REMINDER: CIP Virtualization Suite of Standards Comment Period Extended

Summary:

The 45-day formal comment period for the CIP Virtualization suite of standards (outlined below) has been extended and is now open through 8 p.m. (Eastern), Monday, April 11, 2022. Additional ballots for the standards and non-binding polls of the associated Violation Risk Factors and Violation Severity Levels will be conducted April 1-11, 2022.

Additional Discussion:

Background:

The Version 5 Transition Advisory Group (V5 TAG) transferred issues to the Version 5 SDT that were identified during the industry transition to implementation of the Version 5 CIP Standards. Specifically, the issues that the SDT will address are:

• Cyber Asset and BES Cyber Asset Definition
• Network and Externally Accessible Devices
• Transmission Owner (TO) Control Centers Performing Transmission Operator (TOP)
• Obligations
• Virtualization

On January 21, 2016, FERC issued Order No. 822 Revised Critical Infrastructure Protection Reliability Standards. In this order, FERC approved revisions to version 5 of the CIP standards and also directed that NERC address each of the Order 822 directives by developing modifications to requirements in CIP standards and the definition of Low Impact External Routable Connectivity (LERC), or the SDT shall develop an equally efficient and effective alternative.

• Develop modifications to the CIP Reliability Standards to provide mandatory protection for transient devices used at Low Impact BES Cyber Systems based on the risk posed to bulk electric system reliability.
• Develop modifications to the CIP Reliability Standards to require responsible entities to implement controls to protect, at a minimum, communication links and sensitive bulk electric system data communicated between bulk electric system Control Centers in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).
• Develop a modification to provide the needed clarity, within one year of the effective date of this Final Rule, to the LERC definition consistent with the commentary in the Guidelines and Technical Basis section of CIP-003-6.

Standard(s) Affected

• CIP-002-7 – Cyber Security - BES Cyber System Categorization
• CIP-003-Y – Cyber Security - Security Management Controls
• CIP-004-8 – Cyber Security - Personnel & Training
• CIP-005-8 – Cyber Security - BES Cyber System Logical Isolation
• CIP-006-7 – Cyber Security - Physical Security of BES Cyber Systems
• CIP-007-7 – Cyber Security - Systems Security Management
• CIP-008-7 – Cyber Security - Incident Reporting and Response Planning
• CIP-009-7 – Cyber Security - Recovery Plans for BES Cyber Systems
• CIP-010-5 – Cyber Security - Configuration Change Management and Vulnerability Assessments
• CIP-011-4 – Cyber Security - Information Protection
• CIP-013-3 – Cyber Security - Supply Chain Risk Management

Link

https://sbs.nerc.net/