1 / 38

Laura Scholl Managing Director of Stakeholder Outreach

Laura Scholl Managing Director of Stakeholder Outreach. WECC Compliance Open Webinar Thursday, April 18, 2013 2:00 pm MT. AGENDA. EOP-005-2 – effective July 1, 2013 Reminder BES Definition Process Update

meryle
Download Presentation

Laura Scholl Managing Director of Stakeholder Outreach

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Laura SchollManaging Director of Stakeholder Outreach WECC ComplianceOpen Webinar Thursday, April 18, 2013 2:00 pm MT

  2. AGENDA • EOP-005-2 – effective July 1, 2013 Reminder • BES Definition Process Update • CIP Version 4 Transition Guidance Update and Audit Approach for FERC Remand on NERC Guidance for CIP-002-R3 • Audit Approach for FERC Remand on NERC Guidance for CIP-006 R1.1 • US Entities / Periodic Data Submittal (PDS) / 2013 WECC Actively Monitored List (WECC AML) • webCDMS Single User Sign On

  3. Phil O’DonnellManager, Operations and Planning Audits EOP-005-2 Reminder April 18, 2013

  4. EOP-005-2 REMINDER • EOP-005-2 is effective July 1, 2013 • R1 requires all TOP’s to have a Restoration Plan “Approved by the RC” on that date. • The RC’s related restoration standard EOP-006 specifies what they must do for a review of the TOP plans and gives them 30 days to complete the review.

  5. EOP-005-2 REMINDER • As a reminder If TOP’s do not provide your restoration plans to the RC by June 1, 2013 it will be a challenge for you as a TOP to be compliant on July 1.  • The compliance expectation is for all TOP’s to have an RC approved plan on July 1, 2013. • If the TOP does not have an approved plan on July 1 due to late submittal of its plans for review to the RC it will be considered as non compliant for R1.

  6. Questions? Phil O’Donnell Manager, Operations and Planning Audits podonnell@wecc.biz

  7. Joseph B. Baugh, Ph.D., PMP, CISA, CISSP, CRISC, CISMSenior Compliance Auditor – Cyber SecurityWECC: Vancouver WA Office WECC Open Webinar April 18, 2013 CIP-002 Topics

  8. Speaker Intro: Dr. Joseph Baugh • 40 years of Electrical Utility Experience • Transmission Lineman • NERC Certified System Operator • IT Manager & Power Operations Manager • 20 years Information Technology & IT Security Experience • Project Manager & IT Program Manager • PMP, CISA, CISSP, CRISC, CISM, NSA-IAM/IEM certs • 20 years of Educational Experience • Degrees earned: Ph.D., MBA, BS-Computer Science • Academic & Technical Course Teaching Experience • Information Technology and IT Security • Business Strategy, Leadership, and Management • Project Management • PMP, CISA, CISSP, CISM, ITIL, & Cisco exam preparation

  9. Agenda • 142 FERC ¶ 61,204 Docket No. RD12-5-000 • Remanding CIP-002-3 R3 Interpretation • Impact on WECC CIP Audit Approach • Update on NERC Transition Guidance for CIP-002-4

  10. 142 FERC ¶ 61,204 Docket No. RD12-5-000 • Original interpretation was filed under CIP-002-3a R3. • Although some language in the interpretation refers to CIP-002-4 R3 (e.g., Section 4, p. 2), Sections 6 & 13 clarify the interpretation also applies to CIP-002-4 R2 (FERC Order, 2013, pp. 4, 6) • FERC agreed with NERC Q1 interpretation, but considered NERC Q2 interpretation to be faulty (FERC Order, 2013, Section 10, p. 5) • However, the order remands entire NERC interpretation on CIP-002-4 R2 as the original interpretation was approved on one balloting (FERC Order, 2013, Footnote 12 , p. 5)

  11. 142 FERC ¶ 61,204 Docket No. RD12-5-000 • Laptops were primarily cited as an example, "the proposed interpretation fails to consider that a computer (e.g., a laptop) used by utility staff or contractors to control the functions and operations of a Critical Asset is, during such usage, 'inherent to or necessary for the operation of a Critical Asset,' and thus falls within the scope of CIP-002-4, Requirement R2" (FERC Order, Section 13, pp. 5-6). • “laptop computers connected to an EMS network through the Internet and used to supervise control, optimize, and manage generation and transmission systems would be ‘considered essential’” (FERC Order, 2013, Section 17, p. 7) • In addition, FERC stated the NERC Q2 “interpretation and petition do not provide adequate justification for leaving unprotected cyber assets (e.g., laptop computers) essential to the operation of associated Critical Assets” (FERC Order, 2013, Section 18, p. 7)

  12. Impact on WECC CIP Audit Approach [Q1] • Minimal impact to WECC Audit Approach by FERC order on Q1 • WECC Audit Approach considers the examples discussed in the Q1 interpretation: • As illustrative, not prescriptive, and • Provide a minimal list of Cyber Assets, associated with each Critical Asset identified pursuant to CIP-002-4 R1, that should be considered relative to CIP-002-4 R2, but • Do not represent an exhaustive list of Cyber Assets that must be considered under CIP-002-4 R2

  13. Impact on WECC CIP Audit Approach [Q2] • Burden to demonstrate essentiality of Cyber Assets for operation of Critical Assets pursuant to CIP-002-4 R2 still lies on entity shoulders. Due diligence in light of the FERC order indicates entities should: • Consider definition of essential (NERC, Identifying Critical Cyber Assets, Section C, pp. 7-8) in Critical Cyber Asset Identification [CCAID] methodology • Apply definition to inventory of Cyber Assets associated with each Critical Asset identified and documented pursuant to R2 • Include an evaluation of all laptops, smart phones, and any other Cyber Assets which may be configured for or are capable of, controlling generation or transmission systems and meets one or more of the qualifying characteristics cited above • Document all evaluations and CCA/non-CCA status of the inventory of all Cyber Assets associated with each Critical Asset identified pursuant to CIP-002-4 R1

  14. NERC CIP-002-4Transition Guidance • During today’s (April 18, 2013) FERC Sunshine Meeting, FERC proposed a NOPR that would require Registered Entities to maintain compliance efforts with CIP version 3 until CIP version 5 is Approved • NERC has advised a period of discussion to consider the FERC action and develop a common approach to future compliance efforts across all regions • More details in light of the FERC proposal and its impact relative to the WECC Audit Approach will be forthcoming at the June CIPUG in Portland • See you there

  15. References • FERC Order on Interpretation of Reliability Standard. (2013, March 21). 142 FERC ¶ 61, 204. Docket No. RD12-5-000. • NERC. (2010, June 17). Security Guideline for the Electricity Sector: Identifying Critical Cyber Assets (v1.0). • NERC. (2013, April 11). Cyber Security Standards Transition Guidance.

  16. Joseph B. Baugh, Ph.D., PMP, CISA, CISSP, CRISC, CISM Senior Compliance Auditor - Cyber Security Western Electricity Coordinating Council (WECC) 7400 NE 41st Street, Suite 160 Vancouver, WA  98662 jbaugh (at) wecc (dot) biz (C) 520.331.6351 (O) 360.567.4061 Questions?

  17. Mick NeshemSenior Compliance Auditor, Cyber Security CIP-006 Interpretation Remand– Audit Implications April 18, 2013 WECC Webinar

  18. CIP-006-1 R1.1 Requirement Processes to ensure and document that all Cyber Assets within an Electronic Security Perimeter (ESP) also reside within an identified Physical Security Perimeter. Where a completely enclosed (“six-wall”) border cannot be established, the Responsible Entity shall deploy and document alternative measures to control physical access to the Critical Cyber Assets.

  19. CIP-006 R1.1 NERC Interpretation Response Summary (CIP-006-4) • “… Since wiring is not included in the definition of “Cyber Asset,” Requirement R1.1 of CIP-006-1 does not apply to wiring.” E-7_Order_Remaning_CIP-006-4_2013.3.21.pdf

  20. CIP-006 R1.1 FERC Remand- Summary • “15. …We do not agree that the network cabling (i.e., wires) that gives a communication network its networking capability would be exempt from the CIP Reliability Standards…” E-7_Order_Remaning_CIP-006-4_2013.3.21.pdf

  21. CIP-006-2 R1.1 NERC Existing Interpretation [Approved by FERC] • 21 …” For Electronic Security Perimeter wiring external to a Physical Security Perimeter, the drafting team interprets the Requirement R1.1 as not limited to measures that are “physical in nature.” The alternative measures may be physical or logical, on the condition that they provide security equivalent or better to a completely enclosed (“six-wall”). Alternative physical control measures may include, but are not limited to, multiple physical access control layers within a non-public, controlled space. Alternative logical control measures may include, but are not limited to, data encryption and/or circuit monitoring to detect unauthorized access or physical tampering. E-7_Order_Remaning_CIP-006-4_2013.3.21.pdf

  22. CIP-006 R1.1 FERC Remand- Summary • “23. First, by its plain language, the existing interpretation clearly applies to Electronic Security Perimeter wiring. Second, NERC states in the petition supporting the existing Commission-approved interpretation that “the interpretation request [in Docket No. RM06-22-000] discusses connections between multiple Physical Security Perimeters that reside within a single Electronic Security Perimeter.” • Description of “Extended” ESP – WECC Audit Staff E-7_Order_Remaning_CIP-006-4_2013.3.21.pdf

  23. CIP-006 R1.1 Remand- Summary

  24. WECC Audit Approach • Doesn’t change • Require encryption or other appropriate controls to interconnect ESPs through multiple PSPs (Extended ESP concept) • Discrete ESPs must have CIP-005 Access Points at each discrete ESP location. • Cabling in between discrete ESPs is exempt from audit (encryption is always a good practice)

  25. Questions? Michael (Mick) Neshem CISA, CISSP, CSSA Senior Compliance Auditor - Cyber Security Western Electricity Coordinating Council (WECC) 7400 NE 41st Street, Suite 160 Vancouver, WA  98662 mneshem@wecc.biz (C) 360.773.8490 (O) 360.567.4074

  26. Kim IsraelssonLead Data Analyst US Entities Periodic Data Submittal (PDS) 2013 WECC Actively Monitored List (WECC AML) April 18, 2013 Compliance Open Webinar

  27. Periodic Data Submittal (PDS) • PDS Reporting Matrix is available on the WECC Website • Identifies PDS Standards • Applicable Functions • Reporting Due Dates • Reporting Forms • Submittal Method • PDS Reporting Matrix is located here • Go to www.wecc.biz, select “Compliance,” then “United States,” then “Monitoring Processes,” and then “Periodic Data Submittal” • Annual Request for UFLS data will be posted in webCDMS on May 1, 2013 • Announcement and Training details will be communicated in the next week

  28. 2013 WECC Actively Monitored List (WECC AML) • Release of Version 2 of the 2013 WECC AML • V2 Posted April 17, 2013 • Version History has been added • Document is located here • Go to www.wecc.biz, select “Compliance,” then “United States”

  29. Support • For process questions; • Contact WECC Compliance Support • compliancesupport@wecc.biz • 1-801-883-6879

  30. Kim Israelsson Lead Data Analyst Western Electricity Coordinating Council 155 North 400 West, Suite 200 Salt Lake City, Utah 84103 801.819.7613 kisraelsson@wecc.biz Questions?

  31. Domenic DarlingData Analyst II webCDMS Single User Sign On April 18, 2013 Compliance Open Webinar

  32. webCDMS Single User Sign On • Registered Entity Users will be able to access webCDMS for multiple entities using a single entity username • Users will be able to consolidate accounts into a single username, password, and webCARES Digital Certificate • Announcement and Training details will be communicated in the next week

  33. Support • For process questions; • Contact WECC Compliance Support • compliancesupport@wecc.biz • 1-801-883-6879

  34. Domenic Darling Data Analyst II Western Electricity Coordinating Council 155 North 400 West, Suite 200 Salt Lake City, Utah 84103 801.819.7605 ddarling@wecc.biz Questions?

  35. Laura SchollManaging Director of Stakeholder Outreach Upcoming Events

  36. Upcoming Events • Next Open Webinar - May 16, 2013 • Compliance 101 Webinar - May 23, 2013 • WECC CUG/CIPUG Meetings – Portland, OR • CUG - June 4 - 5, 2013 • CIPUG - June 6, 2013

  37. Laura Scholl Managing Director of Stakeholder Outreach lscholl@wecc.biz (801) 819-7619 Questions?

More Related