10/8/2014 NERC CIP Version 5 Webinar Series "Version 5 . - ABB
10/8/2014NERC CIP Version 5 webinar series“Version 5 transition” ABBOctober 8, 2014 Slide 1
Housekeeping ABBOctober 8, 2014 Slide 2 All attendees are automatically in “Mute”. If you have any questions, please type them into thequestions panel. This webinar is being recorded and can be found onhttp://new.abb.com/us/about/nerc-cip-education after thelive event. You will get a copy of this presentation in a follow-up email. Please take a few moments at the end of the webinar toanswer the survey questions.
About the presenter(s) Joseph BaxterNERC CIP Lead – HVDC / FACTSjoseph.baxter@us.abb.com(919) 807-5077Before coming to ABB, Joseph Baxter completed several years as a NERC CIP Auditor forthe SERC region, with special emphasis on the technical side of cyber security. He has bothaudited and been audited in the realm of CIP, and brings over fifteen years of InformationSecurity experience gleaned from the Financial Sector to bear on the problems facing GridSecurity today. Tim ConwayEKC ConsultingTechnical Director ICS and SCADA programs at SANS. Formerly, the Director of CIPCompliance and Operations Technology at Northern Indiana Public Service Company(NIPSCO). Former Chair of the RFC CIPC, current Chair of the NERC CIP InterpretationDrafting Team, member of the NESCO advisory board, current Chair of the NERC CIPCGridEx Working Group, and Chair of the NBISE Smart Grid Cyber Security panel. ABBOctober 8, 2014 Slide 3
From the other side of the tableAudit tales ABBOctober 8, 2014 Slide 4 2009 Spot Check CIP-002-1 in scope One of our auditors knewjust a little too much aboutour system Just how did thatsubstation connect
Audience Question #1CIP Program ABBOctober 8, 2014 Slide 5
In the old days of CIP-002A deductive processBESCACCA ABBOctober 8, 2014 Slide 6 CIP-002 Pilot Program Starting inventory alwaysthe problem
CIP-005 and CIP-006The inductive processCCAESPPSP ABBOctober 8, 2014 Slide 7 CIP-002 took things out CIP-005 declared an ESP CIP-006 declared a PSP
Meant to be quantitativeTurned out qualitative ABBOctober 8, 2014 Slide 8 The old way of doing things Seven questions Three questions And what went wrong? Committee review
CIP Version 4How the future became bright ABBOctober 8, 2014 Slide 9 Obvious that FERC wantedmore assets listed Critical Version 4 introduced theBright Line Criteria (BLC) Right or wrong Love it or hate it
The Metcalf SubstationA new standard ABBOctober 8, 2014 Slide 10 CIP-014 came into being Requirement 1 extremelyclose to the Version 3RBAM So don’t throw out yourRBAM just yet Attend the CIP-0014webinar to find out more
CIP v5 BLC SimplifiedThe easy wayHighStartBES CyberSystemsBLCMediumLow ABBOctober 8, 2014 Slide 11 Well, maybe not quite that easy A lot of moving parts exist inside that smallyellow diamond labeled “BLC” Replaces my deductive pyramid
RequirementImpactAssetEntityDetermination ApplicabilityThe big picture ABB Slide 12
Audience Question #2Asset Analysis ABBOctober 8, 2014 Slide 13
Impact RatingsHigh, Medium, and Low ABBOctober 8, 2014 Slide 14 High - essentially 100% ofall the Requirements Medium – about 95% of theRequirements Low – technically 1Requirement (CIP-003-3R2)
External routable connectivityAnd what it means to you ABBOctober 8, 2014 Slide 15 Physical Access Controllers(PACs) Electronic Access Controland Monitoring (EACMs) Protected Cyber Assets(PCAs) And now: ERC
Quality EvidenceDocumentation is king ABBOctober 8, 2014 Slide 16 Archive library Workflow and tracking Reporting engine Granular to minimum vector Strong vs. weak
Additional NERC CIP educational webinars(All webinars are Eastern Time) Change managementWednesday, October 15, 2014 at 2:00 p.m.Learn about change management and the fact that this will be the largest area ofrecurring effort. You will gain understanding of why Patch Management is not asolution to meet your NERC CIP updates and why Version 3 no longer applies.Register now: https://www1.gotomeeting.com/register/567897657 Baseline managementWednesday, October 22, 2014 at 2:00 p.m.Learn what a baseline and testing are, why automation is key and what isrequired to meet Version 5 compliance.Register now: https://www1.gotomeeting.com/register/937111497 Cyber asset groupingThursday, October 23, 2014 at 12:00 p.m.(Power generation specific) Learn process approaches to CIP-002-5.1 R1 as itpertains to BES cyber asset categorization.Register now: https://www1.gotomeeting.com/register/774616816 ABBOctober 8, 2014 Slide 17
Additional NERC CIP educational webinars(All webinars are Eastern Time) Access management and malicious software controlsWednesday, October 29, 2014 at 2:00 p.m.Learn how to access control fits with CIP-004-5 and why account management isnot effortless.Register now: https://www1.gotomeeting.com/register/448008129 Low assets and future CIP versionsWednesday, November 5, 2014 at 2:00 p.m.(Power generation specific) Learn the compliance requirements for entities withlow assets and audit worksheets as well as future standard activities.Register now: https://www1.gotomeeting.com/register/872327665 Identification and review of critical transmission assetsWednesday, November 12, 2014 at 2:00 p.m.Learn how to approach the guidelines and criteria highlighted by NERC to fulfillthe risk assessment goal.Register now: https://www1.gotomeeting.com/register/639963169 ABBOctober 8, 2014 Slide 18
Automation & Power World (APW)Power SmartStream Digital Conference Theme: Preparing for the power evolution Date: November 6, 2014 – 11 a.m. – 6 p.m. EST Why should you attend?25 educational webinars, dozens of scheduled chats andinterviews and more than 100 white papers available for downloadfrom knowledgeable subject matter experts. Earn Professional Development Hours (PDH)Download an official attendance certificate for every livewebinar session you attend to get credit for your learning time No travel or registration costs! Can’t attend the day of?That’s fine. All webinars will be recorded and will be availablefor on-demand viewing after the live event.Register now: http://bit.ly/SmartStreamPower ABBOctober 8, 2014 Slide 19
Automation & Power World (APW)LIVE conference – APW 2015 Theme: Harnessing the power of change Date: March 2-5, 2015 in Houston, Texas Location: George R. Brown Convention Center Why should you attend? Listen to interesting and topical keynote presentations Chose from over 300 industry and solution-focusededucational sessions and panel discussions Network with ABB experts and your peers Earn Professional Development Hours (PDH) Completely free!Check the website for updates: http://new.abb.com/apw ABBOctober 8, 2014 Slide 20
Questions?This is the point to review and answer anyquestions in the panel. If you have aquestion, please type your question in now. ABBOctober 8, 2014 Slide 21
SurveyPlease take a few moments to answer thesurvey questions.Thank you. ABBOctober 8, 2014 Slide 22
Former Chair of the RFC CIPC, current Chair of the NERC CIP Interpretation Drafting Team, member of the NESCO advisory board, current Chair of the NERC CIPC GridEx Working Group, and Chair of the NBISE Smart Grid Cyber Security panel.
CIP -003 -5, CIP -004 -5, CIP -005 -5, CIP -006 -5, CIP -007 -5, CIP -008 -5, CIP -009 -5, CIP -010 -1, . controls to mitigate risk to BES Cyber Systems. This suite of CIP Standards is referred to as the Version 5 CIP Cybe r Security Standards . Most requirement s open with , Each Responsible Entity shall implement one or more documented .
NERC CIP v5/v6 o Overview of Version 5 NERC Cyber Security Standards o Notable differences between Version 3 and Version 5 NERC CIP reliability standards Tools and resources o A few words about “tools” and NERC CIP compliance o Active vulnerability assessment tools o Danger:
This NPCC whitepaper is not intended to replace or supersede the NERC Implementation Guidance for CIP-012-1. 1. This document is intended to accompany and complement the NERC Implementation Guidance for CIP-012-1. NERC Reliability Standard CIP012- -1 is intended to “protect the confid
CIP-005-5 . 4/1/2016: CIP-006-5. 4/1/2016: CIP-007-5. 4/1/2016: CIP-008-5. 4/1/2016: CIP-009-5. 4/1/2016: CIP-010-1. 4/1/2016: CIP-011-1. 4/1/2016: Talk with Texas RE & NRWG February 18, 2016. 3 CIP
(CIP 005 and CIP 006) g, g ( ) Replacement of 500 signs and 3,000 chain markers (CIP 020) Rehabilitation of 5,000 feet of track pads/shock absorbers (CIP 021) Rehabilitation of 5 miles of third rail (CIP 023) Rehabilitation of 10 miles of running rail (CIP 024)Rehabilitati
Ms. Rayo is a NERC CIP Compliance Program Consultant assisting clients in developing a solid sustainable NERC CIP Program which included a Sabotage Reporting Procedure, Cyber Security Policy, Internal Compliance Program, and othe
NERC CIP-014. Compliance Guide. The purpose of the NERC CIP-014 reliability standard is to protect electrical . facilities from physical attacks that could threaten the stability and operation of the electric grid distribution system. Requirement R5 man
The Guidelines and Technical Basis from NERC CIP-007-5, clears away a lot of possible confusion. The Guideline states that "the SDT intends for the entity to know what network accessible ports and associated services are accessible on their assets".1 This NERC CIP clarification limits the ports to listening ports and their respective services.
