Without being a policy analyst for the CIP world, just a guy who writes code in it, these seem like a good idea. The only thing I would add is a point 4- faili

Without being a policy analyst for the CIP world, just a guy who writes code in it, these seem like a good idea. The only thing I would add is a point 4- failing audits should hurt/cost. There needs to be an incentive to not fail. The key problems to avoid lie around point 2. It can not become a case of regulatory capture. Nor, for that matter, should be a bunch of IT security yahoos who don't understand the unique demands that CIP/SCADA systems have. (By the way, if anyone wants to talk about this sort of thing, feel free to email me).