Cyber Security Standards Update: Version 5
|
|
|
- Joshua Bryant
- 8 years ago
- Views:
Transcription
1 Cyber Security Standards Update: Version 5 January 17, 2013 Scott Mix, CISSP CIP Technical Manager
2 Agenda Version 5 Impact Levels Format Features 2 RELIABILITY ACCOUNTABILITY
3 CIP Standards Version 5 CIP Version 5 Draft 4 Final Version Approved by industry on Nov 5, 2012 Approved by NERC Board of Trustees on Nov Filing to FERC and other regulators in progress 3 RELIABILITY ACCOUNTABILITY
4 CIP Standards Version 5 CIP 002 5: BES Cyber Asset and BES Cyber System Categorization CIP 003 5: Security Management Controls CIP 004 5: Personnel and Training CIP 005 5: Electronic Security Perimeter(s) CIP 006 5: Physical Security of BES Cyber Systems CIP 007 5: Systems Security Management CIP 008 5: Incident Reporting and Response Planning CIP 009 5: Recovery Plans for BES Cyber Assets and Systems CIP 010 1: Configuration Management and Vulnerability Assessments CIP 011 1: Information Protection 4 RELIABILITY ACCOUNTABILITY
5 CIP Standards Version 5 New / Modified Terms: BES Cyber Asset BES Cyber System BES Cyber System Information CIP Exceptional Circumstance CIP Senior Manager Control Center Cyber Assets Cyber Security Incident Dial up Connectivity Electronic Access Control and Monitoring Systems (EACMS) Electronic Access Point (EAP) Electronic Security Perimeter (ESP) External Routable Connectivity Interactive Remote Access Intermediate Device Physical Access Control Systems (PACS) Physical Security Perimeter (PSP) Protected Cyber Asset (PCA) Reportable Cyber Security Incident 5 RELIABILITY ACCOUNTABILITY
6 Retired Terms Critical Assets Critical Cyber Assets CIP Standards Version 5 6 RELIABILITY ACCOUNTABILITY
7 CIP 002 CIP Standards Version 5 Builds on bright lines in CIP Version 4 Critical Asset control centers High Other Version 4 Critical Assets Medium Larger Version 4 non critical asset control centers Medium Transmission now looking at capacity rather than number of lines at a voltage level Catch all category for non specifically categorized Low o Something everywhere within the BES o Programmatic requirement: CIP Requirement R2 7 RELIABILITY ACCOUNTABILITY
8 High Impact Large Control Centers CIP 003 through 009 plus Medium Impact Generation and Transmission Control Centers Similar to CIP 003 to 009 V4 All other BES Cyber Systems (Low Impact) must implement a policy to address: Cybersecurity Awareness Physical Security Controls Electronic Access Controls Incident Response High Watermarking CIP Standards Version 5 8 RELIABILITY ACCOUNTABILITY
9 CIP Standards Version 5 Rationale, Guidance & Changes, Main Requirement and Measure Applicable Systems for requirement part Requirement part text Requirement part Measure text Requirement part Reference Requirement part change rationale 9 RELIABILITY ACCOUNTABILITY
10 Format CIP Standards Version 5 Following Results based Standards format Background section before requirements Requirement and Measurement next to each other Measurement more useful Rationale and guidance developed in parallel with requirements still being developed and augmented Two posting formats one with guidance/rationale text boxes inline; other with guidance and rational text grouped at end Still must audit only to the requirement Guidelines and Technical Basis section at end 10 RELIABILITY ACCOUNTABILITY
11 CIP Standards Version 5 Applicable Systems column in tables What systems or entities the row in the table apply to Listed in each standard Specific phrases consistent across all standards A requirement part (row) may have multiple applicability statements Examples: o High Impact BES Cyber Systems o Medium Impact BES Cyber Systems o Medium Impact BES Cyber Systems at Control Centers o Medium Impact BES Cyber Systems with External Routable Connectivity o Protected Cyber Assets o Electronic Access Control Systems 11 RELIABILITY ACCOUNTABILITY
12 Connectivity CIP Standards Version 5 No longer a blanket exemption Now listed in applicability section Routable Connectivity or Dial up Connectivity Routable protocol applicability now applies where large volume, real time communications requirements are listed e.g., logging Low Impact CIP Requirement R2 Programmatic controls (i.e., have a program for ) Requires physical and cyber security protections for locations containing low Does not require lists of every low impact BES Cyber System 12 RELIABILITY ACCOUNTABILITY
13 TFEs CIP Standards Version 5 Attempting to minimize required TFEs (e.g., anti malware on switches) Reduced from 14 requirements to 10 But still have TFEs (including new ones where existing V1 V4 problems exist) Have added per Cyber Asset capability language to allow strict compliance with the language of the requirement, without requiring a TFE (~5 requirements) Measures Guidance to auditors as well as entities An example of evidence may include, but is not limited to, No longer a meaningless restatement of the requirement 13 RELIABILITY ACCOUNTABILITY
14 Bulleted lists vs. numbered lists CIP Standards Version 5 Bulleted lists are separated by or Bulleted lists imply that not all of the items in the list are required Numbered lists are separated by and Numbered lists imply that all of the items in the lists are required Both bulleted and numbered lists are used in both requirements and measures 14 RELIABILITY ACCOUNTABILITY
15 Features of Version 5 Closes out directives in FERC Order No. 706 (also, FERC Order No. 761 imposes March 31, 2013, filing deadline) Results based standards Focus on reliability and security related result Non technology specific Smarter use of Technical Feasibility Exception (TFE) process Plain language of the requirement, i.e., per device capability Risk informed systems approach Adopt solutions and tailor security based on function and risk No longer a harsh in or out demarcation for applicability Impact and connectivity informs applicability 15 RELIABILITY ACCOUNTABILITY
16 Systems approach illustration Features of Version 5 Cyber Assets function together as a complex system Identify the system and apply requirements to the whole rather than the part High Watermarking inside boundary 16 RELIABILITY ACCOUNTABILITY
17 Empowers industry CIP V5 Approach to Correcting Deficiencies Shifts focus from whether deficiencies occur to correcting deficiencies Continuous Improvement o From: backward looking, individual violations o To: forward looking, holistic focus Reliability and security emphasis that promotes the identification and correction of deficiencies Consistent with NERC Internal Controls approach to compliance Version 5 triggering language: implement, in a manner that identifies, assesses, and corrects deficiencies, 17 RELIABILITY ACCOUNTABILITY
18 CIP V5 Approach to Correcting Deficiencies (Continued) Corrected deficiency is a component of satisfying the requirement Does not require internal controls or additional process Standards approach of correcting deficiencies complements the compliance concept of internal controls Reliability Standard Authorization Worksheets (RSAWs) and Violation Severity Levels (VSLs) must support approach Does not expand obligations Clarifies that method of identifying, assessing, and correcting deficiencies is not evaluated 18 RELIABILITY ACCOUNTABILITY
19 Draft RSAW Deficiencies refer to possible non compliances with the standard; not all deficiencies would become issues of non compliance Entities are not required to self report deficiencies if they are identifying, assessing and correcting them CEA samples identified, assessed and corrected deficiencies CEA considers impact of correction in determining the sample size 19 RELIABILITY ACCOUNTABILITY
20 When to Self-Report Plan does not exist Plan has not been implemented Did not assess or correct identified deficiencies Deficiencies that create high risk to the Bulk Electric System 20 RELIABILITY ACCOUNTABILITY
21 Implementation Plan Proposed Effective Date (from CIP 002 5; all standards use the same language): Months Minimum CIP shall become effective on the later of July 1, 2015, or the first calendar day of the ninth calendar quarter after the effective date of the order providing applicable regulatory approval. 2. In those jurisdictions where no regulatory approval is required CIP shall become effective on the first day of the ninth calendar quarter following Board of Trustees approval, or as otherwise made effective pursuant to the laws applicable to such ERO governmental authorities. 21 RELIABILITY ACCOUNTABILITY
22 Implementation issues: Implementation Plan Specified initial performance of all periodic requirements in implementation plan 24 months following regulatory approval for all requirements Identity Verification does not need to be repeated Discussion of unplanned re categorization to a higher impact level Discussion of disaster recovery actions Discussion of requirements applied to access control systems (physical and electronic), and Protected Cyber Assets 22 RELIABILITY ACCOUNTABILITY
23 Applicability Section: Applicability Section 4.1 Functional Entities o Describes which asset owners, based on their functional model designation, and specific ownership of assets, must comply with the standards o May have no qualifications applies to all entities registered for that function Section 4.2 Facilities o Describes which assets must comply with the standards o May have no qualifications applies to all BES assets owned by that function 23 RELIABILITY ACCOUNTABILITY
24 Applicability Example: Applicability For Distribution Providers only those registered DPs that own specifically called out pieces of equipment, such as UFLS systems, must comply with the standards For those DPs, only the specifically called out pieces of equipment must comply with the standards If a DP does not own any called out equipment, it does not need to comply with the standards If a DP owns a piece of called out equipment, only that called out equipment must comply with the standards 24 RELIABILITY ACCOUNTABILITY
25 Applicability 25 RELIABILITY ACCOUNTABILITY
26 Applicability 26 RELIABILITY ACCOUNTABILITY
27 Applicability 27 RELIABILITY ACCOUNTABILITY
28 CIP Standards Version 5 CIP through CIP 009 5, CIP 010 1, CIP Results based Standard format Requirements and measures together Guidance and rational in text boxes Looks bigger ~1 printout for Version 5 (includes VSLs) compared to ~¼ printout for Version 4 Includes much more guidance and rationale for each requirement 28 RELIABILITY ACCOUNTABILITY
29 Version 5 Requirement Counts CIP Requirements; 5 Parts; Attachment with bright lines for High and Medium CIP Requirements; 13 Parts CIP Requirements; 18 Parts CIP Requirements; 8 Parts CIP Requirements; 13 Parts CIP Requirements; 20 Parts CIP Requirements; 9 Parts CIP Requirements; 10 Parts CIP Requirements; 10 Parts CIP Requirements; 4 Parts Total: 32 Requirements; 110 Parts 29 RELIABILITY ACCOUNTABILITY
30 Version 4 Requirement Counts CIP Requirements; 0 parts, Attachment with Bright Lines CIP Requirements; 18 parts/sub parts CIP Requirements; 12 parts/sub parts CIP Requirements; 26 parts/sub parts CIP Requirements; 15 parts/sub parts CIP Requirements; 34 parts/sub parts CIP Requirements; 6 parts CIP Requirements; 2 parts Total: 42 Requirements; 113 parts/sub parts 30 RELIABILITY ACCOUNTABILITY
31 Sub Requirements CIP Standards Version 5 Each Requirement / Sub Requirement is a compliance touch point Non compliance with a sub requirement stands on its own Sub requirements have independent VSLs (unless rolled up) Requirement Parts Only the Requirement is a compliance touch point Cannot be independently in non compliance with a Part VSLs written only at the Requirement level (making very long and complicated VSL language) Parts allow flexibility in development and implementation of the requirement 31 RELIABILITY ACCOUNTABILITY
32 Version 5 Technical Webinars Draft 1 Technical Webinar on format and CIP 002 SDT lead November 15, 2011 Draft 1 Technical webinar on CIP 003 through CIP 011 SDT lead November 29, 2011 Draft 2 Technical Webinar SDT Lead April 10, 2012 ( 83) 32 RELIABILITY ACCOUNTABILITY
33 Version 5 Webinars Draft 3 Webinar: Version 5 CIP Standards: A Focus on Correcting Deficiencies SDT s approach to internal controls concepts but does not require an internal controls program Industry (SDT and others) and NERC Staff Lead September 11, 2012 Draft 3 Technical Webinar SDT Lead September 21, 2012 ( 83) 33 RELIABILITY ACCOUNTABILITY
34 Version 5 Features Annual interaction with CAN now 15 months Monthly requirements changed to 35 days Functional Entity / Facilities section Applicability issues (between requirements, standards, in requirement vs. applicability column) Measures are examples with bulleted lists; format, wording Compliance artifacts in requirements (e.g., documentation of ) LSE (removed) 300 MW threshold on UFLS/UVLS No justification for a different value 34 RELIABILITY ACCOUNTABILITY
35 Version 5 Features Definition / threshold of Control Center Includes data centers Connectivity (routable, dial up) Notifications: IROL, must run (resolving as part of V4) IROL s in WECC Low Impact (policy) List not required Date tracking (PRA, training, access, etc) Role based training Access revocation (reassignments, timing, immediate) IDS in measure Added additional examples 35 RELIABILITY ACCOUNTABILITY
36 Version 5 Features Removed 99.9% availability phrasing Difficult to track and audit Replaced with IAC language Interactive Remote Access Clarify encryption and multi factor authentication points Remove examples from requirements Remove purpose of encryption More use of graded VSLs, as opposed to many binary VSLs in previous versions Ports & Services Physical ports FERC Directive Anti malware clarify system level Per device capability clauses added 36 RELIABILITY ACCOUNTABILITY
37 Version 5 Features No remediation plan if install patches within 35 days Allow updates to existing plans rather than new plans all the time Password changing / pseudorandom passwords (RuggedCom vulnerability impacts) Evidence Retention (compliance vs. security monitoring) Take back reporting requirement from EOP 004 into CIP 008 Guidance on active vs. passive vulnerability assessment V4 bypass language still in implementation plan 37 RELIABILITY ACCOUNTABILITY
38 Standard project page: References 06_Cyber_Security.html Version 4 page: 06_Cyber_Security_PhaseII_Standards.html Version 4 Guidance Document 06_CIP 002 4_Guidance_clean_ pdf Version 5 page: 06_Cyber_Security_Version_5_CIP_Standards_.html 38 RELIABILITY ACCOUNTABILITY
39 Questions Scott Mix, CISSP
Cyber Security Standards Update: Version 5 with Revisions
Cyber Security Standards Update: Version 5 with Revisions Security Reliability Program 2015 Agenda CIP Standards History Version 5 Format Impact Levels NOPR Final Rule References 2 RELIABILITY ACCOUNTABILITY
CIP-003-5 Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-5 3. Purpose: To specify consistent and sustainable security management controls that establish responsibility and
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
Implementation Plan for Version 5 CIP Cyber Security Standards
Implementation Plan for Version 5 CIP Cyber Security Standards April 10September 11, 2012 Prerequisite Approvals All Version 5 CIP Cyber Security Standards and the proposed additions, modifications, and
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
CIP-005-5 Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-5 3. Purpose: To manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security
Summary of CIP Version 5 Standards
Summary of CIP Version 5 Standards In Version 5 of the Critical Infrastructure Protection ( CIP ) Reliability Standards ( CIP Version 5 Standards ), the existing versions of CIP-002 through CIP-009 have
Cyber Security Compliance (NERC CIP V5)
Cyber Security Compliance (NERC CIP V5) Ray Wright NovaTech, LLC Abstract: In December 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791 which approved the Version 5 CIP Reliability
CIP v5/v6 Implementation Plan CIP v5 Workshop. Tony Purgar October 2-3, 2014
CIP v5/v6 Implementation Plan CIP v5 Workshop Tony Purgar October 2-3, 2014 Revision History CIP v5/v6 Implementation Plan Change History Date Description Initial Release July 25, 2014 Revision V0.1 August-2014
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
NERC Cyber Security Standards
SANS January, 2008 Stan Johnson Manager of Situation Awareness and Infrastructure Security Stan.johnson@NERC.net 609-452-8060 Agenda History and Status of Applicable Entities Definitions High Level of
North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5)
Whitepaper North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5) NERC-CIP Overview The North American Electric Reliability Corporation (NERC) is a
NB Appendix CIP-004-5.1-NB-1 - Cyber Security Personnel & Training
This appendix establishes modifications to the FERC approved NERC standard CIP-004-5.1 for its specific application in New Brunswick. This appendix must be read with CIP-004-5.1 to determine a full understanding
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
Standard CIP 007 3 Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for securing
Alberta Reliability Standard Cyber Security Implementation Plan for Version 5 CIP Security Standards CIP-PLAN-AB-1
External Consultation Draft Version 1.0 December 12, 2013 1. Purpose The purpose of this reliability standard is to set the effective dates for the Version 5 CIP Cyber Security reliability standards and
Notable Changes to NERC Reliability Standard CIP-005-5
MIDWEST RELIABILITY ORGANIZATION Notable Changes to NERC Reliability Standard CIP-005-5 Electronic Security Perimeter(s) Bill Steiner MRO Principal Risk Assessment and Mitigation Engineer MRO CIP Version
Alberta Reliability Standard Cyber Security Personnel & Training CIP-004-AB-5.1
Alberta Reliability Stard A. Introduction 1. Title: 2. Number: 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the bulk electric system from individuals
When this standard has received ballot approval, the text boxes will be moved to the Guidelines and Technical Basis section of the Standard.
CIP-002-5 Cyber Security BES Cyber System Categorization When this standard has received ballot approval, the text boxes will be moved to the Guidelines and Technical Basis section of the Standard. A.
ReliabilityFirst CIP Evidence List CIP-002 through CIP-009 are applicable to RC, BA, IA, TSP, TO, TOP, GO, GOP, LSE, NERC, & RE
R1 Provide Risk Based Assessment Methodology (RBAM) R1.1 Provide evidence that the RBAM includes both procedures and evaluation criteria, and that the evaluation criteria are riskbased R1.2 Provide evidence
Cyber Security Standards: Version 5 Revisions. Security Reliability Program 2015
Cyber Security Standards: Version 5 Revisions Security Reliability Program 2015 Overview of Development Activities The Team Standard Drafting Team (SDT) appointed to address these revisions in Project
Standard CIP 004 3a Cyber Security Personnel and Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-3a 3. Purpose: Standard CIP-004-3 requires that personnel having authorized cyber or authorized unescorted physical access
Alberta Reliability Standard Cyber Security Configuration Change Management and Vulnerability Assessments CIP-010-AB-1
A. Introduction 1. Title: 2. Number: 3. Purpose: To prevent and detect unauthorized changes to BES cyber systems by specifying configuration change management and vulnerability assessment requirements
NERC CIP Tools and Techniques
NERC CIP Tools and Techniques Supplemental Project - Introduction Webcast Scott Sternfeld, Project Manager Smart Grid Substation & Cyber Security Research Labs ssternfeld@epri.com (843) 619-0050 October
Alberta Reliability Standard Cyber Security Physical Security of BES Cyber Systems CIP-006-AB-5
Alberta Reliability Stard Final Proposed Draft Version 2.0 September 9, 2014 A. Introduction 1. Title: 2. Number: 3. Purpose: To manage physical access to BES cyber systems by specifying a physical security
3. Purpose: To improve the reliability of the Bulk Electric System by requiring the reporting of events by Responsible Entities.
A. Introduction 1. Title: Event Reporting 2. Number: EOP-004-2 3. Purpose: To improve the reliability of the Bulk Electric System by requiring the reporting of events by Responsible Entities. 4. Applicability:
CIP-003-6 R2 BES Assets Containing Low Impact BCS. Lisa Wood, CISA, CBRA, CBRM Compliance Auditor Cyber Security
CIP-003-6 R2 BES Assets Containing Low Impact BCS Lisa Wood, CISA, CBRA, CBRM Compliance Auditor Cyber Security Slide 2 About Me Been with WECC for 5 years 1 ½ years as a Compliance Program Coordinator
The North American Electric Reliability Corporation ( NERC ) hereby submits
December 8, 2009 VIA ELECTRONIC FILING Kirsten Walli, Board Secretary Ontario Energy Board P.O Box 2319 2300 Yonge Street Toronto, Ontario, Canada M4P 1E4 Re: North American Electric Reliability Corporation
LogRhythm and NERC CIP Compliance
LogRhythm and NERC CIP Compliance The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to ensure that the bulk electric system in North America is reliable, adequate
TOP 10 CHALLENGES. With suggested solutions
NERC CIP VERSION 5 TOP 10 CHALLENGES With suggested solutions 401 Congress Avenue, Suite 1540 Austin, TX 78791 Phone: 512-687- 6224 E- Mail: chumphreys@theanfieldgroup.com Web: www.theanfieldgroup.com
Notable Changes to NERC Reliability Standard CIP-010-3
C L AR I T Y AS S U R AN C E R E S U LT S M I D W E S T R E LIAB I L I T Y ORGAN I Z AT I ON Notable Changes to NERC Reliability Standard CIP-010-3 Cyber Security Configuration Change Management and Vulnerability
Standard CIP 003 1 Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-1 3. Purpose: Standard CIP-003 requires that Responsible Entities have minimum security management controls in place
Alberta Reliability Standard Cyber Security System Security Management CIP-007-AB-5
A. Introduction 1. Title: 2. Number: 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in support of protecting BES cyber systems against compromise
Completed. Document Name. NERC CIP Requirements CIP-002 Critical Cyber Asset Identification R1 Critical Asset Identifaction Method
NERC CIP Requirements CIP-002 Critical Cyber Asset Identification R1 Critical Asset Identifaction Method R2 Critical Asset Identification R3 Critical Cyber Asset Identification Procedures and Evaluation
152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]
![152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]](/thumbs/26/8579930.jpg "152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]")
152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION 18 CFR Part 40 [Docket No. RM15-14-000] Revised Critical Infrastructure Protection Reliability Standards (July 16, 2015) AGENCY:
Alberta Reliability Standard Cyber Security Security Management Controls CIP-003-AB-5
A. Introduction 1. Title: 2. Number: 3. Purpose: To specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES cyber systems against
BPA Policy 434-1 Cyber Security Program
B O N N E V I L L E P O W E R A D M I N I S T R A T I O N BPA Policy Table of Contents.1 Purpose & Background...2.2 Policy Owner... 2.3 Applicability... 2.4 Terms & Definitions... 2.5 Policy... 5.6 Policy
EnergySec Partnered Webinar with MetricStream Transitioning to NERC CIP Version 5: What Does it Mean for Electric Utilities JANUARY 28, 2015
EnergySec Partnered Webinar with MetricStream Transitioning to NERC CIP Version 5: What Does it Mean for Electric Utilities JANUARY 28, 2015 Housekeeping Items Submit questions using control panel Contact
CIP-014-1 Physical Security. Nate Roberts CIP Security Auditor I
CIP-014-1 Physical Security Nate Roberts CIP Security Auditor I Notes Critical Infrastructure Protection (CIP) Standard CIP-014-1 is currently pending approval by the Federal Energy Regulatory Commission
A. Introduction. B. Requirements. Standard PER-005-1 System Personnel Training
A. Introduction 1. Title: System Personnel Training 2. Number: PER-005-1 3. Purpose: To ensure that System Operators performing real-time, reliability-related tasks on the North American Bulk Electric
E-Commerce Security Perimeter (ESP) Identification and Access Control Process
Electronic Security Perimeter (ESP) Identification and Access Control Process 1. Introduction. A. This document outlines a multi-step process for identifying and protecting ESPs pursuant to the North American
NERC Cyber Security. Compliance Consulting. Services. HCL Governance, Risk & Compliance Practice
NERC Cyber Security Compliance Consulting Services HCL Governance, Risk & Compliance Practice Overview The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to
TRIPWIRE NERC SOLUTION SUITE
CONFIDENCE: SECURED SOLUTION BRIEF TRIPWIRE NERC SOLUTION SUITE TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on our mission of delivering
Technology Solutions for NERC CIP Compliance June 25, 2015
Technology Solutions for NERC CIP Compliance June 25, 2015 2 Encari s Focus is providing NERC CIP Compliance Products and Services for Generation and Transmission Utilities, Municipalities and Cooperatives
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
Information Shield Solution Matrix for CIP Security Standards
Information Shield Solution Matrix for CIP Security Standards The following table illustrates how specific topic categories within ISO 27002 map to the cyber security requirements of the Mandatory Reliability
KEY CONSIDERATIONS FOR MIGRATING TO THE VERSION 5 NERC CIP CYBER SECURITY STANDARDS
KEY CONSIDERATIONS FOR MIGRATING TO THE VERSION 5 NERC CIP CYBER SECURITY STANDARDS Lenny Mansell Director, Consulting Services 1 January 29, 2014 AGENDA Introduction Multiple paradigm shifts ahead How
IRA Risk Factors Update for CIP. Ben Christensen Senior Compliance Risk Analyst, Cyber Security October 14, 2015
IRA Risk Factors Update for CIP Ben Christensen Senior Compliance Risk Analyst, Cyber Security October 14, 2015 2 Agenda Why the changes? What s new? Example of a Risk Factor How does this effect CIP V5?
Patching & Malicious Software Prevention CIP-007 R3 & R4
Patching & Malicious Software Prevention CIP-007 R3 & R4 Scope Compliance Assessment Summary Introspection & Analysis Program-In Review Maturity Model review Control Design review Process Components of
Redesigning automation network security
White Paper WP152006EN Redesigning automation network security Presented at Power and Energy Automation Conference (PEAC), Spokane, WA, March 2014 Jacques Benoit Eaton s Cooper Power Systems Abstract The
NovaTech NERC CIP Compliance Document and Product Description Updated June 2015
NovaTech NERC CIP Compliance Document and Product Description Updated June 2015 This document describes the NovaTech Products for NERC CIP compliance and how they address the latest requirements of NERC
The first step in protecting Critical Cyber Assets is identifying them. CIP-002 focuses on this identification process.
CIPS Overview Introduction The reliability of the energy grid depends not only on physical assets, but cyber assets. The North American Electric Reliability Corporation (NERC) realized that, along with
SecFlow Security Appliance Review
Solution Paper. SecFlow Security Appliance Review NERC CIP version 5 Compliance Enabler July 2014 Abstract The alarming increase in cyber attacks on critical infrastructure poses new risk management challenges
Automating NERC CIP Compliance for EMS. Walter Sikora 2010 EMS Users Conference
Automating NERC CIP Compliance for EMS Walter Sikora 2010 EMS Users Conference What do we fear? Thieves / Extortionists Enemies/Terrorists Stuxnet Malware Hacker 2025 Accidents / Mistakes 9/21/2010 # 2
Top Ten Compliance Issues for Implementing the NERC CIP Reliability Standard
Top Ten Compliance Issues for Implementing the NERC CIP Reliability Standard The North American Electric Reliability Corporation 1 s (NERC) CIP Reliability Standard is the most comprehensive and pervasive
Reclamation Manual Directives and Standards
Vulnerability Assessment Requirements 1. Introduction. Vulnerability assessment testing is required for all access points into an electronic security perimeter (ESP), all cyber assets within the ESP, and
SCADA Compliance Tools For NERC-CIP. The Right Tools for Bringing Your Organization in Line with the Latest Standards
SCADA Compliance Tools For NERC-CIP The Right Tools for Bringing Your Organization in Line with the Latest Standards OVERVIEW Electrical utilities are responsible for defining critical cyber assets which
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
A Tactical Approach to Continuous Compliance. Walt Sikora, Vice President Security Solutions EMMOS 2013
A Tactical Approach to Continuous Compliance Walt Sikora, Vice President Security Solutions EMMOS 2013 Abstract NERC has moved quickly to address shortcomings and lack of clarity in previous versions of
Top 10 Compliance Issues for Implementing Security Programs
www.dyonyx.com Top 10 Compliance Issues for Implementing Security Programs This White Paper articulates the top ten issues that we have encountered in the design and implementation of comprehensive Security
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System
CIP- 005 R2: Understanding the Security Requirements for Secure Remote Access to the Bulk Energy System Purpose CIP-005-5 R2 is focused on ensuring that the security of the Bulk Energy System is not compromised
Voluntary Cybersecurity Initiatives in Critical Infrastructure. Nadya Bartol, CISSP, SGEIT, nadya.bartol@utc.org. 2014 Utilities Telecom Council
Voluntary Cybersecurity Initiatives in Critical Infrastructure Nadya Bartol, CISSP, SGEIT, nadya.bartol@utc.org 2014 Utilities Telecom Council Utility cybersecurity environment is full of collaborations
Critical Infrastructure Security: The Emerging Smart Grid. Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn
Critical Infrastructure Security: The Emerging Smart Grid Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn Overview Assurance & Evaluation Security Testing Approaches
Muscle to Protect Your Grid July 2009. Sustainable and Cost-effective Muscle to Protect Your Grid
July 2009 Sustainable and Cost-effective Muscle to Protect Your Grid Page 2 Ensuring the reliability of the North American power grid is no small task and one that continues to grow in complexity on a
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance Introduction Critical infrastructure is the backbone of any nations fundamental economic and societal well being. Like any business, in
Supporting our customers with NERC CIP compliance. James McQuiggan, CISSP
Supporting our customers with NERC CIP compliance James, CISSP Siemens Energy Sector Energy products and solutions - in 6 Divisions Oil & Gas Fossil Power Generation Renewable Energy Service Rotating Equipment
Secure Remote Substation Access Interest Group Part 3: Review of Top Challenges, CIPv5 mapping, and looking forward to 2014!
Secure Remote Substation Access Interest Group Part 3: Review of Top Challenges, CIPv5 mapping, and looking forward to 2014! October 3, 2013 Scott Sternfeld, Project Manager Smart Grid Substation & Cyber
North American Electric Reliability Corporation (NERC) Cyber Security Standard
North American Electric Reliability Corporation (NERC) Cyber Security Standard Symantec Managed Security Services Support for CIP Compliance Overviewview The North American Electric Reliability Corporation
NERC CIP Compliance with Security Professional Services
NERC CIP Compliance with Professional Services The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to ensure that the bulk electric system in North America is
NERC CIP Compliance 10/11/2011
NERC CIP Compliance 10/11/2011 Authored by Dan Barker, American Transmission Co. Ron Bender, Nebraska Public Power District Richard Burt, Minnkota Power Cooperative, Inc. Marc Child, Great River Energy
NERC CIP Implementation Prepared by David Grubbs City of Garland NERC Critical Infrastructure Protection Committee (CIPC) Municipal Systems are well represented on the NERC CIPC Committee David Grubbs,
North American Electric Reliability Corporation. Compliance Monitoring and Enforcement Program. December 19, 2008
116-390 Village Boulevard Princeton, New Jersey 08540-5721 North American Electric Reliability Corporation Compliance Monitoring and Enforcement Program December 19, 2008 APPENDIX 4C TO THE RULES OF PROCEDURE
Change and Configuration Management
Change and Configuration Management for CIP Compliance OCTOBER 21, 2009 Developed with: Presenters Bart Thielbar, CISA Senior Research hanalyst Sierra Energy Group, a Division of Energy Central CIP-003,
Meeting NERC CIP Access Control Standards. Presented on February 12, 2014
Meeting NERC CIP Access Control Standards Presented on February 12, 2014 Presented By: CyberLock The leading supplier of key-centric access control systems Based in Corvallis, Oregon James T. McGowan Technology
NERC CIP Compliance Gaining Oversight with ConsoleWorks
NERC CIP Compliance Gaining Oversight with ConsoleWorks The current challenge for many Utility companies is finding efficient ways to gain oversight and control over NERC CIP regulation compliance. NERC
Cyber Security for NERC CIP Version 5 Compliance
GE Measurement & Control Cyber Security for NERC CIP Version 5 Compliance imagination at work Contents Cyber Security for NERC CIP Compliance... 5 Sabotage Reporting... 6 Security Management Controls...
GRADUATE RELIABILITY TRAINING PROGRAM. Initiation Date: September 2012
GRADUATE RELIABILITY TRAINING PROGRAM Initiation Date: September 2012 Board Approved Date: May 2012 GRADUATE RELIABILITY TRAINING PROGRAM Program Description This program is intended for recent college
SYMMETRY WHITE PAPER. Support for Critical Infrastructure Protection (CIP) Cyber Security Standards. Adam Shane
SYMMETRY WHITE PAPER Support for Critical Infrastructure Protection (CIP) Cyber Security Standards Adam Shane Support for Critical Infrastructure Protection (CIP) Cyber Security Standards The Symmetry
4.1.1 Generator Owner 4.1.2 Transmission Owner that owns synchronous condenser(s)
A. Introduction 1. Title: Verification and Data Reporting of Generator Real and Reactive Power Capability and Synchronous Condenser Reactive Power Capability 2. Number: MOD-025-2 3. Purpose: To ensure
NERC Audit Definition
Utilities & Energy Compliance & Ethics Conference NERC Audit Definition An engagement that provides assurance or conclusions on an evaluation of sufficient, appropriate evidence against stated criteria,
FERC, NERC and Emerging CIP Standards
Protecting Critical Infrastructure and Cyber Assets in Power Generation and Distribution Embracing standards helps prevent costly fines and improves operational efficiency Bradford Hegrat, CISSP, Principal
149 FERC 61,140 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM14-15-000; Order No.
149 FERC 61,140 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION 18 CFR Part 40 [Docket No. RM14-15-000; Order No. 802] Physical Security Reliability Standard (Issued November 20, 2014) AGENCY:
WHITE PAPER CYBER SECURITY AND ELECTRIC UTILITY COMMUNICATIONS WHAT NERC/CIP MEANS FOR YOUR MICROWAVE
CYBER SECURITY AND ELECTRIC UTILITY COMMUNICATIONS WHAT NERC/CIP MEANS FOR YOUR MICROWAVE MAY 2011 TABLE OF CONTENTS 1.0 INTRODUCTION... 3 2.0 MODERN ELECTRIC UTILITY COMMUNICATIONS... 4 2.1 DOMAINS AND
April 8, 2013. Ms. Diane Honeycutt National Institute of Standards and Technology 100 Bureau Drive, Stop 8930 Gaithersburg, MD 20899
Salt River Project P.O. Box 52025 Mail Stop: CUN204 Phoenix, AZ 85072 2025 Phone: (602) 236 6011 Fax: (602) 629 7988 James.Costello@srpnet.com James J. Costello Director, Enterprise IT Security April 8,
How To Write A Cyber Security Checkout On A Nerc Webinar
AS WE PREPARE FOR OUR WEBINAR Thanks to each of you for taking the time to participate in our Webinar today, which will provide extensive insight into what is required to address the Version 5 NERC Cyber
Compliance Open Webinar. Thursday, August 20th, 2015
Compliance Open Webinar Thursday, August 20th, 2015 2 Upcoming Events CIP Advanced Concepts September 9-10, 2015 Compliance Open Webinar September 17, 2015 WECC CIPUG/CUG October 13-15, 2015 Compliance
CIP-005-3 Electronic Security Perimeter (ESP) - Dan Mishra FRCC Compliance Workshop May 09-13, 2011
CIP-005-3 Electronic Security Perimeter (ESP) - Dan Mishra FRCC Compliance Workshop May 09-13, 2011 1 Purpose Specific NERC CIP-005 Requirements Underlying fundamentals of the ESP architecture Building
HIPAA Security & Compliance
Creative Mind. Creative Heart. Creative Care. 2014 WALA Spring Conference HIPAA Security & Compliance Jeff Grady Thursday, March 27 10:30 am HIPAA Security & Compliance A TIME FOR ACTION Jeff Grady, Senior
Lessons Learned CIP Reliability Standards
Evidence for a requirement was not usable due to a lack of identifying information on the document. An entity should set and enforce a "quality of evidence" standard for its compliance documentation. A
Secure Remote Substation Access Solutions
Secure Remote Substation Access Solutions Supplemental Project - Introduction Webcast October 16, 2013 Scott Sternfeld, Project Manager Smart Grid Substation & Cyber Security Research Labs ssternfeld@epri.com
2012 CIP Spring Compliance Workshop May 7-11. Testing, Ports & Services and Patch Management
2012 CIP Spring Compliance Workshop May 7-11 Testing, Ports & Services and Patch Management Purpose This presentation provides an overview of the CIP-007-3 R1 Test Procedures which includes a discussion
ABB Power Generation Cyber Security Users Group
August 28, 2014 ABB Power Generation Cyber Security Users Group ABB Group August 28, 2014 Slide 1 Registration Peer Group Survey ABB Group August 28, 2014 Slide 2 ABB Group August 28, 2014 Slide 3 Registration
Welcome to the CIP Workshop!
Welcome to the CIP Workshop! Download Materials @ SPP.org ->Regional Entity ->2015 CIP Workshop: Questions or Comments? Email reworkshop@spp.org Please wait for a microphone Submit via online form on workshop
Supplier IT Security Guide
Revision Date: 28 November 2012 TABLE OF CONTENT 1. INTRODUCTION... 3 2. PURPOSE... 3 3. GENERAL ACCESS REQUIREMENTS... 3 4. SECURITY RULES FOR SUPPLIER WORKPLACES AT AN INFINEON LOCATION... 3 5. DATA
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
BSM for IT Governance, Risk and Compliance: NERC CIP
BSM for IT Governance, Risk and Compliance: NERC CIP Addressing NERC CIP Security Program Requirements SOLUTION WHITE PAPER Table of Contents INTRODUCTION...................................................
PCI DSS 3.0 Changes Bill Franklin Executive IT Auditor bfranklin@compassitc.com January 23, 2014
PCI DSS 3.0 Changes Bill Franklin Executive IT Auditor bfranklin@compassitc.com January 23, 2014 Agenda Introduction PCI DSS 3.0 Changes What Can I Do to Prepare? When Do I Need to be Compliant? Questions
Jenifer Vallace Associate Cyber Security Analyst. Best User Reporting Practices September 24, 2013 CIP 101
Jenifer Vallace Associate Cyber Security Analyst Best User Reporting Practices September 24, 2013 CIP 101 Agenda What s needed when filling out: Self Reports (SR) Self Certifications (SC) Mitigation Plans
Entity Name ( Acronym) NCRnnnnn Risk Assessment Questionnaire
Entity Name ( Acronym) NCRnnnnn Risk Assessment Questionnaire Upcoming Audit Date: March 16, 2015 Upcoming Audit Type: O&P Audit Start of Audit Period: March 16, 2012 Date Submitted: Table of Contents
Tyson Jarrett CIP Enforcement Analyst. Best Practices for Security Patch Management October 24, 2013 Anaheim, CA
Tyson Jarrett CIP Enforcement Analyst Best Practices for Security Patch Management October 24, 2013 Anaheim, CA A little about me Graduated from the University of Utah with a Masters in Information Systems