Mandatory Reliability Standards for Critical Infrastructure Protection
Federal RegisterAug 6, 2007
Ask Donna
What actually matters in this document.
Text
DEPARTMENT OF ENERGY
Federal Energy Regulatory Commission
18 CFR Part 39
[Docket No. RM06-22-000]
Mandatory Reliability Standards for Critical Infrastructure Protection
July 20, 2007.
AGENCY:
Federal Energy Regulatory Commission, Department of Energy.
ACTION:
Notice of proposed rulemaking.
SUMMARY:
Pursuant to section 215 of the Federal Power Act (FPA), the Federal Energy Regulatory Commission (Commission), proposes to approve eight Critical Infrastructure Protection (CIP) Reliability Standards submitted to the Commission for approval by the North American Electric Reliability Corporation (NERC). The CIP Reliability Standards require certain users, owners, and operators of the Bulk-Power System to comply with specific requirements to safeguard critical cyber assets. In addition, pursuant to section 215(d)(5) of the FPA, the Commission proposes to direct NERC to develop modifications to the CIP Reliability Standards to address specific concerns identified by the Commission. Approval of these standards will help protect the nation's Bulk-Power System against potential disruptions from cyber attacks.
DATES:
Comments are due October 5, 2007.
ADDRESSES:
You may submit comments, identified by docket number by any of the following methods:
•
Agency Web Site: http://ferc.gov.
Follow the instructions for submitting comments via the eFiling link found in the Comment Procedures section of the preamble.
•
Mail/Hand Delivery:
Commenters unable to file comments electronically must mail or hand deliver an original and 14 copies of their comments to the Federal Energy Regulatory Commission, Secretary of the Commission, 888 First Street, NE., Washington, DC 20426. Please refer to the Comment Procedures section of the preamble for additional information on how to file paper comments.
FOR FURTHER INFORMATION CONTACT:
Gary Cohen (Legal Information), Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426, (202) 502-8321.
Paul Silverman (Legal Information), Office of the General Counsel, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426, (202) 502-8683.
Regis Binder (Technical Issues), Office of Energy Markets and Reliability, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426, (202) 502-6460.
Jan Bargen (Technical Issues), Office of Energy Markets and Reliability, Federal Energy Regulatory Commission, 888 First Street, NE., Washington, DC 20426, (202) 502-6333.
SUPPLEMENTARY INFORMATION:
Table of Contents
Paragraph Numbers
I. Background
2.
A. EPAct 2005 and Mandatory Reliability Standards
2.
B. Development of CIP Reliability Standards
7.
C. CIP Assessment
11.
II. Discussion
13.
A. General Issues
13.
1. Cyber Security Challenges
13.
2. Applicability
21.
3. Compliance Measured by Outcome
32.
4. Implementation Plan
42.
5. Issues Presented by Terminology
50.
6. Guidance for Improving CIP Reliability Standards
87.
B. Discussion of Each CIP Reliability Standard
89.
1. CIP-002-1—Critical Cyber Asset Identification
89.
2. CIP-003-1—Security Management Controls
120.
3. CIP-004-1—Personnel and Training
149.
4. CIP-005-1—Electronic Security Perimeter(s)
176.
5. CIP-006-1—Physical Security of Critical Cyber Assets
204.
6. CIP-007-1—Systems Security Management
223.
7. CIP-008-1—Incident Reporting and Response Planning
265.
8. CIP-009-1—Recovery Plans for Critical Cyber Assets
289.
C. Violation Risk Factors
321.
1. Background
321.
2. Commission Proposal
324.
III. Information Collection Statement
332.
IV. Environmental Analysis
339.
V. Regulatory Flexibility Act Certification
340.
VI. Comment Procedures
350.
VII. Document Availability
353.
Appendix A List of Commenters
Appendix B Violation Risk Factors: Proposed Dispositions
Before Commissioners: Joseph T. Kelliher, Chairman; Suedeen G. Kelly, Marc Spitzer, Philip D. Moeller, and Jon Wellinghoff.
1. Pursuant to section 215 of the Federal Power Act (FPA), the Commission proposes to approve eight Critical Infrastructure Protection (CIP) Reliability Standards submitted to the Commission for approval by the North American Electric Reliability Corporation (NERC). The CIP Reliability Standards require certain users, owners, and operators of the Bulk-Power System to comply with specific requirements to safeguard critical cyber assets.
1
In
addition, pursuant to section 215(d)(5) of the FPA, the Commission proposes to direct NERC to develop modifications to the CIP Reliability Standards to address specific concerns identified by the Commission.
1
In the context of the CIP Reliability Standards, cyber assets are programmable electronic devices
and communication networks including hardware, software, and data.
See
note 69,
infra.
I. Background
A. EPAct 2005 and Mandatory Reliability Standards
2. On August 8, 2005, the Electricity Modernization Act of 2005, which is Title XII, Subtitle A, of the Energy Policy Act of 2005 (EPAct 2005), was enacted into law.
2
EPAct 2005 adds a new section 215 to the FPA, which requires a Commission-certified Electric Reliability Organization (ERO) to develop mandatory and enforceable Reliability Standards, which are subject to Commission review and approval. Once approved, the Reliability Standards may be enforced by the ERO subject to Commission oversight, or the Commission can independently enforce Reliability Standards.
3
2
Energy Policy Act of 2005, Pub. L. No. 109-58, Title XII, Subtitle A, 119 Stat. 594, 941 (2005),
to be codified
at 16 U.S.C. 824o.
3
16 U.S.C. 824o(e)(3).
3. On February 3, 2006, the Commission issued Order No. 672, implementing section 215 of the FPA.
4
Pursuant to Order No. 672, the Commission certified one organization, NERC, as the ERO.
5
The Reliability Standards developed by the ERO and approved by the Commission will apply to users, owners and operators of the Bulk-Power System, as set forth in each Reliability Standard.
4
Rules Concerning Certification of the Electric Reliability Organization; Procedures for the Establishment, Approval and Enforcement of Electric Reliability Standards,
Order No. 672, 71 FR 8662 (Feb. 17, 2006), FERC Stats. & Regs. ¶ 31,204 (2006),
order on reh'g,
Order No. 672-A, 71 FR 19814 (Apr. 18, 2006), FERC Stats. & Regs. ¶ 31,212 (2006).
5
North American Electric Reliability Corp.,
116 FERC ¶ 61,062 (ERO Certification Order),
order on reh'g & compliance,
117 FERC ¶ 61,126 (ERO Rehearing Order) (2006),
order on compliance,
118 FERC ¶ 61,030 (2007) (Jan. 2007 Compliance Order),
appeal docket sub nom. Alcoa, Inc.
v.
FERC,
No. 06-1426 (D.C. Cir. Dec. 29, 2006).
4. Pursuant to section 215(d)(2) of the FPA and § 39.5(c) of the Commission's regulations, the Commission is required to give due weight to the technical expertise of the ERO with respect to the content of a Reliability Standard or to a Regional Entity organized on an Interconnection-wide basis with respect to a proposed Reliability Standard or a proposed modification to a Reliability Standard to be applicable within that Interconnection.
6
6
18 CFR 39.5(c)(1), to be codified at 16 U.S.C.824o.
5. The ERO must file with the Commission each new or modified Reliability Standard that it proposes to be made effective under section 215 of the FPA. The Commission can then approve or remand the Reliability Standard. The Commission also can, among other actions, direct the ERO to modify an approved Reliability Standard to address a specific matter if it considers this appropriate to carry out section 215 of the FPA.
7
Only Reliability Standards approved by the Commission will become mandatory and enforceable.
7
Section 215(d)(5) of the FPA.
6. On April 4, 2006, as modified on August 28, 2006, NERC submitted to the Commission a petition seeking approval of 107 proposed Reliability Standards. On March 16, 2007, the Commission issued a final rule, Order No. 693, approving 83 of these 107 Reliability Standards and directing other action related to these Reliability Standards.
8
8
Mandatory Reliability Standards for the Bulk-Power System,
Order No. 693, 72 FR 16416 (Apr. 4, 2007), FERC Stats. & Regs. ¶ 31,242 (2007);
reh'g pending.
B. Development of CIP Reliability Standards
7. In August 2003, NERC approved the Urgent Action 1200 standard, which was the first comprehensive cyber security standard for the electric industry. This voluntary standard applied to control areas (
i.e.
, balancing authorities), transmission owners and operators, and generation owners and operators that perform defined functions. Specifically, it established a self-certification process relating to the security of system control centers of the applicable entities. The Urgent Action 1200 standard remained in effect on a voluntary basis until June 1, 2006, at which time the eight CIP Reliability Standards that are the subject of the current rulemaking replaced the Urgent Action 1200 standard.
8. On August 28, 2006, NERC submitted to the Commission for approval the following eight proposed CIP Reliability Standards:
9
9
The proposed Reliability Standards are not proposed to be codified in the CFR and are not attached to the NOPR. They are, however, available on the Commission's eLibrary document retrieval system in Docket No. RM06-22-000 and are available on the ERO's Web site,
http://www.nerc.com/filez/standards/Reliability_Standards.html#Critical_Infrastructure_Protection.
• CIP-002-1—Cyber Security—Critical Cyber Asset Identification: Requires a responsible entity to identify its critical assets and critical cyber assets using a risk-based assessment methodology.
• CIP-003-1—Cyber Security—Security Management Controls: Requires a responsible entity to develop and implement security management controls to protect critical cyber assets identified pursuant to CIP-002-1.
• CIP-004-1—Cyber Security—Personnel & Training: Requires personnel with access to critical cyber assets to have an identity verification and a criminal check. It also requires employee training.
• CIP-005-1—Cyber Security—Electronic Security Perimeters: Requires the identification and protection of an electronic security perimeter and access points. The electronic security perimeter is to encompass the critical cyber assets identified pursuant to the risk-based assessment methodology required by CIP-002-1.
• CIP-006-1—Cyber Security—Physical Security of Critical Cyber Assets: Requires a responsible entity to create and maintain a physical security plan that ensures that all cyber assets within an electronic security perimeter are kept in an identified physical security perimeter.
• CIP-007-1—Cyber Security—Systems Security Management: Requires a responsible entity to define methods, processes, and procedures for securing the systems identified as critical cyber assets, as well as the non-critical cyber assets within an electronic security perimeter.
• CIP-008-1—Cyber Security—Incident Reporting and Response Planning: Requires a responsible entity to identify, classify, respond to, and report cyber security incidents related to critical cyber assets.
• CIP-009-1—Cyber Security—Recovery Plans for Critical Cyber Assets: Requires the establishment of recovery plans for critical cyber assets using established business continuity and disaster recovery techniques and practices.
9. NERC stated that these Reliability Standards provide a comprehensive set of requirements to protect the Bulk-Power System from malicious cyber attacks.
10
They require Bulk-Power System users, owners, and operators to establish a risk-based vulnerability assessment methodology and use that methodology to identify and prioritize critical assets and critical cyber assets. Once the critical cyber assets are identified, the CIP Reliability Standards require, among other things, that the responsible entities establish plans,
protocols, and controls to safeguard physical and electronic access, to train personnel on security matters, to report security incidents, and to be prepared for recovery actions. Further, NERC explained that, because of the expanded scope of facilities and entities covered by the eight CIP Reliability Standards, and the investment in security upgrades required in many cases, NERC has also developed an implementation plan that provides for a three-year phase-in to achieve full compliance with all requirements.
11
10
NERC Filing at 24.
11
I
d.
at 24: Exhibit B (Implementation Plan for Cyber Security Standards).
10. Each proposed Reliability Standard uses a common organizational format that includes five sections, as follows: (A) Introduction, which includes “Purpose” and “Applicability” sub-sections; (B) Requirements; (C) Measures; (D) Compliance; and (E) Regional Differences. In this NOPR, these section titles are capitalized when referencing a designated provision of a Reliability Standard.
C. CIP Assessment
11. On December 11, 2006, the Commission released a “Staff Preliminary Assessment of the North American Electric Reliability Corporation's Proposed Mandatory Reliability Standards on Critical Infrastructure Protection” (CIP Assessment). The CIP Assessment identified staff's preliminary observations and concerns regarding the eight proposed CIP Reliability Standards. The CIP Assessment described issues common to a number of the proposed CIP Reliability Standards. It also reviewed and identified issues regarding each individual CIP Reliability Standard but did not make specific recommendations regarding the appropriate action on a particular proposal.
12. Comments on the CIP Assessment were due by February 12, 2007. Entities that filed comments are listed in Appendix A to this NOPR.
II. Discussion
A. General Issues
1. Cyber Security Challenges
13. The CIP Reliability Standards represent the most thorough attempt to date to address cyber security issues that relate to the Bulk-Power System. For many years the control systems for the Bulk-Power System have operated in a stand-alone environment without computer or communication links to an external Information Technology (IT) infrastructure. However, over recent years, such stand-alone enclaves have been increasingly connected to both the corporate environment and the external world.
14. Modern computer and communication network interconnection brings with it the potential for cyber attacks on these systems. These concerns become particularly critical when several entities come under attack simultaneously. The CIP Assessment identified “defense in depth” as a widely recognized strategy to address cyber threats. Defense in depth involves the layering of various defense mechanisms in a way that either discourages an adversary from continuing an attack or aids in early detection of cyber threats.
15. A major challenge to preserving system protection is that changes occur rapidly in system architectures, technology, and threats. As a result, cyber security strategies must comprise a layered, interwoven approach to vigilantly protect the Bulk-Power System against evolving cyber security threats.
16. Cyber security involves a careful balance of the technologies available with the existing control equipment and the functions they perform. Cyber security does have purely technical components, which consist of the various available technologies to defend computer systems. The task of balancing technical options comes into play as one selects and combines the various available technologies into a comprehensive architecture to protect the specific computer environment.
17. A key to the successful cyber protection of the Bulk-Power System will be the establishment of CIP Reliability Standards that provide sound, reliable direction on how to choose among alternatives to achieve an adequate level of security, and the flexibility to make those choices. This conclusion is consistent with the lessons learned from the August 2003 blackout occurring in the central and northeastern United States. The identification of the causes of that and other previous major blackouts helped determine where existing Reliability Standards need modification or new Reliability Standards need to be developed to improve Bulk-Power System reliability. The U.S.—Canada Power System Blackout Task Force, in its Blackout Report, developed specific recommendations for the improving the then-current voluntary standards and development of new Reliability Standards.
12
12
U.S.—Canada Power System Blackout Task Force, Final Report on the August 14, 2003 Blackout in the United States and Canada: Causes and Recommendations (April 2004) (Blackout Report). The Blackout Report is available on the Internet at
http://www.ferc.gov/industries/electric/indus-act/blackout.asp.
18. Thirteen of the 46 Blackout Report Recommendations relate to cyber security. They address topics such as the development of cyber security policies and procedures; strict control of physical and electronic access to operationally sensitive equipment; assessment of cyber security risks and vulnerability at regular intervals; capability to detect wireless and remote wireline intrusion and surveillance; guidance on employee background checks; procedures to prevent or mitigate inappropriate disclosure of information; and improvement and maintenance of cyber forensic and diagnostic capabilities.
13
The proposed CIP Reliability Standards address these and related topics.
13
See
Blackout Report at 163-169, Recommendations 32-44.
19. As we noted in Order No. 693, the Blackout Report recommendations address key issues for assuring Bulk-Power System reliability and represent a well-reasoned and sound basis for action.
14
Likewise, in this NOPR, the Commission recognizes the merits of specific Blackout Report recommendations as a basis for proposing certain modifications to the eight CIP Reliability Standards that the Commission proposes to approve.
14
See
Order No. 693 at P 234.
20. We recognize that the guidance and directives in the cyber security Reliability Standards themselves must also strike a reasonable balance. If the provisions are overly prescriptive they tend to become a “one size fits all” solution, which does not suit this environment, where systems vary greatly in architecture, technology, and risk profile. However, if Reliability Standards lack sufficient detail, they will provide little useful direction, thereby making compliance and enforcement difficult, allow flawed implementation of security mechanisms, and result in inadequate protection. The Commission will evaluate the proposed CIP Reliability Standards in the context of the above over-arching considerations.
2. Applicability
21. The Applicability section of each proposed CIP Reliability Standard identifies the following 11 categories of responsible entities that must comply
with the Reliability Standard: reliability coordinators, balancing authorities, interchange authorities, transmission service providers, transmission owners, transmission operators, generator owners, generator operators, load serving entities, NERC, and Regional Reliability Organizations.
22. The CIP Assessment raised two issues regarding applicability of the CIP Reliability Standards. First, it stated that, although it is likely that NERC and the Regional Entities
15
are not directly subject to mandatory Reliability Standards, their compliance with the CIP Reliability Standards is important to the extent that they have cyber communications with users, owners or operators of the Bulk-Power System.
16
The CIP Assessment suggested that NERC and Regional Entity compliance could be required pursuant to NERC's Rules of Procedure. Some commenters pointed out that NERC out-sources critical application systems that are relied upon by many responsible entities, such as the Interchange Distribution Calculator, and suggest that the out-source provider should be contractually compelled to comply with the CIP Reliability Standards, with NERC ultimately responsible for non-compliance.
17
15
In Order No. 693, at P 157, the Commission directed NERC to remove all references to the Regional Reliability Organization and replace them with a reference to the Regional Entity where appropriate. This directive should apply to the CIP Reliability Standards as well.
16
See
CIP Assessment at 12-14.
17
E.g.,
ISO-NE, ISO/RTO Council, and SPP.
23. Second, the CIP Assessment raised concerns about the appropriateness of a size threshold, below which small entities would be exempt from compliance. It explained that, while the assets and operations of a smaller entity may not have a major day-to-day operational impact on the Bulk-Power System, such an entity can provide a cyber gateway to compromise larger users, owners, or operators of the Bulk-Power System. When attacked simultaneously with the facilities of other small entities, the aggregate result could have an adverse impact on the reliability of the Bulk-Power System. Thus, the CIP Assessment suggested that a key to any determination of whether an entity should be subject to the CIP Reliability Standards is whether or not it is a user, owner, or operator of the Bulk-Power System and whether it has a cyber connection to other users, owners or operators of the Bulk-Power System. The CIP Assessment concluded that the CIP Reliability Standards should apply to all users, owners, or operators regardless of size, because a relatively small entity could have critical importance from a cyber security perspective.
24. A number of commenters stated that the focus should be on those entities that own or operate critical assets, rather than being addressed in terms of “large” or “small” size of entities.
18
These commenters warn that a blanket waiver that uniformly exempts small entities from compliance with certain provisions of the proposed CIP Reliability Standards therefore would not be appropriate. NERC and other commenters maintain that applicability should not be determined based on cyber connections but, rather by identifying those users, owners and operators of the Bulk-Power System that own or operate critical assets and associated critical cyber assets. Another group of commenters urge that the Commission not impose the same compliance obligations on smaller entities as on larger entities when a violation by the smaller entity would not have a critical impact on the Bulk-Power System. They maintain that adverse impacts on the grid from small entities would be an uncommon occurrence and urge a case-by-case approach to granting waivers from compliance with the CIP Reliability Standards.
19
18
E.g.,
Allegheny, California PUC, EEI, Georgia System, ISO-NE, MidAmerican, NERC, ReliabilityFirst, Northeast Utilities, NRECA, Ontario IESO, Tampa Electric, and Xcel.
19
E.g.,
APPA/LPPC and Santa Clara.
Commission Proposal
25. With regard to the applicability of the CIP Reliability Standards to the ERO, NERC has modified its Rules of Procedure to provide that the ERO will comply with each Reliability Standard that identifies the ERO as an applicable entity.
20
Similarly, the delegation agreements between NERC and each of the eight Regional Entities expressly state that the Regional Entity is committed to comply with approved Reliability Standards.
21
The Commission believes that this approach is sufficient and, accordingly, does not propose any additional measures or revisions on this issue.
20
See
NERC Rules of Procedure, section 100.
21
See North American Electric Reliability Corp.
, 119 FERC ¶ 61,060 at P 4-5 (2007) (approving the delegation agreements and directing certain modifications).
26. The Commission's determinations in Order No. 693 are relevant to deciding the applicability of the CIP Reliability Standards to small entities. In Order No. 693, the Commission approved NERC's compliance registry process as a reasonable means “to ensure that the proper entities are registered and that each knows which Commission-approved Reliability Standard(s) are applicable to it.”
22
Further, the Commission approved NERC registry criteria that identify specific categories of users, owners and operators of the Bulk-Power System and criteria for registering entities within each of the categories.
23
22
Order No. 693 at P 92,
quoting ERO Certification Order
, 116 FERC ¶ 61,062 at P 689.
23
Order No. 693 at P 93-95. NERC's Statement of Compliance Registry Criteria (Revision 3), approved by the Commission in Order No. 693, is available on NERC's Web site at:
ftp://www.nerc.com/pub/sys/all_updl/ero/Statement_of_Compliance_ Registry_Criteria_Rev3.pdf
.
27. The Commission will also rely on the NERC registration process to determine applicability with the CIP Reliability Standards. In other words, an entity would be responsible to comply with the CIP Reliability Standards if the entity is (1) registered by NERC under one or more functional categories and (2) within a functional category for which the entity is registered as identified in the Applicability section of the CIP Reliability Standards. However, even though it is the Commission's present intention to rely on the NERC registration process to identify appropriate entities, we remain concerned about the possibility of entities not identified by the registration process becoming a weakness in the security of the Bulk-Power System. In this regard, we note that, in Order No. 693, the Commission explained that, “if there is an entity that is not registered and NERC later discovers that the entity should have been subject to the Reliability Standards, NERC has the ability to add the entity, and possibly other entities of a similar class, to the registration list * * *.”
24
In addition, in Order No. 693, the Commission indicated that it would further examine applicability issues under section 215 of the FPA in a future proceeding, and notes the same intention here.
25
24
Order No. 693 at P 97.
25
Id.
at P 77.
28. Regarding our concern about small entities becoming a gateway for cyber attacks, some commenters argue that the Commission should not focus on cyber connections to determine applicability of the CIP Reliability Standards. Others state that it would be uncommon for a small entity to cause an adverse impact upon the grid. The Commission's reliance upon the NERC registration process to determine the applicability of the CIP Reliability Standards is in part based upon our expectation that industry will use the “mutual distrust” posture discussed below regarding CIP-
003-1. The term “mutual distrust” is used to denote how these “outside world” systems are treated by those inside the control system. A mutual distrust posture requires each responsible entity that has identified critical cyber assets to protect itself and not trust any communication crossing an electronic security perimeter, regardless of where that communication originates.
29. Similarly, the Commission is relying on the NERC registration process to include all critical assets and associated critical cyber assets. For example, if assets are important to the reliability of the Bulk-Power System, such as black start units, we would expect that the NERC registration process would identify the owners or operators of those units as critical, and require them to register, even though the facilities may be “smaller” or at low voltages. Demand side aggregators might also need to be included in the NERC registration process if their load shedding capacity would affect the reliability or operability of the Bulk-Power System.
30. As discussed later, as an initial compliance step, each entity that is responsible for compliance with the CIP Reliability Standards must identify critical assets through the application of a risk-based assessment as required by CIP-002-1. Whether that entity must comply with the remainder of the requirements in the CIP Reliability Standards would depend on the outcome of that assessment and the subsequent identification of critical cyber assets, also required by CIP-002-1. Thus, CIP-002-1 acts as a filter, determining which entities must comply with the remaining CIP requirements (
i.e.
, CIP-003-1 through CIP-009-1).
31. The Commission agrees with the commenters that access to information essential to the operation of critical cyber assets by out-sourced entities that are not otherwise subject to the CIP Reliability Standards presents a potential vulnerability to the Bulk-Power System. We understand that, on occasion, NERC negotiates contracts with such third party vendors, and the products developed by the vendors are then used by responsible entities that, as owners of the critical cyber assets, are ultimately responsible for their cyber security protection under the CIP Reliability Standards. The Commission invites comment on whether and how such out-sourced entities should be contractually obligated to comply with the CIP Reliability Standards while satisfying their other contractual obligations.
3. Compliance Measured by Outcome
a. Performance-Based Standards
32. The CIP Assessment expressed concern that the lack of specificity within the proposed CIP Reliability Standards could result in inadequate implementation efforts and inconsistent results.
26
NERC, along with a number of other commenters, states that the CIP Reliability Standards are not prescriptive, positing that the level of specificity they embody is appropriate. NERC explains that the use of a performance-based structure frames the CIP Reliability Standards in terms of required results or outcomes with criteria for verifying compliance, but without prescribing the methods for achieving the required results. In other words, the specific means to achieve that outcome are left to the discretion of the responsible entity. Such an approach contrasts with a prescribed or design-based standard. NERC concludes that, when taken together, the proposed Reliability Standards constitute a comprehensive set of cyber security activities, stating that it is more important that a pre-defined, desirable outcome is achieved than prescribing the means to that end.
26
CIP Assessment at 3.
33. The Commission generally agrees that use of performance-based standards is a part of the design of cyber security safeguards for the Bulk-Power System's critical assets. However, as we indicated in Order No. 672, performance-based standards may not always be appropriate, for example, in situations where “the ‘how' may be inextricably linked to the Reliability Standard and may need to be specified to ensure the enforceability of the standard.”
27
Accordingly, where necessary, the Commission proposes to direct NERC to modify the CIP Reliability Standards to address the “how.” Moreover, the Commission is concerned that, while NERC explains that the CIP Reliability Standards are performance-based, the CIP Reliability Standards do not provide a mechanism to measure performance or otherwise determine whether a responsible entity has met the goals of a particular requirement set forth in the standards.
27
Order No. 672 at P 260. The Commission also explained that, for some Reliability Standards, “leaving out implementation features could [
inter alia
] sacrifice necessary uniformity in implementation * * *”.
34. The Commission believes that monitoring the performance of responsible entities identified in the CIP Reliability Standards involves three strategies. First, it is important that there be both internal and external oversight of the responsible entity's activities. While the proposed Reliability Standards embody internal management oversight strategies, there should also be oversight that embodies a wide-area view. Second, when flexibility is exercised in a way that excepts an entity from a Requirement, such action should be monitored, documented, and periodically revisited to determine consistency and effectiveness of the implementation. Third, reporting certain wide-area information and analysis to the Commission is vital to its role in ensuring that approved CIP Reliability Standards achieve on an ongoing basis an adequate level of cyber security protection to the Bulk-Power System. These three strategies are applied in our discussion below of various provisions of the CIP Reliability Standards.
b. Adequacy of Outcomes
35. The CIP Assessment explained that many of the Requirements in the proposed CIP Reliability Standards consist of broad directives, and that the Measures and Compliance provisions focus largely on proper documentation. The Reliability Standards themselves do not explain the interplay between the Requirements, on one hand, and the Measures and Levels of Non-Compliance, on the other.
36. The CIP Assessment expressed the view that the focus of the Measures and Compliance provisions on documentation could be interpreted to suggest that possession of documentation can demonstrate compliance, regardless of the quality of its contents. It suggested that compliance with the CIP Reliability Standards must be understood in terms of compliance with the Requirements, which, according to NERC, define what an entity must do to be compliant and establishes an enforceable obligation.
Comments
37. NERC and others do not share the CIP Assessment concern regarding the focus on documentation.
28
NERC and ReliabilityFirst acknowledge the extensive use of documentation throughout the CIP Reliability Standards, but note that the majority of this documentation is used to demonstrate that the Requirements have been met. NERC indicates that, while the “mere possession of documentation” does not guarantee compliance, appropriate documentation is essential to demonstrate that steps to comply with the Requirements have been taken and will streamline after-the-
fact compliance audits. Similarly, EEI believes that the quality of the documentation is an important factor for assessing compliance and should be the subject of an audit. FirstEnergy and Santa Clara state that it would be helpful for NERC to provide guidance on what constitutes reasonable documentation.
28
E.g.,
ReliabilityFirst, APPA/LPPC, and SPP.
38. Others raise concerns regarding the emphasis on documentation. For example, Duke Energy agrees with the CIP Assessment that the CIP Reliability Standards rely heavily on documentation to verify compliance. Duke Energy believes that the accumulation of documentation to facilitate audits may prove to be less than optimum for the CIP Reliability Standards and suggests that efforts to improve the CIP Requirements should gradually focus less on documentation, and more on the actual level of cyber security to be implemented by the responsible entity. ISA Group states that the CIP Reliability Standards do not specify clear Requirements and do not provide sufficient guidance. ISA Group believes that the clarity and detail of the Levels of Non-Compliance in terms of documentation give the impression that the documentation is the focus of the CIP Reliability Standards.
Commission Proposal
39. The Commission agrees with NERC that, while documentation is necessary, the documentation by itself does not satisfy the Requirements of a Reliability Standard. Rather, implementation of the substance of the Requirements is most important in determining compliance. As we explained in Order No. 693, “while Measures and Levels of Non-Compliance provide useful guidance to the industry, compliance will in all cases be measured by determining whether a party met or failed to meet the Requirement given the specific facts and circumstances of its use, ownership or operation of the Bulk-Power System.”
29
Moreover, the Commission recognized that:
29
Order No. 693 at P 253.
The most critical element of a Reliability Standard is the Requirements. As NERC explains, “the Requirements within a standard define what an entity must do to be compliant * * * [and] binds an entity to certain obligations of performance under section 215 of the FPA.” If properly drafted, a Reliability Standard may be enforced in the absence of specified Measures or Levels of Non-Compliance.
30
30
Id., quoting
NOPR at P 105 (footnote omitted).
40. To reiterate, while documentation set forth in the Measures and Levels of Non-Compliance plays an important role in assuring that a responsible entity is able to demonstrate to an auditor or others that it has complied with the substantive Requirement of a Reliability Standard, adequate documentation does not substitute for substantive compliance with the obligations and responsibilities set forth in the Requirement.
41. Related, certain Requirements of the CIP Reliability Standards obligate a responsible entity to develop and maintain a plan, policy or procedure. However, such Requirements do not always explicitly require implementation of the plan, policy or procedure.
31
The Commission interprets such provisions to include an implicit requirement to implement the plan, policy or procedure; and to make a responsible entity subject to a non-compliance action for failing to implement the policy. Such an interpretation is reasonable to prevent the scenario in which the ERO, Regional Entity or the Commission could assess a penalty against a responsible entity for failure to develop a plan, policy or procedure that satisfies the Requirements of the Reliability Standard, but unable to assess a penalty against a responsible entity that has developed an adequate plan but fails to implement it. Further, the Commission proposes that the ERO, in developing modifications to the CIP Reliability Standards, include explicitly in such Requirements that a responsible entity must implement a plan, policy or procedure that it is required to develop.
31
See,
e.g.
, CIP-006-1, Requirement R1 (requiring a responsible entity to “create and maintain a ‘physical security plan” ');
cf.
CIP-003-1, Requirement R1 (requiring a responsible entity to “document and implement a cyber security policy”).
4. Implementation Plan
42. Unlike the Reliability Standards approved in Order No. 693, which NERC formulated based on existing voluntary standards, the CIP Reliability Standards are new and require applicable entities in many cases to develop new cyber security systems and procedures, which will take time to develop and implement. To address this task, NERC developed an implementation plan that includes a proposed four-stage schedule for implementing the proposed CIP Reliability Standards over a three-year period.
32
32
NERC August 28, 2006 Filing, Exhibit B “ Implementation Plan for Cyber Security Standards” (Implementation Plan).
43. The Implementation Plan sets out a proposed schedule for accomplishing the various tasks associated with compliance with the CIP Reliability Standards. The schedule gives a timeline by calendar quarters for completing various tasks and prescribes milestones for when a responsible entity must: (1) “Begin work;” (2) “be substantially compliant” with a requirement; (3) “be compliant” with a requirement; and (4) “be auditably compliant” with a requirement.
44. According to the implementation plan, “auditably compliant” must be achieved in 2009 for certain Requirements by certain responsible entities, and in 2010 for the remainder.
CIP Assessment
45. The CIP Assessment suggested that it may be possible to assess a responsible entity's level of compliance prior to the time when it achieves its “auditably compliant” status. It noted that, if a responsible entity is in the “begin work” phase, it has: (1) Developed and approved a plan to address the Requirements of a Reliability Standard; (2) identified and planned for necessary resources; and (3) begun implementing the Requirements. These are specific steps that an audit can examine. The CIP Assessment observed that the difference between the “compliant” and “auditably compliant” status for many of the Requirements is the accumulation of 12 months of compliance records. It sought comment on whether it would be beneficial to audit a responsible entity at the “begin work” and “compliant” stages, even though the responsible entity may not have the full 12 month accumulation of compliance records.
Comments
46. A number of commenters agree that some type of assessment, although not necessarily in the form of an audit, is both possible and potentially beneficial prior to the time an entity achieves “auditably compliant” status.
33
NERC agrees that there is a benefit to ensuring that responsible entities are moving timely toward “auditably compliant” status. While NERC believes that audits at an interim stage are not possible, it states that it plans to monitor progress through self-certification without assessing penalties. Other commenters oppose interim audits, stating that they could interfere with implementation plans and lead to penalties for non-compliance.
34
33
E.g.,
Santa Clara, SPP, APPA/LPPC, NERC, Allegheny, Georgia Operators, ISO RTO Council, MidAmerican, SoCal Edison, and NRECA.
34
E.g.,
ATC, EEI, National Grid, Tampa Electric, and FirstEnergy.
Commission Proposal
47. The Commission proposes to approve NERC's Implementation Plan, including the proposed timelines for achieving compliance. NERC indicates that the proposed timelines were developed with input from all sectors of the electric industry. Further, while some responsible entities have already installed the necessary equipment and software to address cyber security, the Commission recognizes that many responsible entities must purchase and install new equipment and software to achieve compliance. Based on these considerations, the Commission believes that the timetable proposed by NERC sets reasonable deadlines for industry compliance.
48. However, the Commission is concerned whether the industry will be fully prepared for compliance upon reaching the implementation deadline and will take reasonable action to protect the Bulk-Power System during this interim period. The Commission believes that NERC's plans to require self-certification during the interim period are helpful. NERC, however, does not indicate the interval for self-certification. We believe that an annual certification would not allow adequate monitoring of progress and propose to direct that the ERO develop a self-certification process with more frequent certifications, either tied to target dates in the schedule or perhaps quarterly or semi-annual certifications. While we agree with NERC that an entity should not be subject to a monetary penalty if it is unable to certify that it is on schedule, such an entity should explain to the ERO the reason it is unable to self-certify. The ERO and the Regional Entities should then work with such an entity either informally or, if appropriate, by requiring a remedial plan to assist such an entity in achieving full compliance in a timely manner. Further, the ERO and the Regional Entities should provide informational guidance, upon request, to assist a responsible entity in assessing its progress in reaching “auditably compliant” status.
49. To further address our concerns about the period prior to when responsible entities achieve full compliance with the CIP Reliability Standards, the Commission also proposes to direct the ERO to add a cyber security assessment to NERC's existing readiness reviews. In this readiness assessment process, the ERO should assist in the identification of best practices and deficiencies of the reviewed entities, both to help them prepare for implementation of the CIP Reliability Standards and to assess the status of their compliance efforts. The readiness reviews will also help the Commission to evaluate the potential effectiveness of the cyber security Reliability Standards before they are implemented by disclosing the progress made by reviewed entities in their CIP Reliability Standards implementation efforts.
5. Issues Presented by Terminology
a. Business Judgment
NERC Proposal
50. Each of the proposed CIP Reliability Standards incorporates the concept of “reasonable business judgment” as a guide for determining what constitutes appropriate compliance with those Reliability Standards. The Purpose statement of Reliability Standard CIP-002-1 provides that:
These standards recognize the differing roles of each entity in the operation of the Bulk Electric System, the criticality and vulnerability of the assets needed to manage Bulk Electric System reliability, and the risks to which they are exposed. Responsible entities should interpret and apply Standards CIP-002 through CIP-009 using reasonable business judgment.
Each of the subsequent CIP Reliability Standards includes a statement that “Responsible Entities should interpret and apply the Reliability Standard using reasonable business judgment.”
51. NERC's Glossary of Terms Used in Reliability Standards (NERC glossary) does not define the term “reasonable business judgment,” and the CIP Reliability Standards do not otherwise suggest how the term is to be interpreted. NERC's Frequently Asked Questions (FAQ) document that accompanies the CIP Reliability Standards provides the only available guidance on the issue.
35
It states that the phrase is meant “to reflect—and to inform—any regulatory body or ultimate judicial arbiter of disputes regarding interpretation of these Standards—that responsible entities have a significant degree of flexibility in implementing these Standards.” The FAQ document notes that there is a long history of judicial interpretation of the business judgment rule and suggests that this history is relevant to the use of this rule in the context of the CIP Reliability Standards. The document goes on to say:
35
NERC included the FAQ document in its August 28, 2006 filing. The FAQ document is also available at
ftp://www.nerc.com/pub/sys/all_updl/standards/sar/Revised_CIP-002-009_FAQs_06Mar06.pdf
.
Courts generally hold that the phrase indicates reviewing tribunals should not substitute their own judgment for that of the entity under review other than in extreme circumstances. A common formulation indicates the business judgment of an entity—even if incorrect in hindsight—should not be overturned as long as it was made (1) in good faith (not an abuse or indiscretion), (2) without improper favor or bias, (3) using reasonably complete (if imperfect) information as available at the time of the decision, (4) based on a rational belief that the decision is in the entity's business interest. This principle, however, does not protect an entity from simply failing to make a decision.
CIP Assessment
52. The CIP Assessment acknowledged the importance of flexibility and discretion in implementing cyber security strategies. However, it expressed skepticism about the appropriateness of the business judgment rule in this context, given the unusually broad discretion it permits. The CIP Assessment thus expressed concern that such an approach to flexibility and discretion would unduly compromise the effectiveness of the CIP Reliability Standards and the ability to enforce compliance with them.
53. The CIP Assessment sought comment on: (1) Specific examples of the differing roles of entities in relationship to their potential impact on cyber security risks to Bulk-Power System reliability; (2) alternatives to reliance on the reasonable business judgment rule that would allow for recognition of differing roles of entities, vulnerability of assets, and exposure to risk but also permit effective enforcement of the CIP Reliability Standards; and (3) the ramifications of removing the “reasonable business judgment” language from the proposed CIP Reliability Standards while an alternative approach is developed using the ERO's Reliability Standards development process.
Comments
54. A number of commenters stress the importance of flexibility and discretion in implementing the CIP Reliability Standards, but agree that it would not be reasonable to give the term “business judgment” the meaning it has in the context of corporate fiduciary responsibility.
36
Other commenters state that the use of reasonable business judgment was not meant to allow entities to evade application of the CIP Reliability Standards, but they acknowledge that legal precedent
suggests that inclusion of the term could increase the potential for disputes.
37
These commenters support the use of alternative terms to acknowledge the need for flexibility and discretion, such as “reasonableness,” “good utility practice,” or “good engineering practices.”
36
E.g.
, California PUC, APPA/LPPC, EPSA, and Progress Energy.
37
E.g.
, Duke, Progress Energy, Xcel, and National Grid.
55. Other commenters argue that the “reasonable business judgment” language is essential to provide balance in the implementation of the CIP Reliability Standards and should not be removed. Some indicate that use of the term was intended to allow consideration of cost or business implications of an action.
38
For instance, NERC states that, if business considerations are left out of account, the CIP Reliability Standards would describe an impossibly high level of technical content, and the cost of implementing such a solution would approach an infinite amount of time, money, and resources. Commenters also state that use of reasonable business judgment allows every entity the flexibility to make the best choice for its unique situation.
39
Finally, some commenters believe that the term reasonable business judgment will ensure that the CIP Reliability Standards are enforceable by permitting development of a record of industry practices over time that provides a body of reasonable, industry cyber security practices.
40
38
E.g.
, NERC, Southern, and PG&E.
39
E.g.
, NERC, NU, PJM, Santa Clara, and Cleveland Public Power.
40
E.g.
, IRC and Tampa Electric.
56. Some commenters argue that use of the term “reasonable business judgment” was not intended to trigger the exculpatory “business judgment rule” as used in connection with the actions of corporate directors.
41
They contend the term was intended as a “reasonableness” standard that was meant to add a defined and objective measure for assessing an entity's actions in implementing the CIP Reliability Standards based on the entity's particular system and assets. EEI argues that while the NERC FAQ accurately describes traditional use of the reasonable business judgment rule in the context of corporate law, it does not articulate how this language is being used in the context of cyber security standards. EEI also states that it is unlikely that the FAQ document would control interpretation of the CIP Reliability Standards.
41
E.g.
, Arizona Public Service, EEI, Progress Energy, SoCal, TEC, Duke, ReliabilityFirst and National Grid.
57. Finally, some commenters acknowledge that the traditional corporate business judgment rule does grant officers and directors broad discretion, but also contains elements that temper this discretion.
42
To receive the benefit of the rule, a business decision must be made on an informed basis, in good faith and in honest belief that the action taken was in the best interests of the company. In addition, the person making the decision must act with the care that an ordinarily prudent person would reasonably be expected to exercise in a like position with similar circumstances. The commenters argue that these requirements permit the term reasonable business judgment to be adapted to the cyber security context.
42
E.g.
, EEI and Progress Energy.
Commission Proposal
58. For the reasons discussed below, the Commission proposes to direct the ERO to modify the CIP Reliability Standards to remove references to the “reasonable business judgment” language before compliance audits start in 2009.
59. The Commission agrees with commenters that flexibility and discretion are essential in implementing the CIP Reliability Standards and that implementing those Reliability Standards must be done on the basis of the specific facts and circumstances applicable in the individual case at hand. Cyber security problems do not lend themselves to one-size-fits-all solutions. In addition, the Commission acknowledges that cost can be a valid consideration in implementing the CIP Reliability Standards. However, the Commission believes that the traditional concept of reasonable business judgment is ill suited to the task of implementing an appropriate program of cyber security pursuant to FPA section 215. The concept of reasonable business judgment addresses the issue of whether a decision-making process conforms to certain standards. It was developed specifically to address the issue of how courts should approach business decisions made by a company's officers or directors, and the answer it provides is based on certain assumptions about how our economic system operates and who is most likely to have the knowledge and expertise needed to make appropriate business decisions. However, the concept of reasonable business judgment takes on a very different meaning when removed from its original context and applied to a different factual situation where very different assumptions apply. As explained below, when transferred to the realm of cyber security or Bulk-Power System reliability generally, recourse to reasonable business judgment is inconsistent with the purpose of FPA section 215.
60. Cyber standards are essential to protecting the Bulk-Power System against attacks by terrorists and others seeking to damage the grid. Because of the interconnected nature of the grid, an attack on one system can affect the entire grid. It is therefore unreasonable to allow each user, owner or operator to determine compliance with the CIP Reliability Standards based on its own “business interests.” Business convenience cannot excuse compliance with mandatory Reliability Standards.
61. While some commenters argue that references to reasonable business judgment in the CIP Reliability Standards were not intended to trigger the traditional corporate business judgment rule, the FAQ document can be read to suggest the contrary. In fact, the FAQ document states explicitly that “reasonable business judgment” means what the courts have said it means in the corporate context. It states that the phrase has an almost 200 year history in the common law nations and notes that “[c]ourts generally hold that the phrase indicates reviewing tribunals should not substitute their own judgment for that of the entity under review other than in extreme circumstances.” The FAQ document then goes on to list the elements of reasonable business judgment as the courts generally define it. The FAQ document nowhere states or suggests that the meaning and significance of reasonable business judgment is subject to some modification or qualification in the context of implementing and complying with the CIP Reliability Standards.
62. Moreover, as the FAQ document makes clear, compliance turns on whether a decision was “based on a rational belief that the decision is in the entity's business interest.” That test is fundamentally incompatible with Congress' decision to adopt a regime of mandatory Reliability Standards. As we stated above, the vulnerability of one entity can pose risks to the entire grid. We therefore cannot allow each user, owner or operator to determine compliance based on its own parochial business interests. The purpose of section 215 is to protect the national interest in grid reliability.
63. The business judgment rule was adopted in a context that is simply not appropriate for mandatory Reliability Standards. The business judgment rule recognizes that officers and directors
must have wide latitude if a company is to be managed properly and efficiently and that it is not in the interest of shareholders to create incentives for officers and directors to be overly cautious.
43
Courts have noted that shareholders voluntarily undertake the risk of bad business judgments and investors who are adverse to such risk have alternative investment opportunities available to them.
44
In the context of section 215, however, these principles do not apply. The issue under section 215 is not whether the management of a business is acting in the interest of its own shareholders, but rather whether an entity is taking appropriate action to avert risks that could threaten the entire grid.
43
Cramer
v.
General Telephone and Electronics Corp.
, 582 F.2d 259 (3d Cir. 1978);
Joy
v.
North
, 692 F.2d 880 (2d Cir. 1982).
44
Joy
v.
North
, 692 F.2d 880 (2d Cir. 1982).
64. It is also notable that the business judgment rule is invoked, in the corporate governance context, only in extreme circumstances. Generally, to find an officer or director liable there must be evidence establishing that he or she acted fraudulently, in bad faith, or with gross or culpable negligence.
45
Some cases refer to unconscionable conduct, illegal or oppressive acts, willful abuse of discretionary power or neglect of duty, and recklessness as situations that fall outside reasonable business judgment.
46
While the FAQ document does not explain this point clearly, it does allude to it when it notes that the “[c]ourts generally hold that the phrase indicates reviewing tribunals should not substitute their own judgment for that of the entity under review
other than in extreme circumstances
.” (Emphasis supplied).
45
In Re Bal Harbour Club, Inc.
, 316 F.3d 1192 (11th Cir. 2003) (
Bal Harbour
);
Froelich
v.
Senior Campus Living LLC
, 355 F.3d 802 (4th Cir. 2004);
Poth
v.
Rassey
, 281 F. Supp. 2d (E.D. Va. 2003) (
Poth
v.
Rassey
).
46
Bal Harbour; Poth
v.
Rassey
;
Gray
v.
Manhattan Medical Center, Inc.
, (18 P.3d 291 (Kan. 2001);
G & N Aircraft, Inc.
v.
Boehm
, 743 N.E.2d 227 (Ind. 2001).
65. These criteria are plainly inappropriate for mandatory CIP Reliability Standards. For example, if an inadequate cyber plan caused a grid-wide disturbance or blackout, a violation could be established only in “extreme circumstances” where there was “unconscionable conduct” or “recklessness” or, as discussed above, where the entity's plan was not consistent with its “own business interest.” These highly deferential legal standards are not compatible with a mandatory reliability regime under section 215 of the FPA. We therefore propose to direct NERC to delete references to “reasonable business judgment” from the CIP Reliability Standards.
66. We wish to stress, however, that, even though we propose to delete the business judgment rule, we believe flexibility in the application of the CIP Reliability Standards remains appropriate. First, as discussed throughout this NOPR, the CIP Reliability Standards contain specific provisions that explicitly permit various alternative courses of action. More importantly, however, the CIP Reliability Standards do not simply allow the exercise of flexibility and discretion, they require it. Even with the various revisions and additions that the Commission is proposing in this NOPR, the CIP Reliability Standards constitute a relatively brief document, and the Requirements it contains are largely performance based. These Requirements for the most part are quite general and do not dictate specific solutions to cyber-security problems. Responsible entities therefore must interpret and apply them to their specific circumstances. The CIP Assessment explained:
The task of balancing technical options comes into play as one selects and combines the various available technologies into a comprehensive architecture to protect the specific computer environment. The key to success is possessing cyber security standards that provide reliable direction on how to choose among alternatives to achieve an adequate level of security.
47
47
CIP Assessment at 8.
67. Based on our careful consideration of this issue as discussed above, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, the Commission proposes to direct that the ERO modify each of the proposed CIP Reliability Standards to remove references to the “reasonable business judgment” language before compliance audits start in 2009.
b. “Technical Feasibility” and “Acceptance of Risk”
68. Two CIP Reliability Standards contain language that provides exceptions from compliance with a Requirement. This language takes two forms: one focuses on technical feasibility, and the other focuses on acceptance of risk.
69. Some provisions require a responsible entity to take action “where technically feasible.”
48
The NERC glossary does not define the term “technically feasible,” and the Reliability Standards themselves do not specify how an entity is to determine whether an action is technically feasible. NERC's FAQ document provides the following guidance on the meaning of the phrase “where technically feasible:”
48
The “technically feasible” phrase is found in CIP-005-1, Requirements R2.4, R2.6, R3.1, R3.2 and CIP-007-1, Requirements R4, R5.3, R6, R6.3. Additionally, CIP-007, Requirement R2.3 uses “technical limitations” to similar effect.
Technical feasibility refers only to engineering possibility and is expected to be a “can/cannot” determination in every circumstance. It is also intended to be determined in light of the equipment and facilities already owned by the responsible entity. The responsible entity is not required to replace any equipment in order to achieve compliance with the Cyber Security Standards. When existing equipment is replaced, however, the responsible entity is expected to use reasonable business judgment to evaluate the need to upgrade the equipment so that the new equipment can perform a particular specified technical function in order to meet the requirements of these standards.
49
49
FAQ Document at 1.
Technical feasibility is here related to reasonable business judgment, but only in a situation where equipment is being replaced. Otherwise, the FAQ document treats technical feasibility in terms of objective engineering judgments regarding what is possible with existing equipment.
70. Some Requirements in the CIP Reliability Standards permit an entity
not
to take the actions specified in the Requirement if they “document compensating measures applied to mitigate risk exposure or an acceptance of risk.”
50
The Reliability Standards do not provide explicit guidance on the circumstances in which it is appropriate to accept the risk of non-compliance.
50
See
CIP-007-1, Requirements R2.3, R3.2, and R4.1.
CIP Assessment
71. In the discussion of specific Reliability Standards, the CIP Assessment expressed concern about the need to reference technical feasibility, either because the action in question appeared to be clearly technically feasible or because of the extremely limited number of situations in which technical feasibility could become an issue.
51
51
See, e.g.
, CIP Assessment at 26-27, 32-33.
72. The CIP Assessment noted that acceptance of risk raised special concern in a cyber environment. Where there are interconnected control systems, an acceptance of a cyber risk by one entity would actually be tantamount to an acceptance of risk on behalf of all entities connected with it because the first entity can serve as a gateway to the others as noted above. The entity that initially accepts the risk
becomes a “weak link” in the chain. The CIP Assessment noted that there is no provision in the proposed CIP Reliability Standards for oversight or consideration of the broader impacts of risk acceptance in individual cases. It sought comment on the appropriateness of risk acceptance and suggested that, if this concept is appropriate, clear guidance is needed to explain the limited circumstances in which it is appropriate.
Comments
73. NERC states that the term “technical feasibility” is intended to be very limited in scope. It defines the term as the physical ability of in-place equipment or software to conform directly to some Requirement in the Reliability Standards or the ability of in-place equipment or software to perform its required function if modified in a way that would most directly conform to some Requirement. The term is used to prevent penalizing responsible entities unnecessarily in situations where they cannot change immediately or prudently to comply with a Requirement. NERC states that where the concept of technical feasibility applies, the responsible entity should document the technical issue and its mitigation plans or strategies.
74. Many commenters
52
emphasize that the phrase “where technically feasible” is intended to permit flexibility, to permit the application of the Reliability Standards to a wide variety of situations, and to allow compliance with the Reliability Standards to evolve over time as technologies change. Some commenters note that in many cases it is not feasible to enhance equipment without replacing it. In some cases, off-the-shelf solutions are not available for various parts of the system.
52
E.g.
, National Grid; ISO/RTO Council; PJM, Ontario IESO, SPP, and ISO-NE.
75. ISA Group states that the phrase “where technically feasible” could be eliminated entirely from the CIP Reliability Standards and replaced with an exception mechanism that requires a decision to invoke technical feasibility to be explicit and reviewable. The exception mechanism should require that there be alternative mitigation that provides the level of security that would otherwise have been achieved. California PUC argues that the phrase “technically feasible” should be removed unless there is a serious question about the actual feasibility of a requirement being imposed.
76. Most commenters support the “acceptance of risk” terminology with certain qualifications. NERC states that the concept of risk acceptance recognizes that flexibility and judgment are required to make prudent decisions, but does not allow an entity to do nothing. It also contends that acceptance of risk is a fundamental tenet of an audit process, which recognizes that not all systems or implementations can be perfect. Other commenters state that acceptance of risk is needed to allow for flexibility and that it can be workable if decisions to accept risk are documented, compensating or mitigating action is taken, and decisions to accept risk are transparent and subject to review and oversight.
53
Some commenters state that any invocation of the risk acceptance provision should be subject to a sunset date or plan to achieve compliance.
54
In contrast, Wisconsin Electric states that acceptance of risk could seriously endanger reliability and supports removal of the option to accept risk.
53
E.g.
, Allegheny, MidAmerican and National Grid.
54
E.g.
, MidAmerican and Allegheny.
Commission Proposal
77. For the reasons discussed below, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, the Commission proposes to direct that the ERO: (1) interpret the term “technical feasibility” narrowly as applying to the technical characteristics of existing assets and having no relation to the considerations of business judgment discussed above; (2) treat instances where technical feasibility is invoked as exceptions that require certain alternative courses of action; (3) eliminate the “acceptance of risk” option from the CIP Reliability Standards; and (4) develop an annual report that quantifies, on a wide-area basis, the frequency with which responsible entities invoke “technical feasibility” or other provisions that produce the same outcome. The reason the Commission believes these proposed safeguards are necessary, as well as additional details regarding these proposals, are provided below.
Technical Feasibility
78. The Commission acknowledges that, in the near term, exceptions from compliance based on the concept of “technical feasibility” may be appropriate in a limited set of circumstances.
55
However, responsible entities should not be permitted to invoke technical feasibility on the basis of “reasonable business judgment,” as NERC's FAQ suggests. We have already discussed the concerns that reasonable business judgment can create for effective cyber security. Nor should a responsible entity be able to except itself unilaterally from a Requirement of a mandatory Reliability Standard with no oversight. Unless invocation of the technical feasibility exception is carefully circumscribed, substantial opportunity for abuse, difficulty in enforcement and the continued allowance of unacceptable reliability risks could result.
55
For example, it is understandable that some older “legacy” systems are not capable of utilizing certain cyber protection strategies needed to fully comply with the Requirements of these CIP Reliability Standards. In such a case, the responsible entity could be granted an exception upon the satisfactory submittal of a mitigation plan leading to compliance, by a date certain.
79. Therefore, the Commission proposes to require the ERO to establish a structure to require accountability from those who rely on “technical feasibility” as the basis for an exception. Such a structure would require a responsible entity to: (1) Develop and implement interim mitigation steps to address the vulnerabilities associated with each exception; (2) develop and implement a remediation plan to eliminate the exception, including interim milestones and a reasonable completion date; and (3) obtain written approval of these steps by the senior manager assigned with overall responsibility for leading and managing the entity's implementation of, and adherence to, the CIP Reliability Standards as provided in CIP-003-1, Requirement R2. This proposed structure should include a review by senior management of the expediency and effectiveness of the manner in which a responsible entity has addressed each of these three proposed conditions. In addition, the Commission proposes to require a responsible entity to report and justify to the ERO and the Regional Entity for approval each exception and its expected duration. In situations where any of the proposed conditions are not satisfied, the ERO or the Regional Entity would inform the responsible entity that its claim to an exception based on technical feasibility is insufficient and therefore not approved. Failure to timely rectify the deficiency would invalidate the exception for compliance purposes.
80. The Commission believes that it is important that the ERO, Regional Entities and the Commission understand the circumstances and manner in which responsible entities invoke the technical feasibility provision as well as other provisions that function as an exception to the CIP Reliability Standards. The Commission,
therefore, proposes to direct the ERO to submit an annual report that would include, at a minimum, the frequency of the use of such provisions, the circumstances or justifications that prompt their use, the interim mitigation measures used to address the vulnerabilities, and the milestone schedule to eliminate them and to bring the entities into compliance to eliminate future reliance on the exception. The Commission expects that the report would not provide a level of detail so as to contain critical energy infrastructure information, but would include sufficient information such that it is clear that the mitigation measures have addressed the interim vulnerabilities and the milestone schedules will be sufficient to bring the entities into compliance by a date certain in a timely manner. The report should include aggregated information with sufficient detail for the Commission to understand the frequency in which specific provisions are being invoked as well as mitigation and remediation plans over time and by region. Such information would allow the Commission to evaluate whether to initiate the development of additional Reliability Standards or require new Reliability Standards and/or modifications to existing Reliability Standards.
81. The Commission also seeks comment on additional categories of information that should be included in the content of this report that would be useful for the Commission, as well as the ERO and Regional Entities, in evaluating the invocation of technical feasibility and similar provisions, and the impact on protection of critical assets.
82. The Commission proposes to direct the ERO to consider making “technically feasible,” and derivative forms of that phrase as used in the CIP Reliability Standards, defined terms in NERC's glossary, pursuant to the prior clarifications, without any reference to reasonable business judgment.
Acceptance of Risk
83. The Commission has several concerns regarding the references to “acceptance of risk” that appear in the CIP Reliability Standards. As proposed by NERC, there are no controls or limits on a responsible entity's use of this exception. For example, a responsible entity may invoke the “acceptance of risk” exception without any explanation, mitigation efforts, evaluation of the potential ramifications of accepting the risk, or other accountability. In essence, the phrase “or an acceptance of risk” allows a responsible Entity to opt out of certain provisions of a mandatory Reliability Standard at its discretion.
84. Further, there is no requirement that a responsible entity communicate to a responsible authority information related to the potential vulnerabilities created by a decision to accept risk and how they could affect Bulk-Power System reliability. The resulting uncertainty concerning who had invoked “acceptance of risk” and in what connection would mean that neither the ERO, Regional Entities nor others would know whether adequate cyber security precautions are in place to protect critical assets. The possibility that appropriate security measures for critical assets have not been implemented due to acceptance of risk and that no corresponding compensating or mitigating steps have been taken presents an undue and unacceptable risk to Bulk-Power System reliability.
85. Moreover, the Commission believes the acceptance of risk language does not serve any justifiable purpose. To the extent that an entity would invoke this exception because compliance is not technically feasible, it should rely on that exception, which with the Commission's proposal would have specific safeguards and limitations. To the extent that a responsible entity would invoke the acceptance of risk language because its business preference is not to expend resources on cyber vulnerability, we believe that is inappropriate for all the reasons discussed previously. A responsible entity should not be able to jeopardize critical assets of others, and create a significant and unknown risk to Bulk-Power System reliability, simply because it is willing to “accept the risk” that its own assets may be compromised.
86. Accordingly, the Commission proposes to direct that the ERO remove the “acceptance of risk” language from the CIP Reliability Standards.
6. Guidance for Improving CIP Reliability Standards
87. Several commenters discussed the proposed CIP Reliability Standards in relation to other standards that exist for governmental and industrial cyber security. MITRE and NIST suggest that more advanced cyber security standards have been developed that could provide a model in future improvements to the CIP Reliability Standards. In particular, they point to NIST Special Publication 800-53 Revision 1, Recommended Security Controls for Federal Information Systems (SP 800-53). MITRE believes that the relevant NIST publications, including Federal Information Processing Standards (FIPS) 199, FIPS 200, and SP 800-53, constitute a comprehensive and coherent basis for cyber security in the electric power sector. NIST recommends that the Commission consider a planned transition to cyber security standards that are identical to, consistent with, or based on SP 800-53 and related NIST standards and guidelines.
Commission Proposal
88. The Commission declines to propose at this time that NERC incorporate any provisions of the NIST standards into the CIP Reliability Standards. However, the Commission expects NERC to monitor the development and implementation of the NIST standards to determine if they contain provisions that will better protect the Bulk-Power System.
56
Several federal entities, such as the Tennessee Valley Authority and Western Area Power Administration, are subject to both the NIST standards and the Reliability Standards, and therefore are likely to have unique insights into the NIST standards. The Commission expects the ERO to seek and consider comments from those federal entities on the effectiveness of the NIST standards and on any implementation issues. Any provisions that will better protect the Bulk-Power System should be addressed in the ERO's Reliability Standards development process. The Commission may revisit this issue in future proceedings as part of an evaluation of existing Reliability Standards or the need for new Reliability Standards, or as part of assessing NERC's performance of its responsibilities as the ERO.
57
56
The Commission is also aware that the Instrumentation, Systems, and Automation Society (ISA) is developing cyber security standards, referred to as ISA SP-99, and that other infrastructure sectors are considering adopting the ISA standards for their control systems.
57
See
Order No. 672 at P 186-91.
B. Discussion of Each CIP Reliability Standard
1. CIP-002-1—Critical Cyber Asset Identification
89. Reliability Standard CIP-002-1 deals with the identification of critical cyber assets. The NERC glossary defines “cyber assets” as “programmable electronic devices and communication networks including hardware, software, and data.” It defines “critical cyber assets” as “cyber assets essential to the reliable operation of critical assets.” NERC defines “critical assets” as “facilities, systems, and equipment which, if destroyed, degraded, or otherwise rendered unavailable, would
affect the reliability or operability of the Bulk Electric System.”
58
58
“The term ‘reliable operation' means operating the elements of the bulk-power system within equipment and electric system thermal, voltage, and stability limits so that instability, uncontrolled separation, or cascading failures of such system will not occur as a result of a sudden disturbance, including a cybersecurity incident, or unanticipated failure of system elements.” EPAct 2005, section 215(a)(4).
90. As the first step in identifying critical cyber assets, CIP-002-1 requires each responsible entity to develop a risk-based assessment methodology to use in identifying its critical assets. Requirement R1 specifies certain types of assets that an assessment must consider for critical asset status and also allows the consideration of additional assets that the responsible entity deems appropriate. Requirement R2 requires the responsible entity to develop a list of critical assets based on an annual application of the risk-based assessment methodology. Requirement R3 provides that the responsible entity must use the list of critical assets to develop a list of associated critical cyber assets that are essential to the operation of the critical assets. CIP-002-1 requires an annual re-evaluation and approval by senior management of the lists of critical assets and critical cyber assets.
91. The CIP Assessment emphasized that, while CIP-002-1 through CIP-009-1 function as an integrated whole, CIP-002-1 is a key to the success of the cyber security framework that these Reliability Standards seek to create.
59
The CIP Assessment also stressed that, because CIP-002-1 addresses the assessment methodology and process for identifying critical assets and critical cyber assets, it represents the critical first step that can fundamentally affect the chances for successful implementation of the remaining CIP Reliability Standards. The methodology and process used by a responsible entity must be stringent and rigorous. Otherwise, a responsible entity may fail to identify some facilities that are critical to effective cyber protection and, as a consequence, leave them vulnerable to an attack that could threaten the reliability of the Bulk-Power System.
59
CIP Assessment at 16-17.
92. The Commission proposes to approve Reliability Standard CIP-002-1 as mandatory and enforceable. In addition, the Commission proposes to direct the ERO to develop modifications to this Reliability Standard. In our discussion below, the Commission addresses its concerns in the following topic areas regarding CIP-002-1: (1) The proper risk-based assessment methodology for identifying critical assets and associated critical cyber assets; (2) internal approval of the risk assessment; (3) oversight of critical asset identification; and (4) interdependency analysis.
a. Risk-Based Assessment Methodology
93. As mentioned above, CIP-002-1 requires each responsible entity to develop a risk-based assessment methodology to identify critical assets.
CIP Assessment
94. The CIP Assessment noted that, while CIP-002-1 requires use of a risk-based assessment methodology, it does not provide direction on the nature and scope of that methodology, its basic features or the issues it should address. The CIP Assessment expressed concern that the absence of such direction could result in the Requirement being unevenly executed, which could result in inconsistency and inefficiency. It stated that, due to this lack of direction, the Reliability Standard does not provide a basis for evaluating whether the risk-based assessment methodology adopted by a particular entity will permit effective identification of all critical assets.
95. The CIP Assessment explained that proper risk-based assessment methodology is essential to achieve sufficient scope and implementation of critical infrastructure protection. Requirement R4 specifically contemplates the circumstance that a “Responsible Entity may determine that it has no Critical Assets or Critical Cyber Assets,” and correspondingly requires that a signed and dated record of management approval of the list of critical assets and critical cyber assets be kept “even if such lists are null.” The CIP Assessment pointed out, however, that a small entity whose operations may not have a major, day-to-day operational impact on the Bulk-Power System can have critical importance from a cyber security perspective, especially as a gateway to larger entities or when attacked simultaneously with other entities. The absence of adequate direction on what constitutes a proper risk-based assessment methodology may potentially result in entities improperly identifying a limited or “null set” of critical assets and critical cyber assets. This result could have serious adverse effects for Bulk-Power System reliability.
Comments
96. Commenters generally agree that CIP-002-1 plays a crucial role because whether a responsible entity must comply with the substance of the remaining CIP Reliability Standards depends on whether it identifies critical cyber assets pursuant to CIP-002-1. Commenters also agree that the risk assessment methodology is the key to a responsible entity accurately identifying its critical assets and critical cyber security assets.
97. While some commenters agree with the CIP Assessment that the Requirement for the risk-based assessment methodology would benefit from additional guidance or specificity, the majority disagree. Among those who support the need for more specificity, Arizona Public Service expresses concern that CIP-002-1, as proposed, may place a responsible entity in the position of not having enough guidance on whether its risk-based methodology will result in the identification of all critical assets.
98. Ontario IESO agrees that the CIP Assessment's reasons for concern are valid, which stem from the fact that many assessments will be performed by entities not previously subject to compliance with NERC Reliability Standards, and from the potential disagreement between entities on what constitutes a critical asset. It also shares the concern that some entities may avoid declaring critical assets to avoid further compliance obligations with the CIP Reliability Standards. Ontario IESO emphasizes that an essential feature of a good assessment is the quality of the judgments that necessarily must be applied. Rather than making modifications to provide more explicit direction, Ontario IESO suggests that much of the concern associated with critical asset identification could be addressed by modifying the Reliability Standard to require that the responsible entity consult with its reliability coordinator, and granting the reliability coordinator the authority to make the final determination of critical assets within its territory.
99. NERC and others oppose including additional specificity, claiming that CIP-002-1 is specifically written to allow each responsible entity the flexibility to implement it as it applies to the specific circumstances within each organization, and at each location containing critical cyber assets.
60
These commenters are concerned that a Commission directive to include additional guidance would restrict the needed flexibility. For example, APPA argues that the proposed provisions provide an adequate basis for evaluating the methodology, stating that prescribing a national-level “one size fits all” risk-based assessment methodology would
require a costly effort to comply, but would not result in measurable cyber security improvements. APPA adds that every entity's risk-based assessment will be subject to challenge by an audit team from time-to-time, which will include review by peer technical experts who share the goal of preventing any successful attack on critical assets. AMP-Ohio suggests that it would be inappropriate to divide the Bulk Electric System into a large number of small, discrete and in some cases rather isolated pieces and then to assign responsibility to each of these small pieces to determine what is or is not critical to the reliable operation of the Bulk Electric System.
60
E.g., ReliabilityFirst, EEI, EPSA, and APPA.
Commission Proposal
100. Most commenters on the CIP Assessment acknowledge the importance of CIP-002-1 in ensuring that an appropriate set of critical assets is identified. However, many commenters oppose any modification to CIP-002-1 to provide additional specificity regarding the risk assessment methodology for identifying critical assets, based on concerns that such specificity will impede the needed flexibility that is currently provided by the Reliability Standard.
101. The Commission recognizes the commenters' concerns and is mindful of the need for flexibility in the risk assessment process to take into account the individual circumstances of a responsible entity. Yet, the Commission is concerned that, without some additional guidance, each responsible entity will have to devise its own assessment methodology without sufficient assurance that the methodology is adequate to identify the types of assets necessary to protect the reliability of the Bulk-Power System. As explained by Ontario IESO, many responsible entities performing the risk assessment have not previously been subject to compliance with NERC's Reliability Standards. Further, there is a potential for disagreement among responsible entities regarding what constitutes a critical asset.
102. The Commission also is concerned that the risk assessment methodologies required by CIP-002-1 must place the proper emphasis on the possible consequences from an outage of a particular asset. Generically, risk assessments include consideration of both consequence (in this case, the effect of loss of availability of an asset on the reliable operation of the Bulk-Power System) and threat (the likelihood that an outage will occur, naturally or by malicious act). However, in this context we believe that the consequence of an outage should be the controlling factor. We note that the definition of “critical assets” is focused on the criticality of the assets, not the likelihood of an outage.
103. Accordingly, the Commission proposes to direct NERC to develop modifications to CIP-002-1 to provide some basic guidance on the content or considerations to be applied in a risk assessment methodology. We are not proposing that NERC develop specific details of a methodology that must be applied in all circumstances. However, the Commission believes that responsible entities would benefit from NERC providing some common understanding regarding the scope, purpose and basic direction of the risk assessment methodology. For example, the Reliability Standard should indicate that a proper risk-based assessment methodology to identify critical assets should examine (1) the consequences of the loss of the asset to the Bulk-Power System and (2) the consequence to the Bulk-Power System if an adversary gains control of the asset for intentional misuse. Such guidance could also address how a generation owner, or even a partial owner of generation, without a wide-area reliability perspective, should approach a risk-based assessment.
104. Further, we are concerned that relatively smaller registered entities, such as some resources, load-serving entities, and demand side aggregators, may have difficulty in determining whether a particular asset is “critical” for Bulk-Power System reliability, since, for example, the impact of their facilities may be dependent on their connection with a transmission owner or operator. We believe that such an entity may want to perform an accurate assessment but lack the regional view to make a determination on its own. Thus, we propose that the ERO and Regional Entities provide reasonable technical support to such entities that would assist them in determining whether their assets are critical to the Bulk-Power System.
105. Accordingly, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, the Commission proposes to direct that the ERO develop modifications to CIP-002-1 through its Reliability Standards development process to provide additional guidance as to the features and functionality of an adequate risk-based assessment methodology, as discussed above.
b. Internal Approval of Risk Assessment
106. Requirement R4 of CIP-002-1 requires that a senior manager “or delegate(s)” must approve annually the list of critical assets and critical cyber assets. The CIP Assessment suggested that that this senior management involvement should be extended to approving the risk-based assessment methodology developed pursuant to Requirement R1.
61
Several commenters disagree,
62
stating that this approval is implied by the requirement for senior management approval of the critical asset list and the critical cyber asset list. Other commenters generally believe that senior management approval of the risk-based assessment methodology would be a benefit.
63
61
CIP Assessment at 17-18.
62
NERC, ReliabilityFirst, and Santa Clara.
63
E.g.,
APPA/LPPC, FirstEnergy, National Grid, Progress Energy, and Xcel.
Commission Proposal
107. The Commission believes that senior management approval of the risk-based assessment methodology has clear benefits that exceed any additional burden placed on the responsible entities, and the rigor that the senior management approval would encourage is worth the effort. As explained in the CIP Assessment, since a poor methodology will likely result in an inadequate identification of critical assets and critical cyber assets, senior management awareness and approval of the chosen risk-based assessment methodology is of critical importance.
64
It is not clear to the Commission that, as some commenters suggest, senior management approval of the risk-based assessment methodology is implicit in the requirement that senior management approve the critical asset list and critical cyber asset list. Commenters did not object to the concept, but only believed that it might be redundant. We believe this additional layer of oversight is important and should be made explicit. The Commission also notes that requiring this senior management approval helps to implement the Blackout Report's Recommendation 43, which calls for establishing “clear authority and ownership for physical and cyber security.”
65
64
CIP Assessment at 18.
65
See
Blackout Report at 169, Recommendation 43.
108. Thus, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, the Commission proposes to direct that the ERO develop a modification to CIP-002-1 through its Reliability Standards development process to include a requirement that a senior manager annually review and approve the risk-based assessment methodology.
c. Oversight of Critical Assets Identification
109. The CIP Assessment emphasized the underlying importance that each responsible entity develop accurate lists of critical assets and critical cyber assets. Several commenters note that responsible entities currently lack a wide-area view that would enable them to better assess the risks associated with certain assets.
66
They suggest that guidance or oversight from an external organization could help ensure that responsible entities have properly identified critical assets from a regional perspective. Cleveland Public Power suggests that the Regional Entities should assume this role. Similarly, AMP-Ohio recommends that the Regional Entities should be responsible for identifying critical assets, with input from reliability coordinators and transmission planners. EPSA indicates that independent system operators (ISOs) and regional transmission organizations (RTOs) could provide guidance to individual companies in assessing critical assets and their vulnerability, in coordination with NERC and the Commission.
66
E.g.,
AMP-Ohio, EPSA, and Cleveland Public Power.
110. NERC, however, opposes regional oversight, stating that “[i]t is not the function of the standards to implement an oversight or hierarchical organization for determining risks or vulnerabilities.”
67
NERC suggests that regional perspective is gained through information sharing forums such as the Electricity Sector Information Sharing and Analysis Center (ESISAC)
68
and NERC's Critical Infrastructure Protection Committee.
67
NERC Comments, Attachment 1 at 17 (in response to a CIP Assessment suggestion regarding the need for regional perspective in CIP-003-1).
68
The Electric Sector Information Sharing and Analysis Center was created based on a recommendation of Presidential Decision Directive 63, which defined specific infrastructures critical to the national economy and public well-being. ESISAC serves the Electricity Sector by facilitating communications between electricity sector participants, governmental entities, and other critical infrastructures. It is the job of the ESISAC to promptly disseminate threat indications, analyses, and warnings, together with interpretations, to assist electricity sector participants to take protective actions. NERC is functioning as the operator of the ESISAC.
Commission Proposal
111. The Commission disagrees with commenters that suggest that the responsibility for identifying critical assets should be placed on the Regional Entities or another organization instead of the categories of applicable entities currently identified in CIP-002-1. Such an approach would shift primary responsibility away from the asset owner or operator. We believe that such a shift would not improve the identification of critical assets, but more likely overwhelm the Regional Entities.
112. On the other hand, the Commission believes that a formal or systematic approach to external oversight of the identification of critical assets would assure a wide-area view. Such an approach, on a regional basis, would better ensure that responsible entities are identifying similar assets. Even taking into account the individual circumstances of a responsible entity, we would expect certain trends in critical asset identification within a class of responsible entities, such as generator owners or transmission owners. If the vast majority of transmission owners, for example, identified a certain asset as critical, and a few did not, this result could be due to the unique circumstances of those transmission owners or from a flawed risk-based assessment methodology. However, without external oversight using a wide-area view, such trends or deviations would never be identified prior to an incident or audit, perhaps precluding a necessary adjustment to a particular critical asset list. In addition, a wide-area view would help to ensure that assets that have regional importance, such as for reactive power supply, are included as critical assets.
113. NERC suggests that such issues can be addressed through existing forums for the voluntary exchange of information on cyber security issues. The Commission believes that this matter is too important to leave to voluntary mechanisms. Accordingly, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, the Commission proposes to direct that the ERO develop a modification to CIP-002-1 through its Reliability Standards development process to include a mechanism for the external review and approval of critical asset lists based on a regional perspective. While we propose that the Regional Entities should be responsible for this function, we will not exclude the possibility of a critical asset review process that allows for participation of other organizations, such as transmission planners and reliability coordinators.
114. Moreover, we note that the definition of “critical cyber assets” encompasses data.
69
Thus, marketing or other data essential to the proper operation of a critical asset, and possibly the computer systems that produce or process that data, would be considered critical cyber assets subject to the CIP Reliability Standards. Therefore, the Commission proposes to direct the ERO to develop guidance on the steps that would be required to apply the CIP Reliability Standards to such data and to include computer systems that produce the data.
69
The NERC Glossary defines “Critical Cyber Assets” as “Cyber Assets essential to the reliable operation of critical assets.” It defines “Cyber Assets” as “programmable electronic devices and communication networks including hardware, software, and data.” Therefore, marketing data or other system data that are essential to the proper operation of the critical asset may confer critical cyber asset status to those data and the computer systems that process them.
115. The Commission is concerned that all critical assets are identified, and interprets the phrase, “[t]he risk-based assessment shall consider the following assets:” in Requirement R1.2 to mean that a responsible entity must be able to show, based on the risk-based assessment methodology used, why specific assets were or were not chosen as critical assets. The Commission is also concerned that sufficient rigor is applied in examining whether control systems are determined to be critical assets. While it seems obvious that an evaluation of a control system for critical asset status would consider the potential loss of operability of the control center due to power or communications failure, we also believe that such an evaluation should include an examination of any misuse of the control system, the impact this misuse could have on any electric facilities that the responsible entity controls, and the combined impact of such facilities. Therefore, the Commission proposes to direct the ERO to modify Requirement R1.2 to clarify the requirement to show why specific assets were or were not chosen as critical assets, and to require the consideration of misuse of control systems.
d. Interdependency
116. The CIP Assessment noted that CIP-002-1 does not address the issue of interdependency with other infrastructures and explained that there may be occasions where an electric sector asset, while not critical to Bulk-Power System reliability, may be crucial to the operation of another critical infrastructure.
70
The CIP Assessment asked (1) whether this issue is appropriate for inclusion in CIP-002-1 and (2) whether this topic is an area for future coordination and collaboration with other industries and government agencies.
70
CIP Assessment at 17.
117. Commenters generally agree that this issue is worthy of consideration and coordination and cooperation could be
advantageous. However, most commenters consider the topic outside the scope of CIP-002-1.
71
By contrast, one commenter posits that there is a clear need to articulate that this type of interdependency analysis should be part of the responsible entity's determination of critical assets.
72
71
E.g.,
APPA/LPPC, Duke, EEI, Georgia System, National Grid, NERC, ReliabilityFirst, SPP, Xcel, SoCal Edison, Progress Energy, and MidAmerican.
72
ISA Group.
Commission Proposal
118. Reliability Standard CIP-002-1 pertains to the identification of assets critical to Bulk-Power System reliability. While broader interdependency issues cannot be ignored, the Commission intends to revisit this matter through future proceedings and with other agencies. This work will help to inform the electric sector and this Commission about the need for future Reliability Standards, especially when the interdependent infrastructures affect generating capabilities, such as through fuel transportation.
e. Commission Proposal Summary
119. In summary,
73
the Commission proposes to approve Reliability Standard CIP-002-1 as mandatory and enforceable. In addition, the Commission proposes to direct the ERO, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, to develop modifications to CIP-002-1 through its Reliability Standards development process that: (1) Provide some basic guidance on the content or considerations to be applied in a risk-based assessment methodology; (2) include a requirement that a senior manager annually review and approve the risk-based assessment methodology; (3) include a mechanism for the external review and approval of critical asset lists based on a regional perspective; and (4) modify Requirement R1.2 to (a) clarify the requirement to show why specific assets were or were not chosen as critical assets and (b) require the consideration of misuse of control systems.
73
This summary should be read in conjunction with the discussion above.
2. CIP-003-1—Security Management Controls
120. Reliability Standard CIP-003-1 seeks to ensure that each responsible entity has minimum security management controls in place to protect critical cyber assets identified pursuant to CIP-002-1. To achieve this goal, a responsible entity first must develop a cyber security policy that represents management's commitment and ability to secure its critical cyber assets. The responsible entity must designate a senior manager to lead and direct the responsible entity's cyber security program. This senior manager will also be the person authorized to approve any exception set out in the entity's cyber security policy.
121. Further, a responsible entity must implement an information protection program to identify, classify and protect sensitive information concerning critical cyber assets, as well as an access control program to designate who may have access to such information. Finally, the responsible entity must establish a change control and configuration management program to oversee changes made to the critical cyber assets' hardware or software.
122. The Commission proposes to approve Reliability Standard CIP-003-1 as mandatory and enforceable. In addition, we propose to direct the ERO to develop modifications to this Reliability Standard. In our discussion below, the Commission addresses its concerns in the following topic areas regarding CIP-003-1: (1) Adequacy of policy guidance; (2) discretion to grant exceptions; (3) leadership; (4) access authorization; (5) change control and configuration management; and (6) interconnected networks.
a. Adequacy of Policy Guidance
123. Requirement R1 of Reliability Standard CIP-003-1 directs the responsible entity to “document and implement a cyber security policy that represents management's commitment and ability to secure its critical cyber assets.” The only guidance that is given with regard to the nature and scope of the cyber security policy is that it “addresses the Requirements in CIP-002-1 through CIP-009-1, including the provisions for emergency situations.” The Requirement also requires that a senior manager annually review and approve the policy.
124. The CIP Assessment stated that senior management involvement should improve the prioritization of control system security within the entity, including allocation of resources.
74
It explained that, since many of the Requirements in the CIP Reliability Standards leave considerable discretion to each responsible entity, the scope and thoroughness of the cyber security policies could vary widely. Thus, the CIP Assessment expressed concern that, because Requirement R1 does not address the policy's adequacy, this Requirement could actually mask certain security vulnerabilities.
74
CIP Assessment at 19.
125. APPA/LPPC are not convinced that the variation allowed in cyber security policies means that plans lack a sufficient level of protection. They believe that the Reliability Standard allows an appropriate level of variation as to how specific requirements will be met. Likewise, Georgia System does not share the CIP Assessment's concern that Requirement R1 could allow responsible entities to mask vulnerabilities, positing that it is in a utility's self-interest to take actions that improve reliability. Thus, it does not see a need for any additional guarantee that the involvement of senior management will result in improvements to the responsible entity's cyber security policy.
Commission Proposal
126. The Commission acknowledges that details of particular security policies will vary due to the different cyber architectures and equipment used by the responsible entities. However, in addition to consideration of every Requirement in Reliability Standards CIP-002-1 through CIP-009-1, the Commission expects that responsible entities' security policies will address issues that are not currently reflected in the CIP Reliability Standards, but are important to the security of the control system. For instance, currently data networks and communication networks are not covered by any CIP Reliability Standard. Yet these networks play an important role in the proper functioning of the control systems. The Commission would expect a security policy for control systems to address the responsible entity's actions to protect communication networks. Other possible topics for guidance here are the appropriate use of defense in depth strategy; the use of wireless communications for control systems; uninterruptible power supplies; and heating, ventilation, and air-conditioning equipment for critical cyber assets. We note that Recommendation 34 of the Blackout Report states that “grid-related organizations should have a planned and documented security strategy, governance model, and architecture for EMS [energy management systems] automation systems.”
75
75
See
Blackout Report at 165, Recommendation 34.
127. The Commission proposes to direct the ERO to modify CIP-003-1 to provide additional guidance for the topics and processes that the required cyber security policy should address to ensure that the responsible entity
reasonably protects its critical cyber assets.
b. Discretion to Grant Exceptions
128. Requirement R3 of CIP-003-1 provides that a responsible entity must document as an exception, with senior manager authorization, each instance where a responsible entity cannot conform to its security policy developed pursuant to Requirement R1. Documentation of the exception must include “an explanation as to why the exception is necessary and any compensating measures, or a statement accepting risk.” An exception to the cyber security policy must be documented within 30 days of senior management approval. An authorized exception must be reviewed and approved annually to ensure that the exception is still required and valid.
129. The CIP Assessment expressed concern that this provision allows for broad discretion and may serve as a disincentive for upgrading to control systems that fully comply with cyber security Reliability Standards.
76
With regard to a responsible entity's option to “accept the risk,” it pointed out that, for interconnected control systems of various entities, acceptance of risk by one entity is actually an acceptance of risk for all those that are interconnected. Yet, other entities may not be aware of the vulnerability, particularly absent any oversight or regional perspective of the risks or vulnerabilities that may exist.
76
CIP Assessment at 20.
130. Most commenters believe that it is appropriate to provide latitude for management to document exceptions to the responsible entity's established policies, select alternative and mitigating solutions, and ultimately accept residual risk. APPA/LPPC expect that the exercise of discretion will be one of the areas that will draw the most attention from auditors.
131. Others, such as California PUC agree with the CIP Assessment's concern that the broad discretion allowed for exceptions could act as a disincentive for upgrading control systems. California PUC also agrees that acceptance of the risk in a cyber environment is actually an acceptance of risk for all connected entities because the entity that initially accepts the risk becomes the “weak link” in the chain. Santa Clara suggests that a responsible entity that makes exceptions and “accepts risks” is responsible for communicating such exceptions to its Regional Entity, which can then evaluate the overall “risk,” if any, to the bulk electric system. The Regional Entity, in turn, can then communicate appropriately to any interconnected entities so that they might take any necessary action.
Commission Proposal
132. The Commission is concerned that CIP-003-1 allows a responsible entity too much latitude in excusing itself from compliance with its cyber security policy. While there may be valid reasons for exceptions to a cyber security policy, and it is helpful that exceptions must be explained in writing and approved by a designated senior manager, the Commission does not believe that the “exceptions” provision provides sufficient rigor or external accountability regarding the decision of a responsible entity to except itself from the cyber security policy. Accordingly, the Commission proposes to direct that NERC develop a modification to Requirement R3 of CIP-003-1 to require a responsible entity to periodically submit to the Regional Entity the documentation of exceptions to the cyber security policy. The Commission believes that the external review of this documentation will provide added assurance that each responsible entity adequately justifies the exceptions to its cyber security policy.
133. In addition, the Commission believes that there is a distinction between situations where a responsible entity excepts itself from its cyber security policy, rather than from specific Requirements of the CIP Reliability Standards based on technical feasibility. An exception to a cyber security policy provision does not also excuse compliance with a Requirement of a CIP Reliability Standard. Generally, a responsible entity has no authority to excuse itself from compliance with a mandatory Reliability Standard. As discussed above in section II.B.1.6, the CIP Reliability Standards do include several Requirements that allow an exception based on technical feasibility. However, the Commission has proposed to direct NERC to modify such provisions so that a responsible entity can only invoke the technical feasibility exception after fulfilling specific conditions including receiving approval from the ERO or the relevant Regional Entity. In contrast, an exception to a cyber security policy would require only senior manager approval and after-the-fact reporting to the Regional Entity. Accordingly, the Commission proposes to direct NERC to clarify that the exceptions mentioned in Reliability Standard CIP-003-1, Requirements R2.3 and R3, do not except responsible entities from the requirements of the CIP Reliability Standards.
c. Leadership
134. The CIP Assessment notes that senior management involvement in security issues is important to ensure that responsible entities achieve compliance as quickly as possible and to ensure that it exercises any necessary discretion in an appropriate manner.
77
77
CIP Assessment at 20.
135. While National Grid concurs with the CIP Assessment, it also suggests that given the wide variety of critical assets, critical cyber assets and physical security requirements, no single senior manager has the expertise or authority to ensure compliance with all of the CIP Reliability Standards.
Commission Proposal
136. The Commission's view is that Requirement R2 of CIP-003-1 should be interpreted to require the designation of a single manager who has direct and comprehensive responsibility for the implementation and ongoing compliance with the CIP Reliability Standards. While this senior manager must have authority to delegate tasks and responsibilities within the entity's management structure, we believe that the senior manager must remain accountable for the responsible entity's compliance with the CIP Reliability Standards. In our view, it is essential to make clear both the “authority and ownership” for security, as Recommendation 43 of the Blackout Report states.
78
Therefore, the Commission proposes to direct the ERO to modify CIP-003-1, to make clear the senior manager's ultimate responsibility.
78
See
Blackout Report at 169, Recommendation 43.
d. Access Authorization
137. Requirement R5 of CIP-003-1 directs the responsible entity to implement a program for managing access to protected critical cyber asset information. The CIP Assessment suggested that an annual review of personnel access to this information appears insufficient and could result in unnecessary vulnerability, especially since there is no requirement that a responsible entity revise access privileges to such protected information upon employee termination or job reassignment.
138. Many commenters agree with the CIP Assessment's concern that an employee who leaves the company or who no longer performs job functions that require access to critical cyber assets should have that access revoked
promptly.
79
NERC, Xcel, FirstEnergy and ReliabilityFirst note that this Requirement seeks establishment of “a program for managing access to protected critical cyber asset information.” They stress that CIP-003-1, Requirement R5 relates to the governance and approval process, not the implementation and review of individual access (the oversight responsibility of which lies with the senior manager of the responsible entity). NERC asserts that the three requirements work together. The implementation provisions are in Requirement R5 of CIP-007-1, the revocation requirements are in Requirement R4 of CIP-004-1, and the management review and approval requirements are in Requirement R5 of CIP-003-1. NERC argues that, together, these provisions serve as a check that the CIP-004-1 revocation provision has been implemented.
79
E.g.,
APPA/LPPC and California PUC.
Commission Proposal
139. The Commission believes that the language of CIP-007-1, Requirement R5, CIP-004-1, Requirement R4, and CIP-003-1, Requirement R5 does not interlink these related provisions as clearly as some commenters assert. We are not persuaded by commenters who claim these Requirements adequately address the access issues related to employee turnover. We believe that the interrelationship among these provisions must be made clearer. We note that CIP-007-1, Requirement R5.1.3, which specifically refers to CIP-003-1, Requirement R5, addresses “user accounts.” Likewise, CIP-004-1, Requirement R4 addresses authorization for unescorted physical or cyber access to “critical cyber assets.” However, the information for which Requirement R4 of CIP-003-1 requires protection appears to be broader than “user accounts” and “critical cyber assets.” According to CIP-003-1, Requirement R4, protected information includes lists of critical cyber assets, floor plans, and security configuration information. While the concept of access authorization is similar across these provisions, there is no explicit mention in them of revoking access to “information” about critical cyber assets. While the priority must be on granting and revoking access to the critical cyber assets themselves, access to information concerning the critical cyber assets should also be adequately protected, and revocations always should be made promptly. We also note that Recommendation 44 of the Blackout Report stresses the need to prevent inappropriate disclosure of information.
80
Thus, the Commission proposes to direct the ERO to modify Reliability Standards CIP-003-1, CIP-004-1, and/or CIP-007-1, to ensure and make clear that access to protected information is revoked promptly.
80
See
Blackout Report at 169, Recommendation 44.
e. Change Control and Configuration Management
140. Requirement R6 requires the responsible entity to establish a process of change control and configuration management for adding, modifying, replacing, or removing critical cyber asset hardware or software.
141. The CIP Assessment noted that entities often rely on commercial vendors to test and certify that electronic security patches they provide will not adversely affect other electronic systems already in place. It is not clear how a responsible entity could otherwise verify that a problem does not exist without burdensome testing each time a patch is implemented. Such a testing requirement may also inhibit or delay the use of security patches and thereby prolong vulnerabilities that would otherwise be relatively easy to fix.
142. Santa Clara submits that electric utilities, like all “cyber users,” must rely on information technology vendors for accurate and reliable “emergency or normal modifications.” It suggests that it is not only unrealistic, but unnecessary, to expect that all responsible entities under the CIP Reliability Standards should, or could, possess the technical expertise to understand an IT vendor's code in enough detail to ensure that any modifications made by the IT vendor are accurate and reliable.
143. SPP believes that the purpose of the change management program is to ensure the entity is aware of all changes being made to a critical cyber asset and, in being aware, readily recognizes when an unapproved change is made. An unapproved change could be an indication of a cyber attack in progress. SPP comments that Requirement R6 may fall short because it does not specify the need for detection and monitoring controls to determine when changes occur. SPP also asserts that a proper change management program includes provisions for routine, planned changes and emergency, unplanned changes.
Commission Proposal
144. While Requirement R6 of Reliability Standard CIP-003-1 captures the essence of managing changes intentionally made to critical cyber assets, it fails to address accidental consequences or malicious actions by individuals. Thus, the Commission believes that this Requirement needs to go further and we propose to direct the ERO to make two changes. First, we propose additional wording to require verification that authorized changes made to critical cyber assets, which include software and data, only affect processes that are intended. Our concern here includes both accidental consequences and malicious actions by individuals performing the changes. Second, we propose a requirement for responsible entities to take actions to detect unauthorized changes to critical cyber assets. Such changes could result from malicious actions originating either outside or inside the responsible entity. No electronic security perimeter is 100 percent effective, especially when a malicious action is performed by an insider, and detection must be part of a good cyber security program. Therefore, the Commission proposes, as suggested by SPP, to direct the ERO to modify Requirement R6 of Reliability Standard CIP-003-1 to include in the process of change control and configuration management a requirement for detection and monitoring controls to determine if changes are made as intended and to investigate whether any unintended or unplanned changes have been made.
f. Interconnected Networks
145. The CIP Assessment also raised a concern that interconnected control system networks are more susceptible to infiltration by a cyber intruder. Georgia Operators responds that every responsible entity must protect its critical cyber assets by guarding its electronic access points against the spread of harm from external interconnected entities. This task can only be accomplished by assuming that such external entities are themselves unprotected.
146. NERC and ReliabilityFirst claim that the purpose of establishing policy and procedure is for a responsible entity to protect itself from the “outside world” wherever that “outside world” might exist. It does not matter if the “outside” is an internally connected corporate network, or a completely separate entity. These commenters explain that the CIP Reliability Standards address a responsible entity's area of responsibility—the equipment it owns and controls. All interconnected control system network communications will traverse through electronic access points; therefore, there exists a need for “security” on the
interconnection points. Both commenters state that the electronic security perimeter effectively implements a model of mutual distrust between any collection of critical cyber assets within an electronic security perimeter, and any and all other cyber assets.
Commission Proposal
147. The Commission agrees with commenters who caution that a responsible entity should protect itself from whatever is outside its control system. The phrase “mutual distrust” has been used to denote how these “outside world” systems are treated by those inside the control system. However, there is very little guidance for how a responsible entity would configure an architecture under a “mutual distrust” posture to handle both interactive login-type connectivity between the outside world and the control system as well as direct application communications (data shared between programs) that also occur between the control system and the outside world (both internal and external to the responsible entity). In addition, the Commission notes that, in our earlier discussion regarding the applicability of the CIP Reliability Standards to small entities, we relied in part upon the expectation that the responsible entities would adopt “mutual distrust” postures when receiving communications from others that impact the functioning of control systems. Therefore, the Commission proposes to direct the ERO to modify Reliability Standard CIP-003-1 to provide direction regarding the issues and concerns that a “mutual distrust” posture must address to protect the control system from the “outside world.”
81
81
An architecture with a mutual distrust posture could involve various hardware or software mechanisms or manual procedures to restrict and verify access to the control system from these outside sources. Examples include: Firewalls; data checking software(s); or procedures for manually implementing a connection to allow a vendor to perform maintenance work.
g. Commission Proposal Summary
148. In summary, the Commission proposes to approve Reliability Standard CIP-003-1 as mandatory and enforceable. In addition, the Commission proposes to direct the ERO, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, to develop modifications to CIP-003-1 through its Reliability Standards development process that (1) provide additional guidance for the topics and processes that should be addressed by the required cyber security policy in order to ensure that the responsible entity reasonably protects its critical cyber assets; (2) require a responsible entity to submit periodically to the Regional Entity the documentation of exceptions to the cyber security policy; (3) clarify that the exceptions mentioned in Requirements R2.3 and R3 of CIP-003-1 do not except responsible entities from the requirements of the CIP Reliability Standards; (4) make clear that the senior manager ultimately remains responsible for the responsible entity's compliance with the CIP Reliability Standards; (5) ensure and make clear that access to protected critical cyber asset information is revoked promptly (and make parallel modifications to CIP-004-1 and CIP-007-1 as needed); (6) include in the process of change control and configuration management a requirement for detection and monitoring controls to determine if changes were made as intended and to investigate whether any unintended or unplanned changes have occurred; and (7) provide direction regarding the issues and concerns that a “mutual distrust” posture must address in order to protect a responsible entity's control system from the “outside world.”
3. CIP-004-1—Personnel and Training
149. Reliability Standard CIP-004-1 requires that personnel having authorized cyber access or unescorted physical access to critical cyber assets must have an appropriate level of personnel risk assessment, training and security awareness. Responsible entities must develop and implement a security awareness program that addresses concerns related to cyber security; a cyber security training program for affected personnel that addresses policies, access controls, procedures for the proper use of critical cyber assets, physical and electronic access to critical cyber assets, proper handling of asset information, and recovery methods after a Cyber Security Incident; and a personnel risk assessment program for all personnel having access to critical cyber assets.
150. The Commission proposes to approve Reliability Standard CIP-004-1 as mandatory and enforceable. In addition, we propose to direct the ERO to develop modifications to this Reliability Standard. In our discussion below, the Commission addresses its concerns in the following topic areas regarding CIP-004-1: (1) Training; (2) personnel risk assessments; (3) access; and (4) jointly owned facilities.
a. Training
151. The CIP Assessment noted that the training requirements specified in Requirement R2 apply to all personnel, contractors, and service vendors who have authorized cyber access or unescorted physical access to critical cyber assets.
82
It then expressed concern that this requirement does not clearly address the interconnectivity of systems;
i.e.
, the required training programs should address not only the critical cyber assets themselves, but also any networking hardware or software linking them. It noted that the importance of network support to overall security environment may not be understood by personnel if the training does not encompass the related non-critical cyber assets, such as switches and routers that can impact the security of the critical cyber assets. Moreover, it pointed out that while this requirement specifies the minimum topics that training should cover, it does not provide criteria for assessing the quality and adequacy of the training. With regard to both the awareness program of Requirement R1 and the training program of Requirement R2, the CIP Assessment noted that certain NIST publications provide guidance on training of personnel and practices that enhance the security posture of information systems.
83
82
CIP Assessment at 23.
83
See
NIST Special Publication 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model (1998); and NIST Special Publication 800-50, Building an Information Technology Security Awareness Training Program (2003),
available
at:
http://csrc.nist.gov/publications/nistpubs/.
152. NERC states that a subset of networking hardware and software is included in Requirement R2 to the extent active communications hardware and software reside within the defined electronic security perimeter, and because hardware and software acts as an electronic access control, defining the electronic security perimeter. NERC draws attention to the fact that communication networks and data communication links between discrete electronic security perimeters are specifically excluded by Applicability section 4.2.2 of this Reliability Standard.
153. APPA/LPPC believe that most, if not all, networking hardware and software will be essential to the operation and control of critical cyber assets and therefore will be subject to the Reliability Standard and encompassed by the security training requirement. FirstEnergy notes the Measures and Compliance provisions currently require only documentation of
the requirements and states that NERC should focus on developing Reliability Standards to maintain the quality of personnel training in this area. FirstEnergy states that training requirements should be appropriate to each employee's experience and access level.
154. The CIP Assessment also questioned whether it is appropriate to allow personnel to have access to critical cyber assets for up to 90 days prior to receiving any cyber security training, as Requirement R2.1 allows. It suggested that personnel should receive the training prior to such access.
155. NERC and ReliabilityFirst state that the sub-requirements of Requirement R2 list specific expected outcomes from the training. NERC and ReliabilityFirst state that the 90-day period is based on the belief that certain conditions may require that personnel receive access prior to specific additional training in cyber security processes and procedures in order to maintain or restore the reliable operation of the Bulk-Power System. They explain that standard industry practice ensures anyone with access to sensitive systems has had adequate training, but that such training may not have been specific to the systems or environment to which they receive access, such as when, in an emergency restoration, personnel with specialized knowledge may be required to access systems outside their normal assignments.
84
84
APPA/LPPC, SPP and Xcel agree that this flexibility is needed in emergency situations, and comment that training beforehand would not always be practical.
156. APPA/LPPC agree with the CIP Assessment that, whenever possible, personnel should receive their cyber security training and undergo the required personnel risk assessment before being allowed access to critical cyber assets. However, APPA/LPPC favor retention of the 90-day period for conducting training so that responsible entities will not risk a technical violation of the Reliability Standard when emergency conditions require that personnel obtain access before they are trained or authorized with access.
157. ISA Group agrees with the CIP Assessment that training in critical security practices should occur prior to an individual having the corresponding access and suggests making a distinction between the training that is needed before access is granted and the remaining training that is not critical for access but still significant. The ISA Group also states that training and awareness programs should be specific to the critical cyber assets to be protected and that persons who provide the training should be adequately trained to address the cyber security of the systems. SPP and ISO-NE agree with the CIP Assessment that allowing unescorted access to critical cyber assets prior to security training introduces an unnecessary risk. SPP suggests that, under normal circumstances, training prior to access should be the requirement with provisions made for emergency conditions.
Commission Proposal
158. Training is clearly integral to the protection of critical cyber assets. Allowing personnel to access critical cyber assets prior to receiving training increases the vulnerability of and risk to such assets. Thus, such access should not be the norm under the Reliability Standard. Accordingly, we propose to direct the ERO to modify this provision to require affected personnel to receive the required training before obtaining access to critical cyber assets (rather than within 90 days of access authorization), but allowing limited exceptions, such as during emergencies, subject to documentation and mitigation.
159. Alternate provisions for emergencies and certain other conditions could be designed, such as requiring documentation of all personnel who received access to particular equipment during the emergency and whether they received a briefing or any other training prior to their access concerning the specific facilities; the extent to which people needed for the emergency had received general training and possessed appropriate specialized expertise for the circumstance; and any risk mitigation steps taken during the emergency access, as discussed by commenters in this proceeding. To facilitate communications in emergency situations, the Commission proposes to direct the ERO to require responsible entities to identify “core training” elements to ensure that essential training elements will not go unheeded in an emergency and other contingency situations where full training prior to access will not best serve the reliability of the Bulk-Power System. We note that during “emergency conditions,” the Bulk-Power System could be particularly vulnerable to mischief or mistakes, and we propose to require the ERO to consider this when developing the modification. We also propose to direct the ERO to consider what, if any, modifications to CIP-004-1 should be made to address the concern raised by the ISA Group that security trainers be adequately trained themselves.
160. In addition, we propose to direct the ERO to modify the CIP-004-1 to clarify that the cyber security training programs required by Requirement R2 are intended to encompass training on the networking hardware and software and other issues of electronic interconnectivity supporting the operation and control of the critical cyber assets. As indicated by the comments, it is not clear whether interconnectivity issues are already included in the proposed language of the training requirement of CIP-004-1. One method of clarification the ERO should consider is the addition of a provision such as that contained in CIP-005-1, Requirement R1.4, which specifically subjects any non-critical cyber asset within a defined electronic security perimeter to the Reliability Standard. CIP-004-1 should leave no doubt that cyber security training concerning a critical cyber asset should encompass the electronic environment in which the asset is situated and the attendant vulnerabilities.
161. Finally, we propose to direct the ERO to increase the guidance in the Reliability Standard as to the scope and quality of training. We note that part of the goal for training, in conjunction with awareness programs, is to keep security practices on the minds of employees, contractors, and vendors. Examples of some areas where the inclusion of guidance can be considered are: control of electronic devices (such as laptop computers), the appropriate audiences for the training, delivery methods, and updates of training materials. In our view, the awareness and training programs, addressed separately by Requirements R1 and R2, complement each other and work in tandem. In parallel with the security awareness program, we expect the ERO to consider relevant aspects of the cited NIST Special Publications, as well as other relevant models, to improve CIP-004-1 and prevent a lowest common denominator result.
b. Personnel Risk Assessment
162. Requirement R3 of CIP-004-1 requires each responsible entity to have a documented personnel risk assessment program. It also requires that a personnel risk assessment, including a criminal check, be conducted within 30 days after a person receives cyber access or unescorted physical access to critical cyber assets. The CIP Assessment noted that Requirement R3 would allow access to critical cyber assets while investigation is still underway, and even before an investigation has started.
163. NERC and ReliabilityFirst assert that certain conditions affecting the reliable operation of the Bulk-Power System may require that personnel be allowed to access the critical cyber assets prior to completing the personnel risk assessment process, although they may be subject to escort and review during the investigative period.
164. Several commenters agree with the CIP Assessment that an appropriate personnel risk assessment should be completed before an employee (especially a newly hired employee or vendor) is granted access to critical cyber assets. SPP states that emergency contingency procedures can be developed to handle situations where access must be granted prior to completing the required background check.
165. However, NERC and other commenters have concerns about existing personnel. NERC and ReliabilityFirst assert that certain conditions affecting the reliable operation of the Bulk-Power System may require that personnel be allowed to access the critical cyber assets prior to the completion of the personnel risk assessment process, although they may be subject to escort and review during the investigative period. National Grid expresses concern that, since the Requirement appears to apply to a significant portion of existing utility workforce, any attempt to revoke access to such employees while completing their personnel risk assessments would create more reliability concerns than simply allowing such employees to remain on the job. FirstEnergy states that the 30-day window may be appropriate for employees and vendors with which the responsible entity has had a working relationship. FirstEnergy comments that Requirement R3 does not provide sufficient detail on what constitutes an adequate personnel risk assessment, which could cause variable interpretations of this Requirement. ISO-NE agrees with the CIP Assessment that the Reliability Standard provides insufficient direction regarding the elements of an appropriate awareness program.
Commission Proposal
166. Similar to our concerns regarding the training provisions of Requirement R2, we believe that allowing applicable personnel, including vendors, to access critical cyber assets prior to the completion of their personnel risk assessment increases the vulnerability of, and risk to, these assets. We also observe that Recommendation 41 of the Blackout Report emphasizes the need for guidance on implementing background checks.
85
At the same time, we believe that commenters have raised a valid concern regarding the disruptions that would result if current employees and vendors with established involvement were denied access to critical cyber assets for a 30-day period. Accordingly, we propose that the ERO develop modifications to Requirement R2 to provide that newly-hired personnel and vendors should not have access to critical cyber assets, except in specified circumstances such as an emergency. The ERO should determine the parameters of such exceptional circumstances in developing the proposed modification through its Reliability Standards development process. However, to avoid disruptions, we propose that the 30-day window allowing access before the personnel risk assessment is completed remain in effect for current employees and vendors with existing contractual relationships with the responsible entity as of the effective date of the Reliability Standard. We propose to direct that the ERO include, in developing modifications to CIP-004-1, criteria that address circumstances in which current personnel can continue access to critical cyber assets during the 30-day investigative period during initial compliance with CIP-004-1.
85
See
Blackout Report at 167-168, Recommendation 41, where the Blackout Report recommends that NERC provide guidance on background checks to be completed on contractor and sub-contractor employees in advance of allowing access to secure facilities.
c. Access
167. Requirement R4 directs the responsible entity to maintain list(s) of personnel with authorized cyber or authorized unescorted physical access to critical cyber assets. The CIP Assessment observed that the lists do not serve to deny personnel access from critical cyber assets prior to completion of a personnel risk assessment. However, Requirement R4.2 requires that access to critical cyber assets be revoked within 24 hours for personnel terminated for cause and within seven calendar days for personnel who no longer require such access.
168. NERC states that while the access list itself does not prevent access, it does provide for identification of personnel for which additional levels of review and escort may be assigned. California PUC suggests amending the Reliability Standard to require immediate updates when an employee is transferred, retires, or is terminated.
Commission Proposal
169. Timely system updates to access rights are important. Employee, contractor, or vendor access to critical cyber assets when the employee, contractor, or vendor no longer has a need for such access, due for example to a transfer or termination, represents a gap in security. Moreover, while Requirement R4 of CIP-004-1 requires a responsible entity to maintain a list of authorized personnel, it does not indicate what the responsible entity must do with the list. Accordingly, the Commission proposes to direct that NERC develop modifications to CIP-004-1 to require immediate revocation of access privileges when an employee, contractor, or vendor no longer performs a function that requires authorized physical or electronic access to a critical cyber asset for any reason (including disciplinary action, transfer, retirement or termination). Because an organization is typically aware in advance of personnel action dates, timely updating of the authorization list should not be unduly burdensome. Further, we propose to direct that NERC modify Requirement R4 to make clear that unescorted physical access should be denied to individuals that are not identified on the authorization list.
d. Question of Jointly Owned Facilities
170. APPA/LPPC request that the Commission direct NERC to consider clarifications for entities with facilities governed by existing joint use or joint ownership agreements. They explain that most of there members have joint facilities with neighboring entities (
e.g.
, a transmission substation at a point of interconnection with an adjacent system), and that joint facility agreements often prohibit individual co-owners from blocking the other co-owners' use of, or access to, such facilities. APPA/LPPC state that CIP-004-1 obligates individual responsible entities to block certain persons from their facilities, possibly including persons with existing contractual rights of access. APPA/LPPC believe that one joint facility owner should not be able to block another unaffiliated entity's existing contractual rights of access. APPA/LPPC also ask that entities with joint facilities not be subject to sanctions solely because an unaffiliated entity that is a party to one of its joint facility agreements failed to comply with CIP-004-1 when acting independently.
Commission Proposal
171. The Commission views joint owners of critical cyber assets as being
equally subject to the CIP Reliability Standards as other responsible entities. If an asset is designated as a critical cyber asset by one joint owner, it must be treated likewise by the other owner(s). Thus, each entity that possesses an interest in a jointly-owned facility would be responsible to develop a list of its authorized personnel and to respect each other joint owner's corresponding list.
172. APPA/LPPC also raise the issue of “joint use” arrangements. For example, an owner of a critical cyber asset substation may well house electronic or other equipment on its premises that belongs to another entity that may or may not be subject to these Reliability Standards. The Commission believes that, in principle, the owner of a critical cyber asset is responsible under the Reliability Standards for ensuring that all persons having access to the critical cyber asset meet the requirements of these Reliability Standards, much as the owner is responsible to ensure that vendor personnel have the required levels of security training, awareness and background checks.
173. Nevertheless, we can appreciate that even with this general guidance, further clarification regarding how “joint use” arrangements should be addressed. Therefore, we propose to direct the ERO to address the “joint use” concerns expressed by APPA/LPPC while developing any modifications to these Reliability Standards directed in a final rule. Regardless of whether a facility subject to CIP-004-1 is jointly owned or not, all entities that have access to it must comply with CIP-004-1. Each entity, however, is responsible for only its compliance and may not attempt to block or limit another's access on the basis of its perception that the other entity has not complied with CIP-004-1. In the event non-compliance is suspected, it must be promptly reported to the Regional Entity or ERO.
e. Commission Proposal Summary
174. In summary, the Commission proposes to approve Reliability Standard CIP-004-1 as mandatory and enforceable. In addition, the Commission proposes to direct the ERO, pursuant to section 215(d)(5) of the FPA and § 39.5(f) of our regulations, to develop modifications to CIP-004-1 through its Reliability Standards development process that: (1) Require affected personnel, with limited exceptions, to receive required training before obtaining access to critical cyber assets (rather than within 90 days of access authorization); (2) require responsible entities to identify “core training” elements to ensure that essential training elements will not go unheeded in an emergency and other contingency situations where full training prior to access will not best serve the reliability of the Bulk-Power System; (3) clarify that the cyber security training programs required by Requirement R2 are intended to encompass training on networking hardware and software and other issues of electronic interconnectivity supporting the operation and control of critical cyber assets; (4) provide increased guidance on the scope and quality of training; (5) make modifications to Requirement R2 to provide that newly-hired personnel and vendors should not have access to critical cyber assets, except in specified circumstances such as an emergency; (6) address circumstances in which current personnel can continue access to critical cyber assets during the 30-day investigative period during initial compliance with CIP-004-1; and (7) require immediate revocation of both physical and electronic access privileges when an employee, for any reason (including disciplinary action, transfer, termination, or retirement), no longer performs a function that requires access to critical cyber assets.
175. In addition, the Commission proposes to direct the ERO to (1) consider what, if any, modifications to CIP-004-1 should be made to address the concern raised by the ISA Group that security trainers be adequately trained; (2) consider relevant aspects of certain NIST Special Publications, as well as other relevant models, to improve CIP-004-1; and (3) address the “joint use” concerns expressed by APPA/LPPC and discussed herein by the Commission when developing modifications to the Reliability Standards that the Commission may direct when we issue our final rule.
4. CIP-005-1—Electronic Security Perimeter(s)
176. Reliability Standard CIP-005-1 requires identification and protection of the electronic security perimeters inside which all critical cyber assets are located, as well as all access points. The electronic security perimeters are to encompass all the critical cyber assets that are identified using the risk-based assessment methodology required by Reliability Standard CIP-002-1. Multiple electronic security perimeters may be required; for example, one may be needed around a control room while another may be established around a substation. Once each electronic security perimeter has been established, the responsible entity must develop mechanisms to control and monitor electronic access to all electronic access points. Furthermore, the responsible entity must assess the electronic security perimeter's cyber vulnerability and test every electronic access point at least annually.
177. The Commission proposes to approve Reliability Standard CIP-005-1 as mandatory and enforceable. In addition, we propose to direct the ERO to develop modifications to this Reliability Standard. Further, the Commission also proposes to require the ERO to consider various other matters of clarification, guidance, and modification. In our discussion below, the Commission addresses its concerns in the following topic areas regarding CIP-005-1: (1) Adequacy of electronic security perimeters; (2) protecting access points and controls; (3) monitoring access logs; (4) vulnerability assessments; and (5) document updates.
a. Adequacy of Electronic Security Perimeters
178. Requirement R1 of CIP-005-1 addresses the identification of electronic security perimeters to ensure that every critical cyber asset resides within one. The CIP Assessment explained that the electronic security perimeter constitutes the appropriate first line of defense. However, a responsible entity should use a cyber security protection program that contains additional security measures to detect and stop intrusions that penetrate the outer shell of the defense (
i.e.
, a defense in depth approach).
179. APPA/LPPC and Xcel agree with the CIP Assessment's concept of defense in depth and when possible, securing the non-critical cyber assets outside the electronic security perimeter. However, APPA/LPPC state that the use of “defense in depth” may not be practical for all critical cyber assets, such as assets supplied by vendors that are no longer in business.
180. Xcel notes that a line needs to be drawn in order to avoid responsible entities taking expensive precautions that are not cost-effective. It further adds that CIP-005-1 should not be extended to equipment and systems beyond the electronic security perimeter.
Commission Proposal
181. The Commission recognizes that there is a point at which having multiple defense layers would not be cost effective. However, the effectiveness of any one defense measure is often dependent upon the quality of active human maintenance, and there is no one perfect defense measure that will guarantee the
protection of the Bulk-Power System. Therefore, we believe that a responsible entity must implement two or more distinct security measures when constructing an electronic security perimeter. Thus, the Commission proposes to direct the ERO to develop a requirement to implement a defensive security approach including two or more defensive measures in a defense in depth posture. This approach should not inhibit, but instead supplement the establishment of an electronic security perimeter. While such layers/measures are generally integrated within and constitute part of a system or program, many are also effectively, and more feasibly, placed “in front of” a system, such as an older, legacy system.
b. Protecting Access Points and Controls
182. Requirement R2 of CIP-005-1 requires a responsible entity to implement organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the electronic security perimeter. Requirement R2.4 requires “strong procedural and technical controls” at enabled external access points “to ensure authenticity of the accessing party, where technically feasible.”
183. The CIP Assessment raised concerns regarding the qualifier “where technically feasible” in Requirement R2.4. The CIP Assessment also cautioned that keeping pace with advances in cyber security is a necessary part of the defense strategy needed to protect against intrusion by an adversary. The CIP Assessment noted that implementation and maintenance of strong controls to ensure authenticity of the accessing party is not a question of technical feasibility. It represents that the technology currently exists and that every responsible entity identifying critical cyber assets should be able to implement such controls. Balancing an appropriate mix of protections and technology is part of achieving effective cyber security. The CIP Assessment also expressed the view that Requirement R2.4 should not allow a responsible entity to fail to implement rudimentary procedural and technical access controls.
184. California PUC states that electronic access from outside the electronic security perimeter should require strong verification, such as digital certificates or two-factor authentication. It suggests that such a system is virtually impenetrable and that it, or some similar system, should be required in the CIP Reliability Standards.
185. California PUC comments that access controls should be implemented at all access points to the network and that the caveat of “technical feasibility” in the NERC-proposed Reliability Standard is inappropriate. California PUC further states that Requirement R2.0 prescribes,
inter alia,
that only those ports and services required for normal or emergency operations should be enabled, while all others should be disabled. Furthermore, it notes that access control, including the authorization process and authentication method for each access point, should be documented. Access should be monitored twenty-four hours a day, seven days a week, and disturbances and unauthorized access attempts should be identified. All responsible entities should conduct vulnerability assessments of their access points, scanning to verify that only the proper ports and services are enabled. California PUC agrees with the CIP Assessment assertion that “such (strong access control) technology currently exists” and implementation by every entity is feasible.
186. NERC disagrees with the CIP Assessment comment that a “technical feasibility” caveat is not needed in Requirement R2.4, particularly for legacy implementations and substation environments. NERC agrees that the CIP Assessment statement may be applicable in a modern control center environment, where common IT systems have migrated into the control environment. However, NERC states that this is not the case for many existing field systems. The technical feasibility clause, NERC claims, is needed to accommodate the vast majority of legacy systems that cannot be upgraded due to the age and nature of their system configurations.
86
86
Progress Energy, ReliabilityFirst, and Santa Clara agree with NERC.
187. Given the numerous scenarios surrounding access control, APPA/LPPC believe that removing the “technically feasibility” caveat will not provide a solution in every situation. They assert that Requirement R2.4 is appropriate as currently written. APPA/LPPC note that some access control solutions, such as biometric ones, are still subject to failure and may grant access to unauthorized people.
Commission Proposal
188. Requirement R2.4 of CIP-005-1 calls for the implementation of “strong procedural or technical controls” at access points to ensure authenticity of the accessing party. While we agree with the goal of Requirement R2.4, we are concerned that requiring “strong” controls does not provide sufficient guidance and possibly sets subjective criteria. Thus, we believe that Requirement R2.4 should provide greater clarity regarding the expectation for adequate compliance by identifying examples of specific verification technologies that would satisfy the Requirement, while also allowing compliance pursuant to other technically equivalent measures or technologies. The Commission agrees with California PUC that strong verification includes technologies such as digital certificates and two-factor authentication. We also note that Recommendation 32 of the Blackout Report emphasizes the need “to ensure access is granted only to users who have corresponding job responsibilities.”
87
We propose to direct the ERO to modify this Reliability Standard accordingly.
87
See
Blackout Report at 164-165, Recommendation 32.
189. The Commission believes that providing such basic security measures as access control can be accomplished using/placing measures “in front of” systems as opposed to “inside” systems. Such an approach can be used to secure even older, yet functioning, legacy systems. The Commission proposes to direct the ERO to evaluate the issue and provide specific guidance to responsible entities that must face such issues.
190. The Commission is persuaded by commenters that maintain that, due to t
This text is long and has been trimmed here. Open the source document for the complete record.
This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.