{"id":2576,"date":"2021-03-23T09:00:02","date_gmt":"2021-03-23T09:00:02","guid":{"rendered":"https:\/\/itegriti.com\/staging\/?p=2576"},"modified":"2021-04-12T05:12:21","modified_gmt":"2021-04-12T05:12:21","slug":"quarterly-roundup-of-key-nerc-security-updates-q1-2021","status":"publish","type":"post","link":"https:\/\/itegriti.com\/staging\/2021\/compliance\/quarterly-roundup-of-key-nerc-security-updates-q1-2021\/","title":{"rendered":"Quarterly Roundup of Key NERC Security Updates \u2013 Q1 2021"},"content":{"rendered":"

[fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” status=”published” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” border_style=”solid” type=”legacy” admin_toggled=”no”][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_image_id=”” background_position=”left top” background_repeat=”no-repeat” hover_type=”none” border_color=”” border_style=”solid” border_position=”all” border_radius=”” box_shadow=”no” dimension_box_shadow=”” box_shadow_blur=”0″ box_shadow_spread=”0″ box_shadow_color=”” box_shadow_style=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” margin_top=”” margin_bottom=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”true” border_sizes_top=”0″ border_sizes_bottom=”0″ border_sizes_left=”0″ border_sizes_right=”0″ first=”true”][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” content_alignment_medium=”” content_alignment_small=”” content_alignment=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” sticky_display=”normal,sticky” class=”” id=”” font_size=”” fusion_font_family_text_font=”” fusion_font_variant_text_font=”” line_height=”” letter_spacing=”” text_color=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=””]<\/p>\n

Every week, the North American Electric Reliability Corporation (NERC) releases a \u201cStandards, Compliance and Enforcement\u201d bulletin<\/a>. These documents contain important information with regard to NERC\u2019s Reliability Standards<\/a>. That includes the Critical Infrastructure Protection<\/a> (CIP), a suite of measures designed to help organizations secure their bulk assets and thereby support the operability of North America\u2019s bulk electric system.<\/p>\n

It\u2019s imperative that organizations keep up with these bulletins so that they might modify their compliance efforts accordingly. Towards that end, here is a roundup of the key security updates, including news surrounding CIP, that NERC made over the course of Q1 2021.<\/p>\n

[fusion_table fusion_table_type=”1″ fusion_table_rows=”” fusion_table_columns=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=””]<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Date of Bulletin<\/span><\/strong><\/td>\nOverview of Update<\/span><\/strong><\/td>\nDescription of Update<\/span><\/strong><\/td>\n<\/tr>\n<\/thead>\n
12\/21\/20<\/a><\/td>\nAn assessment finds that an evolving resource mix is changing the reliability, security and resilience landscape<\/td>\nThe 2020 Long-Term Reliability Assessment<\/a> found that there is enough capacity to meet electricity demand over the next 10 years. Even so, it found that some developments including the continued growth of distributed energy resources (DER) and the retirement of conventional generation are changing the way the grid is planned and operated. In some areas, there could be inadequate supply for serving electricity demand.<\/td>\n<\/tr>\n
12\/21\/20<\/a><\/td>\nNERC submits filings concerning the CIP Standards to FERC<\/td>\nOn December 14, 2020, NERC submitted a petition<\/a> of approval to FERC for the proposed Reliability Standards CIP-013-2, CIP-005-7 and CIP-010-4 addressing Supply Chain Cyber Security Risk Management. It also submitted an informational compliance filing<\/a> that contained a status update on standards development projects relating to the CIP Reliability Standards.<\/td>\n<\/tr>\n
12\/21\/20<\/a><\/td>\nNERC takes action on order that cites need for possible modifications to the CIP Reliability Standards<\/td>\nDuring its monthly open meeting, NERC took an action on an order regarding virtualization and cloud computing services. The order required NERC to submit an informational filing that evaluates the need for possible modifications to the CIP Reliability Standards concerning virtualization and cloud computing.<\/td>\n<\/tr>\n
12\/28\/20<\/a><\/td>\nCIP-008-6 enters into effect on January 1, 2021<\/td>\nNERC explained that CIP-008-6<\/a>, \u201cIncident Reporting and Response Planning,\u201d was slated to take full effect on January 1, 2021.<\/td>\n<\/tr>\n
01\/04\/21<\/a><\/td>\nNERC opens registration for its 2021 RISC Reliability Leadership Summit<\/td>\nAt the end of January, NERC and the Reliability Issues Steering Committee (RISC) opened registration for the 2021 RISC Reliability Leadership Summit<\/a>. This event traditionally gathers dozens of industry leaders, federal officials and others together to discuss security risks, critical infrastructure interdependencies and other factors confronting the grid.<\/td>\n<\/tr>\n
01\/11\/21<\/a><\/td>\nERO Enterprise extends the expansion and deferment of on-site activities for the Self-Logging Program through mid-2021<\/td>\nThe Electric Reliability Organization (ERO) Enterprise extended the temporary expansion of the Self-Logging Program as well as the deferral of on-site activities through June 30, 2021. It implemented this measure to help registered entities log instances of non-compliance while minimizing the risks associated with their response to COVID-19.<\/td>\n<\/tr>\n
01\/11\/21<\/a><\/td>\nNERC schedules team conference call on the topic of modifying the CIP-012 standard<\/td>\nOn its Standards calendar<\/a>, NERC revealed that it had scheduled a team conference call<\/a> to discuss draft modifications to CIP-012, a standard which helps to secure communications between command centers. That call took place on January 14, 2021.<\/td>\n<\/tr>\n
01\/19\/21<\/a><\/td>\nNERC schedules two additional team conference calls on the topic of modifying CIP-012<\/td>\nUnder Project 2020-04, NERC scheduled two additional team conference calls to discuss draft modifications to CIP-012 on January 21, 2021<\/a> and January 26, 2021<\/a>.<\/td>\n<\/tr>\n
02\/01\/21<\/a><\/td>\nNERC publishes agenda of the Technology and Security Committee for the Board of Trustees\u2019 quarterly meeting<\/td>\nAccording to an agenda<\/a> published by NERC, the Technology and Security Committee intended to discuss the Align tool and the ERO Secure Evidence Locker (ERO SEL), among other items, during the Board of Trustees\u2019 quarterly meeting scheduled for February 3, 2021.<\/td>\n<\/tr>\n
02\/08\/21<\/a><\/td>\nNERC proposes revisions to section 1003 of its Rules of Procedure (ROP)<\/td>\nIn accordance with FERC\u2019s Order on Compliance Filings, NERC proposed revisions to section 1003 of its Rules of Procedure (ROP). This section deals with NERC\u2019s infrastructure security program. The organization went on to say that it intended to submit those changes to the Board of Trustees for approval during their meeting in May 2021.<\/td>\n<\/tr>\n
02\/08\/21<\/a><\/td>\nNERC published new proposed Implementation Guidance documents concerning three of the CIP Standards.<\/td>\nNERC posted proposed Implementation Guidance documents for CIP-005-7 (R3) \u201cElectronic Security Perimeters,\u201d<\/a> CIP-010-4 (R1) \u201cConfiguration Change Management and Vulnerability Assessments\u201d<\/a> and CIP-013-2 \u201cSupply Chain Risk Management Plans.\u201d<\/a><\/td>\n<\/tr>\n
02\/08\/21<\/a><\/td>\nBoard of Trustees address emerging reliability and security risks during first meeting of 2021<\/td>\nDuring its first meeting of the year, NERC\u2019s Board of Trust accepted a framework to address known and emerging reliability and security risks affecting registered entities. It also welcomed two new Board members.<\/td>\n<\/tr>\n
02\/08\/21<\/a><\/td>\nNERC submits notice of withdrawal for CIP-002-6<\/td>\nIn early February, NERC submitted a notice of withdrawal<\/a> on the proposed CIP-002-6 Standard to FERC.<\/td>\n<\/tr>\n
02\/08\/21<\/a><\/td>\nNERC creates webinar series to discuss modifications made to several CIP Standards<\/td>\nIn Project 2016-02, the Modifications to CIP Standards drafting team created a two-part industry webinar series to discuss modifications made to Standards CIP-002 through CIP-011 as well as CIP-013.<\/td>\n<\/tr>\n
02\/16\/21<\/a><\/td>\nNERC schedules GridEx VI for mid-November, 2021<\/td>\nEvery two years, NERC and the Electricity Information Sharing and Analysis Center (E-ISAC) hold a GridEX security exercise that simulates a cyber and physical attack on the North American electricity grid. The sixth iteration of this exercise series is planned for November 16-17, 2021, with registration<\/a> now open for Lead Planners and Planners.<\/td>\n<\/tr>\n
02\/16\/21<\/a><\/td>\nThe Modifications to CIP Standards drafting team announces part I of its industry webinar series<\/td>\nNERC scheduled the first part of the webinar series<\/a> covering recent modifications made to the CIP Standards for February 23, 2021.<\/td>\n<\/tr>\n
02\/22\/21<\/a><\/td>\nNERC schedules a Modifications to CIP-012 conference call<\/td>\nAs part of Project 2020-04, NERC arranged a team conference call<\/a> to discuss modifications made to the CIP-012 standard.<\/td>\n<\/tr>\n
03\/01\/21<\/a><\/td>\nNERC announces the 10th<\/sup> iteration of GridSecCon<\/td>\nNERC and Texas RE announced that they will be holding the 10th<\/sup> instance of GridSecCon on October 19-20, 2021. This event, which will be held virtually this year, brings cyber and physical leaders together to participate in training sessions, discuss lessons learned and share effective mitigation practices.<\/td>\n<\/tr>\n
03\/01\/21<\/a><\/td>\nNERC publishes slide presentations and recordings for CIP Standards webinars<\/td>\nNERC announced that it had published the streaming webinar<\/a> and slide presentation<\/a> for the first part of the Modifications to CIP Standards Outreach webinar. It also said that it posted the same<\/a> resources<\/a> for the Update on CIP Standards webinar.<\/td>\n<\/tr>\n
03\/08\/21<\/a><\/td>\nThe Reliability and Security Technical Committee approves the scope of the Security Working Group at its quarterly meeting<\/td>\nOn March 2nd<\/sup>, the Reliability and Security Technical Committee (RSTC) approved the scope of the Security Working Group<\/a> (SWG). That scope includes supporting industry efforts to mitigate emergent risks confronting the electricity grid.<\/td>\n<\/tr>\n
03\/08\/21<\/a><\/td>\nNERC publishes slide presentation and recording for second part of CIP Standards modifications webinar<\/td>\nNERC posted the slide presentation<\/a> and the recording<\/a> for the second part of the Modifications to CIP Standards Outreach webinar.<\/td>\n<\/tr>\n
03\/08\/21<\/a><\/td>\nNERC posts revised ERO Enterprise CIP Evidence Request Tool (ERT)<\/td>\nNERC published a revised version of the ERO Enterprise CIP Evidence Request Tool<\/a> (ERT). This resource helps entities with their CIP compliance monitoring engagements.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

[\/fusion_table]<\/p>\n

Check back next quarter for another roundup of security-related updates. In the meantime, you can review NERC\u2019s full list of bulletins here<\/a>.<\/p>\n

[\/fusion_text][\/fusion_builder_column][\/fusion_builder_row][\/fusion_builder_container]<\/p>\n","protected":false},"excerpt":{"rendered":"

Stay informed of the key security updates, including news surrounding CIP, that NERC made over the course of Q1 2021.<\/p>\n","protected":false},"author":12,"featured_media":2578,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2179],"tags":[],"_links":{"self":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/2576"}],"collection":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/comments?post=2576"}],"version-history":[{"count":4,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/2576\/revisions"}],"predecessor-version":[{"id":2581,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/posts\/2576\/revisions\/2581"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/media\/2578"}],"wp:attachment":[{"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/media?parent=2576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/categories?post=2576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itegriti.com\/staging\/wp-json\/wp\/v2\/tags?post=2576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}