WIXLIB

Transitioning from Version 3 toVersion 5 of the NERC CriticalInfrastructure ProtectionReliability StandardsAndrew GalloDirector, Reliability ComplianceAustin Energy1SpeakerEducation/Training J.D (1985)Certified Compliance & Ethics Professional (CCEP since 2009)Career Most Recently:– Austin Energy: Director, Reliability Compliance, June 2010 ‐ Present– Calpine: VP Regulatory Compliance, 2010– Seattle City Light: Chief Compliance Officer, 2008 ‐2010– ERCOT: Asst. General Counsel, 2002 – 2008Roles Member of NERC Standards CommitteeNERC Quality ReviewerChair, Texas RE Regional Standards CommitteePast Chair – Texas RE NERC Standards Review Subcommittee (NSRS)Past Chair – ERCOT NERC Reliability Working Group (NRWG)21

Background3How We Got Here CIP Version 1– Approved 1/18/2008 (Order 706)– Effective 7/1/2008 (18 CFR Part 40)– FERC Order with directives: Remove “Reasonable Business Judgment” and “Acceptance ofRisk” Address Technical Feasibility Exceptions CIP Version 2– Effective 4/1/2010 to 9/30/2010– Minor changes (Low‐hanging fruit) CIP Version 3– Approved 3/31/2010– Effective 10/1/2010 to 4/1/201642

Why New Version(s) News Reports– Congress Concerns– White House (Cybersecurity Framework) Concerns5Why New Version(s) (cont’d) Versions 1, 2 & 3 ‐ Disorganized– Change Control / Information Protection / Governance– Vulnerability Assessments in two Standards Too much discretion to industry– Risk‐Based Assessment Methodology (RBAM) Too few in‐scopeassets Perceived “loopholes” NERC Action before FERC or Congress– FERC: “Progress Being Made on Cybersecurity Guidelines, but KeyChallenges Remain to be Addressed” – Feb. 14, 201263

NERC CIP Version 4 Approved 4/19/2012 (Order 761)Replaced RBAM with “bright line”Effective 4/1/14, postponed to 10/1/2014, except .Switch from Risk‐Based Assessment Methodology (RBAM)to “Bright‐line”– But kept “Critical Assets” and “Critical Cyber Assets” (CCAs) Bright‐line (CIP‐002‐4)– 17 criteria– Tied to operational Standards (IROL, Black Start, ContingencyReserves) No technical changes in other Standards Never became effective– Skipped to V57Version 4 Bright‐Line CriteriaIgnore (sort of) 1.1 – Gen Plants 1500 MWs 1.2 – Reactive resources 1000 MVAR 1.3 – “RMR” resources 1.4 – Black Start resources 1.5 – Cracking Paths 1.6 – Transmission facilities 500 kV 1.7 ‐ Transmission facilities 300 kV and connected to 3other facilities 300 kV 1.8 – Transmission facilities deemed “critical” by RC, PA orTP84

Version 4 Bright‐Line Criteria 1.9 – Flexible AC Transmission Systems (FACTS) deemed“critical” by RC, PA or TP 1.10 – Transmission facilities which, if lost or compromised,would cause the loss of gen from criteria 1.1 or 1.3 1.11 – Transmission facilities necessary for NPIRs 1.12 – SPS/RAS which, if lost, would affect anInterconnection Reliability Operating Limit (IROL) 1.13 – Load shedding systems 300 MW w/o humanintervention 1.14 – RC Control Centers (and back‐ups)9Version 4 Bright‐Line Criteria 1.15 – Control Centers (and back‐ups) used to control gen atmultiple plant locations and identified in 1.1, 1.3 or 1.4.Each control center (and back‐up) used to control gen 1500 MW 1.16 – Control Center (and back‐up) used by a TOP whichincludes control of at least one asset identified in 1.2, 1.5 –1.12 1.17 – BA Control Center (and back‐up) which includes atleast one asset from 1.1, 1.3, 1.4, 1.13105

NERC CIP Version 5 Approved 11/22/2013 (Order 791) Effective 4/1/2016 (mostly) Still not entirely finished .––––“Identify, Assess & Correct”Transient Devices (thumb drives; laptops)“Communication Network” definitionSecurity Controls for Low Impact assets Final Ballot closed 2/2/1511New Versions CIP Version 5 Effective Dates126

CIP Version 5 ‐ Approach CIP V5 priorities shift– Primarily focuses on improving security instead of “compliance”– A turning point for the CIP Standards– Compliance is important but can leave security gaps compliant secure– Version 5 tries to combine compliance and security by achievingcompliance through security Structure Corrections– Versions 1 – 4 Change Control and Information Protection embedded in Governancestandard– Change Control: CIP‐003‐3, R6– Info Protection: CIP‐003‐3, R4– Version 5 CIP‐010‐5: Change Control / Vulnerability Assessments CIP‐011‐5: Information Protection13CIP Version 5 – Approach (cont’d) New Format– Background section– Requirements/Measures (usually w/ table) Suggested evidence– Guidelines and Technical Basis Transition Period – 11/22/13 to 4/1/16 (Now)– Entities may maintain V3 RBAM– May adopt bright‐line criteria (compliance will notaddress black start units and cranking paths)– Entities must identify when requested147

Version 5 ‐ Major Changes Move from “Critical Assets” and “Critical Cyber Assets” toBES Cyber Assets and BES Cyber Systems High/Medium/Low Impact BES Cyber Systems External Routable Connectivity (ERC)15Version 5 – New DefinitionsNot verbatim Annual – Once every 15 months (or less) BES Cyber Asset –Cyber Asset if rendered unavailable/degraded/misused would, w/n 15 minutes, adversely impact Facilitie(s), system(s)or equipment, which, if destroyed/degraded/rendered unavailable (asneeded) would affect reliable operation of Bulk Electric System (BES) BES Cyber System – 1 BES Cyber Asset logically grouped to performreliability task(s) (aka BROS) BES Reliability Operating Service – BES Cyber Systems in‐scope underV5 (b/c of impact on BES reliability)–––––––––Dynamic Response to BES conditionsBalancing Load and GenerationControlling Frequency (Real Power)Controlling Voltage (Reactive Power)Managing ConstraintsMonitoring & ControlBES RestorationSituational AwarenessInter‐Entity Real‐Time Coordination and Communication168

Version 5 – New Definitions (cont’d) BROS by Registration17Version 5 – New Definitions Electronic Access Control or Monitoring System (EACMS) ‐ CyberAssets performing electronic access control or monitoring of ElectronicSecurity Perimeter (ESP) or BES Cyber Systems (includes IntermediateSystems) (previously ACM) Physical Access Control System (PACS) ‐ Cyber Assets which control,alert or log access to the Physical Security Perimeter (PSP) (exc. locallymounted hardware or devices) at PSP (e.g. motion sensors, electroniclock control mechanisms and badge readers) Protected Cyber Asset (PCA) ‐ 1 Cyber Asset connected using aroutable protocol w/n or on an ESP which is not part of the highestimpact BES Cyber System w/n the same ESP (previously NCCA)– Impact rating of PCA the highest rated BES Cyber System in same ESP– Cyber Asset is not a PCA if connected to either a Cyber Asset within the ESPor the network within the ESP for 30 consecutive days and used for datatransfer, vulnerability assessment, maintenance or troubleshootingpurposes (aka “transient device” ‐ e.g. troubleshooter laptop)189

Version 5 – New Definitions (cont’d) Low Impact BES Cyber System Electronic Access Point (LEAP) ‐ CyberAsset interface which allows Low Impact External Routable Connectivity– Cyber Asset may reside at a location external to the asset(s)containing low impact BES Cyber System– LEAP is not an Electronic Access Control or Monitoring System Low Impact External Routable Connectivity (LERC) ‐ Bi‐directionalroutable communications between low impact BES Cyber System(s) andCyber Assets outside the asset containing the low impact BES CyberSystem(s)– Communication protocols created for Intelligent Electronic Device(IED) to IED communication for protection and/or control functionsfrom assets containing low impact BES Cyber Systems are excluded(e.g. IEC 61850 GOOSE or vendor proprietary protocols)19Version 5 – New Definitions (cont’d) BES Cyber System Information (BCSI) ‐ Information about BES CyberSystem which could be used to gain unauthorized access or pose asecurity threat to BES Cyber System– Does not include individual pieces of information which, bythemselves, do not pose a threat or could not be used to allowunauthorized access to BES Cyber Systems (e.g. device names,individual IP addresses w/o context, ESP name or policystatements).– Examples of BCSI: security procedures or security information aboutBES Cyber Systems, PACS and EACMS not publicly available andwhich could be used to allow unauthorized access or unauthorizeddistribution; collections of network addresses; and networktopology of BES Cyber System2010

V5 Problems/Issues (FERC Order 791) FERC ordered NERC to:– Revise or remove “Identify, Assess and Correct” language– Define communication networks and create new/modified Standards toprotect nonprogrammable components of communication networks(e.g. cables and wires)– Add objective criteria re: sufficiency of controls for Low Impact assets– Develop new or modified Standards for Transient Devices (e.g. thumbdrives and laptops) NERC Project 2014‐02––––Removed “identify, assess, and correct” languageAddress security controls for Low Impact assetsDevelop requirements to protect transient electronic devicesDefine “communication networks” and develop new/modifiedstandards to address protection of communication networks– (More later .maybe)21Transition from Version 3toVersion 52211

Disclaimer This presentation contains general information about legal matters. The information isnot advice and you should not treat it as such. I am not your lawyer.Limitation of warranties– The information in this presentation is provided “as is” without any representationsor warranties, express or implied. I make no representations or warranties inrelation to the legal information in this presentation.Without limiting the generality of the foregoing paragraph, I do not warrant that:– the information in this presentation will be constantly available, or available at all; or– the information in this presentation is complete, true, accurate, up‐to‐date or non‐misleading.You should not rely on the information in this presentation as an alternative to legaladvice from your attorney or other professional legal services provider. If you have anyspecific questions about any legal matter, you should consult your attorney or otherprofessional legal services provider. You should never delay seeking legal advice, disregardlegal advice or commence or discontinue any legal action because of information in thispresentation.Nothing in this disclaimer will limit any liabilities in any way not permitted underapplicable law or exclude any liabilities which may not be excluded under applicable law.I’m just doing the best I can like the rest of you . 23Asset Identification Options Option 1 – Continue to comply with all CIP V3Standards during Transition Period Option 2 – Begin transitioning to compliance w/some or all CIP V5 Standards Option 3 ‐ Adopt V5 “High” and “Medium” ImpactRating Criteria (CIP‐002‐5.1, Attachment 1) in lieuof RBAM2412

Critical Asset Identification – Option 125Critical Asset Identification – Option 2 Responsible Entities which adopted CIP V4 CriticalAsset Criteria may continue in lieu of RBAM Adoption of V4 Criteria must have occurred before 8/12/14 Critical Assets identified per criteria 1.4 and 1.5 (BlackStart Resources and Cranking Paths) not subject to CIPV3 but TOP Control Centers controlling Cranking Pathassets will be treated as Critical Assets Annually approve adoption of V4 Critical Asset Criteria2613