Audited Controls, Mapped to the Standards Utilities Are Measured Against
A note on scope. ACS is not a NERC Registered Entity. It maintains controls equivalent to those set forth in the CIP standards for Low Impact environments and provides evidence of them. Each registered utility remains responsible for its own CIP compliance program; ACS evidence supports that program rather than replacing it.
Control Areas
Physical Security
Hosting and network equipment sits inside a CIP-006-style physical security perimeter at each site: six-wall enclosures with biometric access control, real-time entry alerting, 24×7 staffed monitoring, and video surveillance with automated analysis. Unescorted access is limited to personnel in the ACS personnel management program. Response is provided by on-site security staff and local law enforcement.
Data in Transit
All data leaving a physical security perimeter is encrypted using CIP-012-style controls, including traffic between ACS sites.
Personnel
ACS employees undergo background screening at hire and periodic security awareness training. The SOC 2 program monitors adherence to these processes.
Tenant Isolation
Only vetted critical infrastructure applications are admitted to the platform. Tenants are isolated in their own virtual private clouds, and dedicated hardware tenancy is available for workloads that cannot share CPU or memory.
Supply Chain
All compute, network, and security hardware is sourced from US-allied manufacturers. Named hardware vendors are available to customers.
Security Operations
Security event monitoring runs 24×7 through a specialized managed security operations center, alongside 24×7 platform monitoring by ACS staff. Infrastructure changes affecting a tenant are communicated in advance.
Continuity
No hardware single points of failure at any site, N+1 power and cooling, 120+ hours of on-site generator fuel, and cross-site disaster recovery in active-passive or active-active configurations, with scheduled testing.
Evidence Available to Your Compliance Team
Provided under NDA to hosted vendors and their utility customers.
- SOC 2 Type II audit report
- Mapping of SOC 2 controls to NERC CIP requirements for Low Impact environments
- NERC CIP Low Impact shared responsibility matrix identifying obligations of ACS, the vendor, and the utility
- Physical and logical architecture diagrams with security boundary demarcation
- Documented network path from workload to internet edge or carrier handoff
- Availability SLA