Joseph B. Baugh, Ph.D., PMP, CISA, CISSP, CRISC, CISM Senior Compliance Auditor – Cyber Security WECC: Vancouver WA Off

1. Joseph B. Baugh, Ph.D., PMP, CISA, CISSP, CRISC, CISMSenior Compliance Auditor – Cyber SecurityWECC: Vancouver WA Office CIP-002-5 Outreach Session CIP v5 Roadshow Salt Lake City May 14-15, 2014

2. Speaker Intro: Dr. Joseph Baugh • Over 40 years of Electrical Utility Experience • Transmission Lineman • NERC Certified System Operator • IT Manager & Power Operations Manager • 20 years Information Technology & IT Security Experience • Project Manager & IT Program Manager • PMP, CISA, CISSP, CRISC, CISM, NSA-IAM/IEM certs • 20 years of Educational Experience • Degrees earned: Ph.D., MBA, BS-Computer Science • Academic & Technical Course Teaching Experience • Information Technology and IT Security • Business Strategy, Leadership, and Management • Project Management • PMP, CISA, CISSP, CISM, ITIL, & Cisco exam preparation

3. WECC Disclaimer • The contents of this presentation represent sound practices based on WECC’s understanding of CIP-002-5.1, however: • WECC neither provides prescriptive solutions nor endorses specific vendors, tools, or products for compliance with CIP Standards. • The processes and applications discussed in this presentation represent one approach toward compliance efforts for CIP-002-5.1, but this is not the only possible method. • WECC will not provide the actual spreadsheets used to explicate the processes described in this presentation to entities or other interested parties. • Blind adherence to any process does not guarantee compliance. • Each Registered Entity is responsible for demonstrating its compliance with CIP-002-5.1 in a manner befitting the entity’s registered functions and operational requirements relative to the reliability of the BES.

4. Agenda • Definition of Terms • Mapping CIP-002-x Compliance Evolution • Review CIP-002-5.1 • CIP-002-5.1 Process Overview • Breaking Down the Process Steps • Demonstrating Compliance through Auditable Processes • Questions

5. Definition of Terms - BES • Current Bulk Electric System [BES] Definition – • Expires June 30, 2014 • As defined by the Regional Reliability Organization, the electrical generation resources, transmission lines, interconnections with neighboring systems, and associated equipment, generally operated at voltages of 100 kV or higher. Radial transmission facilities serving only load with one transmission source are generally not included in this definition(NERC, 2013 Nov, Glossary of Terms, p. 12).

6. Definition of Terms - BES • New Bulk Electric System [BES] Definition • Effective July 1, 2014 • Unless modified by the lists shown below [Emphasis Added], all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy (NERC, 2013 Nov, Glossary of Terms, pp. 13-20). • New definition maps to an extensive list of Inclusions and Exclusions(NERC, 2014 April, BES Definition Reference Document, pp. 1-66).

7. Definition of Terms - IRC • Impact Rating Criteria (CIP-002-5.1 – Attachment 1, pp. 14-16) • 1. High Impact Rating (H) Each BES Cyber System used by and located at any of the following: (See IRC 1.1 – 1.4) • 2. Medium Impact Rating (M) Each BES Cyber System, not included in Section 1 above, associated with any of the following: (See IRC 2.1 – 2.13) • 3. Low Impact Rating (L) BES Cyber Systems not included in Sections 1 or 2 above that are associated with any of the following assets and that meet the applicability qualifications in Section 4 ‐ Applicability, part 4.2 – Facilities, of this standard: (See IRC 3.1 – 3.6)

8. Definition of Terms - BCA • BES Cyber Asset (BCA) – Effective April 1, 2016 • A Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its required operation, misoperation, or non-operation, adversely impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation of the Bulk Electric System. • Redundancy of affected Facilities, systems, and equipment shall not be considered when determining adverse impact. • Each BES Cyber Asset is included in one or more BES Cyber Systems. • (A Cyber Asset is not a BES Cyber Asset if, for 30 consecutive calendar days or less, it is directly connected to a network within an ESP, a Cyber Asset within an ESP, or to a BES Cyber Asset, and it is used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.) (NERC, 2013 Nov, Glossary of Terms, p. 9).

9. Definition of Terms - BCS • BES Cyber System (BCS) – Effective April 1, 2016 • One or more BES Cyber Assets logically grouped by a responsible entity to perform one or more reliability tasks for a functional entity (NERC, 2013 Nov, Glossary of Terms, p. 10).

10. Definition of Terms - Reliability Tasks • Reliability Tasks • Identified in the NERC Functional Model as listed under the various Functions, “the Model provides the framework on which the NERC Reliability Standards are developed and applied. To ensure that this framework remains viable, the Model itself is governed by a set of “guiding principles” that define a Function's Tasks and establish the relationships between the functional entities which are responsible for meeting the requirements in the NERC Reliability Standards that correspond to these Tasks”(NERC, 2009 Nov, Functional Model v5, p. 11).

11. Definition of Terms -Reliability Tasks • Reliability Tasks • FERC also commented on reliability tasks in the CIPv5 Final Ruling, “we believe that the NERC Functional Model is the basis for the phrase “reliability task” while the Guidelines and Technical Basis section provides clarity on how the term applies to the CIP version 5 Standards” (FERC, 2013, Order 791: P. 156, p. 72774)

12. Definition of Terms -Reliability Tasks • Reliability Tasks • In order to identify BES Cyber Systems, Responsible Entities determine whether the BES Cyber Systems perform or support any BES reliability function according to those reliability tasks identified for their reliability function and the corresponding functional entity’s responsibilities as defined in its relationships with other functional entities in the NERC Functional Model (NERC, 2013 Nov, CIP-002-5.1, p. 5).

13. Definition of Terms - BROS • BES Reliability Operating Services (BROS) • The concept of BES reliability operating service is useful in providing Responsible Entities with the option of a defined process for scoping those Systems that would be subject to CIP‐002‐5.1 (NERC, 2013 Nov, CIP-002-5.1, pp. 17-18). • WECC recommends a good review of BROS details (NERC, 2013 Nov, CIP-002-5.1, pp. 18-22) relative to your specific Registered Functions prior to application of the IRC and subsequent BCS identification.

14. Definition of Terms -BROS • The BROS “includes a number of named BES reliability operating services. These named services include” (NERC, 2013 Nov, CIP-002-5.1, p. 18): • Dynamic Response to BES conditions • Balancing Load and Generation • Controlling Frequency (Real Power) • Controlling Voltage (Reactive Power) • Managing Constraints • Monitoring & Control • Restoration of BES • Situational Awareness • Inter‐Entity Real‐Time Coordination and Communication

15. Definition of Terms -BROS • The BROS may provide guidance to determine which BCS are applicable to a specific Registered Function (NERC, 2013 Nov, CIP-002-5.1, p. 18).

16. CIP-002-x Compliance Evolution

17. The CIP-002-5.1 Compliance Model

18. CIP-002-5.1 Compliance Date • Specific Version 5 CIP Cyber Security Standards have periodic requirements that contain time parameters for subsequent and recurring iterations of the requirement, such as, but not limited to, “. . . at least once every 15 calendar months . . .”, and responsible entities shall comply initially with those periodic requirements as follows (Implementation Plan, p. 2): 1. On or before the Effective Date of the Version 5 CIP Cyber Security Standards for the following requirements: CIP-002-5, Requirement R2 April 1, 2016

19. CIP-002-5.1: R1 • R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes of parts 1.1 through 1.3: • Control Centers and backup Control Centers; • Transmission stations and substations; • Generation resources; • Systems and facilities critical to system restoration, including Blackstart Resources and Cranking Paths and initial switching requirements; • Special Protection Systems that support the reliable operation of the Bulk Electric System; and • For Distribution Providers, Protection Systems specified in Applicability section 4.2.1 above.

20. R1: …shall implement a process… • Process: “a series of actions or operations conducing to an end.” • Two schools of thought on the R1 process flow • Top-down process first evaluates the inventory of BES Assets against the IRC • Bottom-up process evaluates the inventory of BES Cyber Assets against the IRC

21. Top-Down Process Flow ChartGroups

22. Beginning the Process • Start with inventory of BES Assets • Which BES Definition? • Apply the IRC to identify High- & Medium-Impact Facilities • All other BES Assets and applicable Distribution Assets (IRC 3.6) default to Low-Impact

23. Deriving the R1.1-R1.3 Lists • Start with your BES Assets as defined in R1.i-R1.v, plus Distribution Assets, if any, from R1.vi • Apply a logical process to identify your High, Medium, and Low impact rated Facilities • Applicable Distribution Protection Systems default to Low impact (IRC 3.6), add their host facilities to Low Impact List (R1.3) • Whichever methodology you ultimately use is up to each entity, however, be sure to document and review your considerations to ensure you have not let any BCA or BCS slip through the cracks.

24. High IRC (Control Centers)

25. Medium IRC (Control Centers)

26. What is Net Real Power Capability? • Criterion 2.11 contains the term “aggregate highest rated net Real Power capability of the preceding 12 calendar months.” • Also applicable to criterion 2.1 for generation resources. • A best practice would be to use the calculation material found in the new MOD-025-2 standard (see NERC, 2014 March 20, MOD-025-2: Attachment 2, pp. 17-20), including this specific formula: • “Net Real Power Capability (*MW) equals Gross Real Power Capability (*MW) minus Aux Real Power connected at the same bus (*MW) minus tertiary Real Power connected at the same bus(*MW)” (p. 19). • The highest calculated value(s) for the preceding 12 calendar month period is/are acceptable as valid audit evidence for Criteria 2.1 and 2.11.

27. Low IRC (Control Centers)

28. R1.i: Example of Auditable Process

29. Medium IRC (Transmission)

30. Medium IRC (Transmission)

31. Medium IRC (Transmission)

32. Medium / Low IRC (Transmission)

33. R1.ii: Example of Auditable Process

34. Medium IRC (Generation)

35. Medium / Low IRC (Generation)

36. R1.iii-iv: Example of Auditable Process

37. Medium IRC (Protection Systems)

38. Low IRC (Protection Systems)

39. R1.v-vi: Example of Auditable Process

40. CIP-002-5.1: R1.1-R1.3 • R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes of parts 1.1 through 1.3: … 1.1. Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset; 1.2. Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset; and 1.3. Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discrete list of low impact BES Cyber Systems is not required).

41. R1: Identify and Document BCS • Use list of High- & Medium-impact BES Assets • Identify BCA associated with each BES Asset • Logically group BCA into BCS • Document BCS on R1.1 or R1.2 list, as appropriate

42. R1.1-R1.2: Identifying BCS • Develop an auditable process to examine each High and Medium impact Facility • Examine inventory of BCA at each Facility • Consider reliability functions • Group BCA into logical BCS • Identify PCA, EACMS, and PACS

43. Process to Identify BCS

44. Consider Reliable Operation of the BES • Determine whether the BES Cyber Systems perform or support any BES reliability function according to those reliability tasks identified for their reliability function and the corresponding functional entity’s responsibilities as defined in its relationships with other functional entities in the NERC Functional Model (CIP-002-5.1, p. 5). • Ensures the initial scope for consideration includes only those BES Cyber Systems and their associated BES Cyber Assets that perform or support the reliable operation of the BES. (CIP-002-5.1, p. 5).

45. Consider Real-Time Operations • BES Cyber Assets are those Cyber Assets that, if rendered unavailable, degraded, or misused, would adversely impact the reliable operation of the BES within 15 minutes (CIP-002-5.1, p. 5). • Do not consider redundancy in the application of the 15-minute time threshold (CIP-002-5.1, p. 5). • 15-minute limitation will typically "result in the identification of SCADA, Energy Management Systems, transmission protection systems, and generation control systems as BES Cyber Assets” (FERC, 2013, Order 791: P. 123, p. 72771).

46. Consider Ancillary BES Cyber Assets • Protected Cyber Assets • Examples may include, to the extent they are within the ESP: file servers, ftp servers, time servers, LAN switches, networked printers, digital fault recorders, and emission monitoring systems (CIP-002-5.1, p. 6) • May also be lower impact BCA or BCS by virtue of the high-water mark (CIP-005-5, p. 14) • Electronic Access Control or Monitoring Systems • Examples include: Electronic Access Points, Intermediate Systems, authentication servers (e.g., RADIUS servers, Active Directory servers, Certificate Authorities), security event monitoring systems, and intrusion detection systems (CIP-002-5.1, p. 6) • Physical Access Control Systems • Examples include: authentication servers, card systems, and badge control systems (CIP-002-5.1, p. 6).

47. Identifying BES Cyber Assets • Identify if the Cyber Asset meets the definition of BCA • Check for length of installation • If < 30 days, determine if the Cyber Asset is a transient device. • Group into logical BCS with associated PCA

48. Grouping BCA into BCS • Entity determines level of granularity of a BCS • There may be one or more BCA within a given BCS • Consider the BROS for your registrations • In transitioning from version 4 [and version 3] to version 5, a BES Cyber System can be viewed simply as a grouping of Critical Cyber Assets (as that term is used in version 4 [and version 3]). The CIP Cyber Security Standards use the “BES Cyber System” term primarily to provide a higher level for referencing the object of a requirement… Another reason for using the term “BES Cyber System is to provide a convenient level at which an entity can organize their documented implementation of the requirements and compliance efforts (CIP-002-5.1, 2013, p. 4)

49. Graphic Source: http://www.sas.com/news/preleases/energy-visual-analytics.html Examples of BCS

50. Examples of BCA Groupings: BA/TOP • Energy Management Systems (EMS) • Automatic Generation Control (AGC) • SCADA systems • Network Management Systems (NMS) • PI systems (Historians) • ICCP systems (Communications)