The IT Governance, Risk and Compliance Challenge
for Power and Utility Companies

Power and utility companies have several directives impacting their business operations. Not only must the publicly traded companies comply with such regulations as Sarbanes Oxley, HIPAA, various state regulations, and PCI but they must also meet the Federal Energy Regulatory Commission's (FERC) and North American Electric Reliability Corporation (NERC) rules of procedure which can impact power and utility companies in many ways. Costs associated with meeting these requirements can be substantial and those companies that can reduce these costs and transition their risk and compliance effort into an operational process will be much more successful.

These regulations require controls at various points within the organization - from IT systems development and management to SCADA and process controls to physical and environmental security. These regulations are centered on the identification and definition of controls and the establishment of a solid security process within the organization. The challenge lies in meeting these NERC requirements in the context of the business and clearly articulating control infrastructures. An extensible framework to manage both control definition and regulatory requirements with compliance measurements and reporting is necessary for power and utility companies to efficiently and effectively ensure compliance.

IT Governance, Risk and Compliance Challenges for Power and Utility Companies

• Multiple regulatory bodies and requirements
• High costs of defining controls for IT
• High costs of demonstrating compliance
• Budget impact to IT efforts for business
• Allocation of resources away from key business initiatives
• Difficulty with ongoing sustainability
• Companies with wide range of capabilities and resources have similar requirements

Brabeion Solutions:

Brabeion Software solutions eliminate exposure of information security programs to repeat audit findings, regulatory violations and fines protecting brand, customer and commercial relationships. Our solutions ensure audit proven IT security controls maintained by experts including PwC, are mapped to regulations, customized for business requirements and communicated to employees, partners, auditors and regulators. Online dashboards measure and manage business risk, compliance and security program metrics and audit readiness down to the asset level. Our solution reduces the complexity of compliance and the cost of audits across global and heterogeneous environments.