Policy Pulse - Regulatory Roundtable: NERC CIP, Cybersecurity Strategy, AI & Electric Sector

Season 4 - Episode 1

Host: Patrick Miller

Guests: Joy Ditto, Earl Shockley

Policy Pulse: Regulatory Roundable is a new monthly feature of the Critical Assets Podcast. Join Patrick Miller, Joy Ditto, and Earl Shockley as they break down the latest policy, regulatory, and legislative changes impacting critical infrastructure, OT, and cybersecurity. If it affects your assets, audits, or authority, we’re covering it, straight from the policy frontlines.

Episode Summary

NERC CIP Roadmap: Low Impact No More

The panel explores NERC’s proposed push to apply medium-impact-style controls to traditionally lower-tier systems. Topics include:

  • MFA for low-impact boundaries

  • Greater scrutiny of public network use

  • Proxy regulation of DER aggregators via existing registered entities

Joy raises constitutional and policy questions about Federal Power Act boundaries and the creeping federal reach into state-regulated distribution. Earl contextualizes with past discussions on DHS command-and-control models, arguing proactive industry performance is the best defense against unwanted federal takeover.

CMEP Manual and Auditor Competency

The group reacts to updates in the CMEP manual, especially language emphasizing stronger technical capabilities for auditors.

  • Earl describes firsthand struggles with underqualified auditors lacking utility/ICS background.

  • Joy likens it to letting a soccer referee officiate American football, calling for rigor over regulatory theater.

  • Patrick stresses the importance of aligning audits to performance-based standards, not wishful control interpretations.

All agree that audit inefficiencies, excessive RFIs, and inconsistent enforcement undermine trust in the process.

National Cyber Strategy (Pending Release)

Joy shares insights from inside the Beltway on the still-pending national cyber strategy:

  • Expected pillars: Offensive posture, AI governance, and workforce development

  • Concern over leadership gaps at CISA, with Sean Plankey’s confirmation still on hold

  • Calls for more classification transparency so critical infrastructure owners can prepare for threats in real time

Patrick and Earl highlight the need for execution, not just aspiration, especially if infrastructure is to become a battleground in geopolitical conflict.

AI and Critical Infrastructure

The team debates AI’s growing role in OT/ICS:

  • Earl warns against “false precision” and blind deference to AI outputs, advocating for decision support, not decision ownership.

  • Joy calls for trust structures in AI training and deployment, emphasizing risk-managed design over blind faith in tools.

  • Patrick pushes for policy-level boundaries, especially around life-critical or safety-of-life AI decisions.

Concerns also surface about autonomous vehicles, large load data centers, and AI-driven energy demand outpacing grid planning.

Workforce, Succession, and the Talent Gap

Earl issues a stark warning: for every 5 retiring engineers, only 2–3 are in the pipeline. The sector must:

  • Treat succession planning as an enterprise risk

  • Broaden recruiting beyond EE-only mindsets

  • Recognize certifications and targeted skills, especially in cybersecurity

Joy reinforces the need to recognize small utilities and under-resourced sectors as essential parts of national security, and asks whether we need more support (and maybe more declassification) to empower them.

Show links:

Recent Podcasts

Featured
Policy Pulse - Regulatory Roundtable: NERC CIP, Cybersecurity Strategy, AI & Electric Sector
Policy Pulse - Regulatory Roundtable: NERC CIP, Cybersecurity Strategy, AI & Electric Sector

Policy Pulse: Regulatory Roundable is a new monthly feature of the Critical Assets Podcast. Join Patrick Miller, Joy Ditto, and Earl Shockley as they break down the latest policy, regulatory, and legislative changes impacting critical infrastructure, OT, and cybersecurity. If it affects your assets, audits, or authority, we’re covering it, straight from the policy frontlines.

Vulnerability Overload: Making Prioritization Work in the Real World
Vulnerability Overload: Making Prioritization Work in the Real World

Patrick Miller talks with Kylie McLanahan about the messy reality of vulnerability management in OT environments. They dig into the pressure to patch, standardization benefits of machine readability and the CSAF, the limits of CVSS, and how CISA’s KEV list fits into prioritization efforts. Kylie brings insight from across the ecosystem (vendors, regulators, and asset owners), offering strategies to cut through the noise and focus on what matters most. From patch fatigue to risk-based triage, this episode is packed with practical advice for managing cyber risk when time, tools, and resources are limited.

From CISO to Startup: OT Security, Leadership, and Lessons from the Field
From CISO to Startup: OT Security, Leadership, and Lessons from the Field

In this episode, Patrick Miller interviews Darren Highfill, former CISO of Norfolk Southern, for a candid look behind the curtain of life as a security executive. Darren shares hard-won lessons from building and leading a cybersecurity program in a critical infrastructure environment, including how to gain executive buy-in, scale a team, and align security with business priorities. He reflects on the challenges of translating cyber risk into business risk, managing real-world incidents, and the evolving expectations of the CISO role. Whether you're in the chair now or working toward it, this conversation is packed with practical insights for anyone navigating cybersecurity leadership.

Patrick Miller