CIP Version 5 Transition Guidance
|
|
|
- Roy Jennings
- 7 years ago
- Views:
Transcription
1 CIP Version 5 Transition Guidance September 4, 2014 Kevin B. Perry Dir, Critical Infrastructure Protection kperry.re@spp.org
2 Agenda Introduction Critical Asset Identification Options Newly Identified Critical Assets Updated Critical Cyber Asset List Changes to Existing Critical Assets / Critical Cyber Assets Compliance Monitoring During the Transition Period Technical Feasibility Exceptions 2
3 Introduction The goal of the CIP V5 Transition Guidance is to: Provide Responsible Entities an efficient and effective path to full compliance with the CIP Version 5 Reliability Standards by the effective (enforcement) date. Provide Responsible Entities a way to maintain CIP Version 3 compliance while transitioning to Version 5 through a flexible compliance monitoring and enforcement approach during the transition period. Allow Responsible Entities begin to operate in accordance with the CIP V5 Standards while the CIP V3 Standards are still mandatory and enforceable. 3
4 Introduction During the transition period, Responsible Entities may: Continue to comply with all of the CIP V3 Standards, or Begin transitioning to compliance with some or all of the CIP V5 Standards Regional Entities will perform expanded outreach to help Responsible Entities achieve full compliance with the CIP V5 Standards by the effective date. Workshops Webinars On-site meetings / readiness reviews 4
5 Introduction NERC has developed a Mostly Compatible matrix linking each CIP V3 Requirement with its comparable CIP V5 Requirement. The matrix will: Assist Responsible Entities in transitioning their CIP compliance program from V3 to V5. Assist Regional Entities and Responsible Entities with compliance monitoring and enforcement during the Transition Period Matrix is found on the NERC web site at: 5
6 Introduction 6
7 Critical Asset Identification Options Option 1: Continue to maintain a valid Risk-Based Assessment Methodology (RBAM) pursuant to CIP-002-3, Requirement R1. The RBAM must include a procedure for conducting the riskbased assessment. The RBAM must include appropriate and justified evaluation criteria for each type of asset being considered. The RBAM must be reviewed and approved annually. The RBAM must be applied at least annually to derive a list of Critical Assets. 7
8 Critical Asset Identification Options Option 2: Responsible Entities that have already adopted the CIP V4 Critical Asset Criteria (CIP-002-4, Attachment 1), may continue to use the CIP V4 Critical Asset Criteria in lieu of maintaining a RBAM. Adoption of the V4 Critical Asset Criteria must have occurred before August 12, Critical Assets identified per criterion 1.4 (Blackstart Resources) and criterion 1.5 (Cranking Paths) will not be subjected to the CIP V3 Standards, but Transmission Operator Control Centers controlling cranking path assets will continue to be treated as Critical Assets. Annually approve the adoption of the V4 Critical Asset Criteria. 8
9 Critical Asset Identification Options Option 3: Responsible Entities may adopt the CIP V5 High and Medium Impact Rating Criteria (CIP , Attachment 1) to identify Critical Assets in lieu of maintaining a RBAM. May adopt the V5 Impact Rating Criteria at any time. May immediately apply the V5 Impact Rating Criteria to derive a new Critical Asset list. May immediately remove Critical Assets and associated Critical Cyber Assets from the Critical Asset list that do not satisfy any of the V5 High or Medium Impact Rating Criteria. Annually approve the adoption of the V5 Impact Rating Criteria. 9
10 Critical Asset Identification Options Applying the CIP V5 High and Medium Impact Rating Criteria: Read each Criterion statement as Critical Asset evaluation criteria. Do not consider BES Cyber Systems located at or associated with the assets described by the Criteria. Any asset matching one or more High or Medium Impact Rating Criteria is a Critical Asset. Any asset matching only a Low Impact Rating Criterion is a not a Critical Asset. 10
11 Critical Asset Identification Options Additional Guidance: Responsible Entities adopting either the CIP V4 Critical Asset Criteria or the CIP V5 Impact Rating Criteria must adopt the Criteria in their entirety, subject to the caveats documented in the CIP V5 Transition Guidance. Adoption of either the CIP V4 Critical Asset Criteria or the CIP V5 Impact Rating Criteria should be documented by a Memorandum of Record or other, similar memorialization. A documented RBAM is not required. Responsible Entities must annually apply the CIP V3 RBAM or alternative CIP V4 or V5 Criteria to derive an updated Critical Asset list. 11
12 Newly Identified Critical Assets Adoption and application of either the CIP V4 Critical Asset Criteria or the CIP V5 Impact Rating Criteria will result in an updated Critical Asset list. Most existing Critical Assets will continue to be Critical Assets. Some Critical Assets will not satisfy the Criteria and can be immediately removed from the Critical Asset list. New Critical Assets may be identified as a result of adopting and applying the Criteria. Newly identified Critical Assets should be flagged on the updated Critical Asset list as resulting from applying the CIP V4 Critical Asset Criteria or the CIP V5 Impact Rating Criteria. 12
13 Updated Critical Cyber Asset List After updating the Critical Asset list, the performance of CIP-002-3, Requirement R3, will result in an updated Critical Cyber Asset list. Any newly identified Critical Cyber Assets associated with a newly identified Critical Asset will not be expected to come into compliance with the CIP V3 Standards. Newly identified Critical Cyber Assets should be flagged on the updated Critical Cyber Asset list Such Critical Cyber Assets will be taken straight to CIP V5 compliance per the CIP V5 Implementation Plan. 13
14 Updated Critical Cyber Asset List Critical Cyber Assets associated with removed Critical Assets may be immediately removed from the Critical Cyber Asset list. Removed Critical Cyber Assets will immediately come out of the CIP V3 compliance program. Such Cyber Assets will likely come back into the CIP compliance program under CIP V5 as Low impacting BES Cyber Systems. Resumed compliance under CIP V5 will be pursuant to the CIP V5 Standards Implementation Plan. 14
15 Updated Critical Cyber Asset List Existing Critical Cyber Assets that remained on the Critical Cyber Asset list after adoption and application of the CIP V4 or V5 Criteria and subsequent performance of CIP-002-3, Requirement R3, shall remain in the CIP V3 compliance program through the Transition Period. No lapse of CIP compliance is permitted. CIP V3 compliance must be maintained subject to the provisions of the CIP V5 Transition Guidance. Replacement Cyber Assets must be CIP V3 or V5 compliant upon commissioning. 15
16 Changes to Existing CAs/CCAs Consistent with the CIP V3 Implementation Plan for Newly Identified Critical Cyber Assets and Newly Registered Entities and the CIP V5 Implementation Plan, new and upgraded/replaced Critical Cyber Assets resulting from a planned change must be fully compliant upon commissioning. During the Transition Period, compliance may be with either the CIP V3 or CIP V5 standards. Examples include planned replacement of the SCADA/EMS and planned conversion from a nonroutable to a routable protocol in a Transmission substation or generating plant. 16
17 Changes to Existing CAs/CCAs A planned change that elevates BES Cyber Systems to a higher categorization during the Transition Period must be compliant with the higher impacting CIP V5 requirements by the effective date of the requirement. Example includes a planned increase in generation that results in a higher categorization of BES Cyber Systems at the Control Center. Unplanned changes will need to be compliant by the later of the CIP V5 Standards effective date or the Compliance Implementation date shown in the CIP V5 Implementation Plan Examples include Criteria 2.3 and 2.6 notifications. 17
18 Compliance Monitoring During Transition Period On-site CIP compliance audits of Responsible Entities registered as Reliability Coordinators, Balancing Authorities, or Transmission Operators, and other Responsible Entities with Critical Cyber Assets will continue through the Transition Period. Off-site CIP compliance audits of Responsible Entities with no Critical Cyber Assets (other than Reliability Coordinators, Balancing Authorities, and Transmission Operators) are cancelled through the Transition Period. Self-reports, spot checks, and self-certifications still allowed. Audits of off-site entities may resume with CIP V5. 18
19 Compliance Monitoring During Transition Period Responsible Entities audited during the Transition Period may choose to be audited against the CIP V3 or CIP V5 Standards. Election made on requirement-by-requirement basis. Election may be made on a site-by-site basis. Request for Information will be issued 45 days prior to issuance of the 90-day audit notice (135 days prior to the audit). SPP RE will issue a spreadsheet with selection options. Entities will have 15 days to respond. 19
20 Compliance Monitoring During Transition Period 20
21 Compliance Monitoring During Transition Period At audit, in-scope requirements will be initially evaluated per the Responsible Entity s selection. If CIP V5 selected and compliance with the V5 language is determined, the V5 compliance will be viewed as CIP V3 compliant and a No Finding will be issued. If CIP V5 is selected and non-compliance with the V5 language is determined, the audit team will revert back to the CIP V3 language. If V3 compliance is determined, a No Finding will be issued. If neither CIP V3 nor V5 compliance is determined, a Possible Violation or Area of Concern will be issued. 21
22 Compliance Monitoring During Transition Period If a CIP V5 Requirement is selected by the entity, a Possible Violation will not be found for any part of the Requirement that is unique to CIP V5. The audit team will conduct outreach to help steer the Responsible Entity back on course to CIP V5 compliance. An Area of Concern may be issued to document the future potential non-compliance issue. Example includes aspects of the annual security training requirements of CIP-004-5, Requirement R2, such as Requirement R2.1.4 (the visitor control program). 22
23 Compliance Monitoring During Transition Period While not specified by the CIP V5 Transition Guidance, Responsible Entities selecting the CIP V3 audit option will not eliminate a CIP V5 evaluation opportunity. If the V3 option is selected and non-compliance is determined, the audit team will determine if the issue of non-compliance would also be a CIP V5 violation. If CIP V5 has eliminated the non-compliant aspect of the CIP V3 requirement, the audit team will issue an Area of Concern and not a Possible Violation. Example includes lack of an Electronic Access Point for nonroutable communications as required by CIP-005-3, Requirement R1. 23
24 Compliance Monitoring During Transition Period Mitigation of any Open Enforcement Actions during the Transition Period should focus on achieving full compliance with the Mostly Compatible CIP V5 Requirement. This includes violations found prior to the August 12, 2014 release of the CIP V5 Transition Guidance that have not completed mitigation. Full compliance with the CIP V5 Standards must be achieved by the CIP V5 effective date. An unmitigated Open Enforcement Action cannot be used to extend the CIP V5 compliance date. 24
25 Technical Feasibility Exceptions Technical Feasibility Exceptions are still required for certain CIP V5 Requirements. Existing TFEs carried forward for equivalent CIP V5 Requirements. New TFEs required for CIP V5 Requirements with no equivalent V3 Requirement. TFEs for CIP V3 Requirements with no equivalent V5 Requirement will be terminated upon the CIP V5 effective date. CIP V5 TFEs cannot be submitted before October 1, 2015 to allow time for required portal changes. 25
26 Technical Feasibility Exceptions TFEs under the CIP V3 Standards with equivalent CIP V5 Requirements (carry forward). CIP V3 Requirement CIP V5 Requirement CIP / R4 CIP / R2 / Part 2.3 CIP / R2.3 CIP / R1 / Part 1.1 CIP / R6.4 CIP / R4 / Part 4.3 CIP / R5.3.3 CIP / R5 / Part
27 Technical Feasibility Exceptions New CIP V5 TFE-eligible Requirements with no equivalent CIP V3 Requirement (submit). CIP CIP CIP CIP Requirement R1, Part 1.4 Requirement R2, Part 2.1 Requirement R2, Part 2.2 Requirement R1, Part 1.3 Requirement R5, Part 5.1 Requirement R5, Part 5.7 Requirement R1, Part 1.5 Requirement R3, Part
28 Technical Feasibility Exceptions CIP V3 TFEs no longer required under CIP V5 (terminate). CIP CIP CIP R3.1 R1.1 R3.2 R3.2 R4 R5.3 R5.3.1 R5.3.2 R6 28
29 Helpful Resources SPP RE training Past Webinar and workshops presentation materials Video library SPP RE monthly newsletter NERC CIP V5 Standards and Implementation Plan CIP V5 Transition Guidance CIP V5 Transition Study Lessons Learned 29
30 SPP RE CIP Team Kevin Perry, Director of Critical Infrastructure Protection (501) Shon Austin, Lead Compliance Specialist-CIP (501) Steven Keller, Lead Compliance Specialist-CIP (501) Jeremy Withers, Senior Compliance Specialist-CIP (501) Robert Vaughn, Compliance Specialist II-CIP (501)
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
CIP-005-5 Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-5 3. Purpose: To manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security
Implementation Plan for Version 5 CIP Cyber Security Standards
Implementation Plan for Version 5 CIP Cyber Security Standards April 10September 11, 2012 Prerequisite Approvals All Version 5 CIP Cyber Security Standards and the proposed additions, modifications, and
Summary of CIP Version 5 Standards
Summary of CIP Version 5 Standards In Version 5 of the Critical Infrastructure Protection ( CIP ) Reliability Standards ( CIP Version 5 Standards ), the existing versions of CIP-002 through CIP-009 have
Program Guide for Risk-based Compliance Monitoring and Enforcement Program. ERA-01 Rev. 1. NPCC Manager, Entity Risk Assessment
NPCC Entity Risk Assessment Program Guide for Risk-based Compliance Monitoring and Enforcement Program ERA-01 Rev. 1 Process Owner: NPCC Manager, Entity Risk Assessment Effective Date: 03/02/2015 Table
CIP-003-5 Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-5 3. Purpose: To specify consistent and sustainable security management controls that establish responsibility and
ReliabilityFirst CIP Evidence List CIP-002 through CIP-009 are applicable to RC, BA, IA, TSP, TO, TOP, GO, GOP, LSE, NERC, & RE
R1 Provide Risk Based Assessment Methodology (RBAM) R1.1 Provide evidence that the RBAM includes both procedures and evaluation criteria, and that the evaluation criteria are riskbased R1.2 Provide evidence
NERC Cyber Security Standards
SANS January, 2008 Stan Johnson Manager of Situation Awareness and Infrastructure Security Stan.johnson@NERC.net 609-452-8060 Agenda History and Status of Applicable Entities Definitions High Level of
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP 010 1 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
2015 SPP RE Stakeholder Satisfaction Survey Report
05 SPP RE Stakeholder Satisfaction Survey Report Executive Summary Table of Contents Executive Summary...3 Demographics...5 Interaction with other Regional Entities...6 Operations and Planning Compliance
Alberta Reliability Standard Cyber Security Security Management Controls CIP-003-AB-5
A. Introduction 1. Title: 2. Number: 3. Purpose: To specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES cyber systems against
A. Introduction. B. Requirements. Standard PER-005-1 System Personnel Training
A. Introduction 1. Title: System Personnel Training 2. Number: PER-005-1 3. Purpose: To ensure that System Operators performing real-time, reliability-related tasks on the North American Bulk Electric
Alberta Reliability Standard Cyber Security Physical Security of BES Cyber Systems CIP-006-AB-5
Alberta Reliability Stard Final Proposed Draft Version 2.0 September 9, 2014 A. Introduction 1. Title: 2. Number: 3. Purpose: To manage physical access to BES cyber systems by specifying a physical security
Entity Name ( Acronym) NCRnnnnn Risk Assessment Questionnaire
Entity Name ( Acronym) NCRnnnnn Risk Assessment Questionnaire Upcoming Audit Date: March 16, 2015 Upcoming Audit Type: O&P Audit Start of Audit Period: March 16, 2012 Date Submitted: Table of Contents
Alberta Reliability Standard Cyber Security Configuration Change Management and Vulnerability Assessments CIP-010-AB-1
A. Introduction 1. Title: 2. Number: 3. Purpose: To prevent and detect unauthorized changes to BES cyber systems by specifying configuration change management and vulnerability assessment requirements
CIP v5/v6 Implementation Plan CIP v5 Workshop. Tony Purgar October 2-3, 2014
CIP v5/v6 Implementation Plan CIP v5 Workshop Tony Purgar October 2-3, 2014 Revision History CIP v5/v6 Implementation Plan Change History Date Description Initial Release July 25, 2014 Revision V0.1 August-2014
North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5)
Whitepaper North American Electric Reliability Corporation: Critical Infrastructure Protection, Version 5 (NERC-CIP V5) NERC-CIP Overview The North American Electric Reliability Corporation (NERC) is a
Cyber Security Standards Update: Version 5
Cyber Security Standards Update: Version 5 January 17, 2013 Scott Mix, CISSP CIP Technical Manager Agenda Version 5 Impact Levels Format Features 2 RELIABILITY ACCOUNTABILITY CIP Standards Version 5 CIP
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
CIP-010-1 R1 & R2: Configuration Change Management
CIP-010-1 R1 & R2: Configuration Change Management June 3, 2014 Steven Keller Lead Compliance Specialist - CIP skeller.re@spp.org 501.688.1633 Outline What is CIP-010-1? How it is different from CIP-003-3
Voluntary Cybersecurity Initiatives in Critical Infrastructure. Nadya Bartol, CISSP, SGEIT, nadya.bartol@utc.org. 2014 Utilities Telecom Council
Voluntary Cybersecurity Initiatives in Critical Infrastructure Nadya Bartol, CISSP, SGEIT, nadya.bartol@utc.org 2014 Utilities Telecom Council Utility cybersecurity environment is full of collaborations
Alberta Reliability Standard Cyber Security System Security Management CIP-007-AB-5
A. Introduction 1. Title: 2. Number: 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in support of protecting BES cyber systems against compromise
Lessons Learned CIP Reliability Standards
Evidence for a requirement was not usable due to a lack of identifying information on the document. An entity should set and enforce a "quality of evidence" standard for its compliance documentation. A
Standard CIP 004 3a Cyber Security Personnel and Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-3a 3. Purpose: Standard CIP-004-3 requires that personnel having authorized cyber or authorized unescorted physical access
3. Purpose: To improve the reliability of the Bulk Electric System by requiring the reporting of events by Responsible Entities.
A. Introduction 1. Title: Event Reporting 2. Number: EOP-004-2 3. Purpose: To improve the reliability of the Bulk Electric System by requiring the reporting of events by Responsible Entities. 4. Applicability:
Standard CIP 007 3 Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for securing
EnergySec Partnered Webinar with MetricStream Transitioning to NERC CIP Version 5: What Does it Mean for Electric Utilities JANUARY 28, 2015
EnergySec Partnered Webinar with MetricStream Transitioning to NERC CIP Version 5: What Does it Mean for Electric Utilities JANUARY 28, 2015 Housekeeping Items Submit questions using control panel Contact
GRADUATE RELIABILITY TRAINING PROGRAM. Initiation Date: September 2012
GRADUATE RELIABILITY TRAINING PROGRAM Initiation Date: September 2012 Board Approved Date: May 2012 GRADUATE RELIABILITY TRAINING PROGRAM Program Description This program is intended for recent college
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
AEP s Guide to Internal Compliance Training & Awareness for NERC Reliability Standards
AEP s Guide to Internal Compliance Training & Awareness for NERC Reliability Standards SPP RE Compliance Workshop November 13, 2012 Thad Ness American Electric Power Or Herding Cats 2 You Can and Should
2016 Business Plan and Budget. Texas Reliability Entity, Inc. Approved by Texas RE Board of Directors. Date: May 21, 2015
2016 Business Plan and Texas Reliability Entity, Inc. Approved by Texas RE Board of Directors Date: May 21, 2015 1 Table of Contents Table of Contents... 2 Introduction... 3 Section A 2016 Business Plan
PROCEDURE. Ontario Technical Feasibility Exception PUBLIC. Issue 0.2 IESO_PRO_0680
PROCEDURE PUBLIC IESO_PRO_0680 Ontario Technical Feasibility Exception Issue 0.2 This procedure provides guidance to TFE applicants on the Ontario-adapted NERC Technical Feasibility Exception process.
When this standard has received ballot approval, the text boxes will be moved to the Guidelines and Technical Basis section of the Standard.
CIP-002-5 Cyber Security BES Cyber System Categorization When this standard has received ballot approval, the text boxes will be moved to the Guidelines and Technical Basis section of the Standard. A.
NERC CIP Implementation Prepared by David Grubbs City of Garland NERC Critical Infrastructure Protection Committee (CIPC) Municipal Systems are well represented on the NERC CIPC Committee David Grubbs,
Alberta Reliability Standard Cyber Security Implementation Plan for Version 5 CIP Security Standards CIP-PLAN-AB-1
External Consultation Draft Version 1.0 December 12, 2013 1. Purpose The purpose of this reliability standard is to set the effective dates for the Version 5 CIP Cyber Security reliability standards and
ERCOT Design and Implementation of Internal Controls and benefits for NERC CMEP/RAI
ERCOT Design and Implementation of Internal Controls and benefits for NERC CMEP/RAI Matt Mereness, ERCOT Compliance Director August 2015 Anfield Summit Outline of discussion ERCOT Background Business Case
Alberta Reliability Standard Cyber Security Personnel & Training CIP-004-AB-5.1
Alberta Reliability Stard A. Introduction 1. Title: 2. Number: 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the bulk electric system from individuals
Standard CIP 003 1 Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-1 3. Purpose: Standard CIP-003 requires that Responsible Entities have minimum security management controls in place
Critical Asset Security Enhancementation - A Review
U.S. Department of Energy Office of Inspector General Office of Audit Services Audit Report Report on Critical Asset Vulnerability and Risk Assessments at the Power Marketing Administrations--Followup
NPCC Implementation of the NERC Compliance Monitoring And Enforcement Program (CMEP)
Northeast Power Coordinating Council, Inc. NPCC Implementation of the NERC Compliance Monitoring And CP-01 Rev.2 The NERC Rules of Procedure and the Regional Delegation Agreement are the overriding documents
Notable Changes to NERC Reliability Standard CIP-005-5
MIDWEST RELIABILITY ORGANIZATION Notable Changes to NERC Reliability Standard CIP-005-5 Electronic Security Perimeter(s) Bill Steiner MRO Principal Risk Assessment and Mitigation Engineer MRO CIP Version
UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION
UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION Technical Conference on Critical Infrastructure Protection Issues Identified in Order No. 791 Prepared Statement of Melanie Seader, Senior
Regulatory & Compliance Qualifications. Qualifications
Prepared by: Contact: Quanta Technology, LLC Bryan Rushing brushing@quanta-technology.com 4020 Westchase Blvd., Suite 300 Raleigh, NC 27607 (919) 334-3021 office (636) 288-2946 cell CONFIDENTIAL/PROPRIETARY:
Change and Configuration Management
Change and Configuration Management for CIP Compliance OCTOBER 21, 2009 Developed with: Presenters Bart Thielbar, CISA Senior Research hanalyst Sierra Energy Group, a Division of Energy Central CIP-003,
Welcome to the CIP Workshop!
Welcome to the CIP Workshop! Download Materials @ SPP.org ->Regional Entity ->2015 CIP Workshop: Questions or Comments? Email reworkshop@spp.org Please wait for a microphone Submit via online form on workshop
The North American Electric Reliability Corporation ( NERC ) hereby submits
December 8, 2009 VIA ELECTRONIC FILING Kirsten Walli, Board Secretary Ontario Energy Board P.O Box 2319 2300 Yonge Street Toronto, Ontario, Canada M4P 1E4 Re: North American Electric Reliability Corporation
Cyber Security Standards Update: Version 5 with Revisions
Cyber Security Standards Update: Version 5 with Revisions Security Reliability Program 2015 Agenda CIP Standards History Version 5 Format Impact Levels NOPR Final Rule References 2 RELIABILITY ACCOUNTABILITY
Audit-Ready SharePoint Applications
Audit-Ready SharePoint Applications Page 1 of 16 July 7, 2015 Table of Contents 1 Overview... 3 2 Company Background... 4 3 Audit-Ready SharePoint Applications... 4 3.1 Audit-Ready Compliance Dashboard...
Transmission Function Employees Job Titles and Descriptions 18 C.F.R 358.7(f)(1)
Date of Last Change to the Provided Information August 27 th, 2015 Director, Transmission Operations The employee in this position is responsible for effectively managing the operation of FirstEnergy Utilities
Safety Share Who is Cleco? CIP-005-3, R5 How What
1 Safety Share Who is Cleco? CIP-005-3, R5 How What AGENDA 2 SAFETY SHARE 3 Statistics: General Customers: approx. 279,000 retail customers across Louisiana Non-contiguous transmission and service area
152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]
![152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]](/thumbs/26/8579930.jpg "152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION. 18 CFR Part 40. [Docket No. RM15-14-000]")
152 FERC 61,054 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION 18 CFR Part 40 [Docket No. RM15-14-000] Revised Critical Infrastructure Protection Reliability Standards (July 16, 2015) AGENCY:
Hacking and Hardware: Understanding the Threats, Compliance Obligations, and Cybersecurity Solutions for Utilities
WEBINAR Hacking and Hardware: Understanding the Threats, Compliance Obligations, and Cybersecurity Solutions for Utilities May 2, 2013 12:00-1:30 p.m. Eastern Time Online is authorized by IACET to offer
NERC CIP Compliance 10/11/2011
NERC CIP Compliance 10/11/2011 Authored by Dan Barker, American Transmission Co. Ron Bender, Nebraska Public Power District Richard Burt, Minnkota Power Cooperative, Inc. Marc Child, Great River Energy
SCADA Compliance Tools For NERC-CIP. The Right Tools for Bringing Your Organization in Line with the Latest Standards
SCADA Compliance Tools For NERC-CIP The Right Tools for Bringing Your Organization in Line with the Latest Standards OVERVIEW Electrical utilities are responsible for defining critical cyber assets which
Reclamation Manual Directives and Standards
Vulnerability Assessment Requirements 1. Introduction. Vulnerability assessment testing is required for all access points into an electronic security perimeter (ESP), all cyber assets within the ESP, and
Voluntary Cyber Security Standards for Industrial Control Systems v.1.0 www.gcsb.govt.nz www.ncsc.govt.nz
National Cyber Security Centre Voluntary Cyber Security Standards for Industrial Control Systems v.1.0 www.gcsb.govt.nz www.ncsc.govt.nz Foreword The national and economic security of New Zealand depends
Secure Remote Substation Access Interest Group Part 3: Review of Top Challenges, CIPv5 mapping, and looking forward to 2014!
Secure Remote Substation Access Interest Group Part 3: Review of Top Challenges, CIPv5 mapping, and looking forward to 2014! October 3, 2013 Scott Sternfeld, Project Manager Smart Grid Substation & Cyber
North American Electric Reliability Corporation (NERC) Cyber Security Standard
North American Electric Reliability Corporation (NERC) Cyber Security Standard Symantec Managed Security Services Support for CIP Compliance Overviewview The North American Electric Reliability Corporation
Security Solutions to Meet NERC-CIP Requirements. Kevin Staggs, Honeywell Process Solutions
Kevin Staggs, Honeywell Process Solutions Table of Contents Introduction...3 Nerc Standards and Implications...3 How to Meet the New Requirements...4 Protecting Your System...4 Cyber Security...5 A Sample
Secure Remote Substation Access Solutions
Secure Remote Substation Access Solutions Supplemental Project - Introduction Webcast October 16, 2013 Scott Sternfeld, Project Manager Smart Grid Substation & Cyber Security Research Labs ssternfeld@epri.com
NERC CIP Tools and Techniques
NERC CIP Tools and Techniques Supplemental Project - Introduction Webcast Scott Sternfeld, Project Manager Smart Grid Substation & Cyber Security Research Labs ssternfeld@epri.com (843) 619-0050 October
CIP-003-6 R2 BES Assets Containing Low Impact BCS. Lisa Wood, CISA, CBRA, CBRM Compliance Auditor Cyber Security
CIP-003-6 R2 BES Assets Containing Low Impact BCS Lisa Wood, CISA, CBRA, CBRM Compliance Auditor Cyber Security Slide 2 About Me Been with WECC for 5 years 1 ½ years as a Compliance Program Coordinator
Commercial Customs Operations Advisory Committee (COAC) April 2016 Revised May 19, 2016
Commercial Customs Operations Advisory Committee (COAC) April 2016 Revised May 19, 2016 Report of the Work of the COAC Subcommittee on Trade Enforcement and Revenue Collection Co-Chairs Lisa Gelsomino
September 29, 2014. Docket No. ER14- -000 Amendment to CAISO FERC Electric Tariff to Eliminate Annual External Operations Review
California Independent System Operator Corporation September 29, 2014 The Honorable Kimberly D. Bose Secretary Federal Energy Regulatory Commission 888 First Street, NE Washington, DC 20426 Re: California
Cyber Security Standards: Version 5 Revisions. Security Reliability Program 2015
Cyber Security Standards: Version 5 Revisions Security Reliability Program 2015 Overview of Development Activities The Team Standard Drafting Team (SDT) appointed to address these revisions in Project
FERC, NERC and Emerging CIP Standards
Protecting Critical Infrastructure and Cyber Assets in Power Generation and Distribution Embracing standards helps prevent costly fines and improves operational efficiency Bradford Hegrat, CISSP, Principal
FAQs about ALTA Best Practices for Real Estate Settlement Attorneys and Title Companies
Why do I need to have ALTA Best Practices policies and procedures in place and have a CPA give assurance on my compliance to mortgage lenders? In accordance with Consumer Financial Protection Bureau (CFPB)
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Federal Energy Regulatory Commission's Monitoring of Power Grid Cyber Security DOE/IG-0846 January 2011
Redesigning automation network security
White Paper WP152006EN Redesigning automation network security Presented at Power and Energy Automation Conference (PEAC), Spokane, WA, March 2014 Jacques Benoit Eaton s Cooper Power Systems Abstract The
Tyson Jarrett CIP Enforcement Analyst. Best Practices for Security Patch Management October 24, 2013 Anaheim, CA
Tyson Jarrett CIP Enforcement Analyst Best Practices for Security Patch Management October 24, 2013 Anaheim, CA A little about me Graduated from the University of Utah with a Masters in Information Systems
MEMORANDUM OF UNDERSTANDING THE INDEPENDENT ELECTRICITY SYSTEM OPERATOR THE NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION
MEMORANDUM OF UNDERSTANDING BETWEEN THE INDEPENDENT ELECTRICITY SYSTEM OPERATOR AND THE NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION AND THE NORTHEAST POWER COORDINATING COUNCIL, CROSS-BORDER REGIONAL
Cyber Security Compliance (NERC CIP V5)
Cyber Security Compliance (NERC CIP V5) Ray Wright NovaTech, LLC Abstract: In December 2013, the Federal Energy Regulatory Commission (FERC) issued Order No. 791 which approved the Version 5 CIP Reliability
North American Electric Reliability Corporation. Compliance Monitoring and Enforcement Program. December 19, 2008
116-390 Village Boulevard Princeton, New Jersey 08540-5721 North American Electric Reliability Corporation Compliance Monitoring and Enforcement Program December 19, 2008 APPENDIX 4C TO THE RULES OF PROCEDURE
Scope of Restoration Plan
RWG Area Restoration Review Worksheet (10/28/09) EOP-006-02 Directory 8 EOP-005 NYSRG Rule G Text Restoration Plan Requirement R1.Each Reliability Coordinator shall have a Reliability Coordinator Area
Compliance Open Webinar. Thursday, August 20th, 2015
Compliance Open Webinar Thursday, August 20th, 2015 2 Upcoming Events CIP Advanced Concepts September 9-10, 2015 Compliance Open Webinar September 17, 2015 WECC CIPUG/CUG October 13-15, 2015 Compliance
How to Integrate NERC s Requirements in an Ongoing Automation and Integration Project Framework
How to Integrate NERC s Requirements in an Ongoing Automation and Integration Project Framework Jacques Benoit, Cooper Power Systems Inc., Energy Automations Solutions - Cybectec Robert O Reilly, Cooper
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
Physical Security Reliability Standard Implementation
Physical Security Reliability Standard Implementation Tobias Whitney, Manager of CIP Compliance (NERC) Carl Herron, Physical Security Leader (NERC) NERC Sub-Committee Meeting New Orleans, Louisiana CIP-014
RELIABILITYFIRST ANNUAL REPORT FY 2014. Forward Together ReliabilityFirst
RELIABILITYFIRST ANNUAL REPORT FY 2014 Forward Together ReliabilityFirst TABLE OF CONTENTS Letter from the Chair 3 Letter from the President & CEO 4 I. ReliabilityFirst Corporate Mission and Guiding Principles
Vendor Orientation Guide
Vendor Orientation Guide Presentation to: Department of Community Health s Contract and Grant Vendors Presented by: Office of Vendor Management Date: September 2014 0 Mission The Georgia Department of
Appendix A3 - Northeast Power Coordinating Council (NPCC) 2016 CMEP Implementation Plan
Appendix A3 - Northeast Power Coordinating Council (NPCC) 2016 CMEP Implementation Plan This Appendix contains the CMEP Implementation Plan (IP) for the NPCC as required by the NERC Rules of Procedure.
Iman Fund. Identify Theft Prevention Program
Iman Fund Identify Theft Prevention Program Background The Federal Trade Commission adopted a rule, applicable to those investment companies that offer transaction accounts, requiring that investment companies
BUSINESS ASSOCIATE PRIVACY AND SECURITY ADDENDUM RECITALS
BUSINESS ASSOCIATE PRIVACY AND SECURITY ADDENDUM This Business Associate Addendum ( Addendum ), effective, 20 ( Effective Date ), is entered into by and between University of Southern California, ( University
The first step in protecting Critical Cyber Assets is identifying them. CIP-002 focuses on this identification process.
CIPS Overview Introduction The reliability of the energy grid depends not only on physical assets, but cyber assets. The North American Electric Reliability Corporation (NERC) realized that, along with
Re: NERC Notice of Penalty regarding Pacific Gas and Electric Company FERC Docket No. NP10-_-000
f April 28, 2010 Ms. Kimberly Bose Secretary Federal Energy Regulatory Commission 888 First Street, N.E. Washington, D.C. 20426 Re: NERC Notice of Penalty regarding Pacific Gas and Electric Company FERC
REQUESTS FOR PROPOSALS
REQUESTS FOR PROPOSALS Chelsea Village Flood Study (VT Rt.110 Bridge 10, Maple Street Bridge 45, N. Court St Bridge 43) Two Rivers-Ottauquechee Regional Commission A. INTRODUCTION The Two Rivers-Ottauquechee
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance
NERC CIP Whitepaper How Endian Solutions Can Help With Compliance Introduction Critical infrastructure is the backbone of any nations fundamental economic and societal well being. Like any business, in
BUSINESS SERVICES INTEGRATION AGREEMENT
BUSINESS SERVICES INTEGRATION AGREEMENT Integration Agreement for use of Business Services Between General Services Administration Federal Procurement Data System Next Generation And 1 1. Introduction
FUNDAMENTALS OF CYBER SECURITY FOR NUCLEAR PLANTS
COURSE FUNDAMENTALS OF CYBER SECURITY FOR NUCLEAR PLANTS Hyatt Regency Phoenix is authorized by IACET to offer 1.0 CEUs for the course. is authorized by CPE to offer 11.0 credits for the course. 1 OVERVIEW
Reclamation Manual Directives and Standards
PRA Process 1. Introduction. A. Additional information and requirements supplementing the PRA process are defined in the Directive and Standard (D&S). Terms used within this Appendix can be found in the
Cisco Incident Response and Workforce Enablement for the Utility
Cisco Incident Response and Workforce Enablement for the Utility Over the next ten years, it is predicted that aging energy infrastructure and utility industry workforce will undergo their greatest transition
4.1.1 Generator Owner 4.1.2 Transmission Owner that owns synchronous condenser(s)
A. Introduction 1. Title: Verification and Data Reporting of Generator Real and Reactive Power Capability and Synchronous Condenser Reactive Power Capability 2. Number: MOD-025-2 3. Purpose: To ensure
Internal Controls And Good Utility Practices. Ruchi Ankleshwaria Manager, Compliance Risk Analysis
Internal Controls And Good Utility Practices Ruchi Ankleshwaria Manager, Compliance Risk Analysis 2 Introduction Joined WECC in March 2013 6 years of industry experience prior to joining WECC 4 years at
SAN FRANCISCO PUBLIC UTILITIES COMMISSION INFRASTRUCTURE DIVISION PROCEDURES MANUAL PROGRAM AND PROJECT MANAGEMENT
SAN FRANCISCO PUBLIC UTILITIES COMMISSION INFRASTRUCTURE DIVISION PROCEDURES MANUAL PROGRAM AND PROJECT MANAGEMENT SECTION 6: QUALITY ASSURANCE PROCEDURE: PM 6.02 TITLE: QUALITY ASSURANCE AUDITS DATE:
OPERATIONS CONTROL CENTER
OPERATIONS CONTROL CENTER STANDARD SERVICES 24/7/365 Remote Monitoring Fault Notification & Remote Resets Curtailment Management ADVANCED SERVICES In addition to our Standard Services, Advanced Services
NERC Alert System Overview
NERC Alert System Overview Todd Thompson, CIP Investigator todd.thompson@nerc.net Chris Lada, Situation Awareness Coordinator chris.lada@nerc.net About NERC: Mission To ensure the reliability of the North
LEEDS BECKETT UNIVERSITY. Information Security Policy. 1.0 Introduction
LEEDS BECKETT UNIVERSITY Information Security Policy 1.0 Introduction 1.1 Information in all of its forms is crucial to the effective functioning and good governance of our University. We are committed
Virginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Agreement ( Agreement ) is made and entered into this day of [Month], [Year] by and between [Business Name] ( Covered Entity ), [Type of Entity], whose business address