NERC-CIP Standard

Requirement

Description

CIP-002-1: Critical Cyber Asset Identification

Requires identifying and documenting Critical Cyber Assets essential for the Bulk Electric System's operation.

R1. Critical Asset Identification Method

Develop and document a methodology based on risk assessment to identify Critical Assets.

R2. Critical Asset Identification

Create and annually update a list of Critical Assets, derived using the risk assessment method from R1, with regular reviews and necessary updates.

R3. Critical Cyber Asset Identification

Based on the Critical Assets list from R2, compile a list of Critical Cyber Assets vital for the functioning of each Critical Asset.

CIP-003-1: Security Management Controls

Requires Responsible Entities to implement security controls to protect Critical Cyber Assets.

R1. Cyber Security Policy

Create and enforce a cyber security policy that reflects the organization's commitment to securing Critical Cyber Assets.

R2. Leadership

Appoint a senior manager to oversee and ensure compliance with Standards CIP-002 to CIP-009.

R3. Exceptions

Record any deviations from the cyber security policy as exceptions, with authorization from a senior manager or their delegate.

R4. Information Protection

Establish a program to identify, categorize, and safeguard information linked to Critical Cyber Assets.

R5. Access Control

Develop and implement a program to control access to information associated with Critical Cyber Assets.

R6. Change Control and Configuration Management

Set up and document a process for change control and configuration management, addressing all changes to hardware and software of Critical Cyber Assets, in line with the established change control procedures.

CIP-004-1: Personnel and Training

Requires personnel with access to Critical Cyber Assets, including contractors, to undergo risk assessment, training, and security awareness.

R1. Awareness

Develop, document, and maintain a program to continually enhance the security awareness of personnel with authorized access to Critical Cyber Assets.

R2. Training

Implement and document an annual training program on cyber security for staff with authorized access to Critical Cyber Assets, reviewing and updating it as needed.

R3. Personnel Risk Assessment

Maintain a documented program to assess the risk posed by personnel with authorized access, in compliance with relevant legal and union agreements.

R4. Access

Keep updated lists of individuals with authorized access to Critical Cyber Assets, including details of their specific electronic and physical access privileges.

CIP-005-1: Electronic Security Perimeter

Requires protecting Electronic Security Perimeters and their access points where Critical Cyber Assets are located.

R1. Electronic Security Perimeter

The Responsible Entity shall ensure that every Critical Cyber Asset resides within an Electronic Security Perimeter.

R2. Electronic Access Controls

The Responsible Entity shall implement and document the organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the Electronic Security Perimeter(s).

R3. Monitoring Electronic Access

The Responsible Entity shall implement and document an electronic or manual process(es) for monitoring and logging access at access points to the Electronic Security Perimeter(s) twenty-four hours a day, seven days a week.

R4. Cyber Vulnerability Assessment

The Responsible Entity shall perform a cyber vulnerability assessment of the electronic access points to the Electronic Security Perimeter(s) at least annually.

R5. Documentation Review and Maintenance

The Responsible Entity shall review, update, and maintain all documentation to support compliance with the requirements of Standard CIP-005.

CIP-006-1: Physical Security of Critical Cyber Assets

Requires establishing a physical security program for Critical Cyber Assets.

R1. Physical Security Plan

Create and regularly update a physical security plan, ensuring senior management approval and addressing key security aspects.

R2. Physical Access Controls

Document and enforce operational controls to manage physical access at every entry point to secure areas, ensuring 24/7 operation.

R3. Monitoring Physical Access

Monitor all access points to secure areas round the clock, promptly reviewing and managing any unauthorized access attempts.

R4. Logging Physical Access

Log every instance of physical access, including unauthorized attempts, and monitor them consistently, following specified breach protocols.

R5. Access Log Retention

Retain all physical access logs for at least 90 days, and preserve logs concerning major incidents as per Standard CIP-008 requirements.

R6. Maintenance and Testing

Conduct regular maintenance and testing of all physical security systems, especially those related to access control, monitoring, and logging, to ensure their functionality.

CIP-007-1: Systems Security Management

Requires defining security procedures for Critical and non-critical Cyber Assets within Electronic Security Perimeters.

R1. Test Procedures

Ensure new and modified Cyber Assets within the Electronic Security Perimeter don't compromise existing cybersecurity controls.

R2. Ports and Services

Develop and maintain a process to enable only essential ports and services for normal and emergency operations.

R3. Security Patch Management

Establish a program for managing cybersecurity software patches, covering tracking, evaluating, testing, and installing patches for all Cyber Assets.

R4. Malicious Software Prevention

Implement anti-virus and malware prevention tools to protect all Cyber Assets within the Electronic Security Perimeter, where possible.

R5. Account Management

Set up technical and procedural controls for user access authentication and accountability, minimizing unauthorized access risks.

R6. Security Status Monitoring

Utilize automated tools or organizational processes to monitor cybersecurity-related system events for all Cyber Assets.

R7. Disposal or Redeployment

Define formal methods for the disposal or redeployment of Cyber Assets within the Electronic Security Perimeter, as per CIP-005 standards.

R8. Cyber Vulnerability Assessment

Conduct an annual cyber vulnerability assessment for all Cyber Assets within the Electronic Security Perimeter.

R9. Documentation Review and Maintenance

Regularly review and update cybersecurity documentation annually, documenting any system or control modifications within 90 days.

CIP-008-1: Incident Reporting and Response Planning

Requires managing Cyber Security Incidents involving Critical Cyber Assets, including identification, classification, response, and reporting.

R1. Cyber Security Incident Response Plan 

Create and regularly update a plan to respond to cyber security incidents, ensuring it covers essential response strategies and procedures.

R2. Cyber Security Incident Documentation

Maintain detailed records of all cyber security incidents for a period of three years.

CIP-009-1: Recovery Plans for Critical Cyber Assets

Requires recovery plans for Critical Cyber Assets aligned with business continuity and disaster recovery practices.

R1. Recovery Plans 

Develop and conduct annual reviews of recovery plans for Critical Cyber Assets, ensuring they address key recovery strategies.

R2. Exercises 

Perform at least one exercise each year to test the recovery plans, ranging from simple drills to full operational tests or actual incident recoveries.

R3. Change Control 

Revise recovery plans to reflect any new changes or insights gained from exercises or actual incident recoveries, and communicate these updates to relevant personnel within 90 days.

R4. Backup and Restore 

Ensure recovery plans contain detailed processes for backing up and storing information critical for restoring Critical Cyber Assets, including spare parts, configuration settings, and tape backups.

R5. Testing Backup Media 

Annually test backup media containing essential recovery information to verify its availability and effectiveness, with the option to perform tests offsite.