NERC Posts Meeting Materials from “Modifications to CIP Standards Virtualization” Industry Webinar

Summary:

This Webinar provided a high-level overview of modifications for Project 2016-02 Modification to CIP Standards. These Draft 3 Standards are open for comment from February 18 through April 11, 2022. The Standards Affected are: (1) CIP-002 through CIP-011 and (2) CIP-013. The standards with substantial changes are: (1) CIP-005, (2) CIP-007, and (3) CIP-010.

Additional Discussion:

The Version 5 Transition Advisory Group (V5 TAG) transferred issues to the Version 5 SDT that were identified during the industry transition to implementation of the Version 5 CIP Standards. Specifically, the issues that the SDT will address are:

• Cyber Asset and BES Cyber Asset Definition
• Network and Externally Accessible Devices
• Transmission Owner (TO) Control Centers Performing Transmission Operator (TOP) Obligations
• Virtualization

On January 21, 2016, FERC issued Order No. 822 Revised Critical Infrastructure Protection Reliability Standards. In this order, FERC approved revisions to version 5 of the CIP standards and also directed that NERC address each of the Order 822 directives by developing modifications to requirements in CIP standards and the definition of Low Impact External Routable Connectivity (LERC), or the SDT shall develop an equally efficient and effective alternative. To address concerns identified in Order 822, the Commission directed the following:

• Develop modifications to the CIP Reliability Standards to provide mandatory protection for transient devices used at Low Impact BES Cyber Systems based on the risk posed to bulk electric system reliability.
• Develop modifications to the CIP Reliability Standards to require responsible entities to implement controls to protect, at a minimum, communication links and sensitive bulk electric system data communicated between bulk electric system Control Centers in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).
• Develop a modification to provide the needed clarity, within one year of the effective date of this Final Rule, to the LERC definition consistent with the commentary in the Guidelines and Technical Basis section of CIP-003-6.

Click here for: Recording

Associated Files:

• 2016-02_CIP_Virtualization_Implementation_Plan_Clean_02182022
• CIP-002-7_Technical Rationale_03152022
• CIP-003-Y_Technical_Rationale_03152022
• 2016-02_CIP-003-Y_Clean_02182022
• 2016-02_CIP-004-8_Clean_02182022
• 2016-02_CIP-005-8_clean_02182022
• 2016-02_CIP-006-7_Clean_02182022
• 2016-02_CIP-007-7_clean_03092022
• 2016-02_CIP-008-7_Clean_02182022
• 2016-02_CIP-009-7_clean_02182022
• 2016-02_CIP-010-5_Clean_02182022
• 2016-02_CIP-011-4_clean_03092022
• 2016-02_CIP-013-3_clean_02182022