# Governing critical infrastructure data: security, privacy, and regulatory limits
A utility engineer wants to pull ten years of substation sensor logs to train a model that predicts transformertransformerA Transformer is a neural network architecture that uses self-attention to process sequences in parallel, powering most modern language and generative AI models.View full definition → failures. Sounds harmless. But those logs reveal the physical layout and operational limits of grid equipment, which makes them regulated cyber assets under federal rules. The same request touches customer meter data, which is protected by state privacy law. One innocent query just collided with three different regulatory regimes.
This lesson shows you how to govern that collision so your grid data stays both useful and defensible.
Energy data governance is not one problem. It is three overlapping ones, each with its own regulator, logic, and penalties.
1. Reliability and security (NERC CIP). NERC CIP stands for North American Electric Reliability Corporation Critical Infrastructure Protection. These are mandatory standards for the bulk electric system in the US and much of Canada. They classify cyber assets by impact and impose controls on who can touch them, how data moves, and how access is logged. Violations carry financial penalties per day, per violation.
2. Customer privacy. Smart meter data is deeply personal. Fine-grained interval data (readings every 15 minutes, say) can reveal when you wake, cook, travel, or run medical equipment. Many US states regulate this through utility commission rules; California's SB 1476 was an early example restricting how utilities share meter data. In Europe, this is GDPR territory.
3. Cybersecurity mandates. Beyond NERC CIP, utilities face a growing stack: TSA security directives for pipelines, SEC cyber incident disclosure rules for public companies, and state breach notification laws. The direction is more reporting, faster.
These three rarely agree. Security wants data locked down. Analytics wants it flowing. Privacy wants it minimized. Governance is how you referee.
The costliest mistake is treating all grid data the same. It is not. Sort it first.
This is data from the grid itself: SCADA systems (Supervisory Control and Data Acquisition, the software controlling physical equipment), relays, sensors, control settings. Much of it maps to NERC CIP.
Key concept: BES Cyber System Information (BCSI). This is information about Bulk Electric System cyber systems that could be used to plan an attack: network diagrams, IP addresses, configuration files, access lists. BCSI has strict handling rules. Note that not every sensor reading is BCSI; a temperature trend may not be, but the system topology behind it usually is.
Meter reads, billing records, outage reports tied to addresses, demand response participation. Governed by privacy law and utility commission rules, not NERC CIP.
Aggregated or de-identified data, weather feeds, public infrastructure maps. Lower risk, but "de-identified" meter data can sometimes be re-identified when combined with other sets. Treat aggregation as a control, not a magic eraser.
A simple tagging model to apply at ingestion:
dataset: substation_42_sensor_logs
classification:
cip_category: BCSI # none | BCSI | BES_low | BES_medium_high
privacy_class: none # none | customer_PII | interval_data
export_control: internal # public | internal | restricted
min_aggregation: raw # raw | 15min | daily | zip_level
handling:
retention_years: 7
access_role: ot_engineer_cip_trained
cross_border_transfer: prohibitedTag data once, at the source. Every downstream tool inherits the rules. This is the single highest-leverage governance move you can make.
Picture the failure-prediction project from the opening. Here is where it stalls, and why each block exists.
Block 1: The training data is BCSI. Substation logs plus topology equal attack planning material. Under CIP, access requires background-checked, trained personnel and logged access. Your cloud data scientist may not qualify.
Block 2: The meter data is privacy-protected. Pulling interval data to correlate load with transformertransformerA Transformer is a neural network architecture that uses self-attention to process sequences in parallel, powering most modern language and generative AI models.View full definition → stress triggers customer privacy rules. You likely need aggregation or a legitimate-use basis.
Block 3: The cloud environment may not be authorized. Moving CIP-scoped data to a general-purpose cloud tenant can pull that whole environment into CIP scope, meaning the cloud now needs CIP controls too. That is expensive and slow.
None of these blocks are bureaucratic noise. Each maps to a real penalty or a real attack vector. Good governance does not remove the blocks. It builds legitimate paths around them.
The goal is a framework where the common requests have a pre-approved, fast lane, and only the genuinely risky ones escalate.
Physically and logically separate CIP-scoped systems from your analytics environment. Data crosses the boundary only through controlled, one-way, logged transfers (often called a data diode for the strictest cases: hardware that lets data flowdata flowAn automated sequence of steps that moves data from source to destination: ingestion, transformation, validation, and loading, so it arrives clean and ready to use.View full definition → out but not commands back in).
Do the risky work where the data already lives. Aggregate, de-identify, or extract features inside the CIP zone, then export only the sanitized result. The analytics team gets "transformertransformerA Transformer is a neural network architecture that uses self-attention to process sequences in parallel, powering most modern language and generative AI models.View full definition → 42 showed rising thermal variance," not the raw configuration file.
Ask what the model actually needs. Predicting failure rarely requires customer names. Aggregating meter data to feeder level often satisfies both the analytics goal and the privacy rule. Minimization is your best defense: data you never copied cannot be breached or misused.
Every access, transfer, and transformation gets logged. This is required under CIP, but it also makes you defensible in a privacy dispute or a breach investigation. If you cannot show who touched what and why, you have no defense.
For the underlying voluntary framework many US utilities align to, the NIST Cybersecurity Framework is free and widely used as a common language across security and business teams.
🎬 [VIDEO: "How the Power Grid Works and How It's Being Attacked" — youtube.com — an accessible overview of grid systems and the cyber threats that drive security regulation]
Frameworks fail without owners. Three roles matter most.
Data owners decide classification and who gets access. Usually the business or engineering lead for that system.
A CIP compliance function interprets NERC standards and defends audits. Regulated utilities already have this; align data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → to it rather than building a parallel structure.
A privacy function handles customer data rules, which vary sharply by state and country. In multi-state utilities this is genuinely complex, since one dataset may follow different rules depending on where the customer lives.
The mistake to avoid: letting IT own everything by default. IT can enforce controls, but it cannot decide the business and legal tradeoffs. Ownership belongs with the people accountable for the risk.
Knowledge check
1. The lesson opens with a utility engineer requesting substation sensor logs to predict transformer failures. Why does this seemingly routine request become a governance problem?
2. Under NERC CIP, why are substation sensor logs revealing physical layout and operational limits treated as regulated cyber assets?
3. The lesson says fine-grained smart meter interval data (e.g., readings every 15 minutes) is 'deeply personal.' What concept does this illustrate?
4. The lesson frames governance as 'refereeing' between three forces. What underlying tension makes this refereeing necessary?
5. Select ALL correct answers about the cybersecurity mandates described as pulling on grid data beyond NERC CIP.
Select all the correct answers.
6. Select ALL correct answers that correctly characterize why energy data governance is treated as three overlapping problems rather than one.
Select all the correct answers.
Marketing wants a dashboard showing outage patterns by neighborhood to improve communications. Walk it through the framework.
Result: marketing gets a useful, defensible dashboard. No raw customer records left the secure zone. No CIP asset was exposed. The same request that would have been blocked as "too risky" now has a clean, repeatable path.
That repeatability is the whole point. A governance framework is not a one-time approval. It is a set of reusable patterns so the tenth request takes minutes, not months.