entities face rigorous regulatory compliance obligations set by NERC under critical infrastructure protection standards. Compliance failures can result in massive operational burdens, expensive manual audits, and severe regulatory penalties if data collection and evidence generation are not managed proactively.