[fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” status=”published” publish_date=”” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” type=”legacy”][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_image_id=”” background_position=”left top” background_repeat=”no-repeat” hover_type=”none” border_color=”” border_style=”solid” border_position=”all” border_radius=”” box_shadow=”no” dimension_box_shadow=”” box_shadow_blur=”0″ box_shadow_spread=”0″ box_shadow_color=”” box_shadow_style=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” margin_top=”” margin_bottom=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”true” border_sizes_top=”0″ border_sizes_bottom=”0″ border_sizes_left=”0″ border_sizes_right=”0″ first=”true”][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]<\/p>\n
On April 19th, 2018, the U.S. Federal Energy Regulatory Commission approved Critical Infrastructure Protection (CIP) Reliability Standard CIP-003-7. This ruling gave affected organizations a period of approximately two years to demonstrate compliance with the new standard. Prior to the January 1, 2020 deadline, organizations must realize the full extent of their responsibilities under the updated standard. This blog post will lay the groundwork by providing background and a high-level overview of CIP-003-7. A subsequent blog post will cover the significant differences between CIP-003-6 and CIP-003-7 and address various actions that organizations can take to achieve compliance with CIP-003-7.<\/p>\n
[\/fusion_text][fusion_title hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” content_align=”left” size=”2″ font_size=”32px” line_height=”” letter_spacing=”” margin_top=”” margin_bottom=”5px” margin_top_mobile=”” margin_bottom_mobile=”3px” text_color=”#182857″ style_type=”default” sep_color=”” margin_top_small=”” margin_bottom_small=”3px”]<\/p>\n
Background of CIP-003-7<\/strong><\/p>\n [\/fusion_title][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]<\/p>\n Before organizations can explore the intricacies of CIP-003-7, they first need to understand the CIP controls more generally. This story begins with the mission of the North American Electric Reliability Corporation (NERC).<\/p>\n Although NERC was first established in the 1960s, it was formed as a Corporation on March 28, 2006 prior to the Standards becoming mandatory. NERC<\/a> is a not-for-profit international regulatory authority tasked with safeguarding the reliability and security of the electric grid for the United States, Canada and northern parts of Mexico. One of the ways NERC works to protect North America\u2019s electric grid is by developing enforceable Reliability Standards<\/a>. Formulated by a risk-based approach, the Standards provide guidance on how organizations can ensure the reliability of North American bulk power systems.<\/p>\n There are currently 14 different categories<\/a> of Reliability Standards leveraged by NERC. One of those categories is CIP. This set of almost a dozen protocols, including CIP-003, helps Responsible Entities specifically identify and protect Bulk Electric System (BES) Cyber Systems. One of those standards, CIP-002-5.1a<\/a>, explains that these computer systems \u201cif rendered unavailable, degraded, or misused would within 15 minutes adversely impact the reliable operation of the BES.\u201d<\/p>\n If an organization fails to comply with any of the enforceable CIP standards, they may be subject to significant monetary penalties. These fines can reach $1 million dollars per day, per violation.\u00a0 On February 28, 2018, for instance, NERC imposed<\/a> a $2.7 million fine on an unidentified electric utility for having violated CIP standards pertaining to the exposure of BES Cyber System Information, a fancy term for sensitive data.<\/p>\n [\/fusion_text][fusion_title hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” content_align=”left” size=”2″ font_size=”32px” line_height=”” letter_spacing=”” margin_top=”” margin_bottom=”5px” margin_top_mobile=”” margin_bottom_mobile=”3px” text_color=”#182857″ style_type=”default” sep_color=”” margin_top_small=”” margin_bottom_small=”3px”]<\/p>\n Inside CIP-003-7<\/strong><\/p>\n [\/fusion_title][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]<\/p>\n NERC identifies<\/a> the purpose of CIP-003-7 as the need \u201cto specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems (BCSs) against compromise that could lead to misoperation or instability in the Bulk Electric System (BES).\u201d The standard applies to Balancing Authorities, Generator Owners, Generator Operators, Interchange Coordinators, Interchange Authorities, Reliability Coordinators, Transmission Operators and Transmission Owners. It also covers Distribution Providers that own various facilities and systems, like underfrequency Load shedding (UFLS), undervoltage Load shedding (UVLS) systems, certain Special Protection Systems (SPSs) or Remedial Action Schemes (RASs) and Cranking Paths that meet specific switching requirements.<\/p>\n Responsible Entities can achieve compliance with the security management controls specified under CIP-003-7 by working to fulfill the specific requirements outlined below:<\/p>\n Organizations need CIP Senior Manager approval for one or more cyber security policies every 15 calendar months. These policies must address various issues including physical security, incident reporting, recovery plans, personnel and training, Electronic Security Perimeters (ESPs) including interactive remote access, system security management, configuration change management and vulnerability assessments, information protection, and declaring and responding to CIP Exceptional Circumstances for High and Medium Impact BCSs, as discussed in CIP-004 through CIP-011. For Low Impact BCSs, the policies must address cyber security awareness, electronic access controls, physical security controls, incident response, malicious code risk mitigation for removable media and transient cyber assets, and declaring and responding to CIP Exceptional Circumstances.<\/p>\n In the event that the company maintains Low Impact BCSs, Responsible Entities need to implement at least one documented cyber security plan to address the security of those assets, specifically the sections and criteria prescribed in Attachment 1 of CIP-003-7. Entities, however, are not required to maintain an inventory or list of BCSs, BES Cyber Assets (BCAs), or authorized users.<\/p>\n This plan will need to consist of five specific elements per Attachment 1 of CIP-003-7: cyber security awareness, physical security controls, electronic access controls, an incident response plan and mitigation measures for transient assets\/removable media. These elements will receive further discussion in our subsequent blog post.<\/p>\n All Responsible Entities must identify a CIP Senior Manager by name. They must also ensure that any changes to the CIP Senior Manager are documented\u00a0 within 30 calendar days of that change<\/p>\n Responsible Entities shall develop documented processes through which the CIP Senior Manager, where allowed by the CIP Standards, can delegate authority for specific actions. Those processes must specify the name and title of each delegate, the specific actions to which they\u2019ve been delegated, and the date of the delegation. The processes must also include the CIP Senior Manager\u2019s approval for those delegated actions and associated delegates.\u00a0 Similar to Requirement 3 above, any changes to these delegated actions or the corresponding delegates must be updated and documented within 30 days of the change.<\/p>\n [\/fusion_text][fusion_title hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” content_align=”left” size=”2″ font_size=”32px” line_height=”” letter_spacing=”” margin_top=”” margin_bottom=”5px” margin_top_mobile=”” margin_bottom_mobile=”3px” text_color=”#182857″ style_type=”default” sep_color=”” margin_top_small=”” margin_bottom_small=”3px”]<\/p>\n Working Towards Compliance With CIP-003-7<\/strong><\/p>\n [\/fusion_title][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]<\/p>\n The four requirements and five sections within Attachment 1 identified above are essential elements of every Responsible Entity\u2019s efforts to achieving compliance with CIP-003-7. To succeed in this compliance journey, organizations need to make every effort to avoid potential pitfalls, while keeping certain best practices in mind. These elements, in addition to the primary changes between CIP-003-6 and CIP-003-7, will serve as the featured subject of a subsequent blog post.<\/p>\n In the meantime, it\u2019s advisable that Responsible Entities begin organizing any forthcoming compliance work towards CIP-003-7 and other standards into a formalized compliance program. These programs must be scalable, flexible and manageable so as to highlight updates, evaluate the progress of each compliance-driven effort and document each new implementation measure. Learn how ITEGRITI can help your Entity organize their CIP-003-7 compliance program by clicking here<\/a>.<\/p>\n Editor\u2019s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Itegriti, Inc.<\/em><\/p>\n [\/fusion_text][\/fusion_builder_column][\/fusion_builder_row][\/fusion_builder_container]<\/p>\n","protected":false},"excerpt":{"rendered":" [fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” status=”published” publish_date=”” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” type=”legacy”][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” […]<\/p>\n","protected":false},"author":12,"featured_media":1402,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2179],"tags":[839],"_links":{"self":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/1303"}],"collection":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/comments?post=1303"}],"version-history":[{"count":16,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/1303\/revisions"}],"predecessor-version":[{"id":2737,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/1303\/revisions\/2737"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/media\/1402"}],"wp:attachment":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/media?parent=1303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/categories?post=1303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/tags?post=1303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Requirement 1: Receive Approval for Cyber Security Policies<\/h4>\n
Requirement 2: Implement a Cyber Security Plan<\/h4>\n
Requirement 3: Identify a CIP Senior Manager<\/h4>\n
Requirement 4: Use Formalized Processes to Delegate Responsibility<\/h4>\n