Joseph B. Baugh, Ph.D., PMP, - PowerPoint Presentation

1. Joseph B. Baugh, Ph.D., PMP, CISA, CISSP, CRISC, CISMSenior Compliance Auditor – Cyber SecurityWECC: Vancouver WA OfficeCIP-002-5 Outreach SessionCIP v5 RoadshowSalt Lake CityMay 14-15, 2014

2. Over 40 years of Electrical Utility ExperienceTransmission LinemanNERC Certified System OperatorIT Manager & Power Operations Manager20 years Information Technology & IT Security ExperienceProject Manager & IT Program ManagerPMP, CISA, CISSP, CRISC, CISM, NSA-IAM/IEM certs20 years of Educational Experience Degrees earned: Ph.D., MBA, BS-Computer ScienceAcademic & Technical Course Teaching ExperienceInformation Technology and IT Security Business Strategy, Leadership, and Management Project ManagementPMP, CISA, CISSP, CISM, ITIL, & Cisco exam preparation Speaker Intro: Dr. Joseph Baugh

3. The contents of this presentation represent sound practices based on WECC’s understanding of CIP-002-5.1, however:WECC neither provides prescriptive solutions nor endorses specific vendors, tools, or products for compliance with CIP Standards.The processes and applications discussed in this presentation represent one approach toward compliance efforts for CIP-002-5.1, but this is not the only possible method.WECC will not provide the actual spreadsheets used to explicate the processes described in this presentation to entities or other interested parties.Blind adherence to any process does not guarantee compliance.Each Registered Entity is responsible for demonstrating its compliance with CIP-002-5.1 in a manner befitting the entity’s registered functions and operational requirements relative to the reliability of the BES.WECC Disclaimer

4. Definition of TermsMapping CIP-002-x Compliance EvolutionReview CIP-002-5.1CIP-002-5.1 Process OverviewBreaking Down the Process StepsDemonstrating Compliance through Auditable ProcessesQuestions Agenda

5. Current Bulk Electric System [BES] Definition – Expires June 30, 2014As defined by the Regional Reliability Organization, the electrical generation resources, transmission lines, interconnections with neighboring systems, and associated equipment, generally operated at voltages of 100 kV or higher. Radial transmission facilities serving only load with one transmission source are generally not included in this definition (NERC, 2013 Nov, Glossary of Terms, p. 12). Definition of Terms - BES

6. New Bulk Electric System [BES] Definition Effective July 1, 2014Unless modified by the lists shown below [Emphasis Added], all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy (NERC, 2013 Nov, Glossary of Terms, pp. 13-20).New definition maps to an extensive list of Inclusions and Exclusions (NERC, 2014 April, BES Definition Reference Document, pp. 1-66). Definition of Terms - BES

7. Impact Rating Criteria (CIP-002-5.1 – Attachment 1, pp. 14-16)1. High Impact Rating (H)Each BES Cyber System used by and located at any of the following: (See IRC 1.1 – 1.4)2. Medium Impact Rating (M)Each BES Cyber System, not included in Section 1 above, associated with any of the following: (See IRC 2.1 – 2.13)3. Low Impact Rating (L)BES Cyber Systems not included in Sections 1 or 2 above that are associated with any of the following assets and that meet the applicability qualifications in Section 4 ‐ Applicability, part 4.2 – Facilities, of this standard: (See IRC 3.1 – 3.6)Definition of Terms - IRC

8. BES Cyber Asset (BCA) – Effective April 1, 2016A Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its required operation, misoperation, or non-operation, adversely impact one or more Facilities, systems, or equipment, which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation of the Bulk Electric System. Redundancy of affected Facilities, systems, and equipment shall not be considered when determining adverse impact. Each BES Cyber Asset is included in one or more BES Cyber Systems. (A Cyber Asset is not a BES Cyber Asset if, for 30 consecutive calendar days or less, it is directly connected to a network within an ESP, a Cyber Asset within an ESP, or to a BES Cyber Asset, and it is used for data transfer, vulnerability assessment, maintenance, or troubleshooting purposes.) (NERC, 2013 Nov, Glossary of Terms, p. 9). Definition of Terms - BCA

9. BES Cyber System (BCS) – Effective April 1, 2016One or more BES Cyber Assets logically grouped by a responsible entity to perform one or more reliability tasks for a functional entity (NERC, 2013 Nov, Glossary of Terms, p. 10).Definition of Terms - BCS

10. Reliability TasksIdentified in the NERC Functional Model as listed under the various Functions, “the Model provides the framework on which the NERC Reliability Standards are developed and applied. To ensure that this framework remains viable, the Model itself is governed by a set of “guiding principles” that define a Function's Tasks and establish the relationships between the functional entities which are responsible for meeting the requirements in the NERC Reliability Standards that correspond to these Tasks” (NERC, 2009 Nov, Functional Model v5, p. 11). Definition of Terms - Reliability Tasks

11. Reliability TasksFERC also commented on reliability tasks in the CIPv5 Final Ruling, “we believe that the NERC Functional Model is the basis for the phrase “reliability task” while the Guidelines and Technical Basis section provides clarity on how the term applies to the CIP version 5 Standards” (FERC, 2013, Order 791: P. 156, p. 72774)Definition of Terms - Reliability Tasks

12. Reliability TasksIn order to identify BES Cyber Systems, Responsible Entities determine whether the BES Cyber Systems perform or support any BES reliability function according to those reliability tasks identified for their reliability function and the corresponding functional entity’s responsibilities as defined in its relationships with other functional entities in the NERC Functional Model (NERC, 2013 Nov, CIP-002-5.1, p. 5). Definition of Terms - Reliability Tasks

13. BES Reliability Operating Services (BROS)The concept of BES reliability operating service is useful in providing Responsible Entities with the option of a defined process for scoping those Systems that would be subject to CIP‐002‐5.1 (NERC, 2013 Nov, CIP-002-5.1, pp. 17-18). WECC recommends a good review of BROS details (NERC, 2013 Nov, CIP-002-5.1, pp. 18-22) relative to your specific Registered Functions prior to application of the IRC and subsequent BCS identification. Definition of Terms - BROS

14. The BROS “includes a number of named BES reliability operating services. These named services include” (NERC, 2013 Nov, CIP-002-5.1, p. 18): Dynamic Response to BES conditionsBalancing Load and GenerationControlling Frequency (Real Power)Controlling Voltage (Reactive Power)Managing ConstraintsMonitoring & ControlRestoration of BESSituational AwarenessInter‐Entity Real‐Time Coordination and CommunicationDefinition of Terms - BROS

15. The BROS may provide guidance to determine which BCS are applicable to a specific Registered Function (NERC, 2013 Nov, CIP-002-5.1, p. 18).Definition of Terms - BROS

16. CIP-002-x Compliance Evolution

17. The CIP-002-5.1 Compliance ModelCIP-002-5.1 BES Cyber System CategorizationR1: Instead of identifying Critical Assets as in previous versions, the Responsible Entity must Identify Facilities, systems, or equipment (see R1.i-R1.vi, p. 6 for assets that must be considered) that meet the Impact Rating Criteria [IRC] (CIP-002-5.1 Attachment 1, pp. 14-16) as high impact BCS (R1.1), medium impact BCS (R1.2), or low impact (R1.3) assets.Using the lists of Facilities, systems, or equipment identified through the application of the IRC, the Responsible Entity must identify and categorize its BES Cyber Systems as high impact or medium impact. BES Cyber Systems not identified as high impact or medium impact default to Low impact. New standard identifies BES Cyber Systems as a grouping of BES Cyber Assets because it allows entities to apply some requirements at a system level rather than an individual asset level.R2: Annual review (R2.1) and approval (R2.2) of the High and Medium BES Cyber System Lists (R1.1, R1.2) and the list of Low Impact BES Assets (R1.3). The initial reviews and approval pursuant to R2 must occur on or before April 1, 2016 and must occur at least once every 15 calendar months after the initial review and approval.

18. Specific Version 5 CIP Cyber Security Standards have periodic requirements that contain time parameters for subsequent and recurring iterations of the requirement, such as, but not limited to, “. . . at least once every 15 calendar months . . .”, and responsible entities shall comply initially with those periodic requirements as follows (Implementation Plan, p. 2): 1. On or before the Effective Date of the Version 5 CIP Cyber Security Standards for the following requirements: CIP-002-5, Requirement R2 April 1, 2016CIP-002-5.1 Compliance Date

19. R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes of parts 1.1 through 1.3: Control Centers and backup Control Centers;Transmission stations and substations;Generation resources;Systems and facilities critical to system restoration, including Blackstart Resources and Cranking Paths and initial switching requirements;Special Protection Systems that support the reliable operation of the Bulk Electric System; andFor Distribution Providers, Protection Systems specified in Applicability section 4.2.1 above.CIP-002-5.1: R1

20. Process: “a series of actions or operations conducing to an end.”Two schools of thought on the R1 process flowTop-down process first evaluates the inventory of BES Assets against the IRC Bottom-up process evaluates the inventory of BES Cyber Assets against the IRCR1: …shall implement a process…

21. Top-Down Process Flow Chart Groups

22. Start with inventory of BES AssetsWhich BES Definition?Apply the IRC to identify High- & Medium-Impact FacilitiesAll other BES Assets and applicable Distribution Assets (IRC 3.6) default to Low-ImpactBeginning the Process

23. Start with your BES Assets as defined in R1.i-R1.v, plus Distribution Assets, if any, from R1.viApply a logical process to identify your High, Medium, and Low impact rated FacilitiesApplicable Distribution Protection Systems default to Low impact (IRC 3.6), add their host facilities to Low Impact List (R1.3)Whichever methodology you ultimately use is up to each entity, however, be sure to document and review your considerations to ensure you have not let any BCA or BCS slip through the cracks.Deriving the R1.1-R1.3 Lists

24. High IRC (Control Centers)

25. Medium IRC (Control Centers)

26. Criterion 2.11 contains the term “aggregate highest rated net Real Power capability of the preceding 12 calendar months.”Also applicable to criterion 2.1 for generation resources.A best practice would be to use the calculation material found in the new MOD-025-2 standard (see NERC, 2014 March 20, MOD-025-2: Attachment 2, pp. 17-20), including this specific formula:“Net Real Power Capability (*MW) equals Gross Real Power Capability (*MW) minus Aux Real Power connected at the same bus (*MW) minus tertiary Real Power connected at the same bus(*MW)” (p. 19).The highest calculated value(s) for the preceding 12 calendar month period is/are acceptable as valid audit evidence for Criteria 2.1 and 2.11.What is Net Real Power Capability?

27. Low IRC (Control Centers)

28. R1.i: Example of Auditable Process

29. Medium IRC (Transmission)

30. Medium IRC (Transmission)

31. Medium IRC (Transmission)

32. Medium / Low IRC (Transmission)

33. R1.ii: Example of Auditable Process

34. Medium IRC (Generation)

35. Medium / Low IRC (Generation)

36. R1.iii-iv: Example of Auditable Process

37. Medium IRC (Protection Systems)

38. Low IRC (Protection Systems)

39. R1.v-vi: Example of Auditable Process

40. R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes of parts 1.1 through 1.3: …1.1. Identify each of the high impact BES Cyber Systems according to Attachment 1, Section 1, if any, at each asset;1.2. Identify each of the medium impact BES Cyber Systems according to Attachment 1, Section 2, if any, at each asset; and1.3. Identify each asset that contains a low impact BES Cyber System according to Attachment 1, Section 3, if any (a discrete list of low impact BES Cyber Systems is not required).CIP-002-5.1: R1.1-R1.3

41. R1: Identify and Document BCSUse list of High- & Medium-impact BES AssetsIdentify BCA associated with each BES AssetLogically group BCA into BCSDocument BCS on R1.1 or R1.2 list, as appropriate

42. Develop an auditable process to examine each High and Medium impact FacilityExamine inventory of BCA at each FacilityConsider reliability functionsGroup BCA into logical BCSIdentify PCA, EACMS, and PACSR1.1-R1.2: Identifying BCS

43. Process to Identify BCS

44. Determine whether the BES Cyber Systems perform or support any BES reliability function according to those reliability tasks identified for their reliability function and the corresponding functional entity’s responsibilities as defined in its relationships with other functional entities in the NERC Functional Model (CIP-002-5.1, p. 5). Ensures the initial scope for consideration includes only those BES Cyber Systems and their associated BES Cyber Assets that perform or support the reliable operation of the BES. (CIP-002-5.1, p. 5). Consider Reliable Operation of the BES

45. BES Cyber Assets are those Cyber Assets that, if rendered unavailable, degraded, or misused, would adversely impact the reliable operation of the BES within 15 minutes (CIP-002-5.1, p. 5).Do not consider redundancy in the application of the 15-minute time threshold (CIP-002-5.1, p. 5).15-minute limitation will typically "result in the identification of SCADA, Energy Management Systems, transmission protection systems, and generation control systems as BES Cyber Assets” (FERC, 2013, Order 791: P. 123, p. 72771).Consider Real-Time Operations

46. Protected Cyber AssetsExamples may include, to the extent they are within the ESP: file servers, ftp servers, time servers, LAN switches, networked printers, digital fault recorders, and emission monitoring systems (CIP-002-5.1, p. 6)May also be lower impact BCA or BCS by virtue of the high-water mark (CIP-005-5, p. 14)Electronic Access Control or Monitoring Systems Examples include: Electronic Access Points, Intermediate Systems, authentication servers (e.g., RADIUS servers, Active Directory servers, Certificate Authorities), security event monitoring systems, and intrusion detection systems (CIP-002-5.1, p. 6)Physical Access Control SystemsExamples include: authentication servers, card systems, and badge control systems (CIP-002-5.1, p. 6).Consider Ancillary BES Cyber Assets

47. Identifying BES Cyber AssetsIdentify if the Cyber Asset meets the definition of BCACheck for length of installationIf < 30 days, determine if the Cyber Asset is a transient device.Group into logical BCS with associated PCA

48. Entity determines level of granularity of a BCSThere may be one or more BCA within a given BCSConsider the BROS for your registrationsIn transitioning from version 4 [and version 3] to version 5, a BES Cyber System can be viewed simply as a grouping of Critical Cyber Assets (as that term is used in version 4 [and version 3]). The CIP Cyber Security Standards use the “BES Cyber System” term primarily to provide a higher level for referencing the object of a requirement… Another reason for using the term “BES Cyber System is to provide a convenient level at which an entity can organize their documented implementation of the requirements and compliance efforts (CIP-002-5.1, 2013, p. 4)Grouping BCA into BCS

49. Examples of BCSGraphic Source: http://www.sas.com/news/preleases/energy-visual-analytics.html

50. Energy Management Systems (EMS)Automatic Generation Control (AGC)SCADA systemsNetwork Management Systems (NMS)PI systems (Historians)ICCP systems (Communications)Examples of BCA Groupings: BA/TOP

51. Examples of BCA Groupings: BA/TOPGraphic Source: http://www.energy.siemens.com/us/pool/hq/automation/control-center/control_center_details.jpg

52. SCADA Component SystemsRTU Systems (Telecommunications)Protective Relay SystemsExamples of BCA Groupings: TO/TOP

53. Examples of BCA Groupings: TO/TOPGraphic Source: Pacific Northwest National Laboratory (Dagle, J., 2010 Jan)Retrieved from http://publicintelligence.net/scada-a-deeper-look/

54. Pilot Study Lesson-Learned: TO/TOP

55. Programmable Electronic Devices [PEDs]aka Intelligent Electronic Devices [IEDs]Found as data aggregators for CTs/PTsMay be located in breaker cabinetsEvaluate to determine if the PED/IED meets BCA criteriaIf so, consider inclusion in Protective Relay BCSPilot Study Lesson-Learned: TO/TOP

56. Digital Control System (DCS)Control Air System (CAS)Water Demineralization SystemCoal Handling SystemGas Control SystemEnvironmental Monitoring SystemRTU (Communications)Generator Protection Systems (Relays)Examples of BCA Groupings: GO/GOP

57. Examples of BCA Groupings: GO/GOPGraphic Source: https://www.fujielectric.com/company/tech/pdf/r51-3/06.pdf

58. How is the 1,500 MW threshold defined?What about segregated systems?What is a segregated system?What is a common-mode vulnerability?Pilot Study Lesson-Learned: GO/GOP

59. High Impact BCS,High Impact BCS w/ Dial-up Connectivity,High Impact BCS w/ External Routable Connectivity,Medium Impact BCS,Medium Impact BCS at Control Centers,Medium Impact BCS w/ Dial-up Connectivity,Medium Impact BCS w/ External Routable Connectivity,Protected Cyber Assets [PCA], and Electronic Access Points [EAP] (CIP-005-5, pp. 4-5)Consider BCS Types

60. R1.1: Example of Auditable Process

61. R1.1: Example of Auditable Process

62. Any BES Asset (i.e. Facility) not rated as High or Medium defaults to a Low Impact rating BCS associated with a Low impact BES Asset also become Low impact BCS. At this time, all you need to do is list the Low Impact BES Assets to satisfy R1.3. Comply with CIP-003-5 R2R1.3: Example of Auditable Process

63. R2. The Responsible Entity shall2.1 Review the identifications in Requirement R1 and its parts (and update them if there are changes identified) at least once every 15 calendar months, even if it has no identified items in Requirement R1, and2.2 Have its CIP Senior Manager or delegate approve the identifications required by Requirement R1 at least once every 15 calendar months, even if it has no identified items in Requirement R1.R2: Review and Approve the Lists

64. R1.3 Lists: What to Do? CIP-003-5 R2Stay tuned for future developments

65. Review and Approve Lists

66. Review and document initial R1.1 - R1.3 lists (R2.1)Document CIP Senior Manager approval of the R1.1-R1.3 lists (R2.2)Ensure review & approval cycle does not exceed the 15-month limitation (R2.2)Review (and update) lists, as necessary, and approve subsequent R1.1-R1.3 lists (R2.1-R2.2)Maintain documentation of reviews and approvals for audit period to demonstrate compliance to audit teamR2: Example of Auditable Process

67. FERC. (2013 December 3). Order No. 791: Version 5 Critical Infrastructure Protection Reliability Standards. 18 CFR Part 40: 145 FERC ¶ 61,160: Docket No. RM13-5-000. Published in Federal Register: Vol. 78, No. 232 (pp. 72756-72787). Retrieved from http://www.gpo.gov/fdsys/pkg/FR-2013-12-03/pdf/2013-28628.pdf NERC. (2009 November 30). Reliability Functional Model (v5, pp. 1-55). Retrieved from http://www.nerc.com/files/Functional_Model_V5_Final_2009Dec1.pdfNERC. (2012 October 26). Implementation Plan for Version 5 CIP Cyber Security Standards. Retrieved from http://www.nerc.com/pa/Stand/CIP00251RD/Implementation_Plan_clean_4_(2012-1024-1352).pdf References

68. NERC. (2013 November 21). Glossary of Terms Used in NERC Reliability Standards. Retrieved from http://www.nerc.com/pa/stand/glossary%20of%20terms/glossary_of_terms.pdf NERC. (2013 November 22). CIP-002-5.1 – Cyber Security – BES Cyber System Categorization. Retrieved from http://www.nerc.com/_layouts/PrintStandard.aspx?standardnumber=CIP-002-5.1&title=Cyber%20Security%20—%20BES%20Cyber%20System%20Categorization&jurisdiction=nullNERC. (2014 April). Bulk Electric System Definition Reference Document. Retrieved from http://www.nerc.com/pa/Stand/Project%20201017%20Proposed%20Definition%20of%20Bulk%20Electri/bes_phase2_reference_document_20140325_final_clean.pdfReferences

69. CIP-002-5.1 Presentation Revision HistoryVersionChange HistoryDateByv1Developed initial presentation for SLC Outreach01/21/14J. Baughv2Minor changes for SLC Outreach02/01/14J. Baughv3Added IRC slides for SMUD presentation02/16/14J. Baughv4Added examples of BCS Groupings for MDR Outreach03/13/14J. Baughv5Minor changes for SMUD Outreach05/03/14J. Baughv6Added slides to discuss Pilot Study lessons learned proposals; Included discussion on Net Real Power Capability; Added revision history for SLC Outreach05/09/14J. Baugh

70. Joseph B. Baugh, Ph.D., PMPCISA, CISSP, CRISC, CISMSenior Compliance Auditor - Cyber SecurityWestern Electricity Coordinating Council (WECC)7400 NE 41st Street, Suite 320Vancouver, WA  98662jbaugh (at) wecc (dot) biz (C) 520.331.6351 (O) 801.734.8357Questions?