NERC CIP Cheatsheet

NERC CIP-004-6 – Personnel & Training

This NERC CIP standard aims to train contractors and employees. With sufficient training, NERC CIP 004-6 standard will help companies reduce the likelihood of cyber-attacks targeted to BES Cyber Systems. The personal training consists of raising cyber security awareness among staff. In addition, it paints a clear picture of the access and risk management controls for employees and contractors.

Personnel and training are the focus of CIP-004-6. The intent of this standard is to ensure that appropriate levels of risk assessment for personnel are addressed, and that training and cyber awareness are incorporated into the entity’s programs, plans and procedures. Types of personnel reviews, based on need, are outlined as are the timeline review requirements regarding personnel risk assessments. Requirements for frequency of training events, and training content are also outlined in this standard as are requirements related to access and access revocation.

NERC CIP-005-6 – Electronic Security Perimeter

This standard aims to heighten the protection level of BES Cyber Assets and prevent potential instability and operational interruption. Furthermore, the NERC CIP-005-6 standard focuses on having complete control over network access to all critical assets.

In any case, this standard propels utilities to develop a dedicated ESP or Electric Security Perimeter around their cyber assets. Once a virtual barrier exists, entities can track interconnected data flows. And any critical assets outside the boundaries of ESP must become part of the leading network via a dedicated Electronic Access Point (EAP). Companies should also maintain their network segments, control remote access points, and use data encryptions.

This standard aims to heighten the protection level of BES Cyber Assets and assist with the prevention of potential instability and operational interruption by establishing an Electronic Security Perimeter (ESP) using Electronic Access Control or Monitoring Systems (EACMS) to allow only authorized inbound and outbound traffic to BES Cyber Systems. Cyber assets outside the ESP are routed through controlled Electronic Access Points (EAP). Requirements are established for remote interactive access to include dial-up requirements, encryption and multi-factor authentication. Software for systems protection is also addressed in the standard and may include Intrusion Detection Systems (IDS) and application firewalls. Additional requirements the capability to identify remote vendor access and the capability to terminate remote vendor access on demand.

NERC CIP-006-6 – Physical Security of BES Cyber Systems

This standard involves physical and operational controls in connection with a physical security perimeter, testing and maintenance program, and a visitor control program. In the physical security perimeter, entities must restrict their physical access via procedural controls and existing operational documents.

In the visitor control program, entities must implement a protocol to manage all visitors in the last 90 days. And the testing and maintenance program of this standard requires entities to test electronic Physical Security Perimeter on an annual basis.

Plans are established to define operational and procedural controls for physical access. Controls address unescorted physical access, unauthorized physical access, alarms and personnel notification to personnel and groups identified in the entity’s Incident Response (IR) plan. Specifics such as monitoring for physical access control systems, automated logging of personnel based on level of access, retainment of logs and protection of cabling and other components used for communication within an ESP. If physical restrictions are not available, implementation of other types of controls to mitigate risk are required and methods are addressed.

The standard also addresses visitor control such as requirements for visitor escorts, logging requirements, and visitor log retention. Additional requirements, depending on impact level and physical access control configurations, include maintenance and testing of physical access control systems.

NERC CIP-007-6 – System Security Management

Here, entities must define operational and technical elements and processes. The idea is to enhance the security of systems in the ESPs of BES Cyber Systems. Typically, these components include security patches, system access controls, security event monitoring, ports and services, and prevention of malicious code.

Applicable protection requirements may include port management in that only required ports are enabled, port ranges are managed. Physical port managed is required as well, in particular, where removable media is concerned. Another aspect of system security management addresses patch management to include processes for tracking patches on a regular basis, evaluating applicability of those patches and installation of patches based on applicability. Plans should also have processes that address when a patch shall be applied, explanations if a patch can’t be installed as planned. Should patch installation be delayed, mitigations should be in place, or should be implemented, if the patch cannot be installed as planned. Requirements for mitigation of malicious code introduction are defined as well as management of virus software to include signature or definition management, and system hardening.

Monitoring is another key aspect of CIP-007. Required logging of specific events are identified, alert requirements are defined based on event type, log retention requirements and review of those logs are covered. Other requirements include a means to enforce authentication of interactive user access, management of generic group accounts and personnel that have access to those group accounts, user password parameter requirements, password change requirements, and limitations regarding unsuccessful authentication attempts are addressed.

NERC CIP-008-6 – Incidence Reporting and Response Planning

Here, entities must prepare incident reports and create guidelines that work as a response. The incident reporting and response planning standard allow energy entities to document, identify, classify, report, and respond to incidents associated with critical assets.

At its core, this CIP standard compliance divides into incident response plan, implementation of incident response, and final review and communication of the incident response plan.

Roles and responsibility requirements for response groups and individuals are addressed along with the procedures that define incident handling to include containment, eradication and incident resolution. Time requirements for incident response plan testing, types of testing, any lessons learned and requirements to update the incident response plan based on testing are also addressed. Evidence requirements related to evidence retainment for reportable cyber security events are included in the standard.