In Order No. 761, the Federal Energy Regulatory Commission approved the North American Electric Reliability Corporation’s eight modified Critical Infrastructure Protection (CIP) Reliability Standards, which are effective June 25, 2012. The CIP Reliability Standards provide a cybersecurity framework for the identification and protection of “Critical Cyber Assets” associated with “Critical Assets” that support reliable operation of the Bulk-Power System. The North American Electric Reliability Corporation (NERC) Version 4 standards, CIP-002-4– CIP-009-4, replace the risk-based assessment methodology with “bright line” criteria for identifying Critical Assets. NERC, the Commission-certified Electric Reliability Organization (ERO), proposed and the Commission accepted as an effective date the first day of the eighth calendar quarter after regulatory approval for full compliance with the mandatory Version 4 CIP Reliability Standards.
Bright Line Criteria
New CIP-002-4 provides uniform bright line criteria as a checklist to be used in identifying Critical Assets, which are then subject to the remaining CIP Standards. Requirement R1’s Attachment 1—Critical Asset Criteria provides 17 criteria for identifying Critical Assets, and R2 requires a responsible entity to develop a list of associated Critical Cyber Assets that are essential to the operation of the Critical Assets. The list must be reviewed and updated at least annually.
The new criteria include generation and transmission facilities, blackstart resources, and control centers and backup control centers. Several of the criteria pertain to critical generation and transmission assets. Requirement R2 specifically applies a trigger for Critical Cyber Asset identification in that only “shared Cyber Assets that could, within 15 minutes, adversely impact the reliable operation of any combination of units that in aggregate equal or exceed. . . criterion 1.1” (1.1 “generating units (including nuclear)at a single plant location with an aggregate highest rated net Real Power capability. . . equal to or exceeding 1500 MW in a single Interconnection”) need be considered. Also to be designated Critical Assets are specific reactive power resources (criterion 1.2); generation facilities necessary to avoid BES Adverse Reliability Impacts in long-term planning (1.3); transmission facilities critical to the derivation of Interconnection Reliability Operating Limits (IROLs)(1.8); and Flexible AC Transmission Systems (FACTS) (1.9). Criterion 1.4 requires blackstart resources to be designated as Critical Assets, and criteria 1.14 – 1.17 mandate control centers and backup control centers be included.
The Commission provided flexibility with regard to identifying Critical Assets outside the bright line criteria. Consequently, registered entities can voluntarily apply any or all of the CIP Reliability Standards to additional assets they consider critical but are not within the bright line criteria while NERC continues to refine the standards.
Violations
The Commission approved NERC’s proposed Violation Risk Factors (VRFs) and Violation Severity Levels (VSLs) with modifications. Violation Severity Levels (SVLs) address situations where a responsible entity fails to identify or include a Critical Asset (R1) or a Critical Cyber Asset (R2) within the bright line criteria in CIP-002-4 of Requirement R1’s Attachment 1—Critical Asset Criteria. Additionally, the word complete was added in Requirements R1 and R2 (e.g., a violation would result in the absence of a “complete list” of identified Critical Assets (R1)).
Guidance for Full Compliance
According to NERC, the Version 4 CIP Reliability Standards are an “interim step” in addressing the Commission’s requirements in Order No. 706 [122 FERC ¶61,040 (Intelliconnect$)]. Although FERC declined to issue further directives at this time, it provided guidance for future versions of the CIP Standards. Because cyber connectivity of the Bulk-Power System assets increases the risk of a multiple asset cyber attack, the blanket exemption for non-routable connected cyber systems should be eliminated, the Commission advised. Additionally, the Commission’s “mutual distrust” posture noted in Order No. 706 describing how outside world systems are treated by those inside the control system might be supported by electronic security perimeters (zoned security). The Commission also encouraged NERC to incorporate applicable features of the NIST (National Institute of Standards and Technology) Framework into Version 5 CIP Reliability Standards and to consider oversight of Critical Asset identification by an entity with a regional approach, such as an ERO.
Concurrent with acceptance of the Version 4 CIP Reliability Standards, the Commission approved retirement of the Version 3 CIP Reliability Standards. The Commission set March 31, 2013, as the deadline for NERC’s Version 5 CIP Reliability Standards to fully comply with the Commission’s cybersecurity mandate.
Version 4 Critical Infrastructure Protection Reliability Standards [139 FERC ¶61,058 (Intelliconnect$)]