WIXLIB

White paperCisco publicFoundational Security Architecture in Electric UtilitiesData Center / Control Center1SensorSCADASecurity Operations Center (SOC)Cyber VisionAppServersPrivateWANFMCSecureXSP 00Firewall4Substation5SensorHMISensorSensorSPANIE erterCapacitorBankVoltageRegulatorFeederMUCyber Vision Center, Firepower Management Center and SecureX deployed at Control Center.Cyber Vision Sensor embedded in IE3400 switches or deployed via one-hop SPAN on IC3000 in transmission substations.Cyber Vision Sensor embedded in IR1101 gateways in the distribution grid.Application- ow metadata streamed from sensors to center over utility private WAN with little network impact.Industrial Security Appliance (ISA3000) provides the access control and IPS capability - in a simplistic form, it is a DMZ.A Validated Security SolutionCisco is a leader insecuring enterprisenetworks. Cisco isalso a leader inindustrial networking.Cisco’s team of validation engineers design and build these solutions basedon detailed use cases from real-world environments and scenarios. We testthe full solution to the limit of its capabilities and document the results in aCisco Validated Design (CVD). These documents can be found here:www.cisco.com/go/iotcvdCisco is a leader in securing enterprise networks. Cisco is also a leader inindustrial networking. We are leveraging these unique portfolios of productsand solutions, together with threat intelligence from Talos , one of theworld’s largest security research teams, to make security inherent andembedded in the industrial network.Cisco is not only “IT approved” but is “IT preferred”, helping you streamline and accelerate security deployments inthe utility industry. 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicProduct Mapping and Alignment to NERC CIPRequirementsSummaryExplanation/PurposeSolution MappingCIP-002-5.1aCybersecurity – Critical CyberAsset IdentificationTo identify and categorize Bulk Electric System(BES) cyber systems and their associated BEScyber assets for the application of cybersecurityrequirements commensurate with the adverse impactthat loss, compromise, or misuse of those BES cybersystems could have on the reliable operation of theBES. Identification and categorization of BES CyberSystems support appropriate protection againstcompromises that could lead to mis-operation orinstability in the BES.Cisco Cyber VisionCIP-003-8Cybersecurity – SecurityManagement ControlsRequires that responsible entities have minimumsecurity management controls in place to protectcritical cyber assets.Cisco ISA 3000 and FirepowerfirewallsCIP-005-5Cybersecurity – ElectronicSecurity Perimeter(s)Requires the identification and protection of theelectronic security perimeters inside which all criticalcyber assets reside, as well as all access points onthe perimeter.Cisco Duo,ISA 3000CIP-006-6Cybersecurity – PhysicalSecurity of Critical Cyber AssetsAddresses implementation of a physical securityprogram for the protection of critical cyber assets.IoT Grid Security ArchitectureCIP-007-6Cybersecurity – SystemsSecurity ManagementRequires responsible entities to define methods,processes, and procedures for securing thosesystems determined to be critical cyber assets, aswell as the other (non-critical) cyber assets within theelectronic security perimeters.FMC, ISA 3000, Firepower,SecureX, ISECIP-008-5Cybersecurity – IncidentReporting and Response PlanTo mitigate the risk to the reliable operation of the BES Cyber Vision, ISE, FMCas the result of a cybersecurity incident by specifyingSecureX, AMP for Endpoints,incident response requirements.AMP for Networks, ThreatGridCIP-010-2Cybersecurity — ConfigurationChange Management andVulnerability AssessmentsTo prevent and detect unauthorized changes to BulkCisco FMC, Cyber Vision,Electric System (BES) cyber systems by specifyingStealthwatch, ISEconfiguration change management and vulnerabilityassessment requirements in support of protecting BEScyber systems from compromise that could lead tomis-operation or instability in the BES.CIP-011-2Cybersecurity — InformationProtectionTo prevent unauthorized access to BES Cyber SystemInformation by specifying information protectionrequirements in support of protecting BES CyberSystems against compromise that could lead tomis-operation or instability in the Bulk ElectricSystem (BES).Segmentation with ISA 3000,encryption, TrustSecCIP-13-1Supply Chain ManagementTo mitigate cybersecurity risks to the reliableoperation of the BES by implementing securitycontrols for supply chain risk management of BEScyber systems.Cisco has been awardedIEC 61443-4-1 and 4-2certifications.To identify and protect transmission stations andtransmission substations, and their associatedprimary control centers, that if rendered inoperable ordamaged as a result of a physical attack could resultin instability.Meraki MV72 outdoor cameraand analyticsCIP-014-2Physical Security 2021 Cisco and/or its affiliates. All rights -center.html

White paperCisco publicAppendix AIdentification andcategorization of BEScyber systems supportappropriate protectionagainst compromisesthat could lead tomis-operation orinstability in the BES.Current NERC CIP Mandates and Detailed Solution MappingsCIP-002-5 requires the initial identification and categorization of BES cybersystems. CIP-003-5, CIP-004-5, CIP-005-5, CIP-006-5, CIP-007-5, CIP008-5, CIP-009-5, CIP-010-1, and CIP-011-1 require a minimum level oforganizational, operational and procedural controls to mitigate risk to BEScyber systems. This suite of CIP standards is referred to as the Version 5 CIPcybersecurity standards.CIP-002-5.1a Cybersecurity — Critical Cyber Asset Identification. Toidentify and categorize BES cyber systems and their associated BES cyberassets for the application of cybersecurity requirements commensurate withthe adverse impact that loss, compromise, or misuse of those BES cybersystems could have on the reliable operation of the BES. Identification andcategorization of BES cyber systems support appropriate protection againstcompromises that could lead to mis-operation or instability in the BES.CIP-002-5.1a is in place to determine the level of risk associated with the utility under audit and is predominantlya procedure and documentation effort. However, it is necessary to understand the level of exposure and the keycomponents in the grid.The requirements section R1 lists the following:R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes ofparts 1.1 through 1.3: [Violation Risk Factor: High][Time Horizon: Operations Planning]i. Control Centers and backup Control Centers;ii. Transmission stations and substations;iii. Generation resources;iv. Systems and facilities critical to system restoration, including BlackstartResources and Cranking Paths and initial switching requirements;v. Special Protection Systems that support the reliable operation of the Bulk Electric System; andvi. For Distribution Providers, Protection Systems specified in Applicability section 4.2.1.1.1. Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at eachasset;1.2. Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at eachasset; and1.3. Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any(a discrete list of low impact BES Cyber Systems is not required). 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicThe measures associated with R1 are:The Cisco architecturedescribed in this paperidentifies severalmechanisms to supportsecure and up-to-dateequipment inventory,configuration changeand the authenticity ofthe reporting.M1: Acceptable evidence includes, but is not limited to, dated electronic orphysical lists required by Requirement R1, and Parts 1.1 and 1.2.As cited above this mandate is predominantly a documentation andclassification requirement. However, manual data gathering is timeconsuming and often difficult to control, confirm and keep updated.The Cisco architecture described in this paper identifies several mechanismsto support secure and up-to-date equipment inventory, configurationchange and the authenticity of the reporting. With technologies like dynamicmultipoint virtual private network (DMVPN) a Cisco firewall or industrialgateway can establish secure encrypted tunnels to multiple locations froma substation or any grid location. Tunnel termination in a secure loggingand monitoring zone in a data center or control center establishes a virtual“chain of evidence” for any changes occurring in the substation. The auditresponder now has a single source of truth with time stamps of logs andinventory in a single location.The solution would include Cisco Cyber Vision and Stealthwatch as well as the ISA 3000 or one of the Cisco IndustrialRouters to establish and terminate the encryption. Authentication servers such as Cisco Identity Service Engine andswitching infrastructure to support port access, assist with edge device identity, and additional security features tocontrol access and prevent probes or threats.CIP-003-8 Cybersecurity — Security Management Controls. Requires that responsible entities have minimumsecurity management controls in place to protect Critical Cyber Assets.Section B describes the “Requirements and Measures” which are documentation based. This is where the reliabilitystandard audit worksheet (RSAW) is a critical piece of the compliance response. Record keeping and documentretention is critical with CIP-003 as well as workflow process and procedures and adherence to those process andprocedures as detailed in the RSAW.CIP-004-6 Cybersecurity — Personnel and Training. The objective is to minimize the risk against compromise thatcould lead to mis-operation or instability in the Bulk Electric System (BES) from individuals accessing BES CyberSystems by requiring an appropriate level of personnel risk assessment, training, and security awareness in support ofprotecting BES Cyber Systems.This is a utility-specific process and procedures mandate. All of the detailed “Requirements and Measures” are veryspecific to cybersecurity training for utility personnel. Cisco and the Grid Security architecture have no bearing on thespecifications for CIP-004. The RSAW and the preparation put into its completion will play a key role in the utility’ssuccess on this mandate. 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicCIP-005-5 Cybersecurity — Electronic Security Perimeter(s). Requires the identification and protection of the electronicsecurity perimeters (ESP) inside which all Critical Cyber Assets reside, as well as all access points on the perimeter.The “Requirements and Measures” dictate the following electronic security perimeter (ESP):R1. Each Responsible Entity shall implement one or more documented processes that collectively include each of theapplicable requirement parts in CIP-005-5 Table R1 – Electronic Security Perimeter.M1. Evidence must include each of the applicable documented processesthat collectively include each of the applicable requirement parts and additional evidence to demonstrateimplementation.1.1 All applicable Cyber Assets connected to a network via a routable protocol shall reside within a defined ESP.1.2 All External Routable Connectivity must be through an identified Electronic Access Point (EAP).1.3 Require inbound and outbound access permissions, including thereason for granting access, and deny all other access by default.1.4 Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicableCyber Assets.1.5 Have one or more methods for detecting known or suspectedmalicious communications for both inbound and outbound communications.R2. Each Responsible Entity allowing Interactive Remote Access to BES Cyber Systems shall implement one or moredocumented processes that collectively include the applicable requirement parts, where technically feasible, in CIP005-5 Table R2 – Interactive Remote Access Management. [Violation Risk Factor: Medium] [Time Horizon: OperationsPlanning and Same Day Operations].2.1 Utilize an Intermediate System such that the Cyber Asset initiating Interactive Remote Access does not directlyaccess an applicable Cyber Asset.2.2 For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.2.3 Require multi-factor authentication for all Interactive Remote Access sessions. 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicM2. Evidence must include the documented processes that collectivelyaddress each of the applicable requirement parts in CIP- 005-5.The Cisco Grid SecurityArchitecture clearlydefines and establishesan electronic securityperimeter (ESP)The Cisco Grid Security Architecture clearly defines and establishes anelectronic security perimeter (ESP). The compliance requirements forCIP-005-5 are focused on the documentation of the established ESP andthe communications and flow of data into and out of the ESP. This can beachieved in numerous ways including the manual or automated gathering ofdated and time stamped log files from the ESP gateway and the encryptiontunnel terminations at both ends.The secure centralized logging and monitoring as defined in our architectureconsolidates and automates the collection of this data easing the complianceand audit response burden. This architecture also includes a best practice approach for IT/OT interconnection thatincludes back to back firewalls and intermediate systems aka jump-hosts or jump-servers.This can be deployed in a DMZ that includes AAA services and Cisco’s IoT Signature base for intrusion detection. Thissignature base is continuously enhanced by our Talos research team in the form of updated Snort rule sets. This samemodel can be leveraged in the substation for additional levels of protection with the firewall rule set and IoT signaturebase with deep packet inspection on the ISA 3000 industrial firewall.CIP-006-6 Cybersecurity — Physical Security of Critical Cyber Assets. Addresses implementation of a physicalsecurity program for the protection of Critical Cyber Assets.R1. Each Responsible Entity shall implement one or more documented physical security plan(s) that collectivelyinclude all of the applicable requirement parts in CIP-006-6 Table R1 – Physical Security Plan.Rationale for Requirement R1:Each Responsible Entity shall ensure that physical access to all BES Cyber Systems is restricted and appropriatelymanaged. Entities may choose for certain PACS to reside in a PSP controlling access to applicable BES CyberSystems. For these PACS, there is no additional obligation to comply with Requirement R1, Parts 1.1, 1.6 and 1.7beyond what is already required for the PSP.1.1 Define operational or procedural controls to restrict physical access.1.2 Utilize at least one physical access control to allow unescorted physical access into each applicable PhysicalSecurity Perimeter to only those individuals who have authorized unescorted physical access. 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicMonitor forunauthorizedaccess through aphysical accesspoint into a physicalsecurity perimeter.1.3 Where technically feasible, utilize two or more different physical accesscontrols (this does not require two completely independent physical accesscontrol systems) to collectively allow unescorted physical access into PhysicalSecurity Perimeters to only those individuals who have authorized unescortedphysical access.1.4 Monitor for unauthorized access through a physical access point into aPhysical Security Perimeter.1.5 Issue an alarm or alert in response to detected unauthorized accessthrough a physical access point into a Physical Security Perimeter to thepersonnel identified in the BES Cyber Security Incident response plan within 15minutes of detection.1.6 Monitor each Physical Access Control System for unauthorized physicalaccess to a Physical Access Control System.1.7 Issue an alarm or alert in response to detected unauthorized physical access to a Physical Access Control Systemto the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of the detection.1.8 Log (through automated means or by personnel who control entry) entry of each individual with authorizedunescorted physical access into each Physical Security Perimeter, with information to identify the individual and dateand time of entry.1.9 Retain physical access logs of entry of individuals with authorized unescorted physical access into each PhysicalSecurity Perimeter for at least ninety calendar days.1.10 Restrict physical access to cabling and other nonprogrammable communication components used forconnection between applicable Cyber Assets within the same Electronic Security Perimeter in those instances whensuch cabling and components are located outside of a Physical Security Perimeter.Where physical access restrictions to such cabling and components are not implemented, the Responsible Entity shalldocument and implement one or more of the following: encryption of data that transits such cabling and components; or monitoring the status of the communication link composed of such cabling and components andissuing an alarm or alert in response to detected communication failures to the personnel identifiedin the BES Cyber Security Incident response plan within 15 minutes of detection; or an equally effective logical protection. 2021 Cisco and/or its affiliates. All rights reserved.

White paperCisco publicThe Grid SecurityArchitecture de

A matrix mapping NERC-CIP mandates to Cisco solutions is located at the end of this document. Defense-in-Depth A solid security architecture leverages a defense-in-depth approach. The Cisco Grid Security CVD details the integration of multiple security tools and devices to accomplish this in an OT environment. This holistic security