Kellie Macpherson on NERC Compliance, Cybersecurity, and Grid Reliability

Renewable energy has scaled rapidly. Now the industry faces a more demanding question: can solar, wind, and storage operate with the discipline, security, and reliability expected of critical infrastructure?

In this episode of Green Giants: Titans of Renewable Energy, Wes Ashworth, President of Lee Group Search, speaks with Kellie Macpherson, COO of Compliance + Security at Radian Generation and a board member at SEIA (Solar Energy Industries Association).

Kellie brings deep experience across NERC compliance, cybersecurity, commissioning, audits, control centers, and renewable asset operations. Her perspective is shaped by a career spent bridging the gap between traditional grid operations and the fast-moving renewable energy sector.

The conversation explores why compliance is not simply paperwork, how reliability affects real communities, and why the industry’s long-term credibility depends on operating assets as well as it builds them.

Wes and Kellie also break down the significance of NERC Category 2 registration for inverter-based resources. They discuss which solar, wind, storage, and hybrid assets may now fall under increased oversight, why registration alone is not the same as being audit-ready, and what owner-operators should prioritize if they are behind.

Cybersecurity is another central theme. Modern renewable plants rely heavily on remote access, third-party vendors, software, connected devices, and operational technology. That creates efficiency, but also expands the attack surface. Kellie explains why commissioning is one of the most vulnerable stages of a project and why access management, patching, physical security, and documented controls need to be built in before commercial operation.

The episode also examines the leadership side of compliance. Mature programs require executive attention, clear accountability, employee training, operational evidence, and a company culture that understands the financial, reputational, and reliability risks of getting it wrong.

In this episode:

• Why grid reliability became personal for Kellie early in life
• How renewable energy became central to bulk power system reliability
• What NERC Category 2 means for solar, wind, storage, and hybrid assets
• The difference between registration and true audit readiness
• Why cybersecurity should be treated as an operational priority now
• The most common security risks during commissioning
• Warning signs that a project may face future compliance problems
• Why inverter settings, access controls, patching, and evidence matter
• How executives and boards should think about compliance risk
• What trusted renewable operators will do differently over the next three years

As electricity demand grows and renewable assets become more essential to the grid, the companies that earn long-term trust will be the ones that combine speed with discipline, growth with resilience, and innovation with operational accountability.

Links:
Kellie Macpherson on LinkedIn
Radian Generation's Website
Kellie's Power Play Newsletter

Wes Ashworth: https://www.linkedin.com/in/weslgs/

• Email: wes@leegroupsearch.com
• https://leegroupsearch.com/green-giants-podcast/
• https://leegroupsearch.com/

Transcript

Wes Ashworth (00:25)

Welcome back to Green Giants, Titans of Renewable Energy. Today's conversation is about one of the most important topics in clean energy that does not get nearly enough attention: reliability. Not reliability as a slogan and not compliance as paperwork. We're talking about the operational discipline required for renewable energy to function as critical infrastructure.

My guest today is Kellie Macpherson, COO Compliance and Security at Radian Generation, and a board member at SEIA

Kellie has spent years helping renewable asset owners navigate NERC compliance, cybersecurity, manage security services, audits, control centers, and the real world operating demands of the grid. This conversation comes at a critical moment. NERC Category 2 requirements are bringing more inverter-based resources into formal reliability oversight. At the same time, cybersecurity threats to critical infrastructure are becoming more visible, more geopolitical, and more operationally consequential.

So today we're gonna unpack what changed, who is exposed, what renewable operators should be doing now, and why the future credibility of clean energy depends not just on building those projects, but on operating them with discipline, resilience, and trust. With that, Kellie, welcome to the show.

Kellie Macpherson (01:33)

Hi, thank you so much for having me. I'm super excited. I've been a longtime follower of your podcast and the work you're doing. So thanks for having me today.

Wes Ashworth (01:43)

The pleasure is absolutely mine. I'm really excited to get into it. And as always, I kind of just want to start with the human side of this. So compliance can sound abstract from the outside, but reliability only exists because there are real consequences when the grid fails. So you've spent your career in a field, you know, people would describe as technical, maybe a little dry, invisible. What first made grid reliability feel personal to you?

Kellie Macpherson (02:06)

Yeah, well, you know, it's really interesting. I grew up, my dad was an operator at Southern California Edison. and so I knew a lot about the grid, I guess, kind of through osmosis growing up around that. You know, hearing about my dad's work before cybersecurity and kind of some of the physical security requirements. I used to go to work with my dad, you know, and sit in there and I go back and forth to like the Richter scale and like grab the printer papers and like take him his desk and you know it's funny I remember I was probably I think eleven or twelve we had the Northridge earthquake. We were living in Southern California at the time and my dad was the shift supervisor on staff and I was babysitting my brother at home and the earthquake happened and then the power went out of my house and so you know I called my dad and I was like, Dad, the power's out at our house He's like, Kellie, I know

He's like, you know, retrospectively you're like, you're running the grid right now. You of course you know the power's out and it's funny, you know, they definitely prioritized, you know, folks in the control room that had family at home that for restoration on the grid and got our power back. But, you know, I grew up with stories like that, right? Like you know, understanding like, this, you know, huge chaotic event happened and my dad's working really hard trying to restore the grid, trying to bring things back together. Later when I started undergrad, in between like my senior year of high school and starting my freshman year of college of undergrad, I worked as an operator at the California ISO as an intern.

And that was during the California energy crisis in 2001. And you know, we spent the summer with blackouts and brownouts, right? Where you just like you didn't have enough generation to bring online. And so that was a really pivotal moment for me watching what was happening, and the it like seeing the day to day and then, you know, going home and watching it on the news and understanding, you know, people are just talking about these things all the time. And then, It was really interesting. One night we I was sitting on the generation desk planning for the next day ahead, realizing that we didn't have enough generation like for the next few hours. And so we're in a situation. I feel like I've told this story a lot, but everyone says they really like enjoy like the perspective. You know, it's like those pivotal moments, right? so sitting at the generation desk, I'm 18 years old. and I'm looking at the hour ahead, and I'm like, we don't have enough generation. Like, there's not enough megawatts on the grid to power what we have going on. And so I was looking at it, and you're like, okay, what are the biggest power sources? You know, where what are we gonna do? Where are we gonna move? And it was realizing, like, there's two hospitals, and one of them's gonna need to be tripped offline. And so, you know, making those phone calls to the hospitals and saying, like, hey, like, are you prepared? Like, have you checked? You know, so called hospital A. You know, hey, have you, you know, have you tested your backup generators? Like, what situation are you in? Like, do you have enough diesel? you know in a situation where like they've been tripped offline a lot this summer so it's not just like right like you needed to check in and like yeah like we're fine however we are in the middle of a heart transplant and you know we have so many hours and it's like very critical and like we are a little nervous that if you switch over to backup power you know we've never the piece of equipment that they were using the machine is like being your heart for a while, like while they do the heart transplant. And so they're like, We've never actually like gone through a hard backup with that machine before. So, if there's any way not to trip us offline, you know, if you could buy us four hours, that would be amazing. So call hospital B. Hospital B is like, yeah, like we've tested our backup generator, we just got the diesel refilled yesterday, like we're good to go, trip us offline and let us know what time. We're like, okay, call hospital A back. We're like, hey, we're not gonna trip you guys offline. but you know, that was like one of those moments where you're like, gosh, like this is the power of life and death. Like this is you know, grid reliability and power and energy and all that is so much more than just like, you know, about solar films and the politics and all that. At the end of the day, it's truly about reliability and that really matters and it does affect people's lives.

Wes Ashworth (06:12)

Yeah, absolutely. I love all of that so much. I think that is one of the most powerful origin stories and just how you got into this, how you got passionate about it, how you got interested in it. I love the just the kind of the second generation of you know, seeing it and living it from your dad's perspective as a kid, even. And I've said this a lot on the show, but you know, parents out there, like bring your kids into this, show them, you know, bring them to work, get them excited about it. That'll help us build the next generation as well, too, and in the workforce. But Such a powerful story there and such a powerful why you can definitely hear that come through really strongly. and I know so your story does cross this kind of like operations, compliance, cybersecurity, renewable development, executive leadership, you know, a lot of different facets there. Anything else or you saw early in your career that made you believe just renewables had to take reliability more seriously?

Kellie Macpherson (06:58)

Well, so it's interesting. I had that experience as an intern and then I went off and did some nonprofit management and things like that in my early twenties and then when I was twenty-six years old, I was working for a nonprofit and my dad said, you know, Kellie, what are you gonna do with your life? Like are you gonna get serious? And I'm like, I am serious. He's like, Well, you can't have a bleeding heart forever, like you know, like you gotta like, you know, get a grown up job. And so he's like, Come work for me.

And I worked for my dad for a while doing NERC compliance for traditional generation, right? And really helping you know, just regular power coal, you know, regular power plant nuclear power plants, be compliant with the standards, building their programs. And then in 2012, it was actually the day after my first daughter turned one, I went to work in renewables and I went to Recurrent Energy at the time and it was one of those moments like making the transition from traditional generation. So you know I was spending my day to day talking to the regulators, talking about traditional generation and everyone understood

Like, well, this is a coal plant, and this is how it operates, and right, like everybody know, like it felt like in my world prior to renewables to 2012, like everyone knew what a coal plant was, and this is how you make a coal plant compliant, right? And this is how it's reliable, and all that. And I came over to renewables and I realized, my gosh, like there is such a disconnect between the two, right? And you realize I always joke, and I probably should stop joking, but like you're like, you know, renewables at The time in 2012 felt very much like the finance bros world, right? Like it was just like you know, so many people coming out of finance and like, this is like this great financial economic opportunity, blah. And I'm like, you know, and I came in and I'm like, whoa, okay, like super cool, love the economic, like that's awesome, but you guys are kind of forgetting something really important, like you're not understanding this reliability. And so, like, they're like, Hey, we've got this IA that we're the interconnection agreement that we're trying to close, and you know, they're giving us a hard time, and they like think that we're not gonna do something correctly, and there's something about relays.

And then yeah, I'm like, well yeah, that would make sense, right? And so you start going digging in and you're like, well, yeah, they're worried about reliability, like, you know, like this is the voltage constrained part of the grid. I'll you know, I remember very clearly like the first month of being at Recurrent. I got pulled into a room with like all of the executives that like I didn't know at that time. Like you later have all become like very good friends of mine, but you know, it just kind of the newbie, right? And come in the room and they're like, Whoa, why do they care about this? Like, you know, we don't want to do these. relay upgrades like it's gonna add 18 months to construction period and blah right like all these things I was like well let me just draw you a picture of Southern California and Fresno is this like very voltage constrained portion of the grid and so they're very worried about voltage control and they want all these things to happen you know they want the site to function correctly and to be a good neighbor and to do all these things and they're like and then problem solving through that to be like okay well why don't we say like we can follow it you know this like constrained voltage schedule

We can, you know, bring in batteries and like right. Like, and you start like problem solving from like the reliability perspective. But no one at the time when I walked in that room, like nobody understood why like the utility cared and like why it mattered, right? And so I feel like for sure, my first really five years in renewables was really spent bridging that gap between utilities and renewables and trying to like, hey, utility, like just so you know.

Like we're willing to do whatever you want. Like we understand this is a voltage constraint point, but like, is there a better way to do this? Is there a faster way to do this? Like, do you actually have to go and install the relays? Or like, hey, could we go and install this equipment and then transfer ownership to you? Cause we can get this all done in four months if you let us like run with the construction schedule. And then the utility's like, yeah, that would work, right? It's so interesting, but really bridging the gap between the two because people just like don't like it's they you had these two very different type of people.

That didn't understand that, at the end of the day, yes, everyone cares. Renewables are not trying to break the grid. We never were. We just didn't understand why something was important. But then utilities, on the other hand, were not very nice, and you know, it's like kind of like an old timers club. You know, like, who's this new person? I'm very suspect of you. Like, why do I have to explain everything to you? Everyone else I work with makes my job easy. I don't know. So I feel like you know, like that was kinda like that bridge into renewables for me. And so it just really helped. I think I speak both languages. And so I've spent so much time just like trying to pull those teams together and help people, you know, understand.

Wes Ashworth (11:27)

you're like the unsung heroes of the industry, right? I think that bridge is so important. And we've seen that. You know, if you go back in time to where you're saying and you look at today, yeah, there's still work to be done, but just how much more seamless it is, how much more connected it is, everybody's speaking a little bit more of the same language. And so having those people that like yourself where you could bridge that gap and you know, kind of be that translator of worlds, I think that's

So critical. and I think will be one of the more important things too as we go forward. So I like that, like that lens a lot. so we've kind of talked through, set the stage a little bit your career. And I think understanding like I love that how early this started for you, how long you've been just like this is what you live and what your day in the life every day is like. But you know, I want to talk a little bit about you know, compliance and this credibility test for renewables and I think know, the renewable industry, like we talked about over that time, has done an extraordinary job scaling. And a lot of it because of you know, people that can bridge gaps and translate and we get there. But as clean energy becomes just a larger share of the grid, expectations change. Like that's a positive thing, but also creates some challenges. So the question is no longer just can we build it? It's also can we operate it as critical infrastructure? and a lot of people hear NERC compliance and their eyes gloss over and they think paperwork and t tell us a bit about that. Like why is that the wrong frame? And how would you just help them feel a little bit more excited about it?

Kellie Macpherson (12:46)

Well, I think you know, it's interesting. I feel like I can get developer people that are developer owners like really excited about it because they can like, I see how that can change in the future. I see how like doing this well from the beginning makes it easier to get through process going forward, right? 'Cause you're always like, these people are so much easier to work with, right? And that makes a difference

It really does. but you know, so much of it is this idea of you know, the solar farm can be just as compliant as the coal facility, down the street. And they both can offer the same electrons to the grid and solve the same electron crisis. And you know, that's what we're looking at here is an electron crisis in the US. We're definitely entering into some like really potentially scary times.

And I think that's where, you know, when we think about compliance and we want to think about long-term stability, you know, if you're an IPP, if you are a developer, you know, if the future of your business is dependent on more renewable generation coming online, compliance is the ultimate trump card that makes utilities feel comfortable with what we're doing. Because if we do compliance well, then they're like, oh yeah, I'm happy to add more solar. I'm happy to.

Add batteries to our generation mix and our you know in our ISO in our area because I know that you're gonna follow the voltage schedule. I know that you're gonna do outage coordination correctly, I know that you're gonna follow cybersecurity best practices and patch all of your equipment, and you're not just this like rogue agent out there that's gonna like cause threats to everything, right? And so I think compliance becomes this ultimate trump card, and I think that's what I just feel really passionate about, like wanting people to sure they understand like what a big deal it is, right? It really is a really big deal. And it really makes an impact. So

Wes Ashworth (14:40)

Yeah, I agree. You paint that picture beautifully. and then you hear it and understand like why this is so important and so critical to pay attention to and then be ahead of. But you've used that phrase and I wanted to spend a little time on that sort of electron crisis. I think that's a powerful statement. like for you, like what does that mean? What do you see from your side of the equation? And then just why should renewable developers, IPP investors, and operators care?

Kellie Macpherson (15:02)

Well, you know, it's interesting and we talk a lot you know, a lot of my role in SEIA on the board, a lot of that comes from there thinking about, you know, what is important for the industry, what's important for electrical grid, going forward. And I and you spend a lot of time thinking about this and talking about this and at the end of the day, you know, can you go through an hour of your day and not hear about AI right now?

Can you go through an hour day without a data center or you know, some type of like iPhone, like update, your photos going to the cloud, literally our day-to-day lives, hour by hour, are driven by technology, right? And the technology just continues to change. I mean, We're moving so fast.

So just like think about our culture in the United States, in the world, our culture is shifting and we're going through this major cultural shift, which then means that it's changing the way that we live our everyday lives, right? Like we are now deploying tools and technology that we've never used before that require more power than was required before, right? The computational load of just our lifestyle at this point.

So our culture is changing, our society is shifting, the way we live our day-to-day lives is shifting and changing and all of that. And what that then requires is more electrons to the grid. Well, here's the thing: we are building and adding electrons to the grid to a stressed infrastructure, right? Like we don't have a transmission system. You know, we're 10 years behind on transmission, and where we really should be for what we have now. What you know, we have antiquated equipment out there, keeping up with all of that, right? You have that issue. And then you have just like the pure, sheer need for megawatts to meet the electrical grid. And so all those things together, all now, I think we find ourselves in a what I would consider an electron crisis. Like, we do not have enough electrons currently to sustain, like if we continue to grow and have the priorities that we do going forward. And so I think that's where, you know, I think a lot about like, okay, so the other side of this, and maybe I'm getting ahead here a little bit, but you know, I like to think about so like explaining all that, like, and what's happening, we're not gonna slow anyone down, right? Like, you know, it's like, okay, I don't know if anybody else is this way, but like I'm going through like the 13-year-old pain of like having a phone. My daughter, my 13-year-old daughter like has a phone, and you're like, my gosh, like get off the phone, like, what the heck? Like, you've like unlocked this like monster that like can never like doesn't stop using the phone. You're like, my God, like we need a phone detox in my house.

Okay, same thing like our culture. Like, we're not gonna change what we're doing, right? Like it's the same thing. Like, this AI thing, this, and this new technology, and this new app, and this new thing, and this new way. We're not gonna slow any of that down, right? So, next question: what's the quickest way to solve the electron crisis? Like, what is the quickest way to get electrons to the grid?

Kellie Macpherson (17:57)

Well, it's not building a coal or nuclear plant or a hydro facility that's gonna take five years at minimum just to get through the federal permitting process. Like that's not gonna do it. What's the fastest way to bring electrons to grid? If you had six months, what are you gonna do?

We're looking at batteries, we're looking at some solar, you know, right? Like we're like renewables have the answer to the electron crisis. The problem is people get nervous about renewables because of this reliability issue. And they're like, whoa, they're just these, you know, rogue agent outlaws on the grid. And it's like, no, they're not outlaws. We're gonna follow the compliance practices, we're gonna do the right thing, you know? So

Wes Ashworth (18:37)

Love it. The phrase, you know, electron crisis I think captures the stakes really well. and you've just brilliantly said that in just terms of how important this is and we are the answer, but the other side that the compliance or reliability's gotta come alongside it or it doesn't work. So yeah, I love that so much.

Kellie Macpherson (18:55)

And I guess the other side of it too is like and then we don't want to break it. Right. So we're just like we need to prove all the naysayers wrong. We need to show them that we're not, you know, we're not bad agents, you know, But then we also have to like not break it too. Right? Like we don't get to the situation where we're like, hey, raise our hand. We're gonna solve the electron crisis and deploy all this, and then in twenty-four months, thirty-six months, it's gonna break and like now we're

Did exactly what they said they were worried about, right? Like we can't do that. So, everybody needs to be a good neighbor, a good agent, follow the combine's best practices, bring reliable electrons to the grid, right? Make good equipment choices, make good deployment choices, up good operational choices, so that you know those electrons then are reliable and we are truly providing a solution, not just a band-aid.

Wes Ashworth (19:48)

again, so well said. I love all of that in there. I think that perfectly just brings us to where we're headed here and just keep listening. This is why you should care. And then we're gonna get into it. But it brings us kind of to the regulatory shift that makes this conversation, I think, so timely. Category two is not just a new administrative category, it's a signal that more renewable assets are being treated as consequential participants in bulk power system reliability. Talk us a little bit about that, like in plain English.

Wes Ashworth (20:15)

What change with NERC category two? Why is it such a big shift for solar, wind, storage, and hybrid assets?

Kellie Macpherson (20:21)

It's really interesting. I actually, and this is probably my hot take, but I actually think it's kinda cool. because, you know, traditional generation, so like we talked a lot about that or I've mentioned that a lot already, but you know, the hydro facility, the coal plant, etc., they all have to be registered with NERC and follow the reliability standards, if they're twenty megawatts and above, right?

So little history lesson, we'll go back in time. but when the NERC standards are originally written and the registration threshold was written in June of 2007 went into effect.

Okay, so think back here, we're almost to twenty years wild. but if you think about it, like they never thought renewables could get as big as they are, right? Like everyone was like, a solar facility is like a one megawatt, maybe five megawatts was big back then, right? But like people just couldn't imagine that they'd be as big as they are, right? So when I was registering like the first solar facility in 2012, you know, at a hundred megawatts, you know, NERC was like, wait, what? But you know, they wrote the registration criteria in two thousand seven to say an aggregate of 75 megawatts and above then had to be registered. You know the idea was like this aggregation point was interesting. You know, if you think about a solar facility or wind facility at that time, they're spread out over, how many acres? Six, 10, 15, 20 acres of land, right? Like it's this large thing. Like you could have a fire on one side of the road and partial, you know, lose a circuit and still generate 70 of your 75 megawatts, right?

Like it's interesting, like the physical disparity of a site, you know, and so there's this idea of like, okay, well, the site aggregates at 75, then they need to be registered. Well, over time, over the last 10 years, from really 2012 to about 2022, there's all this analysis of all of those smaller solar sites between 20 megawatts and 75 megawatts. And they're like you actually do affect the grid and you do affect generation. And when you lose 60 megawatts of solar.

In the middle of a super, super, super hot day in Texas, like you're in trouble. Like that actually matters. So you know, the regulators have really pushed and made this change to bring the threshold down to 20 megawatts so that way, you know, we're really actually like covering that gap that exists there. I'd honestly at some point imagine that they might even go down lower. to be honest with you with what we're hearing and seeing. But for now, you know, this category two shift. So my hot take on this.

Kellie Macpherson (22:44)

I think it's really flippin' cool because it just espouses that renewables is a solution. We actually matter on the grid. Like we're actually solving generational issues. We're getting to be big enough that we make an impact that we matter. So then, hey, let's be excited about this. Let's register these assets. Let's be compliant. Let's be reliable. You know, let's make a really good name for the industry.

Wes Ashworth (23:11)

that perspective a lot, you know, and it's a signal, right? It's like, yay, we've arrived. Like they're taking us seriously too. We have to do the same. I like that a lot. And you talked about that, you know, that the market often talks about that threshold as 20 megawatts, but I know that the formal language is a little bit more specific. I guess how should asset owners think about that? Like what's more, is there anything more to that story?

Kellie Macpherson (23:31)

So it's 20 megawatts connected at 60 kV or higher. So if you're connected, you know, sub-distribution level, your site may not be impacted. So and in some cases

I don't know, we've gone back and forth. we actually saw a site that was like 18.2 megawatts and then you know went through some reviews and turns out like it did need to be registered. So I would say like if you're on the cusp of some of those numbers, it's definitely worth some analysis. maybe don't just, you know, check a box and move on, but maybe dig in just a little bit. Yeah. Mm-hmm.

Wes Ashworth (24:06)

So probably still good to think about it, even if you're slightly below, as you said, worth looking into and just making sure. Never a bad idea. So thinking about this, as this went into effect, you know, recently, who is most likely to be sort of caught off guard by category two? Is it smaller IPPs, developers moving into ownership, asset managers, operators, investors? Like what's your thoughts there?

Kellie Macpherson (24:09)

Yeah, I think it's definitely the smaller owners that like don't have bigger facilities. So like if you have large stuff, like large facilities, like you're already doing this. So you're kind of like it's already kind of on your radar, if that makes sense. But I think there's quite a few like asset owners, like you know, think about the people that built a facility in like 2010.

And they just have a couple of smaller assets and that's kind of it in their portfolio, like they might not know about this, right? Like it might not be on their radar. So I think that's a big one. And then I think people that are operating these sites that are smaller operations that maybe like don't operate any larger existing already in NERC sites, like those folks could also be surprised by it as well. So yeah.

Wes Ashworth (25:08)

Absolutely. I you know, I think it's important and wanted to point out that out there maybe there's some listeners that are like, okay, now I'm listening even more so, because that's me. Now that this the May 15th deadline is passed, not too long ago, what should an owner operator do? You know, if they're in that category or they're realizing a little bit late, that they may be in scope and may apply to them, like what is what's the step one? Like what should they start doing today?

Kellie Macpherson (25:15)

well You definitely, I mean, gosh, I just like really hope people aren't in that. I feel like I've like spent like the last like six, twelve months like trying so hard between like LinkedIn and like vlogs and like interviews and all the things like to get the word out. Hopefully, hopefully that isn't the case. But if it is the case, you know, we you want to start digging into building a compliance program. And that's gonna, you know, to be compliant with category two, it's gonna require some policies and procedures and getting some documentation put together and then probably more than like Likely, you know, auditing your operational your day-to-day business operational practices and making adjustments so you can be compliant with the standards. So, and you know, for a lot of folks, especially when you're new to this, you know, it may require that you bring in some outside support to help you figure that out. you know, or if you haven't done anything and you're just finding out about this and you fit in that criteria, you know, you may need some extra help so that you can get compliant really, really quickly.

Kellie Macpherson (26:26)

Before you're in the situation where you're being audited, because that's the thing, you know, we had the May 15 deadline to register. As soon as you register, then compliance starts, and you have to be compliant with the standards, which then means that you have to be, you know, following all of the requirements, and then you're gonna be audited, right? And so, and so that audit, those monitoring processes are gonna start here sooner than later. and so you wanna have all your ducks in a row, you know, before.

Wes Ashworth (26:53)

Yeah, absolutely. And again, hopefully it doesn't apply to anybody that you've we've been able to get the word out. You've been able to get the word out, but I'm sure there are some, maybe. thinking about what you just ended there with, what is the true difference? You know, when you think about, hey, I'm registered. I registered, I did what I was supposed to do there. And then that the difference of being like truly audit ready. Like what should people think about?

Kellie Macpherson (26:56)

I mean it's one thing to like check the box and like fill out a form. It's another to be like, well, here you go. Like here is every single month we did, you know, these five best these five compliance things. We ensured that they were being done correctly. You know, we put these policies and procedures in place and it's not just paperwork, like we actually like follow the policies and procedures and be able to show that, you know, there's this concept of an internal compliance program in the NERC space where it's this like, Hey, it's one thing to have paperwork but you actually have to show like back it up like did you train people do you have a PowerPoint of it do you have training records do you continue to train people did you test them right like it's not just like here you go here's a policy we're good right like it's truly like is it implemented can you demonstrate that it's implemented and then continue to follow through with those things

Wes Ashworth (28:03)

you know, I think it's a great way to say it. The real test is that, is whether the evidence controls responsibly hold up under scrutiny. You're actually following the things that you put into place. So you know, I know the official initial category two standards list is narrower than a lot of public discussion around cybersecurity. What is mandatory now and what's prudent now, and what do you expect to become standard later?

Kellie Macpherson (28:24)

Well, so there are technically right now, letter of the law today. So we're recording this. my gosh, July first. Welcome to July. we're recording this July first, twenty-six. So if you think about right now, there are eight standards you have to be compliant with. By the end of twenty-six, so by December of twenty-six, there's gonna be an additional five standards that get added. So we'll have thirteen standards by the end of this year. And then there's this ongoing process. So if you think about every standard on average is like 20 pieces of paper to like write the requirements in the standard right like so it's not an easy thing to like go through and review every standard and be like okay so we have this new group of facilities like do we need to change the language in here because we have this new group of facilities coming in and so how do we edit that and so just like you know like process and all of that like takes time to edit

And revise those standards. So we're gonna see over the next three years, this and really the next 18 months is gonna be hypercritical, but they're gonna continue to revise all of those standards. I believe, and this is just Kellie's opinion, but I believe that, you know, by 2029 that the category two sites will have to be compliant with the same standards as the category one sites, like you know, the same as every other generationional asset on the grid, they'll have to comply with everything. I think it's just literally like prioritizing like how many standards can you update and revise and get through. It's really interesting in our industry and the NERC space. You know, we go through really, it's a pretty collective process where you get lots of industry opinions and comments. And so you can imagine you have 30 people opining on, you know, three pieces of paper. Like that's a lot of opinions.

To sort through and figure out. And so, you know, NERC's actually in a process right now of changing the way that they also edit and revise standards to make things move faster as well, which will be interesting to see how that happens. So I think, you know, there's a lot going on, and there are definitely people that are in the camp of like, this is it, it's just these eight standards, it's no big deal, it's not a lot, and you know, we'll see what happens. I think that's cool. That's like the position you want to take. I just I think historically, like we've seen FERC push NERC really hard when they felt like there was a gap in reliability and I think that knowing what we have going on, hearing executive orders, hearing what is happening on the hill, right? Like that like where we're headed, even from like a national security perspective and things like that, it's not going to slow down. And I don't see a world where FERC doesn't continue and they already are, but continue to push NERC to push these changes and standards through super quickly and make those changes really fast. So

Wes Ashworth (31:13)

Yeah, absolutely. Great context there. And I think for those that are that want to be proactive, you know, maybe they see it as well too, like, hey, this is probably gonna change and you know, as you said, you fast forward out to 2029 and beyond. for those that do wanna be proactive and look at that, like what should they be preparing for before the rules may force them to? Like what can they prepare for today?

Kellie Macpherson (31:19)

Yeah, well, and I think that's really interesting because one of the things that's not in that eight standards in that bucket is cybersecurity. So little history lesson, sorry, lots of history today, but you know, the original NERC standards were really were released in June of 2007, right? And FERC approved them and said, Hey, great job industry, but you forgot something really important. You forgot cybersecurity and you didn't come up with cybersecurity standards. So in June of 2008, then NERC passed.

And FERC approved a set of cybersecurity standards. So, like, we've seen this happen historically where FERC has come back and said, you forgot something really important, right? So currently, right now, we're kind of reliving history. We've got eight standards, none of them are cybersecurity. I don't see a world where in the next 12 to 18 months, cybersecurity standards are not applicable to the sites. Now, When you put those cybersecurity standards into place and you start putting access management, electronic access management, patch management, et cetera, what do you do? Well, you make a better operational facility. Like you are now operating your site. Like, think about you know we see intrusion attempts all day long, constantly on these sites. Like the electrical grid is under attack. And we haven't really even talked about that today. And that's probably like a whole nother conversation. But you know, the electrical grid is from a cyber.

Security standpoint, like is under attack. And so if you're an owner and you're thinking about all this, like you would be remiss to not be working to be compliant with the cybersecurity standard. And if you think about a site that was built in 2010, like, do you know the password to your firewall? Does your site have a firewall? Like, when's the last time it was patched? When's the last time the Windows system was updated? Right? It kind of becomes this, like off to the side, like thing that you don't think about. And so it's really

Interesting. So like if I was any owner right now, like cybersecurity would be number one on my list of things I'd be thinking about.

Wes Ashworth (33:25)

Yeah, like that number one thing to think about as well, too. And I think, you know, perfect segue, like reliability and cybersecurity are so deeply connected now. And the modern renewable plan is software enabled, you know, remotely monitored, vendor dependent, integrated into critical infrastructure. And that creates enormous value, but also creates a broader attack surface. So it's a really important. and some of this, you know, recent cyber headlines have been more focused on like oil, gas, you know, water, other critical infrastructure. but you know, I think

You've explained that a little bit, but why should clean energy operators just assume they're part of that same risk landscape and be viewing this in the same way?

Kellie Macpherson (33:58)

Yeah, well, you know, I think It's really interesting because there's so many moving parts, right? And I think There's so much equipment out there. but the remote operations is such a big deal. You know, we're so interconnected. You know, you have these Met stations, you have, you know, an O&M and wireless network at the O&M and building, you have, you know, relays that have potentially have wireless access. Every device at a solar facility has some sort of connectivity and remote connectivity more often, you know, almost nine out of ten times. take a battery site, for example. Like everything has remote connectivity and the discharge of battery, like all of that, like you could not have a field tech at a battery site, you know, for days on end. And in some cases, like whether good or bad, but just you know, operational practices, you know, that is the reality of what we're seeing.

Wes Ashworth (34:51)

And it's kind of like thinking about that risk kind of within the whole renewable portfolio. I know we've talked a little bit about like commissioning being a very vulnerable point. why is commissioning such a vulnerable moment for both compliance and cybersecurity?

Kellie Macpherson (34:54)

Okay, just like volume of people.

Kellie Macpherson (35:06)

Like have you ever been to a solar site when it's being built and you see the parking lot of folks that are on the site, require just like the sheer volume of people to install a solar facility? You go from like hundreds of cars in the parking lot, then you hit commercial operations and you've got like I don't know three or four field techs trucks on a day-to-day basis. Like just like commissioning building construction is just like the sheer volume of people, right?

And so you have all these people that are like, you know, we're doing the substation and we're doing this and we're doing that and we're bringing on this circuit. And like, well, I just want to have access to this SCADA so I can see what's going on. So like I can troubleshoot and I can figure this out. And like, and there's all these like LDs. So if we don't meet this timeline and milestone on our construction schedule, you know, it's millions of dollars. And it's so interesting. You have this franticness during commissioning, right? And so you end up in the situation where it's like it's very open network for the site, right? Like everything is kind of open because you have all these people that are coming together to put the site together. And then you hit commercial operations and you know right before you hit commercial operations, at least for us, you know, before we get there, we're locking down and we're like, well, do you have a business case? Like do you need to have this access anymore? Like maybe it made sense six months ago for you to have like unfettered admin access because you were literally setting up the network and doing things, but now it's like, but you don't have any ongoing business case, so like you don't you no longer need this access, like we need to pull you from that access. So it's a really interesting, you know, and it kind of becomes a scream test sometimes too, because you're like, okay, like we cannot have all these people, like okay, if you're not screaming that you need the access, then you probably don't need the access. So yeah.

Wes Ashworth (36:49)

Absolutely. And that leads perfectly into kind of where I was gonna go is like what are some of the best practices you've seen or you've implemented with commissioning to be able to control that. It makes a lot of sense, you know, just with there are more bodies, more people involved. There's a lot of other things going on. But anything else that would you would recommend just in terms of best practices to help mitigate that risk?

Kellie Macpherson (37:09)

I think a lot of that is having good process and procedure, right? And having a way that you're doing it, knowing who has access and really saying, Okay, we're thirty days from COD, like start locking down, preparing people, right? Like and doing that. I think so I think access, electronic access is a big one. I think the other thing is patch management, right? Like, you know, you have and this is fine, like this is okay. I'm not like this is no shade on, you know, SCADA on SCADA vendors, but you know, they bulk purchase equipment, right? So you could have a firewall that's been sitting on the shelf for 12 months because they bought, you know, 30 firewalls at one time, right? For their deployment, for their construction schedule, you know, for 2026. And so, you know, it's really looking at those firewalls and be like, okay, like you know, like this is outdated and it needs to be updated and it needs to be patched. And so I think there's just some of those best practices that you can absolutely deploy during commissioning that really ensure that your facility is in a good spot, you know.

Wes Ashworth (38:10)

Good practical advice there. And that's such a simple one, but such an obvious one that's missed a lot of times. It's like even just those patch updates and just making sure everything's like, is it up to date and current and has all the things it needs to? It may have been like as you said, sitting on a shelf for a long time. Let me ask you this if you walked onto a site tomorrow, what early warning signs would tell you that a project is likely to become a compliance or cybersecurity problem later?

Kellie Macpherson (38:18)

I like get sick to my stomach when you walk into a substation and someone has like the password for the HMI like SCADA system like on a post-it note, like right there, and you're like, who. That is not a good thing. that's probably my number one. number two is like lack of physical security. Like, you know, like that someone was not thoughtful about where they put gates or you know, where they put access points and things like that. Like if the substation yard is like the main parking spot for everyone is gonna be the major point of egress for a site, that makes me very nervous. Yeah, those are probably my two top ones there.

Wes Ashworth (39:09)

you're and people are like, yeah. Who leaves a password on a post it note? A lot of people do it. That's why we're talking about it. So don't be one of those. My lesson out there is like, don't make any assumptions that you're like, our people don't do that. You're like, Don't make assumptions. They might. Yeah.

Kellie Macpherson (39:17)

have quite a few pictures on my phone. I think that might be a future LinkedIn post.

wanna be efficient, you wanna move quickly, like you're under pressure, there's financial pressure, it's understandable, right? Like are people be like, well, I you know, I didn't want to pay for more fencing. And it's like, yeah, but you just left this like very critical asset fully exposed, right? But like I understand why people do it. I can see it, but at the end of the day, you've gotta think long term big picture of renewables and where we're headed in the industry and you know everyone's gotta do their part.

Wes Ashworth (40:01)

No great perspective there. So as we've talked, we talked through the rules a bit, we through the risks, the technical realities, but ultimately this becomes a leadership question. And so kind of bring it back to that. Mature compliance does not live in one person's inbox. It lives in the really the culture, systems, budgets, and priority of the company. And you often frame compliance as a culture issue. And I would totally agree, not just a documentation issue. So what does a healthy compliance culture look like inside of a renewable company today?

Kellie Macpherson (40:27)

Yeah, I mean I love when executives, at least at a high level, understand what our compliance is, right? And they understand reliability because you know, every single person at that Exec table should be sitting there. And when, you know, when you're making hard decisions about things, there should at least be a pause to say, how does this affect our compliance program? Are there any implications to our compliance program? Right. And very often, there isn't someone in the room to ask that question because you don't have that engagement at the exec level. You know, and for me I think that's really, really important. I think you know, there need not that you need to be an expert, not that you need to understand everything, but I think you should have to sit through a thirty minutes NERC for executive training and understand NERC 101, like this is why it's important, you know, and these are the financial outcomes as well and the risks. I think, you know, there comes with significant, you know, civil penalties, if you're not following the NERC standards correctly. And I think you know, that's something that executives don't understand either, because they're like, well, this is just an operational thing. And well, it is, but you know, when you get that fine that's, you know, north of five hundred thousand dollars, how does that affect you know, that does become important and material? And so I think, you know, really seeing, you know, leadership engage and dig in is really important. And I think, you know, as part of like becoming, you know, putting myself up to be elected for the SEIA board and campaigning for that. position, I you know, I wanted to be able to help bring some of that perspective there and you know, get to spend time with those folks.

Wes Ashworth (41:57)

that a lot. I think that culture piece is crucial, you know, because I get to your point, like documentation only works when the organization actually behaves the way the documents say it does and they really believe in it. And it comes from the top. I think that true buy-in that you know people they see what's unspoken, they read those things kind of like you know, and it's not front of mind for the executive. It's not it doesn't feel important to the executive, even if they say it is Then that kind of trickles down the organization. So it I agree with you 100%. It starts there, starts with the person being bought in. and you know, invest some little time, like to your point. You don't have to be this expert of all things in it, but at least just spend some time familiarizing yourself with it, getting to know it. what are some other things? So thinking about like the executive CEOs, CFOs, boards, investors, what else should they understand about just compliance risk that maybe they often underestimate?

Kellie Macpherson (42:46)

well I think the financial impact is always something that they find surprising. That's definitely one of them.

And then usually the time that it takes to implement too, right? Because they'll say, hey, let's, you know, the site's underperforming, let's make these equipment changes. And well, that's great. We can make those equipment changes, but we have to run an engineering analysis and make sure. And there has to be a change management program and right and make sure that the equipment is deployed correctly and in a compliant manager. And oftentimes it's seen as this bureaucratic red tape. And you know, and that's always challenging. And so I think understanding that there's a financial implication. reputational implication, you know, and then you know, there is a time implication and it can slow things down if you're not planning and thinking about it ahead of time. But if that's always in your forefront and you come through a lens of a culture of compliance and you start planning from it from the beginning, it isn't that challenging.

Wes Ashworth (43:39)

Absolutely. Such an important message, I think, for executives, because that compliance risk, to your point, can become operational risk, financial risk, you have time risk, reputational risk really, really quickly. And I think that framing should resonate as well. And I've said this before in the show, but this would apply in this case too. It's like that saying, like best time to plant a tree is 20 years ago, next best time is today. Start, start today. Get on it. Cause to your point, it does take time as well. for company listening that is behind.

You know, what would you prioritize in say, let's the first ninety days to reduce risk quickly and build the foundation correctly?

Kellie Macpherson (44:09)

I think there's just a lot of ensuring that the equipment that you're deploying is correct. So a big one is inverter settings, right? There's requirements for inverter settings and the standards are really specific. And so in the first ninety days is like, yeah, these are the Asleft settings, but are they actually compliant and ensuring that they're compliant? Yeah.

Wes Ashworth (44:26)

Yeah, good, good, easy starting place. Gives people a realistic starting place. I wanted to do that as well, too. Three years from now, right? So what will separate the renewable operators who earned long term trust from the ones who are still playing catch up? What will separate the ones that really get this right and do this well?

Kellie Macpherson (44:42)

Well They won't be on the radar of NERC because they won't be in trouble and they won't have fired financial penalties. I think at the end of the day, there'll be less friction in the industry, right? They're gonna be the ones that are like, yes, I'd like to sign an interconnection agreement with you. They're gonna not see the friction through the development process. They're not gonna see the friction through the monitoring and audit process. And, you know, it's really going to be, feeling more like a partnership.

Wes Ashworth (45:08)

Absolutely. I think a great place to land there because the industry's next phase again is not just about more capacity, it's about more trusted, reliable capacity. So this has been so great. Kellie, thank you so much for joining Green Giants. This is a fantastic conversation because it takes a topic that can sound technical or administrative from the outside and brings it back to what really matters, you know, that reliability, resilience, security, public trust. For everyone out there listening, the big takeaway is clear. Renewable energy is no longer a future resource sitting at the edge of the system.

It's central infrastructure. And that means the standards are rising, the risks are changing, and the best operators will be the ones who build compliance and cybersecurity into the way they develop, commission, and run assets every day. Thanks as always for listening to Green Giants Titans of Renewable Energy. If this conversation was valuable, please subscribe, rate the show, share it with your network, and check the show notes as well. These are the conversations that help the industry mature, and we appreciate you being a part of them. With that, we'll see you next week.