00:00Can you prove that this meter reading wasn't altered?
00:03NERCIC IPE, FIRSC reliability standards, NISCSEF 2.0.
00:10They're all moving toward exactly this question.
00:13Not is the environment protected, something harder.
00:17Can you demonstrate that a specific operational value is authentic and unmodified
00:21since it was created at the source device?
00:24Your firewall can't answer that.
00:27Neither can your SIM.
00:28Neither can your intrusion detection system.
00:31Those tools secure the perimeter.
00:33They don't prove the integrity of individual data records.
00:36The gap is specific.
00:38And it's the gap that matters in a NERCIC IP audit,
00:42a FERC enforcement review, or a post-incident investigation.
00:47Firewalls and SIEM, they secure the environment.
00:50They don't prove what happened to individual records inside it.
00:53Internal audit logs, they can be altered
00:55by anyone with database access, including administrators, including, if we're honest, the operator.
01:03Encryption at rest proves confidentiality.
01:06It doesn't prove the data wasn't replaced after it was stored.
01:10Access controls restrict who enters.
01:12Can't prove what authorized users did once inside.
01:15None of these answer the question FERC or a CIP auditor will actually ask in a dispute.
01:21Can you prove this value is what the source device measured and that it hasn't been touched since?
01:27Grid Veritas composes three well-understood cryptographic primitives into one verifiable chain of custody.
01:331. Sign at source.
01:35Every measurement is signed at the edge device, over the payload hash, the source identifier,
01:40the sequence number, and the timestamp.
01:42The signature is independent of the transport path.
01:45Alter the value in transit, the signature breaks.
01:482. Merkle provenance.
01:50Attestations are aggregated into a hash-linked Merkle tree.
01:54Any later change to a stored record shifts the route.
01:56The tampering becomes structurally visible.
01:593. External anchor.
02:01The Merkle routes are submitted to an independent RFC 3161 timestamping authority.
02:07Only the hash leaves the system, never the operational data itself.
02:11Because the witness is external, tampering is detectable even against the platform operator.
02:16Why not blockchain?
02:17Because the property we actually need is simple.
02:20Recorded history cannot be rewritten undetected.
02:23And an independent signed time witness achieves exactly this, at constant per-period cost,
02:29without a consensus protocol, without throughput overhead, without a token, without a new trust dependency.
02:35RFC 3161 is a 20-year-old open internet standard supported by every major certificate authority.
02:41The tokens it produces are in a standardized format, readable by FERC, by CIP auditors, by courts.
02:48No new infrastructure, no new trust assumption, no vendor lock-in.
02:53For U.S. energy operators, that's not a compromise. That's the right engineering choice.
02:58Here's what tamper evident actually means in Grid Veritas.
03:02Even the operator cannot alter the past undetected.
03:05The RFC 3161 anchor is held by an independent time-stamping authority.
03:11Not by Grid Veritas. Not by the utility.
03:14Alter any record after that anchor exists, the root changes, the anchor breaks.
03:20The mismatch is detectable.
03:22And any authorized party can verify this.
03:24F-E-R-C, a CIP auditor, an insurance company investigating a claim, a partner in a contractual dispute.
03:32Without trusting Grid Veritas, without trusting the utility operator, the verification is mathematical, not reputational.
03:41That is the difference between, we have good logs, and, here is cryptographic proof that holds up in a regulatory
03:48proceeding.
03:48Around the cryptographic core, several supporting mechanisms address adjacent concerns.
03:53Replay protection.
03:55A unique constraint on source and sequence number.
03:58Replayed readings are rejected at ingest, not just logged.
04:02Append-only storage.
04:03The database application role cannot execute, update, or delete.
04:07Enforced at the PostgreSQL permission layer.
04:10The record store cannot be mutated, even if the application layer is compromised.
04:15Statistical anomaly detection.
04:17Off the critical path.
04:19Sequence gaps.
04:20Invalid signature rate spikes.
04:22Source silence.
04:24Deterministic thresholds.
04:26Not machine learning.
04:27A local AI audit assistant.
04:29Retrieval augmented.
04:31Restricted to answering questions over retrieved facts.
04:34Never in the verification path.
04:36Runs locally.
04:37No data leaves the operator environment.
04:40Exactly the right scope for a CIP-regulated environment.
04:44And standard security controls.
04:46JWT roles.
04:47Rate limiting.
04:49Optional mutual TLS on ingest.
04:51An append-only audit trail of all API operations.
04:54The U.S. regulatory context is specific, and it's moving fast.
04:58N-E-R-C-C-I-P.
05:00Standards CIP-007 and CIP-010 address system security management and configuration change management.
05:10The requirement for evidence of data integrity and audit trail authenticity is already there.
05:16The gap is in whether operators can actually produce that evidence for individual records.
05:20F-E-R-C.
05:22Order 887 and the broader enforcement posture around reliability standards are demanding demonstrable provenance evidence in metering and operational data
05:31systems.
05:32We have logs is not holding up the way it used to.
05:35N-I-S-T-C-S-F 2.0.
05:39Grid Veritas maps directly to PR.DS-1 and PR.DS-2 under the protect function.
05:46Data integrity at rest and in transit.
05:49And to DE.C-M-1 under detect.
05:52Monitoring for anomalies and events.
05:55State PUCs.
05:57Increasingly requesting cybersecurity posture evidence, particularly from metering data.
06:02Grid Veritas produces that evidence continuously and automatically, without additional manual work from the compliance team.
06:08We want to be upfront about where this is.
06:11Grid Veritas is a functional, running MVP.
06:15The full stack works.
06:17Spring Boot Core.
06:18Go Edge Agent.
06:19PostgreSQL with append-only enforcement.
06:22React Console.
06:24Containerized with a CI pipeline.
06:26The cryptographic proof chain works end-to-end.
06:29Attestations are signed, chained, anchored, and verifiable.
06:33Single instance by design.
06:35What it is not yet?
06:37It is not a NERKEAP certified product.
06:40High availability.
06:41Hardware security module integration beyond the prototype level.
06:45Certificate revocation checking.
06:48And independent third-party security assurance are explicitly deferred to a pilot phase.
06:53The throughput numbers I cite, greater than 1,000 attestations per second, are design targets.
06:58They have not been validated under controlled load testing.
07:02The contribution is not new cryptography.
07:05It's the composition of three well-understood standards into a practical, auditable integrity layer for the US energy sector, with
07:13honest scoping throughout.
07:14I'm looking for US pilot partners in the energy sector.
07:17Specifically, transmission and distribution operators, generation companies across all fuel types, and RTOs or ISOs who want to test demonstrable
07:25data integrity in one clearly scoped, CIP-relevant scenario.
07:30What a pilot looks like.
07:31We define one scenario with a clear boundary.
07:34We establish your current baseline first.
07:36Audit hours per CIP compliance cycle.
07:39Incident investigation time.
07:40The time it takes your team to produce evidence for a FERC inquiry.
07:44We measure against that baseline.
07:46We don't claim whatever number comes out.
07:48We measure against what we set before we start.
07:50Before any commitment, I'll run a 15-minute live tamper demonstration.
07:54We establish attestations, verify them, alter one record, and show the anchor mismatch is detectable.
08:00Real system. Real cryptography.
08:03Feedback and critical questions are explicitly welcome.
08:06This is an MVP stage prototype.
08:08The pilot is where we find out what the real-world CIP integration constraints look like.
08:13Oliver Botemer.
08:15Oliver at esoftworks.consulting.
08:17Grid Veritas.
08:19Verifiable data integrity for US critical energy infrastructure.
08:22Not tamper-proof, tamper-evident.
08:25The distinction is what makes it honest, and what holds up in an FERC proceeding, a CIP audit, or a
08:32legal dispute about metering data.
08:34No system prevents a determined attacker with full access from attempting to alter records.
08:40What Grid Veritas guarantees is that any such alteration is detectable, cryptographically, by an independent party, without trusting the operator.
08:49For the question NERC, CIP, and FERC are moving toward, can you prove this reading wasn't altered?
08:55That's the answer.
08:57Oliver Botemer.
08:58E-softworks.consulting.
