CIP-003-12 is a proposed revision of the Security Management Controls standard. The purpose of this revised standard, once approved by FERC, is to establish consistent and sustainable security management controls. These controls clearly define responsibility and accountability for protecting BES Cyber Systems from cyber threats that could cause misoperation or instability. In other words, the CIP-003-12 standard requires entities to establish and maintain documented policies, assigned roles, and implemented processes, all formally approved to secure BES Cyber Systems.
Understanding CIP-003
CIP-003 exists as part of a suite of CIP Reliability Standards, establishing governance and management controls that support the broader CIP framework. These standards require organizational, operational, and procedural controls to mitigate risk to BES Cyber Systems. Therefore, CIP-003 requires that responsible entities have minimum security management controls in place to protect BES Cyber Systems.
Why CIP-003-12 Compliance Matters
CIP-003-12 requires one or more senior-manager-approved cybersecurity policy documents that collectively address topics corresponding to other CIP standards. Key updates include reordered requirements for better flow and clarifying expectations around vendor remote access for the Low Impact BES Cyber System.
Key Requirements of CIP-003-12
It sets governance, planning, and accountability requirements; a detailed technical rationale is provided in accompanying documentation. Let’s explore the key requirements of CIP-003-12:
1. Documented Cyber Security Policies (Requirement R1)
Responsible Entities must review and obtain approval from the CIP Senior Manager at least once every 15 calendar months for documented cybersecurity policies. They reflect a broad baseline of management controls necessary to mitigate cyber risk.
2. Cyber Security Plans for Low Impact BES Cyber Systems (Requirement R2)
For assets with Low-impact BES Cyber Systems, entities must develop one or more documented Cyber Security Plans that include required sections (such as awareness, access controls, incident response, malware mitigation, malicious inbound/outbound communication detection, user authentication protections, and vendor remote access controls). These plans demonstrate that even lower-impact systems receive formal security consideration and controls.
3. CIP Senior Manager Identification (Requirement R3)
This requirement strengthens organizational accountability for compliance. Each entity must identify a CIP Senior Manager by name, ensuring accountability for the approval and governance of security policies. Any change must be documented within 30 calendar days.
4. Delegation of Authority (Requirement R4)
Entities must implement a documented process to delegate authority from the CIP Senior Manager to other responsible individuals, where delegations are used. Delegations must be documented and updated within 30 days of changes.
Step-by-Step Implementation Guide
A structured approach to CIP-003-12 compliance helps ensure both regulatory conformity and improved security posture. It includes:
1. Gap Assessment
Compare existing security policies and plans with the detailed requirements in the standard. Document where policies or approvals are missing.
2. Develop and Update Policies
Develop the R1 policy with senior approval, covering all requirements.
3. Assign Responsibilities
Ensure a named CIP Senior Manager is listed and that delegation processes are documented.
4. Create Cyber Security Plans
Develop plans for low-impact BES Cyber Systems per the specified sections in Attachment 1.
5. Build Evidence Repository
Collect documented approvals, training records, plan reviews, and other compliance artifacts.
Overcoming Common Challenges
- Documentation gaps plague compliance, with violations often from unapproved exceptions or poor delegation.
- Regular audits build stakeholder trust and prepare for NERC audits.
- Supply chain updates challenge legacy vendors; vet them via questionnaires and contracts.
Conclusion
CIP‑003‑12 specifies consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems against threats that could lead to misoperation or instability in the BES. Entities must be kept aware and educated, as the threats and vulnerabilities change that can affect the safe, sound, and secure day-to-day operations. They must monitor compliance with security policies and investigate security violations.
FAQs
1. Does CIP-003-12 apply to virtual BES Cyber Systems?
2. What evidence is needed for delegation under R6?
3. What is the Compliance Enforcement Authority?
4. What is the Compliance Monitoring and Enforcement Program?
5. How to Implement CIP-003-12 Security Management Controls?
Disclaimer: Any opinions expressed in this blog do not necessarily reflect the opinions of Certrec. This content is meant for informational purposes only.
