DEV Community

Alex Kane
Alex Kane

Posted on

n8n for EnergyTech & UtilityTech SaaS Vendors: 5 Automations for FERC Order 2222, NERC CIP-014, NRC 10 CFR §50.72, EPA CAA Title V, and PURPA Compliance

#n8n #security #automation #programming

n8n for EnergyTech & UtilityTech SaaS Vendors: 5 Automations for FERC Order 2222, NERC CIP-014, NRC 10 CFR §50.72, EPA CAA Title V, and PURPA Compliance

EnergyTech and UtilityTech SaaS platforms operate at the intersection of the most complex regulatory environment in any vertical. Your customers face NERC CIP physical security plans with $1M/day violation exposure, NRC 10 CFR §50.72 event notification clocks measured in hours, FERC Order 2222 DER aggregation market participation obligations, and EPA CAA Title V annual certification requirements — simultaneously.

If your platform routes any of this operational or compliance data through a cloud automation layer, that automation vendor inherits your compliance perimeter. Here are 5 n8n workflows your EnergyTech platform should be running today.

The EnergyTech Compliance Tier Map

Tier Compliance Flags Primary n8n Use Cases
UTILITY_DIGITAL_PLATFORM NERC_CIP_COVERED_ASSET, FERC_ORDER_2222_PARTICIPANT CIP-014 physical security tracking, DER aggregation telemetry, FERC Form 714
ENERGY_MANAGEMENT_SAAS EPA_CAA_TITLE_V_PERMIT, DOE_851_COVERED Title V deviation reporting, DOE worker safety events, FERC filing deadlines
DER_AGGREGATION_PLATFORM FERC_ORDER_2222_PARTICIPANT, PURPA_QUALIFYING_FACILITY ISO/RTO telemetry pipeline, settlement data audit trail, QF certification tracking
RENEWABLE_ENERGY_SAAS PURPA_QUALIFYING_FACILITY, EPA_CAA_TITLE_V_PERMIT QF Form 556 updates, ITC/PTC documentation, NEPA/CEQA records
DEMAND_RESPONSE_SAAS FERC_ORDER_745_PARTICIPANT Baseline measurement data, performance verification, settlement dispute records
ENERGY_ANALYTICS_SAAS NERC_CIP_COVERED_ASSET, SOC2_REQUIRED ICS/SCADA integration security, CISA ICS-CERT advisory monitoring, SOC2 audit
ENERGYTECH_STARTUP SOC2_REQUIRED Core compliance automation, webhook ingestion, Slack/Gmail alerting

Workflow 1: Tier-Segmented Customer Onboarding

Every EnergyTech customer arrives with a different regulatory posture. A utility digital transformation platform faces NERC CIP Electronic Security Perimeter requirements the moment they integrate with grid operations. A DER aggregation platform needs FERC Order 2222 telemetry audit trails. Route each customer to the right compliance context on Day 0.

{
  "name": "EnergyTech Tier-Segmented Customer Onboarding",
  "nodes": [
    {
      "id": "1",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "energytech-signup",
        "responseMode": "lastNode"
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "2",
      "name": "Code - Classify Tier",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const data = $input.first().json;\nconst tier = data.customer_tier || 'ENERGYTECH_STARTUP';\nconst msgs = {\n  'UTILITY_DIGITAL_PLATFORM': 'Note: NERC CIP-014-3 physical security plan required for transmission substations \u2014 annual review and third-party verification. Routing critical infrastructure monitoring data through cloud iPaaS creates an uncontrolled third-party data path that NERC auditors flag as a CIP-007 Electronic Security Perimeter violation. FERC Order 2222: DER aggregation participation in wholesale markets requires real-time telemetry and settlement data with FERC-mandated audit trails.',\n  'ENERGY_MANAGEMENT_SAAS': 'Note: EPA Clean Air Act Title V permit \u2014 annual compliance certification and deviation reporting within 10 days of quarter-end. FERC Form 714 annual electric control area reporting. DOE 10 CFR \u00a7851 worker safety program \u2014 enforcement action = $165K/day. Your platform holds the operational data regulators request in audits.',\n  'DER_AGGREGATION_PLATFORM': 'Note: FERC Order 2222 (issued 2020) \u2014 distributed energy resource aggregators must comply with ISO/RTO participation rules for wholesale market entry. PURPA \u00a7210 qualifying facility status affects interconnection rights. Real-time telemetry data routed through cloud automation = potential ISO/RTO market manipulation audit target.',\n  'RENEWABLE_ENERGY_SAAS': 'Note: FERC Form 556 QF certification for PURPA qualifying facilities. EPA CAA Title V if facility >100 tons/year criteria pollutants. DOE EERE grant compliance if funded \u2014 2 CFR \u00a7200 records retention 3 years. ITC/PTC tax credit documentation must survive IRS audit \u2014 your platform is the evidence trail.',\n  'DEMAND_RESPONSE_SAAS': 'Note: FERC Order 745 demand response compensation in wholesale markets \u2014 performance measurement data must meet ISO/RTO baseline methodology requirements. FERC Investigation and Enforcement Division (IED) can audit demand response settlement data. Incorrect baseline = market manipulation exposure under FPA \u00a7316A ($1M/day).',\n  'ENERGY_ANALYTICS_SAAS': 'Note: CISA ICS-CERT advisories for SCADA/ICS integration \u2014 your analytics platform connected to operational technology networks is in scope for ICS security reviews. NERC CIP-007-6 system security management if connected to BES (Bulk Electric System). SOC2 Type II required by most utility procurement teams.',\n  'ENERGYTECH_STARTUP': 'Welcome to FlowKit. Your onboarding is set up. Reach out anytime.'\n};\nreturn [{json: {customer_id: data.customer_id, email: data.email, company: data.company, tier, onboarding_note: msgs[tier] || msgs['ENERGYTECH_STARTUP']}}];"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "3",
      "name": "Gmail - Day 0 Welcome",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "={{$json.email}}",
        "subject": "={{$json.company}} is live on FlowKit \u2014 FERC/NERC CIP/NRC compliance automations ready",
        "message": "={{$json.onboarding_note}}\n\nYour FlowKit workflows are ready to activate."
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "4",
      "name": "Sheets - Log Onboarding",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "Onboarding!A:G",
        "dataMode": "autoMapInputData"
      },
      "position": [
        900,
        300
      ]
    }
  ],
  "connections": {
    "Webhook": {
      "main": [
        [
          {
            "node": "Code - Classify Tier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Classify Tier": {
      "main": [
        [
          {
            "node": "Gmail - Day 0 Welcome",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Day 0 Welcome": {
      "main": [
        [
          {
            "node": "Sheets - Log Onboarding",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 2: FERC/NERC CIP/EPA/NRC Regulatory Deadline Tracker

The calendar that keeps $1M/day exposure off the table. Energy and utility compliance deadlines operate on multiple independent timelines: NERC CIP-014 annual physical security plan review, EPA Title V quarterly deviation reports (10 days after quarter-end), FERC Form 714 annual filing (June 1), NRC §50.72 event notification windows (4, 8, 24 hours). This workflow monitors your entire compliance calendar and fires alerts at 30-day, 7-day, and overdue thresholds.

{
  "name": "FERC/NERC CIP/EPA/NRC Regulatory Deadline Tracker",
  "nodes": [
    {
      "id": "1",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 6 * * *"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "2",
      "name": "Sheets - Compliance Calendar",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "ComplianceDeadlines!A:J"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "3",
      "name": "Code - Check Deadlines",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const rows = $input.all().map(i => i.json);\nconst today = new Date();\nconst alerts = [];\n\nconst deadlineTypes = {\n  'NERC_CIP_014_ANNUAL_REVIEW': {label: 'NERC CIP-014-3 Physical Security Plan', period: 'ANNUAL', penalty: '$1M/violation/day', note: 'NERC CIP-014-3 R3: annual review + third-party verification of physical security plan. Transmission substations \u2265200 kV or identified critical facilities.'},\n  'NERC_CIP_007_PATCH_QUARTERLY': {label: 'NERC CIP-007-6 Patch Management', period: 'QUARTERLY', penalty: '$1M/violation/day', note: 'CIP-007-6 R2.2: evaluate security patches within 35 days of release. Missing quarter = audit finding.'},\n  'FERC_FORM_714_ANNUAL': {label: 'FERC Form 714 Electric Control Area Report', period: 'ANNUAL by Jun 1', penalty: '$1M/day FPA \u00a7316A', note: 'Annual Electric Control Area and Planning Area Report. Must reflect prior calendar year data. Late filing = FERC enforcement referral.'},\n  'EPA_CAA_TITLE_V_ANNUAL': {label: 'EPA CAA Title V Annual Compliance Certification', period: 'ANNUAL by Mar 1', penalty: '$25K-$100K/day', note: 'Title V \u00a770.6(c)(5): responsible official must certify compliance with all permit conditions annually. Late = permit deviation.'},\n  'EPA_CAA_TITLE_V_QUARTERLY_DEVIATION': {label: 'EPA Title V Quarterly Deviation Report', period: 'QUARTERLY within 30 days', penalty: '$25K-$100K/day', note: 'Title V \u00a770.6(a)(3)(iii)(B): deviations from permit conditions must be reported within 30 days of quarter-end.'},\n  'NRC_50_72_EVENT': {label: 'NRC 10 CFR \u00a750.72 Event Notification', period: 'IMMEDIATE 4h/8h/24h', penalty: '$140K/violation', note: 'Immediate 4h: ENS notification for reactor shutdown, loss of safety function. 8h: personnel injury, security threat. 24h: other non-emergency reportable conditions. SaaS platforms used by NRC licensees: event data flowing through cloud automation = NRC inspection scope.'},\n  'FERC_ORDER_2222_COMPLIANCE': {label: 'FERC Order 2222 DER Aggregation Participation Rules', period: 'ONGOING + ISO/RTO deadlines', penalty: '$1M/day FPA \u00a7316A', note: 'ISO/RTO tariff compliance for DER aggregation \u2014 telemetry data, settlement records, dispatch history. FERC IED can audit wholesale market participation data.'},\n  'PURPA_QF_CERTIFICATION': {label: 'PURPA FERC Form 556 QF Self-Certification', period: 'AS NEEDED + updates', penalty: 'Loss of PURPA rights', note: '18 CFR \u00a7292.207: QF self-certification via FERC Form 556. Updates required when ownership, technology, or capacity changes.'},\n  'DOE_851_ANNUAL_REVIEW': {label: 'DOE 10 CFR \u00a7851 Worker Safety Program', period: 'ANNUAL review', penalty: '$165K/day \u00a7851.25', note: 'DOE contractor safety program annual review. Any platform used by DOE contractors: safety event data in cloud automation = DOE audit exposure.'},\n  'SOC2_TYPE2_ANNUAL': {label: 'SOC2 Type II Audit', period: 'ANNUAL', penalty: 'Contract breach', note: 'Annual SOC2 Type II required by most utility and energy company procurement.'},\n  'ANNUAL_PENTEST': {label: 'Annual Penetration Test', period: 'ANNUAL', penalty: 'Contract breach / NERC CIP finding', note: 'NERC CIP-007-6 and utility procurement requirements. Annual pentest scope must include cloud automation integrations.'},\n  'INCIDENT_RESPONSE_PLAN_REVIEW': {label: 'Incident Response Plan Review', period: 'ANNUAL', penalty: 'NERC CIP audit finding', note: 'NERC CIP-008-6 Cyber Security Incident Response Plans. Annual review + tabletop exercise required.'}\n};\n\nfor (const row of rows) {\n  if (!row.deadline_type || !row.due_date) continue;\n  const dueDate = new Date(row.due_date);\n  const daysLeft = Math.floor((dueDate - today) / (1000 * 60 * 60 * 24));\n  const config = deadlineTypes[row.deadline_type] || {label: row.deadline_type, penalty: 'Unknown', note: ''};\n  \n  if (daysLeft < 0) {\n    alerts.push({deadline_type: row.deadline_type, label: config.label, company: row.company, due_date: row.due_date, days_left: daysLeft, status: 'OVERDUE', penalty: config.penalty, note: config.note, period: config.period});\n  } else if (daysLeft <= 7) {\n    alerts.push({deadline_type: row.deadline_type, label: config.label, company: row.company, due_date: row.due_date, days_left: daysLeft, status: 'CRITICAL', penalty: config.penalty, note: config.note, period: config.period});\n  } else if (daysLeft <= 30) {\n    alerts.push({deadline_type: row.deadline_type, label: config.label, company: row.company, due_date: row.due_date, days_left: daysLeft, status: 'WARNING', penalty: config.penalty, note: config.note, period: config.period});\n  }\n}\n\nif (alerts.length === 0) return [{json: {status: 'ALL_CLEAR', message: 'No energy/utility compliance deadlines due in next 30 days', check_date: today.toISOString().split('T')[0]}}];\nreturn alerts.map(a => ({json: a}));"
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "4",
      "name": "IF - Alerts Exist",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$json.deadline_type}}",
              "operation": "isNotEmpty"
            }
          ]
        }
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "5",
      "name": "Slack - #compliance-deadlines",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "operation": "post",
        "channel": "#compliance-deadlines",
        "text": "ENERGY COMPLIANCE: {{$json.status}} \u2014 {{$json.label}} | Due: {{$json.due_date}} ({{$json.days_left}} days) | Penalty: {{$json.penalty}}"
      },
      "position": [
        1120,
        200
      ]
    },
    {
      "id": "6",
      "name": "Gmail - Compliance Officer",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "compliance@yourcompany.com",
        "subject": "{{$json.status}}: {{$json.label}} \u2014 {{$json.company}} due {{$json.due_date}}",
        "message": "Deadline: {{$json.label}}\nStatus: {{$json.status}}\nDue: {{$json.due_date}} ({{$json.days_left}} days)\nPenalty: {{$json.penalty}}\nPeriod: {{$json.period}}\nNote: {{$json.note}}"
      },
      "position": [
        1120,
        380
      ]
    },
    {
      "id": "7",
      "name": "Sheets - Deadline Log",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "DeadlineAlerts!A:J",
        "dataMode": "autoMapInputData"
      },
      "position": [
        1340,
        300
      ]
    }
  ],
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Sheets - Compliance Calendar",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Sheets - Compliance Calendar": {
      "main": [
        [
          {
            "node": "Code - Check Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Check Deadlines": {
      "main": [
        [
          {
            "node": "IF - Alerts Exist",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Alerts Exist": {
      "main": [
        [
          {
            "node": "Slack - #compliance-deadlines",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Gmail - Compliance Officer",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack - #compliance-deadlines": {
      "main": [
        [
          {
            "node": "Sheets - Deadline Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Compliance Officer": {
      "main": [
        [
          {
            "node": "Sheets - Deadline Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Energy compliance deadline reference:

  • NERC CIP-014-3 → annual review + third-party verification → $1M/violation/day
  • NERC CIP-007-6 patches → evaluate within 35 days of release → $1M/violation/day
  • FERC Form 714 → annual by June 1 → FPA §316A $1M/day
  • EPA CAA Title V → annual certification by March 1, quarterly deviation 10 days after quarter-end → $25K-$100K/day
  • NRC §50.72 → 4h/8h/24h depending on severity → $140K/violation

Workflow 3: EnergyTech API Health Monitor (15-Minute Interval)

Because a 4-hour NRC notification clock doesn't pause for API downtime. NRC 10 CFR §50.72 requires event notification within 4 hours of detection. If your incident reporting API is down when a reportable event occurs, the clock still runs. This workflow polls five critical endpoints every 15 minutes and fires to Slack the moment any endpoint goes down or breaches its SLA.

{
  "name": "EnergyTech API Health Monitor",
  "nodes": [
    {
      "id": "1",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "*/15 * * * *"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "2",
      "name": "Code - Define Endpoints",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "return [\n  {json: {name: 'der_aggregation_api', url: process.env.DER_API_URL || 'https://api.yourplatform.com/health', context: 'FERC Order 2222 DER telemetry \u2014 market participation data. ISO/RTO settlement depends on real-time availability.', sla_ms: 500}},\n  {json: {name: 'grid_monitoring_api', url: process.env.GRID_API_URL || 'https://api.yourplatform.com/grid/health', context: 'NERC CIP-007 Electronic Security Perimeter. Grid monitoring data must not flow through uncontrolled cloud paths.', sla_ms: 300}},\n  {json: {name: 'compliance_reporting_api', url: process.env.COMPLIANCE_API_URL || 'https://api.yourplatform.com/compliance/health', context: 'EPA CAA Title V + FERC Form 714 reporting pipeline. Outage during certification window = permit deviation.', sla_ms: 1000}},\n  {json: {name: 'demand_response_api', url: process.env.DR_API_URL || 'https://api.yourplatform.com/dr/health', context: 'FERC Order 745 demand response performance measurement. Baseline data loss = settlement dispute exposure.', sla_ms: 500}},\n  {json: {name: 'incident_reporting_api', url: process.env.INCIDENT_API_URL || 'https://api.yourplatform.com/incidents/health', context: 'NRC 10 CFR \u00a750.72 event notification pipeline. 4-hour clock starts at event detection \u2014 API outage delays notification = \u00a750.72 violation.', sla_ms: 200}}\n];"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "3",
      "name": "HTTP Request - Health Check",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {
        "method": "GET",
        "url": "={{$json.url}}",
        "timeout": 10000,
        "options": {
          "response": {
            "response": {
              "neverError": true
            }
          }
        }
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "4",
      "name": "Code - Evaluate Health",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const result = $input.first().json;\nconst meta = $('Code - Define Endpoints').first().json;\nconst statusCode = result.statusCode || result.status || 0;\nconst responseTime = result.headers ? parseInt(result.headers['x-response-time'] || 0) : 0;\nconst healthy = statusCode >= 200 && statusCode < 300;\nconst slowSla = responseTime > meta.sla_ms;\nreturn [{\n  json: {\n    endpoint: meta.name, url: meta.url, context: meta.context,\n    status_code: statusCode, response_time_ms: responseTime,\n    health: healthy ? 'UP' : 'DOWN',\n    sla_breach: slowSla,\n    alert: !healthy || slowSla,\n    timestamp: new Date().toISOString()\n  }\n}];"
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "5",
      "name": "IF - Alert",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{$json.alert}}",
              "value2": true
            }
          ]
        }
      },
      "position": [
        1120,
        300
      ]
    },
    {
      "id": "6",
      "name": "Slack - #api-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "operation": "post",
        "channel": "#api-alerts",
        "text": "ENERGYTECH API {{$json.health}}: {{$json.endpoint}} | HTTP {{$json.status_code}} | {{$json.response_time_ms}}ms | Context: {{$json.context}}"
      },
      "position": [
        1340,
        200
      ]
    },
    {
      "id": "7",
      "name": "Sheets - Health Log",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "APIHealth!A:I",
        "dataMode": "autoMapInputData"
      },
      "position": [
        1340,
        380
      ]
    }
  ],
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Code - Define Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Define Endpoints": {
      "main": [
        [
          {
            "node": "HTTP Request - Health Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Request - Health Check": {
      "main": [
        [
          {
            "node": "Code - Evaluate Health",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Evaluate Health": {
      "main": [
        [
          {
            "node": "IF - Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Alert": {
      "main": [
        [
          {
            "node": "Slack - #api-alerts",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Sheets - Health Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Endpoint context:

  • der_aggregation_api — FERC Order 2222 telemetry: ISO/RTO settlement depends on real-time data
  • grid_monitoring_api — NERC CIP-007 ESPerimeter: outage = uncontrolled data path audit finding
  • compliance_reporting_api — EPA Title V + FERC Form 714 pipeline
  • demand_response_api — FERC Order 745 baseline measurement: outage = settlement dispute
  • incident_reporting_api — NRC §50.72 pipeline: 4-hour clock does not pause for outages

Workflow 4: EnergyTech Regulatory Incident Pipeline

Eight incident types. Eight different regulators. Eight different clocks. An NRC event notification must reach the NRC Operations Center within 4 hours. A NERC CIP cyber incident must reach E-ISAC within 1 hour (and simultaneously trigger CISA and FBI notification per FERC Order 848). An EPA Title V deviation report is due 10 days after quarter-end. This workflow classifies every incoming incident event and routes it with the correct deadline and action to the right team.

{
  "name": "EnergyTech Regulatory Incident Pipeline",
  "nodes": [
    {
      "id": "1",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "energy-incident",
        "responseMode": "lastNode"
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "2",
      "name": "Code - Classify Incident",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const data = $input.first().json;\nconst type = data.incident_type || 'OPERATIONAL_EVENT';\nconst clocks = {\n  'NRC_EMERGENCY_NOTIFICATION': {deadline: '4 HOURS', clock: 'NRC 10 CFR \u00a750.72(a) \u2014 immediate 4-hour ENS notification for conditions in \u00a750.72(a)(1): reactor shutdown, loss of safety function, ECCS actuation. Call 301-816-5100.', regulator: 'NRC Operations Center', action: 'IMMEDIATE: call NRC Emergency Notification System 301-816-5100. Preserve all platform event logs \u2014 NRC inspection scope.'},\n  'NRC_FOUR_HOUR_NOTIFICATION': {deadline: '4 HOURS', clock: 'NRC 10 CFR \u00a750.72(b)(2) \u2014 4-hour notification for safety system actuations, major loss of emergency AC power, fire protection system actuation. Penalty: $140K/violation.', regulator: 'NRC Operations Center', action: '4 HOURS: notify NRC via ENS. Retain all platform logs. NRC Region Office follow-up within 24h.'},\n  'NRC_EIGHT_HOUR_NOTIFICATION': {deadline: '8 HOURS', clock: 'NRC 10 CFR \u00a750.72(b)(3) \u2014 8-hour notification for personnel injury from radiological event, security threat, or other non-emergency reportable conditions.', regulator: 'NRC Operations Center', action: '8 HOURS: call NRC ENS 301-816-5100. Document event timeline in platform.'},\n  'NERC_CIP_CYBER_INCIDENT': {deadline: '1 HOUR to ESISAC', clock: 'NERC CIP-008-6 R1.3 \u2014 reportable cyber security incidents to E-ISAC within 1 hour. FERC Order 848 also requires CISA/FBI notification. $1M/violation/day.', regulator: 'NERC E-ISAC + CISA + FBI', action: '1 HOUR: report to E-ISAC (https://www.eisac.com). Simultaneously notify CISA (CISA.gov/report) and FBI. Preserve all forensic evidence.'},\n  'FERC_MARKET_MANIPULATION': {deadline: 'IMMEDIATE', clock: 'FPA \u00a7316A \u2014 FERC IED investigation. Self-reporting early = significant penalty reduction. $1M/violation/day civil penalty + disgorgement of profits.', regulator: 'FERC Office of Enforcement', action: 'IMMEDIATE: engage energy regulatory counsel. Preserve all market data, settlement records, telemetry logs. Do not delete platform logs.'},\n  'EPA_CAA_TITLE_V_DEVIATION': {deadline: '10 DAYS after quarter-end', clock: 'EPA CAA Title V \u00a770.6(a)(3)(iii)(B) \u2014 permit deviations must be reported within 10 days of quarter-end. $25K-$100K/day civil penalty.', regulator: 'EPA Regional Administrator', action: '10 DAYS: file deviation report with state permitting authority. Document root cause and corrective action in platform.'},\n  'PURPA_INTERCONNECTION_DISPUTE': {deadline: 'VARIES by ISO/RTO', clock: 'PURPA \u00a7210 + FERC Order 2003 \u2014 QF interconnection disputes must be filed with FERC within applicable ISO/RTO dispute window. FPA \u00a7206 complaint = 5-year rate refund exposure.', regulator: 'FERC', action: 'File FERC complaint promptly. Preserve all interconnection agreement data and telemetry records.'},\n  'OPERATIONAL_EVENT': {deadline: 'INTERNAL', clock: 'No mandatory regulatory reporting. Internal review and documentation required per platform SLA.', regulator: 'Internal', action: 'Document in platform log. Determine if any regulatory reporting thresholds met.'}\n};\nconst clock = clocks[type] || clocks['OPERATIONAL_EVENT'];\nreturn [{json: {incident_id: data.incident_id || ('ENE-' + Date.now()), incident_type: type, facility: data.facility, description: data.description, ...clock, reported_by: data.reported_by, timestamp: new Date().toISOString()}}];"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "3",
      "name": "Slack - #energy-incidents",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "operation": "post",
        "channel": "#energy-incidents",
        "text": "ENERGY INCIDENT: {{$json.incident_type}} | Facility: {{$json.facility}} | Clock: {{$json.deadline}} | Action: {{$json.action}}"
      },
      "position": [
        680,
        200
      ]
    },
    {
      "id": "4",
      "name": "Gmail - Compliance + Legal",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "compliance@yourcompany.com",
        "subject": "ENERGY INCIDENT: {{$json.incident_type}} \u2014 {{$json.deadline}} DEADLINE",
        "message": "Incident ID: {{$json.incident_id}}\nType: {{$json.incident_type}}\nFacility: {{$json.facility}}\nDeadline: {{$json.deadline}}\nClock: {{$json.clock}}\nRegulator: {{$json.regulator}}\nRequired Action: {{$json.action}}\nTimestamp: {{$json.timestamp}}"
      },
      "position": [
        680,
        380
      ]
    },
    {
      "id": "5",
      "name": "Sheets - Incident Log",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "IncidentLog!A:L",
        "dataMode": "autoMapInputData"
      },
      "position": [
        900,
        300
      ]
    }
  ],
  "connections": {
    "Webhook": {
      "main": [
        [
          {
            "node": "Code - Classify Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Classify Incident": {
      "main": [
        [
          {
            "node": "Slack - #energy-incidents",
            "type": "main",
            "index": 0
          },
          {
            "node": "Gmail - Compliance + Legal",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack - #energy-incidents": {
      "main": [
        [
          {
            "node": "Sheets - Incident Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - Compliance + Legal": {
      "main": [
        [
          {
            "node": "Sheets - Incident Log",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

EnergyTech incident clock reference:

  • NRC Emergency (§50.72(a)) → 4 hours → ENS 301-816-5100
  • NRC 4-hour notification (§50.72(b)(2)) → 4 hours → same
  • NRC 8-hour notification (§50.72(b)(3)) → 8 hours → same
  • NERC CIP cyber incident (CIP-008-6) → 1 hour → E-ISAC + CISA + FBI
  • FERC market manipulation (FPA §316A) → IMMEDIATE → $1M/day + disgorgement
  • EPA Title V deviation → 10 days after quarter-end → $25K-$100K/day

Workflow 5: EnergyTech Weekly KPI Dashboard

Revenue, operations, and compliance in one Monday morning email to CEO, CCO, and CISO. Compliance alert logic fires automatically when NERC CIP findings are open, NRC reportable events need verification, or EPA Title V deviations are unresolved.

{
  "name": "EnergyTech Weekly KPI Dashboard",
  "nodes": [
    {
      "id": "1",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "2",
      "name": "Sheets - Pull KPI Data",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "WeeklyKPIs!A:P"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "3",
      "name": "Code - Build KPI Report",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const rows = $input.all().map(i => i.json);\nconst week = rows[0] || {};\nconst report = {\n  period: `Week ending ${new Date().toISOString().split('T')[0]}`,\n  active_customers: week.active_customers || 0,\n  new_customers_7d: week.new_customers_7d || 0,\n  churned_7d: week.churned_7d || 0,\n  mrr_usd: week.mrr_usd || 0,\n  nerc_cip_open_findings: week.nerc_cip_open_findings || 0,\n  ferc_compliance_events_7d: week.ferc_compliance_events_7d || 0,\n  nrc_reportable_events_7d: week.nrc_reportable_events_7d || 0,\n  epa_title_v_deviations_open: week.epa_title_v_deviations_open || 0,\n  der_aggregation_mw_managed: week.der_aggregation_mw_managed || 0,\n  demand_response_events_7d: week.demand_response_events_7d || 0,\n  api_uptime_pct_7d: week.api_uptime_pct_7d || 0,\n  incidents_7d: week.incidents_7d || 0\n};\n\nconst alerts = [];\nif (report.nerc_cip_open_findings > 0) alerts.push(`NERC CIP: ${report.nerc_cip_open_findings} open findings \u2014 $1M/day exposure until resolved`);\nif (report.nrc_reportable_events_7d > 0) alerts.push(`NRC: ${report.nrc_reportable_events_7d} reportable events this week \u2014 verify \u00a750.72 filings complete`);\nif (report.epa_title_v_deviations_open > 0) alerts.push(`EPA Title V: ${report.epa_title_v_deviations_open} open deviations \u2014 10-day reporting clock may be running`);\nif (report.api_uptime_pct_7d < 99.5) alerts.push(`API uptime ${report.api_uptime_pct_7d}% \u2014 below SLA threshold`);\n\nreturn [{json: {...report, compliance_alerts: alerts.join('; ') || 'None', alert_count: alerts.length}}];"
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "4",
      "name": "Gmail - CEO + CCO + CISO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "ceo@yourcompany.com",
        "cc": "cco@yourcompany.com,ciso@yourcompany.com",
        "subject": "EnergyTech Weekly KPI \u2014 {{$json.period}}",
        "message": "PERIOD: {{$json.period}}\n\nBUSINESS\nActive Customers: {{$json.active_customers}}\nNew (7d): {{$json.new_customers_7d}}\nChurned (7d): {{$json.churned_7d}}\nMRR: ${{$json.mrr_usd}}\n\nOPERATIONS\nDER MW Managed: {{$json.der_aggregation_mw_managed}}\nDemand Response Events (7d): {{$json.demand_response_events_7d}}\nAPI Uptime (7d): {{$json.api_uptime_pct_7d}}%\nIncidents (7d): {{$json.incidents_7d}}\n\nCOMPLIANCE\nNERC CIP Open Findings: {{$json.nerc_cip_open_findings}}\nFERC Compliance Events (7d): {{$json.ferc_compliance_events_7d}}\nNRC Reportable Events (7d): {{$json.nrc_reportable_events_7d}}\nEPA Title V Open Deviations: {{$json.epa_title_v_deviations_open}}\n\nALERTS: {{$json.compliance_alerts}}"
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "5",
      "name": "Sheets - KPI History",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "spreadsheetId": "YOUR_SHEET_ID",
        "range": "KPIHistory!A:M",
        "dataMode": "autoMapInputData"
      },
      "position": [
        1120,
        300
      ]
    }
  ],
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Sheets - Pull KPI Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Sheets - Pull KPI Data": {
      "main": [
        [
          {
            "node": "Code - Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Code - Build KPI Report": {
      "main": [
        [
          {
            "node": "Gmail - CEO + CCO + CISO",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gmail - CEO + CCO + CISO": {
      "main": [
        [
          {
            "node": "Sheets - KPI History",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

The NERC CIP Problem Your Cloud Automation Vendor Creates

NERC CIP-007-6 defines the Electronic Security Perimeter (ESP) as the boundary around critical cyber assets connected to the Bulk Electric System. Any cloud automation platform (Zapier, Make, n8n Cloud) that receives grid monitoring data, DER telemetry, or compliance reporting data from inside the ESP becomes a node in your CIP compliance boundary.

NERC auditors don't ask whether the automation vendor intended to be in scope. They ask whether the data path crosses the ESP boundary. If it does, the vendor is a third-party service provider under CIP-013-2 supply chain risk management requirements — and every quarterly audit will include a row for that vendor.

n8n self-hosted keeps the automation runtime inside your controlled infrastructure. The workflows above are designed so the compliance data never leaves your environment unless you configure it to.

All workflows available at stripeai.gumroad.com — grab the full bundle or individual templates.

FlowKit — n8n automation templates for regulated industries.

Top comments (0)