Mr. Khan has 20+ years experience in IT security and compliance. He has been involved in compliance initiatives around the world with a focus on energy, finance, telecommunications, and government. From 2016 to 2020, he was a NERC CIP Auditor for the Northeast Power Coordinating Council. From 2009 to 2016, Mr. Khan was a Senior NERC CIP compliance advisor for one of North America’s largest electric utilities, Hydro Quebec, a challenging and unique environment. He has 10+ years of hands-on experience with NERC CIP including on-site audits, internal controls evaluations, annual CIP certifications, potential violation reporting and handling, mitigation plans, and technical feasibility exceptions. His broad IT security and compliance experience combined with an operations background allow him to balance the black and white nature of compliance with the realities of real-time operations. His understanding of internal control frameworks and risk-based compliance concepts allow him to quickly adapt to various customer environments and objectives. Mr. Khan has held the CISSP, CISA, CISM, and ISO 27002 Lead Implementer certifications and is an accomplished CISSP and IT security instructor. He is fluent in French and English. Since 2009, Mr. Khan’s CIP experience includes:• NERC CIP Auditor for the NPCC – 2016 to 2020• Audit lead/backup for Low Impact Cyber Assets and new version of CIP-005, CIP-007, CIP-010 CIP-012, CIP-013 • « Trusted advisor » to Hydro Quebec’s senior management for NERC CIP compliance initiatives. Assisted with the development of tactics and strategies supporting NERC CIP security program development, deployment, operations and compliance. • Internal Control Evaluations (ICE) and Risk-based Compliance program implementation• NPCC Cyber Outreach Team Member • Senior customer advisor for NERC CIP audit and evaluations• Development and deployment of NERC CIP compliance program including:• Governance and policy• Operations security model• Personnel controls• Physical and electronic perimeter control• Compliance evaluation and reporting• New technology deployments (MPLS, virtualisation)• CISSP Instructor