NERC CIP
Electric grid requirements
Scope applicable requirements for the bulk electric system, including access boundaries, change management, and supplier risk.
FERC · Grid securitySecurity Critical infrastructure. Clear boundaries.
Protect the work
your business
depends on.
We define data, access, and operating boundaries with your security team—before an AI workflow connects to your systems.
Explore our approachRequirements before deployment
Security starts with the demands
of your operation.
Starting with energy and utilities, we map the requirements that apply to the entity, systems, data, and workflow in scope.
NIST SP 800-82
Operational technology
Use OT security guidance to define network separation, approved access paths, and the boundary between AI and operational control.
NIST · OT securityCEII
Sensitive infrastructure records
Identify protected information and agree permitted recipients, handling rules, storage, and disclosure controls where CEII rules apply.
FERC · CEIIISO 27001 / SOC 2
Enterprise assurance
Agree the supplier evidence procurement requires. Review certificates and reports for the actual services and environment in scope.
ISO · Information securityNIST AI RMF
Accountable AI
Define responsible owners, evaluate workflow risks, establish human review, and retest material changes before release.
NIST · AI risk managementThese are requirements and frameworks used to scope an engagement. Applicability varies; their inclusion is not a claim that Corvana holds a certification or that every workflow falls under the same rules.
Protected information.
Know what is in scope
Classify the records a workflow needs. Use approved, representative, or redacted material during discovery and agree the handling requirements before sensitive data is introduced.
Choose the right environment
Define approved storage locations, processing regions, subprocessors, retention periods, and deletion responsibilities with your security and procurement teams.
Set limits on model-provider use
Review provider terms and settings for training, logging, retention, and secondary use. Agree any restrictions and exceptions before connecting your data.
Operational boundaries.
Keep access deliberate
Design least-privilege access around named users, service identities, and the task. Agree SSO, MFA, access review, and revocation requirements for the delivery environment.
Keep control with the operator
Separate the sandbox from live operations. Define permitted actions and human approval gates; any connection to operational technology requires its own scope and authorization.
Prepare for change and incidents
Agree release approvals, logging, rollback, incident contacts, and notification obligations. Include the evidence and security testing your environment requires.
Accountable AI.
Make the work reviewable
Preserve the source records, versions, workflow actions, and approval decisions needed to examine an outcome. Document uncertainty and route exceptions to the right person.
Evaluate before expanding
Test agreed quality and security criteria before release. Recheck permissions, sensitive-data handling, and behavior when context, models, tools, or workflows change.
Your data. Your decisions.
Define how your information
can be used.
Each engagement starts with a shared set of requirements
for the environment and the people working in it.
Storage & retention
Agree where records live, how long they are kept, and how they are returned or deleted.
Identity & access
Define who can see the context, run the workflow, approve an action, and revoke access.
Encryption & keys
Specify encryption in transit and at rest, key ownership, and the evidence needed to verify it.
Permitted data use
Approve model providers and document training restrictions, logging, and processing terms.
Human authority, by design
The workflow can prepare the work.
Your people hold the authority.
Define what can happen automatically, what requires review,
and what must remain outside the agent’s permissions.
FAQ
Is Corvana certified to ISO 27001 or SOC 2?
Corvana does not currently claim an ISO 27001 certification or a SOC 2 report. We scope the assurance evidence your procurement team requires and review supplier certificates and reports for the services, environment, and period they cover.
Does every utility workflow fall under NERC CIP?
No. Applicability depends on the responsible entity, systems, information, and requirements involved. We define the applicable boundary with your compliance and security teams before designing the workflow.
Will our data be used to train an AI model?
We agree permitted use before connecting data, including any restrictions on model training and secondary use. We review the provider, service settings, retention, and contract terms against those requirements with your team.
Can an agent access or control operational systems?
Each engagement defines the permitted systems, identities, tools, and actions. Any connection to operational technology requires a separate review with the operator, covering safety, reliability, network boundaries, and human authorization.
How are access, encryption, and data location decided?
We document the requirements for your chosen delivery environment: identity, encryption, key management, processing locations, and subprocessors. Your security team agrees the evidence and approvals needed before deployment.
What happens when an engagement ends?
We agree the handover at the start: deliverables and records to return, access to revoke, and retention obligations. The plan also defines how remaining copies and backups are handled and what deletion evidence is needed.
Serious about security?
Talk to Corvana about the requirements
behind your next AI workflow.
