WIXLIB

FEATUREC OM P LIANC EIn essence, PRC compliance and CIPcompliance are tightly integrated partsof overall NERC compliance programs.Although separately enforceable, they aremutually consequential. Utility complianceofficers identify, track, and report on NERCmandated elements within these standards butmay not realize or plan for how the mandatesimpact workers. A best practice is proactivecoordination between compliance officersand subject matter experts from OT/IT andP&C areas of the organization. Complianceprogram success is influenced greatly by theinvolvement of stakeholders who can reveal thecomplications endemic to cyber security whenit comes to routine protection engineering andtesting responsibilities.Utility information systems can be separatedby functional areas. For example, compliancemanagement systems in the domain ofcompliance officers are separate from cybersecurity management systems that reside withIT. Protection system models and relay settingsdata are managed by protection engineers,whereas information about protection testingis found on field computers and shared drivesor in filing cabinets.For compliance program strategies tobe effective, utilities need central data,information, and workflow management.OT/IT and P&C areas can become taskedwith refining and expanding existing in-housesystems. Where there are limits, workaroundsare devised. Commercial software productsthat are used become integrated as far aspossible, but varied data formats and diversework processes within P&C cause gaps thatin-house central management approaches don’tovercome.Many utilities use commercially availablecentral management software that canconsolidate, standardize, and integrate cybersecurity, protection engineering, protectiontesting, and compliance. Ultimately, thesesystems ensure cyber-secure transactions ofcritical data in mediums that do not hinder6 WINTER 2021worker efficiency, even if workers have differentneeds and come from separate functional areas.TRACKI NG ANDREPORTI NGWith effective central management of cyberassets and P&C work details, complianceofficers have visibility of numerousinterconnections between processes andindividual CIP and PRC standards. Havingsuch visibility proves invaluable when plottingwork steps for teams to follow. For instance,consolidated information about CIP andPRC mandates can enable compliance teamsto focus on priorities (the mandates) andoffload tracking and reporting functions tothe software systems’ automated managementfunctions. Analytical tools can provide crucialinsights about compliance-related activities andthe effects they have on reliability.For example, PRC-004, Protection SystemMisoperation Identification and Correctionrequires utilities to formalize proceduressurrounding the identification and correctionof unforeseen or unexpected protection systemoperations. Faulty test practices and incorrectlyapplied relay settings are two main causesof relay failures, and NERC mandates thatutilities track how they investigate and resolvemistakes within their operations.NERC PRC-004 tracking could exposeone additional factor that leads to relaymisoperations: overdue maintenance testing.Another standard, PRC-005, Transmission andGeneration Protection System Maintenance andTesting requires utilities to provide evidence thatrelays and other protection system componentsare tested in regular maintenance intervals.Auditors want to see that utilities have viableprotection system maintenance programs tothe extent that they have the capacity to reachall BES protection system facilities and testingand calibration is accomplished by requireddeadlines.MI SOPERATI ONSBut what if protection system misoperationsresult from relay settings that weren’t correct inTURNING THE CORNER ON CYBER-SECURE PROTECTION TESTING

FEATUREthe first place? Another NERC PRC standard,PRC-027, Coordination of Protection Systemsfor Performance During Faults came intoeffect April 1, 2021, and addresses that issueby mandating periodic settings reviews andprotection system coordination studies.The new requirementsaffect protection engineerswho must produce evidenceof a formal process theyadhere to when developingsettings. Under PRC-027,protection engineers mustalso revisit system models,recalculate all protectionsettings values, and recoordinate protectionschemes.settings may become invalid as changes infault currents occur. These changes may bedue to changes in the power system such aschanging power system characteristics as aresult of significant additions of inverterbased renewables coming online that canaffect protection systemoperability on the BES.NERC wants utilitiesWITH EFFECTIVE CENTRALto enact processes toMANAGEMENT OF CYBERproactively find incorrectrelay settings, correct them,ASSETS AND P&C WORKand communicate correctDETAILS, COMPLIANCEsettings information toOFFICERS HAVE VISIBILITYaffected entities in a timelyTO NUMEROUSmanner.INTERCONNECTIONSPRC-027 Requirement 2(R2) concerns protectionINDIVIDUAL CIP AND PRCsystem coordination.PRC-027 brings intoUnder R2, protectionSTANDARDS.focus the accuracy ofengineers must verify thatprotection settings overcoordination studies aretime. Requirement 1 (R1)performed on the affectedof the standard concernsprotection systems anythe accuracy of the originaltime there have beenpower system modelssignificant changes to theupon which protectionBES. Similar to R1, ifsettings are first calculated.any settings changes ariseThe settings that go into service in protectionfrom coordination studies being performed,schemes are only as good as the data in powerprotection engineers must contact any affectedsystem models. For this reason, PRC-027electrically joined utilities and communicateR1 mandates that power system models arethe new settings information to ensure allreviewed and updated.protection systems in that area are coordinatedproperly for handling power system faults.Another part of R1 concerns review ofprotection system settings. Protection engineersConcerning the communication to neighboringmust periodically revisit the settings forutilities of settings change information, R1accuracy, but also to ensure that neighboring,and R2 are not completed until there iselectrically joined utilities have settings ondocumentation that the communication tookrecord that coordinate with one another, suchplace. Further, the matter of settings changesthat protection systems operate in the intendedon electrically joined BES facilities isn’t a onesequence during faults. Settings verificationsand-done situation; both entities remain inbetween affected utilities is a two-way street,consultation with one another back-and-forthand both share responsibilities under this PRCuntil their respective peer-reviewed coordination027 requirement.studies can validate the settings are accuratewithin the given schemes involved. Both entitiesWhy is this necessary? Because power systemsmust agree and sign off to this effect, which ischange over time. With the PRC-027 standard,the documentation NERC auditors want to seeNERC addresses the likelihood that protectionprovided with PRC-027 evidence.BETWEEN PROCESSES ANDTURNING THE CORNER ON CYBER-SECURE PROTECTION TESTINGNETAWORLD 7

FEATUREDOC UM E NTAT IONNERC standards PRC-004, PRC-005, andPRC-027 are just three examples of standardsthat affect protection engineers and relaytesting crews by requiring documented proofthat activities are performed as mandated.The documentation these standards requirecan come from the same data source ifa robust central management system isimplemented that tracks lifecycle relay testdetails, maintenance intervals, relay settingsand configuration changes, and associatedwork assignments. Many other NERC PRCstandards impact protection engineers that alsorequire evidence of compliance.Protecting PRC compliance data and enablingautomation while P&C teams do their workis possible with commercially available centralmanagement software. However, softwareautomation depends on the human element.OT/IT teams need to be aware of processesand procedures P&C teams have in theircompliance responsibilities. Conversely,P&C workers need to accept their roles andresponsibilities in cyber security.Implementing a central management systemthat supports PRC compliance reporting andoffice-to-field workflows takes a consultativeprocess involving company stakeholders andthe software vendor. A quality supplier willhave a proven track record with many installedutility customers. The ideal supplier will offerconfigurable software and a detailed statementof work (SOW) that is clear and captures thefull scope of the implementation project. Thesystem must comply seamlessly with institutedcyber security measures and offer powerfuladministrative controls over user accessprivileges.C YB E R ATTAC KSUnrelenting cyber attacks on utility computernetworks have increased concerns of adaptivemeasures cyber criminals will take to achievetheir objectives. NERC CIP standardschallenge utility cyber security programs toelevate their defenses by reducing their threatvectors.8 WINTER 2021NERC CIP-013, Supply Chain Risk Managementin particular mandates that utilities have securitycontrols concerning computer software andhardware products being procured. At issueare cyber threats that may be posed to theBES if the products are compromised comingfrom the vendor. CIP-013 requires proactivecommunication from vendors if cyber securityrisks are determined in products sold to utilities,and utilities must coordinate risk managementplans in their supply chain procurementprocesses to prevent onboarding products thatcould pose cyber security risks.NERC CIP-010, Configuration ChangeManagement and Vulnerability Assessments existsto prevent unauthorized changes on BES cybersystems by external intruders. Utilities mustdetermine and address vulnerabilities beforehackers have the opportunity to exploit themfor nefarious purposes.CIP-010 requires vulnerability assessmentsevery 36 months that look for gaps in andassess the effectiveness of preventive measuresagainst malicious cyber attacks. One measurethat can prevent hackers from accessing cybersystems is maintaining up-to-date securitypatches. Unpatched software allows hackersto run malicious code by using a known,unpatched security bug, and so cyber hackersalways try to exploit unpatched systems.As part of vulnerability assessments underCIP-010, utilities must produce evidence thatthey have reviewed installed patches, that theyhave a security patch review and mitigationprocess, and that they have processes forother cyber security vulnerability mitigationsconcerning software and software patches oncyber assets.Requirement 4 (R4) of CIP-010 requiresutilities to deploy transient cyber asset(TCA) computers for workers to use whenconnecting to cyber assets like microprocessorbased protective relays. Having securedTCAs prevents the possibility of malwarebeing introduced onto cyber assets duringmaintenance.TURNING THE CORNER ON CYBER-SECURE PROTECTION TESTING

FEATUREInteractions Affecting PRC and CIP ComplianceNERC PRC-027 Coordination &PRC-004 Misoperations Power System DataSetting CalculationsCoordination StudiesCommunication with ConnectedEntitiesNERC PRC 005Maintenace Deploy Settings and Patches Track Intervals and ResultsNERC CIP-007 SystemSecurityPower System Model Security Patch ManagementNERC CIP-010 ChangeManagement andVulnerability Assessments Maintain Cyber Asset Security Maintain Transient Cyber AssetsNERC CIP-013Supply Chain Risk Supply Chain SecurityGovernanceCentral Management Plan Secure, expandable data warehousing that supportssystem protection and cyber security Non-disruptive processes and workflow controls Transparent engineering, maintenance, and compliancecoordination Automated trending, analysis, messaging, and reportingfunctionsFigure 2: Integrated data and workflow processes supported by a central management platform ensure efficient NERC PRCand NERC CIP compliance.Taken together, the requirements of CIP-010impact OT/IT workers who must supportsecurity patching for a multitude of P&Csoftware applications and manage thoseupdates on TCAs across their organization.Baseline configurations of all cyber assetscomprising cyber systems must be monitoredand vulnerability assessments must beperformed every 36 months to detect anymeans by which unauthorized changes to BEScyber assets could occur.NERC CIP-007, Systems Security Managementrequires a process for assessing, tracking,and installing cyber security patches on BEScyber assets. Utilities must operate theirpatch management process every 35 days toavoid non-compliance penalties. Given thehigh volume of devices and applications thisstandard affects, efficient monitoring andcontrol practices are critical. Commercialpatch management that addresses CIP-007requirements is available that provides a sevenday turnaround and can be a valuable solutionfor overwhelmed OT/IT resources.Compliance with NERC PRC and NERC CIPrequirements would benefit from some form ofautomation to offload burdens from personnelwho already have heavy workloads. The optimalscenario is central management from an integratedplatform of software systems that can track datafrom front-end testing and maintenance activitiesto protection system engineering to back-endcompliance and cyber security processes.Ultimately, PRC requirements come down toassurance that protection systems will operateas intended to maintain reliable power deliveryon the BES. NERC mandates that utilitiesTURNING THE CORNER ON CYBER-SECURE PROTECTION TESTINGNETAWORLD 9

FEATUREensure their relay settings are reviewed and thatthey are properly coordinated across the grid.Protection engineers must demonstrateconsistency and thoroughness in all aspectsof the settings development and deploymentprocess. Personnel who test relays must maintaincyber secure measures while entering substationsand performing work on substation networks.When they test relays — cyber assets — theyhave additional responsibilities to defend againstcyber attacks while ensuring relays are properlyset and correctly functioning.NERC CIP requirements affect PRCcompliance activities by requiring TCAs to beused by field crews. Additionally, the softwareP&C personnel need on their TCAs mustbe patched and monitored regularly, and theTCAs themselves must be tracked.An integrated management platform mustsupport the monitoring and patch managementof testing software used in the field on TCAs.It must also handle power system model dataand relay settings lifecycle changes generatedby protection engineering teams. It should offermodules for connecting P&C data to enterpriseasset management (EAM) systems, evenoffering specialized P&C work managementcomponents that augment EAM workflows. Itmust also provide straightforward, configurablereporting in all aspects for any stakeholder.The platform must be supported by a relationaldatabase that can offer structured data forlinking to external systems. Utilities workingwith a supplier to implement an automatedcentral management system have theopportunity to look at existing processes andshed inefficient or unnecessary practices.Through a consultative implementation process,utilities can harmonize different data from varioussources and for different stakeholders into amodern way of working that benefits all parties: Field crews will operate with theapplications they need and use TCAsseamlessly with test equipment and relays.10 WINTER 2021 Protection engineers will have templatesthat standardize settings developmentand will seamlessly flow settings datainto power system models for efficientcoordination studies. Compliance officers will have dashboardsand simplified reporting. OT/IT personnel will have loweradministrative burden.CONCLUSI ONEffective NERC compliance programs are thosethat enable utilities to achieve objectives. Rightnow, the benefits of substation automation andrenewables are becoming tangible, but digitalprotection systems and the effects of inverterbased generation on the BES need workers’focus to overcome these complex issues.Compounding the complications they alreadyface with inefficient compliance programoperations can prevent modernization fromhappening. Utilities that work from a culture ofNERC compliance and have the proper tools todo their jobs are in the best positions to avoidfinancial penalties from non-compliance andovercome the uncertainties of technologicaland regulatory changes over time.Bryan Gwyn, PhD, CEng, is thesenior director of solutions at DobleEngineering Company where he bringsstrategic leadership to engineering teams inprotection system and cyber security subjectareas that advance new product and serviceofferings for the global power deliverymarketplace.Sagar Singam is a cyber security engineerwith Doble Engineering Company wherehe performs consultative professional servicesin the delivery of Doble PatchAssure and Doble TCA Program cyber securitysolutions.Joe Stevenson is a product marketingmanager with Doble EngineeringCompany where he develops marketingstrategies and materials in support ofDoble protection software including DoblePowerBase , Doble Protection Suite , andDoble RTS .TURNING THE CORNER ON CYBER-SECURE PROTECTION TESTING

Matters of NERC PRC and NERC CIP compliance intersect during protection system testing on substation networks. In the modern regulato ry environment, the beneits of computer-based relaying are challenged by the costs of cyber security and disrupted or insuicient relay testing practices. he way forward demands interconnected data and the ability