Bryan Carr PMP, CISA Compliance Auditor Cyber Security. Audit Evidence & Attachment G CIP 101 Salt Lake City, UT September 25, 2013
|
|
|
- Cornelius Wheeler
- 5 years ago
- Views:
Transcription
1 Bryan Carr PMP, CISA Compliance Auditor Cyber Security Audit Evidence & Attachment G CIP 101 Salt Lake City, UT September 25, 2013
2 About Me Joined WECC in August 2012 Before WECC CIP Compliance Program Manager at PacifiCorp Prior years experience in project and program management 2
3 Topics for Today -Audit Period -Data Retention -Evidence & Other Documentation -Attachment G 3
4 A.C.R.O.N.Y.M.S. BES: Bulk Electric System ROP: NERC Rules of Procedure CMEP: Compliance Monitoring and Enforcement Program RSAW: Reliability Standard Audit Worksheet DR: Data Request 4
5 Metaphorically Speaking An audit is like an onion o It stinks o Makes some people cry o Involves peeling back layers of evidence o An important ingredient in the stew of reliability o When prepared properly, it adds flavor o Improves the overall health of the BES 5
6 Audit Cycle & Audit Period 3 year audit cycle - BA, TOP, RC 6 year audit cycle - all other registrations 3 year audit may include 6 year functions Audit Period (monitoring period): o Specified in Notice of Audit (90 day notice) Starts day after completion of last audit Ends on date of Notice of Audit (90 day notice) o May be affected by self-report, self-certification, other enforcement activities 6
7 Data Retention Section D Compliance Subsection 1.4 Data Retention of each CIP Standard states: The Responsible Entity shall keep documentation required by Standard CIP-00X-3 from the previous full calendar year unless directed by its Compliance Enforcement Authority to retain specific evidence for a longer period of time as part of an investigation. 7
8 Audit Period vs. Data Retention 8 CMEP Section Period Covered The Registered Entity s data and information must show compliance with the Reliability Standards that are the subject of the Compliance Audit for the entire period covered by the Compliance Audit The Registered Entity will be expected to demonstrate compliance for the entire period described above. If a Reliability Standard specifies a document retention period that does not cover the entire period described above, the Registered Entity will not be found in noncompliance solely on the basis of the lack of specific information that has rightfully not been retained based on the retention period specified in the Reliability Standard. However, in such cases, the Compliance Enforcement Authority will require the Registered Entity to demonstrate compliance through other means.
9 Other Means? Demonstrate compliance through other means o Must be as sufficient and appropriate as the actual evidence that would have otherwise been provided. Strongly recommend maintaining actual evidence for the entire audit period Specific timeframes called out in Requirements are still valid (e.g. 90 days, 3 months, etc.) 9
10 The CMEP is which Appendix to the NERC Rules of Procedure? 4C 10
11 Audit Documentation & Evidence FAQ: What examples can you give us for the best compliance documentation or evidence? o Revision history/table w/sufficient detail o Purpose statement (context) o Tie content back to Requirement(s) o Approvals & reviews (where applicable) o Definitions of uncommon or undefined terms o Less concerned about layout, look & feel o Provide additional context/explanation in RSAW 11
12 Documentation & Evidence Pointers Don t o Rename documents to fit different Standards & Requirements o Extract approval page(s) from original documents and provide as separate document Do o Remember Auditor Speak vs. Entity Speak o Provide context for exports, reports, spreadsheets o Create searchable PDFs, use Acrobat Portfolio o Encrypt all evidence prior to submittal 12
13 Attachment G 13 Completely revised for 2014 A guide to help you prepare, organize, and submit evidence prior to audit Tailored to the scope of your audit Does not preclude additional Data Requests Generally follows language of each Requirement Does contain a few detailed and specific requests Due 30 days prior to audit
14 14 Attachment G Snapshots
15 15 Attachment G Snapshots
16 16 Attachment G Snapshots
17 17 Attachment G Snapshots
18 18 Attachment G Snapshots
19 19 Attachment G Snapshots
20 The Northeast blackout occurred on what date? August 14,
21 Attachment G Recap Attachment G is only a guide Provide sufficient and appropriate evidence to demonstrate compliance If evidence is missing or incomplete, auditors will send additional Data Requests For complicated documents or organizational structures, use RSAW to tell the story 21
22 At Your Service Just a phone call away Always willing to provide our audit approach 22
23 Questions? Bryan Carr, PMP, CISA Compliance Auditor, Cyber Security Western Electricity Coordinating Council 155 North 400 West, Suite 200 Salt Lake City, UT (801)
Compliance: Evidence Requests for Low Impact Requirements
MIDWEST RELIABILITY ORGANIZATION Compliance: Evidence Requests for Low Impact Requirements Jess Syring, CIP Compliance Engineer MRO CIP Low Impact Workshop March 1, 2017 Improving RELIABILITY and mitigating
Registration & Certification Update
Registration & Certification Update Processes, Procedures and Responsibilities September 9, 2011 Topics Purpose and Background Organization Certification New Entity Provisional Certification Change/Expanding
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 PRC-004-3 Protection System Misoperation Identification and Correction This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered
WECC Internal Controls Evaluation Process WECC Compliance Oversight Effective date: October 15, 2017
WECC Internal Controls Evaluation Process WECC Compliance Oversight Effective date: October 15, 2017 155 North 400 West, Suite 200 Salt Lake City, Utah 84103-1114 WECC Internal Controls Evaluation Process
Standard INT Dynamic Transfers
Standard INT-004-3.1 Dynamic Transfers A. Introduction 1. Title: Dynamic Transfers 2. Number: INT-004-3.1 3. Purpose: To ensure Dynamic Schedules and Pseudo-Ties are communicated and accounted for appropriately
Standard INT Interchange Authority Distributes Arranged Interchange
Standard INT-005-2 Authority Distributes A. Introduction 1. Title: Authority Distributes 2. Number: INT-005-2 3. Purpose: To ensure that the implementation of between Source and Sink Balancing Authorities
Québec Reliability Standards Compliance Monitoring and Enforcement Program Implementation Plan Annual Implementation Plan
Québec Reliability Standards Compliance Monitoring and Enforcement Program Implementation Plan 2017 Annual Implementation Plan Effective Date: January 1, 2017 Approved by the Régie: December 1, 2016 Table
Standard INT Dynamic Transfers
A. Introduction 1. Title: Dynamic Transfers 2. Number: INT-004-3 3. Purpose: To ensure Dynamic Schedules and Pseudo-Ties are communicated and accounted for appropriately in congestion management procedures.
Joseph B. Baugh, PhD, PMP, CISA, CISSP, CRISC, CISM Senior Compliance Auditor Cyber Security WECC: Vancouver WA Office
Joseph B. Baugh, PhD, PMP, CISA, CISSP, CRISC, CISM Senior Compliance Auditor Cyber Security WECC: Vancouver WA Office CIP-101: CIP-002 v3 to v5 Transition WECC Office: Salt Lake City UT September 24-25,
WECC Criterion INT-001-WECC-CRT-3
WECC Criterion INT-001-WECC-CRT-3 A. Introduction 1. Title: e-tag Requirements for WECC including Wrongful Denial of Request for Interchange (RFI) 2. Number: INT-001-WECC-CRT-3 3. Purpose: To manage Arranged
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 PRC-004-3 Protection System Misoperation Identification and Correction This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered
Records Retention Policy
June 21, 2017 Table of Contents 1 Introduction...3 1.1 Purpose...3 1.2 Scope...3 1.3 Review Cycle...3 1.4 Document Owner...3 1.5 Definitions...3 2 Policy...4 2.1 Records and Record Storage...4 2.2 Applicable
Standard COM Communication and Coordination
A. Introduction 1. Title: Communication and Coordination 2. Number: COM-002-3 3. Purpose: To ensure Emergency communications between operating personnel are effective. 4. Applicability 4.1. Reliability
Standard COM-002-2a Communications and Coordination
A. Introduction 1. Title: Communication and Coordination 2. Number: COM-002-2a 3. Purpose: To ensure Balancing Authorities, Transmission Operators, and Generator Operators have adequate communications
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 CIP-006-6 Cyber Security Physical Security of BES Cyber Systems This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered Entity:
DRAFT Reliability Standard Audit Worksheet 1
DRAFT Reliability Standard Audit Worksheet 1 PRC-025-2 Generator Relay Loadability This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered Entity: NCR Number: Compliance
Standard CIP Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION
NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION NARUC Energy Regulatory Partnership Program The Public Services Regulatory Commission of Armenia and The Iowa Utilities Board Janet Amick Senior Utility
Standard CIP 005 2a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2a 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
New Brunswick 2018 Annual Implementation Plan Version 1
New Brunswick Energy and Utilities Board Reliability Standards, Compliance and Enforcement Program New Brunswick 2018 Annual Implementation Plan Version 1 December 28, 2017 Table of Contents Version History...
COM Operating Personnel Communications Protocols. October 31, 2013
COM-002-4 Operating Personnel Communications Protocols October 31, 2013 Agenda Introductory Remarks: Mark Lauby Project 2007 02 Background COM 002 4 Requirements Implementation Plan Compliance VSL/VRF
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 CIP-012-1 Cyber Security Communications between Control Centers This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered Entity:
Standard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
ERO Certification and Review Procedure
ERO Certification and Review Procedure Reliability Assurance December 15, 2016 3353 Peachtree Road NE Suite 600, North Tower Atlanta, GA 30326 404-446-2560 www.nerc.com 1 of 16 Table of Contents Table
Standard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for securing
TOP-010-1(i) Real-time Reliability Monitoring and Analysis Capabilities
A. Introduction 1. Title: Real-time Reliability Monitoring and Analysis Capabilities 2. Number: TOP-010-1(i) 3. Purpose: Establish requirements for Real-time monitoring and analysis capabilities to support
This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
Certification Program
Certification Program Ryan Stewart, Manager of Registration, NERC FRCC Reliability Performance Workshop September 20, 2017 Purpose of the Certification Program Rules of Procedure (ROP) Section 500: The
5. Effective Date: The first day of the first calendar quarter after applicable regulatory approval.
Introduction 1. Title: IROL and SOL Mitigation in the ERCOT Region 2. Number: IRO-006-TRE-1 3. Purpose: To provide and execute transmission loading relief procedures that can be used to mitigate SOL or
Jim Brenton Regional Security Coordinator ERCOT Electric Reliability Council of Texas
Jim Brenton Regional Security Coordinator ERCOT Electric Reliability Council of Texas Facts expressed in this presentation are Facts Opinions express in this presentation are solely my own The voices I
Standard CIP-006-3c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-3c 3. Purpose: Standard CIP-006-3 is intended to ensure the implementation of a physical security
CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security System Security Management 2. Number: CIP-007-5 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in
Compliance Enforcement Initiative
Compliance Enforcement Initiative Filing and Status Update November 2, 2011 Rebecca Michael Status of the Filings NERC filed several components of the Compliance Enforcement Initiative on September 30,
NB Appendix CIP NB-0 - Cyber Security Recovery Plans for BES Cyber Systems
This appendix establishes modifications to the FERC approved NERC standard CIP-009-6 for its specific application in New Brunswick. This appendix must be read with CIP-009-6 to determine a full understanding
Hetch Hetchy Water and Power of the City and County of San Francisco. Joint Transmission Planning Base Case Preparation Process
California Independent System Operator & Hetch Hetchy Water and Power of the City and County of San Francisco Joint Transmission Planning Base Case Preparation Process This is a living document. Please
November 9, Revisions to the Violation Risk Factors for Reliability Standards IRO and TOP
!! November 9, 2016 VIA ELECTRONIC FILING Jim Crone Director, Energy Division Manitoba Innovation, Energy and Mines 1200-155 Carlton Street Winnipeg MB R3C 3H8 RE: Revisions to the Violation Risk Factors
Standard CIP Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-4 3. Purpose: Standard CIP-003-4 requires that Responsible Entities have minimum security management controls in
Standard CIP Cyber Security Incident Reporting and Response Planning
A. Introduction 1. Title: Cyber Security Incident Reporting and Response Planning 2. Number: CIP-008-4 3. Purpose: Standard CIP-008-4 ensures the identification, classification, response, and reporting
Cyber Security Standards Drafting Team Update
Cyber Security Standards Drafting Team Update Michael Assante, VP & Chief Security Officer North American Electric Reliability Corp. February 3, 2008 Overview About NERC Project Background Proposed Modifications
Standard CIP 004 3a Cyber Security Personnel and Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-3a 3. Purpose: Standard CIP-004-3 requires that personnel having authorized cyber or authorized unescorted physical access
Standard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
Cyber Security Reliability Standards CIP V5 Transition Guidance:
Cyber Security Reliability Standards CIP V5 Transition Guidance: ERO Compliance and Enforcement Activities during the Transition to the CIP Version 5 Reliability Standards To: Regional Entities and Responsible
Standard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-1 3. Purpose: Standard CIP-007 requires Responsible Entities to define methods, processes, and procedures for securing
Standard CIP 007 4a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4a 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for
NERC Overview and Compliance Update
NERC Overview and Compliance Update Eric Ruskamp Manager, Regulatory Compliance August 17, 2018 1 Agenda NERC Overview History Regulatory Hierarchy Reliability Standards Compliance Enforcement Compliance
WECC Criterion INT-001-WECC-CRT-2.13
WECC Criterion INT-001-WECC-CRT-2.13 A. Introduction 1. Title: e-tag Requirements for WECC including Wrongful Denial and Loss of Communication ProceduresRequest for Interchange (RFI) 2. Number: INT-001-WECC-CRT-2.13
Unofficial Comment Form Project Operating Personnel Communications Protocols COM Operating Personnel Communications Protocols
Project 2007-02 Operating Personnel Communications Protocols COM-002-4 Operating Personnel Communications Protocols Please DO NOT use this form. Please use the electronic comment form to submit comments
Standard CIP 005 4a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-4a 3. Purpose: Standard CIP-005-4a requires the identification and protection of the Electronic Security Perimeter(s)
Registered Entity Self-Report and Mitigation Plan User Guide
Registered Entity Self-Report and Mitigation Plan User Guide June 2018 NERC Report Title Report Date I Table of Contents Preface...1 Disclaimer...2 Document Revisions...3 Introduction...4 Chapter 1: Description
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 CIP-002-5.1 Cyber Security BES Cyber System Categorization This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered Entity: NCR
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 FAC-003-4 Transmission Vegetation Management. Registered Entity Name: Applicable Function(s): Applicable only for TO and GO Compliance Monitoring Method: RSAW Version:
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Wksheet 1 CIP-009-6 Cyber Security Security Management Controls This section to be completed by the Compliance Enfcement Authity. Audit ID: Registered Entity: NCR Number: Compliance
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Wksheet 1 CIP 007 6 Cyber Security System Security Management This section to be completed by the Compliance Enfcement Authity. Audit ID: Registered Entity: NCR Number: Compliance
Analysis of CIP-006 and CIP-007 Violations
Electric Reliability Organization (ERO) Compliance Analysis Report Reliability Standard CIP-006 Physical Security of Critical Cyber Assets Reliability Standard CIP-007 Systems Security Management December
CIP Compliance Workshop Boise, ID March 29, 2018
CIP-006-6 Compliance Workshop Boise, ID March 29, 2018 Mark Lemery, MSc, CPP, PSP Auditor, Cyber and Physical Security 2 Impact on Reliability Identify WECC s audit approach and inform entities of physical
Standard CIP Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-1 3. Purpose: Standard CIP-005 requires the identification and protection of the Electronic Security Perimeter(s)
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
Standard CIP-006-4c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-4c 3. Purpose: Standard CIP-006-4c is intended to ensure the implementation of a physical security
A. Introduction. B. Requirements and Measures
A. Introduction 1. Title: Communications 2. Number: COM-001-3 3. Purpose: To establish Communication capabilities necessary to maintain reliability. 4. Applicability: 4.1. Functional Entities: 4.1.1. Transmission
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 3 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
Internal Controls Procedure
Internal Controls Procedure September 30, 2017 MON-114 3000 Bayport Drive, Suite 600 Tampa, Florida 33607-8411 (813) 289-5644 - Phone (813) 289-5646 Fax www.frcc.com Table of Contents Page 3 of 7 Page
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Wksheet 1 CIP-008-5 Cyber Security Incident Repting and Response Planning This section to be completed by the Compliance Enfcement Authity. Audit ID: Registered Entity: NCR Number:
Standard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
Jim Brenton Regional Security Coordinator ERCOT Electric Reliability Council of Texas
Jim Brenton Regional Security Coordinator ERCOT Electric Reliability Council of Texas Facts expressed in this presentation are Facts Opinions express in this presentation are solely my own The voices I
Cyber Security Incident Report
Cyber Security Incident Report Technical Rationale and Justification for Reliability Standard CIP-008-6 January 2019 NERC Report Title Report Date I Table of Contents Preface... iii Introduction... 1 New
Entity Registration: CFRs
Entity Registration: CFRs End User Guide: Registered Entities December 12 th, 2017 1 Table of Contents 1 Overview... 3 1.1 Entity Registration Overview... 3 1.2 CFR Overview... 3 1.2.1 CFR States... 3
Standard TOP Transmission Operations
A. Introduction 1. Title: Transmission Operations 2. Number: TOP-001-34 3. Purpose: To prevent instability, uncontrolled separation, or Cascading outages that adversely impact the reliability of the Interconnection
Unofficial Comment Form Project Operating Personnel Communications Protocols COM-002-4
Project 2007-02 Operating Personnel Communications Protocols COM-002-4 Please DO NOT use this form. Please use the electronic comment form to submit comments on the proposed draft COM 002 4 (Operating
Submitting Evidence to the Vault. FRCC CIP Spring Compliance Workshop May 13-16, 2013
Submitting Evidence to the Vault FRCC CIP Spring Compliance Workshop May 13-16, 2013 Objectives Explain the step-by-step process for submitting evidence to FRCC Vault Share what happens to the evidence
Better Practices to Provide Reasonable Assurance of Compliance with the CIP Standards, Part 2
Better Practices to Provide Reasonable Assurance of Compliance with the CIP Standards, Part 2 David Cerasoli, CISSP Manager, CIP Audits October 30, 2018 Disclaimer The goal of this webinar is to share
CIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-6 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric
Ben Christensen CIP Enforcement Analyst. Root Cause Analysis for Commonly Violated Requirements June 6, 2013 CIPUG
Ben Christensen CIP Enforcement Analyst Root Cause Analysis for Commonly Violated Requirements June 6, 2013 CIPUG Agenda Methodology Individual Standard Requirements o Root Causes o Effective Solutions
Critical Cyber Asset Identification Security Management Controls
Implementation Plan Purpose On January 18, 2008, FERC (or Commission ) issued Order. 706 that approved Version 1 of the Critical Infrastructure Protection Reliability Standards, CIP-002-1 through CIP-009-1.
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Wksheet 1 CIP-004-6 Cyber Security Personnel & Training This section to be completed by the Compliance Enfcement Authity. Audit ID: Registered Entity: NCR Number: Compliance
Standard CIP Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-3 3. Purpose: Standard CIP-006-3 is intended to ensure the implementation of a physical security program
Consideration of Issues and Directives Federal Energy Regulatory Commission Order No. 791 June 2, 2014
Federal Energy Regulatory Commission Order No. 791 June 2, 2014 67 and 76 67. For the reasons discussed below, the Commission concludes that the identify, assess, and correct language, as currently proposed
CIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-5.1 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the BES from individuals
Comprehensive Mitigation
Comprehensive Mitigation Jenny Anderson Compliance Engineer - CIP janderson.re@spp.org 501.614.3299 July 25, 2013 Goals and Benefits of Mitigation Mitigation should lessen the risk of unintended consequences
Standard CIP Cyber Security Critical Cyber As s et Identification
A. Introduction 1. Title: Cyber Security Critical Cyber Asset Identification 2. Number: CIP-002-4 3. Purpose: NERC Standards CIP-002-4 through CIP-009-4 provide a cyber security framework for the identification
CIP Cyber Security Configuration Change Management and Vulnerability AssessmentsManagement
The Background, VRF/VSLs, and Guidelines and Technical Basis Sections have been removed for this informal posting. The Project 2016-02 is seeking comments around the concept of the Requirement/Measure
Impacts and Implementation: NERC Reliability Standards, Compliance Initiatives, and Regulatory Activities
Impacts and Implementation: NERC Reliability Standards, Compliance Initiatives, and Regulatory Activities NRECA TechAdvantage March 2014 Patti Metro Manager, Transmission & Reliability Standards NRECA
Board of Trustees Compliance Committee
Board of Trustees Compliance Committee August 13, 2014 10:00 a.m. 11:00 a.m. Pacific The Westin Bayshore 1601 Bayshore Drive Vancouver, BC V6G 2V4 Reliability Assurance Initiative (RAI) Progress Report
This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Description of Current Draft
4.1.1 Generator Owner Transmission Owner that owns synchronous condenser(s)
A. Introduction 1. Title: Verification and Data Reporting of Generator Real and Reactive Power Capability and Synchronous Condenser Reactive Power Capability 2. Number: MOD-025-2 3. Purpose: To ensure
Loss of Control Center Functionality: EOP-008-1, CIP-008-3, CIP September 30, 2014
Loss of Control Center Functionality: EOP-008-1, CIP-008-3, CIP-009-3 September 30, 2014 James Williams Lead Compliance Specialist jwilliams.re@spp.org 501.614.3261 Jeremy Withers Senior Compliance Specialist
Cyber Security Supply Chain Risk Management
Cyber Security Supply Chain Risk Management JoAnn Murphy, SDT Vice Chair, PJM Interconnection May 31, 2017 FERC Order No. 829 [the Commission directs] that NERC, pursuant to section 215(d)(5) of the FPA,
NPCC Compliance Monitoring Team Classroom Session
NPCC Compliance Monitoring Team Classroom Session John Muir - Director, Compliance Monitoring Jacqueline Jimenez - Senior Compliance Engineer David Cerasoli, CISSP - Manager, CIP Audits 5/14/2018 1 Compliance
A. Introduction 1. Title: 2. Number: 3. Purpose: 4. Applicability: 4.1. Functional Entities: Balancing Authority Distribution Provider
The Background, VRF/VSLs, and Guidelines and Technical Basis Sections have been removed for this informal posting. The Project 2016-02 is seeking comments around the concept of the Requirement/Measure
NERC CIP Information Protection
NERC CIP Information Protection Eric Ruskamp Manager, Regulatory Compliance September 13, 2017 1 Agenda NERC History NERC Compliance Overview of Reliability Standards Compliance with Reliability Standards
RELIABILITY COMPLIANCE ENFORCEMENT IN ONTARIO
RELIABILITY COMPLIANCE ENFORCEMENT IN ONTARIO June 27, 2016 Training provided for Ontario market participants by the Market Assessment and Compliance Division of the IESO Module 1 A MACD training presentation
Hang on it s going to be a wild ride
AGA/EEI Utility Internal Auditor's Training Course Washington, DC August 26, 2015 Hang on it s going to be a wild ride There are no NERC CIP Babel Fish "The Babel fish is small, yellow, leech-like, and
Reliability Standard Audit Worksheet 1
Reliability Standard Audit Wksheet 1 CIP-005-6 Cyber Security Electronic Security Perimeter(s) This section to be completed by the Compliance Enfcement Authity. Audit ID: Registered Entity: NCR Number:
CIP Version 5 Evidence Request User Guide
CIP Version 5 Evidence Request User Guide Version 1.0 December 15, 2015 NERC Report Title Report Date I Table of Contents Preface... iv Introduction... v Purpose... v Evidence Request Flow... v Sampling...
CMEP Data Acquisition & Administration (CDAA) Portal User Guide
CMEP Data Acquisition & Administration (CDAA) Portal User Guide November 5, 2018 Revision 4 1 Table of Contents Introduction... 4 What is the NPCC Compliance Portal ( CDAA )?... 4 How do I access the CDAA?...
Lee County Electric Cooperative, Inc.
Lee County Electric Cooperative, Inc. BUILDING A Compliance Program Background A Not-For-Profit Florida Corporation Providing electric service in Southwest Florida since 1940 Five Counties (Lee, Collier,
Standard Development Timeline
CIP-008-6 Incident Reporting and Response Planning Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard
Critical Infrastructure Protection Version 5
Critical Infrastructure Protection Version 5 Tobias Whitney, Senior CIP Manager, Grid Assurance, NERC Compliance Committee Open Meeting August 9, 2017 Agenda Critical Infrastructure Protection (CIP) Standards
Standard CIP-006-1a Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-1a 3. Purpose: Standard CIP-006 is intended to ensure the implementation of a physical security program
Title. Critical Infrastructure Protection Getting Low with a Touch of Medium. CanWEA Operations and Maintenance Summit 2018.
Critical Infrastructure Protection Getting Low with a Touch of Medium Title CanWEA Operations and Maintenance Summit 2018 January 30, 2018 George E. Brown Compliance Manager Acciona Wind Energy Canada