SPECIALTY COURSE · RELEASING NOVEMBER 2026
Cloud for Electric and Water Utilities
What may and may not move for the bulk electric system, and how water systems weigh risk and resilience.
All coursesOpens November 2026
You will get the most from it if you are…
- IT, operational technology and security leads at electric, water and combined utilities, public or investor-owned
- Compliance and reliability staff who own NERC CIP programs or a water system's risk and resilience assessment
- Engineers, finance and rates staff who must plan, justify and pay for cloud work under a regulator's eye
- Consultants and integrators who advise utilities and have finished the Foundations course
What it covers.
- 01The utility estate and its rulebooksThree regulators, three questions, and the boundary that matters most
- 02The bulk electric system and the CIP standardsWhat is in scope, what may sit in a cloud today, and what is changing by 2029
- 03Operational technology and what may moveControl stays close to the process; data and business systems can move with care
- 04Vendors and supply chain riskThe cloud provider as a vendor, under CIP-013 and beyond it
- 05Water and wastewaterRisk and resilience assessments, emergency response plans and EPA's posture in 2026
- 06Paying for it, and when things go wrongCost recovery, incident reporting and resilience
9 short lessons, part by part.
The utility estate and its rulebooks
- Two utilities under one roof
- Name the three rulebooks that shape cloud decisions at a utility: electric reliability, drinking water, and rates
- Explain why the boundary between operational technology and business IT matters more here than the cloud boundary
- Describe the fictional utility this course follows and the three zones it uses to place workloads
Job aid: Two utilities under one roof: a one-page guide
The bulk electric system and the CIP standards
- What is in scope: categorization under CIP-002
- Explain how registration and CIP-002 categorization decide which CIP requirements reach a system
- Describe the high, medium and low impact ratings and the associated systems that travel with them
- Cite a CIP obligation properly: standard, version, enforcement state and effective date
Job aid: CIP-002 categorization: a one-page guide
- BES Cyber System Information in the cloud
- Explain what BES Cyber System Information is and why it is the first CIP-regulated material that can sensibly live in a cloud
- Describe the three steps the current standards require: identify, protect, and manage provisioned access
- Prepare the evidence a utility needs, especially around encryption keys and the provider's own staff
Job aid: BES Cyber System Information in the cloud: a one-page guide
- What is changing, and when
- Distinguish what is approved and dated from what is still in development, as of October 2026
- Explain what FERC Order No. 919 on virtualization does, and why it is not a cloud rule
- Describe NERC's cloud standards project and how to plan around a draft without treating it as a requirement
Job aid: The CIP family in motion: a one-page guide, as of October 2026
Operational technology and what may move
- Control stays close to the process
- Explain why operational technology is placed by performance, reliability and safety before cost or convenience
- Place electric and water workloads in the three zones, with reasons a regulator or auditor would accept
- Design data flows out of the plant so that information leaves and commands do not come back the same way
Job aid: What may move: a one-page guide
Vendors and supply chain risk
- The cloud provider as a vendor
- Describe what CIP-013-2 asks of a supply chain risk management plan, and where it applies
- Apply the six vendor topics in CIP-013 to a cloud provider and to a control system vendor's cloud services
- Carry the same questions to the water side, where no equivalent mandatory standard exists
Job aid: The cloud provider as a vendor: a one-page guide
Water and wastewater
- Risk and resilience for water systems
- Describe what America's Water Infrastructure Act requires of community water systems, and the current certification cycle
- Summarize EPA's cybersecurity posture for water as of October 2026, including what it tried, withdrew and enforced
- Place cloud services inside the risk and resilience assessment and the emergency response plan
Job aid: Water risk and resilience: a one-page guide
Paying for it, and when things go wrong
- Who pays: rates and cost recovery
- Explain why the capital and operating expense distinction matters for cloud decisions at a regulated utility
- Describe how NARUC, FERC accounting guidance and FERC's cybersecurity incentive rule have responded
- Prepare a cloud proposal that a rate regulator or governing board can judge prudent
Job aid: Who pays: a one-page guide
- Reporting incidents and staying resilient
- Describe the cyber incident reporting obligations an electric utility faces today, and their clocks
- Explain the status of federal cyber incident reporting for water systems and of CIRCIA, as of October 2026
- Build a cloud provider into the incident and recovery plans, and plan for running the process without it
Job aid: Incident reporting and resilience: a one-page guide, as of October 2026
How it is delivered.
- Narrated lessons in short parts you can take one at a time
- A one-page job aid for each lesson
- A short check at the end of each lesson
- A lens for your role: security, cloud architecture or compliance
Narration is AI-generated (OpenAI's Cedar voice). The courses teach preparation and method; they certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor or regulator.