Internal Controls Evaluation (ICE) Processing
|
|
- Harold Jennings
- 6 years ago
- Views:
Transcription
1 Internal Controls Evaluation (ICE) September 28, 2017 RAM Bayport Drive, Suite 600 Tampa, Florida (813) Phone (813) Fax
2
3 Table of Contents Page 3 of 8 Page 1.0 Purpose and Scope Purpose Scope Background Terms and Definitions Responsibilities Procedure Owner Procedure Reference Section... 7 Appendix A Using the Work of Others... 8 Overview... 8 Evaluation... 8
4 Page 4 of Purpose and Scope 1.1 Purpose 1.2 Scope 2.0 Background This procedure provides the steps to be taken by FRCC Risk Assessment and Mitigation (RAM) Specialist(s) to perform an Internal Controls Evaluation (ICE) for a Registered Entity (entity). The ICE will be performed upon request from an entity. It will use the output of the Inherent Risk Assessment (IRA) to determine the potential standards and requirements for review. This document covers tools to be used. This procedure applies to the performance of Internal Controls Evaluations by the RAM team within FRCC. 2.1 Terms and Definitions Preventive controls controls established as the first line of defense since they are designed to prevent the fault/error from occurring. This type of controls will prevent a determined consequence, issue, threat, loss, or harm from occurring Detective controls controls designed to detect the potential error condition or fault after it has occurred, or identify instances where practices or procedures were not followed Corrective controls controls designed to correct the error condition or fault after it has been detected. These controls restore the system or the process back to a stable state prior to the error condition. They fix the problem during, or immediately after, the issue has occurred minimizing the impact. 1 NERC ERO Enterprise Guide for Internal Controls Version 2
5 Page 5 of Responsibilities 3.1 Procedure Owner This procedure is the responsibility of the FRCC Manager of Risk Assessment and Mitigation to maintain as necessary to keep the procedure current with the latest North American Electric Reliability Corporation (NERC) Rules of Procedure - Compliance Monitoring and Enforcement Program Appendix 4C and established FRCC procedures The review of this procedure will be performed when changes to departmental or NERC Rules of Procedure occur and have a potential impact to this processing. In addition, a review will be performed at least once every three (3) years from the last update. The review shall be documented in the Review/Modification section of this document This procedure will be approved by the FRCC Manager of Risk Assessment and Mitigation, the FRCC Director of Enforcement, Risk Assessment and Mitigation, and the VP Compliance, Enforcement and Reliability Performance. 4.0 Procedure 4.1 Within thirty days of receipt of the request for ICE, the RAM Specialist will use the output from the IRA to review the list of Standards/Requirements identified as moderate or high-risk, and will collaborate with the entity to determine the Standards/Requirements to be included in the ICE. FRCC will only perform ICE for selected moderate and high-risk requirements as identified in the IRA. 4.2 When selection of the Standards/Requirements is complete, the RAM Specialist will notify the entity by sending an with the Registered Entity Internal Controls by Standard worksheet (worksheet) and ICE Entity Guide (guide) attached. The guide provides the entity with instructions on completing the worksheet. The is to contain instructions on returning the completed worksheet and any supporting materials within 15 days to the FRCC Secure Transfer site. 4.3 Within 15 days of receiving the worksheet the RAM Specialist will review the information provided to determine if any further information is required. If further
6 Page 6 of 8 information is required the RAM Specialist will issue the appropriate information request. 4.4 The entity may provide the work of others as a part of the response to provide evidence that internal controls are implemented and functioning as documented (see Appendix A - Using the Work of Others). 4.5 Within ninety days the RAM Specialist will perform an assessment of the entity s internal controls using the ICE Worksheet to determine the effectiveness of the controls. The assessment will include, but is not limited to, the following: Automation of the internal controls Compensating and supporting internal controls Entity identification of key controls Level of available internal controls documentation Peer review of key controls within the registered entity Feedback on controls design processes (are there reviews of the control design from others in the entity) Registered entity s internal review and testing of existing internal controls Frequency of execution Maturity of internal controls (length of time in use) 4.6 The RAM Specialist will assess and rate the quality of the preventative, detective, and corrective controls using one of the following options: Fully Implemented (FI): Controls are in effect 24x7 and will prevent, detect, or correct the determined consequence. Entity has implemented many controls that will directly prevent, detect, or correct the consequence. The Entity has provided evidence of implementation of these controls and based on the review the controls have been implemented. Entity s personnel are very well trained on these controls. Controls cannot be overridden without management notification/resolving issue. Largely Implemented (LI): Controls are in effect most of the time and could prevent, detect, or correct the determined consequence. Entity has implemented many controls that could directly prevent, detect, or correct the consequence. The review, either based on evidence provided by the Entity, based on a site visit or an interview with the Entity, has provided
7 Page 7 of 8 evidence of the implementation. Entity s personnel are generally trained on these controls. Partially Implemented (PI): Entity has implemented some controls but either they are not in effect at all times or the controls are weaker (i.e. they could indirectly impact the consequence). Some reasonable assurance has been identified to indicate that these controls have been implemented. Entity s personnel are aware of these controls. Not Implemented (NI): Entity has some controls defined, but there is no assurance identified to indicate they have been implemented. Not all Entity personnel are aware of the controls. Missing: Entity does not have any controls that could directly prevent the consequence. You strongly believe that no controls have been implemented. Entity s personnel are not aware of any controls. Not Applicable: Preventative controls are not applicable to this requirement. This is not a common choice. 4.7 The RAM Specialist will document the results of the ICE using the ICE worksheet. 4.8 Once the assessment has been completed the RAM Specialist will populate the ICE Summary Report and update the entity IRA worksheets. The report is then shared with the FRCC Monitoring representative to inform potential updates to the Compliance Oversight Plan (COP). 4.9 Upon completion of the Monitoring review, the RAM Specialist will call the entity and coordinate the method of delivery (face-to-face, WebEx, etc.) of the ICE Summary Report to the entity within 15 days of completion and supply the entity with a written copy of the results. 5.0 Reference Section 5.1 NERC ERO Enterprise Inherent Risk Assessment Guide, October NERC ERO Enterprise Internal Control Evaluation Guide, October NERC ERO Enterprise Guide for Internal Controls Version 2, September 2017
8 Page 8 of 8 Appendix A Using the Work of Others Overview Many entities employ an independent team to assess compliance with their risk management strategy that includes adherence to NERC Reliability Standards. An independent internal control evaluation may be conducted by a specialist, government entity (such as the Government Accountability Office or Nuclear Regulatory Commission), a contractor who has been commissioned by the entity as a disinterested third party, or by an internal department within the entity that is independent of the department performing reliability standards operations. Evaluation If a registered entity seeks to have the RAM Specialist rely on the work of others, the RAM Specialist may review the independence, capabilities, and competencies of the individuals performing the review and any relevant documentation related to the assessment itself for consideration as part of the ICE assessment. In addition, the RAM Specialist will review the work of others including analysis, reports, etc. to determine its impact on the assessment. The information regarding an entity s independent review will be gathered when the entity supplies the ICE - entity Internal Controls by Standard worksheet response. Any additional information requests necessary will be sent to the entity, as necessary.
Internal Controls Procedure
Internal Controls Procedure September 30, 2017 MON-114 3000 Bayport Drive, Suite 600 Tampa, Florida 33607-8411 (813) 289-5644 - Phone (813) 289-5646 Fax www.frcc.com Table of Contents Page 3 of 7 Page
More informationWECC Internal Controls Evaluation Process WECC Compliance Oversight Effective date: October 15, 2017
WECC Internal Controls Evaluation Process WECC Compliance Oversight Effective date: October 15, 2017 155 North 400 West, Suite 200 Salt Lake City, Utah 84103-1114 WECC Internal Controls Evaluation Process
More informationPhysical Security Reliability Standard Implementation
Physical Security Reliability Standard Implementation Attachment 4b Action Information Background On March 7, 2014, the Commission issued an order directing NERC to submit for approval, within 90 days,
More informationRisk-Based Compliance Monitoring & Enforcement Oversight Framework. FRCC Spring Compliance Workshop April 14 16, 2015
Risk-Based Compliance Monitoring & Enforcement Oversight Framework FRCC Spring Compliance Workshop April 14 16, 2015 Upcoming Events FRCC is Conducting Individual Outreach NERC CIP Version 5 Workshop &
More informationCIP Version 5 Evidence Request User Guide
CIP Version 5 Evidence Request User Guide Version 1.0 December 15, 2015 NERC Report Title Report Date I Table of Contents Preface... iv Introduction... v Purpose... v Evidence Request Flow... v Sampling...
More informationCyber Security Reliability Standards CIP V5 Transition Guidance:
Cyber Security Reliability Standards CIP V5 Transition Guidance: ERO Compliance and Enforcement Activities during the Transition to the CIP Version 5 Reliability Standards To: Regional Entities and Responsible
More informationStandard CIP 004 3a Cyber Security Personnel and Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-3a 3. Purpose: Standard CIP-004-3 requires that personnel having authorized cyber or authorized unescorted physical access
More informationStandard CIP 007 4a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4a 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for
More informationMisoperations Information Data Analysis System (MIDAS)
Misoperations Information Data Analysis System (MIDAS) End User Guide June 2016 NERC Report Title Report Date I Table of Contents Preface... iii Chapter 1 Reporting Obligations...1 Entities Obligated to
More informationNERC Staff Organization Chart Budget 2019
NERC Staff Organization Chart Budget 2019 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel and Corporate
More informationStandard CIP 007 3a Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-3a 3. Purpose: Standard CIP-007-3 requires Responsible Entities to define methods, processes, and procedures for
More informationCyber Security Incident Report
Cyber Security Incident Report Technical Rationale and Justification for Reliability Standard CIP-008-6 January 2019 NERC Report Title Report Date I Table of Contents Preface... iii Introduction... 1 New
More informationNERC Staff Organization Chart Budget 2018
NERC Staff Organization Chart Budget 2018 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel and Corporate
More informationCritical Infrastructure Protection Version 5
Critical Infrastructure Protection Version 5 Tobias Whitney, Senior CIP Manager, Grid Assurance, NERC Compliance Committee Open Meeting August 9, 2017 Agenda Critical Infrastructure Protection (CIP) Standards
More informationNERC Staff Organization Chart Budget 2017
NERC Staff Organization Chart Budget 2017 President and CEO Administrative Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel
More informationNORTH AMERICAN ELECTRIC RELIABILITY CORPORATION
NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION NARUC Energy Regulatory Partnership Program The Public Services Regulatory Commission of Armenia and The Iowa Utilities Board Janet Amick Senior Utility
More informationNERC Staff Organization Chart Budget 2017
NERC Staff Organization Chart Budget 2017 President and CEO Administrative Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel
More informationRELIABILITY COMPLIANCE ENFORCEMENT IN ONTARIO
RELIABILITY COMPLIANCE ENFORCEMENT IN ONTARIO June 27, 2016 Training provided for Ontario market participants by the Market Assessment and Compliance Division of the IESO Module 1 A MACD training presentation
More informationDRAFT. Cyber Security Communications between Control Centers. March May Technical Rationale and Justification for Reliability Standard CIP-012-1
DRAFT Cyber Security Communications between Control Centers Technical Rationale and Justification for Reliability Standard CIP-012-1 March May 2018 NERC Report Title Report Date I Table of Contents Preface...
More informationStandard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-4 3. Purpose: Standard CIP-007-4 requires Responsible Entities to define methods, processes, and procedures for securing
More informationStandard CIP Cyber Security Security Management Controls
A. Introduction 1. Title: Cyber Security Security Management Controls 2. Number: CIP-003-4 3. Purpose: Standard CIP-003-4 requires that Responsible Entities have minimum security management controls in
More informationERO Enterprise Strategic Planning Redesign
ERO Enterprise Strategic Planning Redesign Mark Lauby, Senior Vice President and Chief Reliability Officer Member Representatives Committee Meeting February 10, 2016 Strategic Planning Redesign Current
More informationCyber Security Standards Drafting Team Update
Cyber Security Standards Drafting Team Update Michael Assante, VP & Chief Security Officer North American Electric Reliability Corp. February 3, 2008 Overview About NERC Project Background Proposed Modifications
More informationMulti-Region Registered Entity Coordinated Oversight Program
Multi-Region Registered Entity Coordinated Oversight Program Ken McIntyre, Vice President and Director of Standards and Compliance Compliance Committee Open Meeting February 7, 2018 Coordinated Oversight
More informationStandard CIP Cyber Security Incident Reporting and Response Planning
A. Introduction 1. Title: Cyber Security Incident Reporting and Response Planning 2. Number: CIP-008-4 3. Purpose: Standard CIP-008-4 ensures the identification, classification, response, and reporting
More informationStandard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
More informationCritical Cyber Asset Identification Security Management Controls
Implementation Plan Purpose On January 18, 2008, FERC (or Commission ) issued Order. 706 that approved Version 1 of the Critical Infrastructure Protection Reliability Standards, CIP-002-1 through CIP-009-1.
More informationNERC Management Response to the Questions of the NERC Board of Trustees on Reliability Standard COM September 6, 2013
NERC Management Response to the Questions of the NERC Board of Trustees on Reliability Standard COM-003-1 September 6, 2013 At the August 14-15, 2013 meeting of the Board of Trustees ( Board ) of the North
More informationNew York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities
More informationCIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-5.1 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the BES from individuals
More informationCyber Threats? How to Stop?
Cyber Threats? How to Stop? North American Grid Security Standards Jessica Bian, Director of Performance Analysis North American Electric Reliability Corporation AORC CIGRE Technical Meeting, September
More informationStandard CIP Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
More informationStandard CIP 005 4a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-4a 3. Purpose: Standard CIP-005-4a requires the identification and protection of the Electronic Security Perimeter(s)
More informationProject Retirement of Reliability Standard Requirements
Project 2013-02 Retirement of Reliability Standard Requirements Unofficial Comment Form for Paragraph 81 (P81) Project Retirement of Reliability Standard Requirements This form is provided in a Word format
More information2018 MRO Regional Risk Assessment
MIDWEST RELIABILITY ORGANIZATION 2018 MRO Regional Risk Assessment Ben Lewiski, Risk Assessment and Mitigation Engineer November 28, 2017 Improving RELIABILITY and mitigating RISKS to the Bulk Power System
More informationStandard CIP 005 2a Cyber Security Electronic Security Perimeter(s)
A. Introduction 1. Title: Cyber Security Electronic Security Perimeter(s) 2. Number: CIP-005-2a 3. Purpose: Standard CIP-005-2 requires the identification and protection of the Electronic Security Perimeter(s)
More informationCIP Cyber Security Personnel & Training
A. Introduction 1. Title: Cyber Security Personnel & Training 2. Number: CIP-004-6 3. Purpose: To minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric
More informationNERC Request for Data or Information: Protection System Misoperation Data Collection August 14, 2014
Request for Data or Information Protection System Misoperation Data Collection August 14, 2014 3353 Peachtree Road NE Suite 600, North Tower Atlanta, GA 30326 404-446-2560 www.nerc.com 1 of 15 Table of
More informationThreat and Vulnerability Assessment Tool
TABLE OF CONTENTS Threat & Vulnerability Assessment Process... 3 Purpose... 4 Components of a Threat & Vulnerability Assessment... 4 Administrative Safeguards... 4 Logical Safeguards... 4 Physical Safeguards...
More informationNew Brunswick 2018 Annual Implementation Plan Version 1
New Brunswick Energy and Utilities Board Reliability Standards, Compliance and Enforcement Program New Brunswick 2018 Annual Implementation Plan Version 1 December 28, 2017 Table of Contents Version History...
More informationStandard CIP-006-3c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-3c 3. Purpose: Standard CIP-006-3 is intended to ensure the implementation of a physical security
More informationStandard CIP Cyber Security Critical Cyber Asset Identification
Standard CIP 002 1 Cyber Security Critical Cyber Asset Identification Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed
More informationUnofficial Comment Form Project Operating Personnel Communications Protocols COM Operating Personnel Communications Protocols
Project 2007-02 Operating Personnel Communications Protocols COM-002-4 Operating Personnel Communications Protocols Please DO NOT use this form. Please use the electronic comment form to submit comments
More informationStandard CIP Cyber Security Critical Cyber Asset Identification
Standard CIP 002 1 Cyber Security Critical Cyber Asset Identification Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed
More informationNERC Overview and Compliance Update
NERC Overview and Compliance Update Eric Ruskamp Manager, Regulatory Compliance August 17, 2018 1 Agenda NERC Overview History Regulatory Hierarchy Reliability Standards Compliance Enforcement Compliance
More informationStandard CIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security Systems Security Management 2. Number: CIP-007-1 3. Purpose: Standard CIP-007 requires Responsible Entities to define methods, processes, and procedures for securing
More informationNational Policy On Classified Information Spillage
June 2006 National Policy On Classified Information Spillage This document prescribes minimum standards. Your department or agency may require further implementation. CHAIR FOREWORD 1. The handling of
More informationNERC Staff Organization Chart Budget
NERC Staff Organization Chart 2013 2014 President and CEO (Dept. 2100) Executive Assistant (Dept. 2100) Senior Vice President and Chief Operating Officer (Dept. 2100) Senior Vice President General Counsel
More informationStandard CIP-006-4c Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-4c 3. Purpose: Standard CIP-006-4c is intended to ensure the implementation of a physical security
More informationNERC Staff Organization Chart Budget 2019
NERC Staff Organization Chart Budget 2019 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Officer Senior Vice President, General Counsel and Corporate
More informationProject Cyber Security - Order No. 791 Identify, Assess, and Correct; Low Impact; Transient Devices; and Communication Networks Directives
Project 2014-02 - Cyber Security - Order No. 791 Identify, Assess, and Correct; Low Impact; Transient Devices; and Communication Networks Directives Violation Risk Factor and Justifications The tables
More informationFRCC Disturbance Monitoring Equipment Outage Reporting
FRCC Disturbance Monitoring Equipment Outage FRCC-RE-OP-004-I Effective Date: May 30, 2018 Version: Inactive 3000 Bayport Drive, Suite 600 Tampa, Florida 33607-8410 (813) 289-5644 - Phone (813) 289-5646
More informationA. Introduction 1. Title: 2. Number: 3. Purpose: 4. Applicability: 4.1. Functional Entities: Balancing Authority Distribution Provider
The Background, VRF/VSLs, and Guidelines and Technical Basis Sections have been removed for this informal posting. The Project 2016-02 is seeking comments around the concept of the Requirement/Measure
More informationStandard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard is adopted by the NERC Board of Trustees (Board).
More informationBoard of Trustees Compliance Committee
Board of Trustees Compliance Committee August 13, 2014 10:00 a.m. 11:00 a.m. Pacific The Westin Bayshore 1601 Bayshore Drive Vancouver, BC V6G 2V4 Reliability Assurance Initiative (RAI) Progress Report
More informationCybersecurity and Data Protection Developments
Cybersecurity and Data Protection Developments Nathan Taylor March 8, 2017 NY2 786488 MORRISON & FOERSTER LLP 2017 mofo.com Regulatory Themes 2 A Developing Regulatory Environment 2016 2017 March CFPB
More informationProject Posting 8 Frequently Asked Questions Guide
Project 2007-02 Posting 8 Frequently Asked Questions Guide General Questions 1. What were the inputs that drove the development of posting 8 of Project 2007-02? The NERC Board of Trustees November 7 th,
More informationGrid Security & NERC. Council of State Governments. Janet Sena, Senior Vice President, Policy and External Affairs September 22, 2016
Grid Security & NERC Council of State Governments The Future of American Electricity Policy Academy Janet Sena, Senior Vice President, Policy and External Affairs September 22, 2016 1965 Northeast blackout
More informationReliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 FAC-003-4 Transmission Vegetation Management. Registered Entity Name: Applicable Function(s): Applicable only for TO and GO Compliance Monitoring Method: RSAW Version:
More informationCertification Program
Certification Program Ryan Stewart, Manager of Registration, NERC FRCC Reliability Performance Workshop September 20, 2017 Purpose of the Certification Program Rules of Procedure (ROP) Section 500: The
More informationTOP-010-1(i) Real-time Reliability Monitoring and Analysis Capabilities
A. Introduction 1. Title: Real-time Reliability Monitoring and Analysis Capabilities 2. Number: TOP-010-1(i) 3. Purpose: Establish requirements for Real-time monitoring and analysis capabilities to support
More informationReliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 CIP-012-1 Cyber Security Communications between Control Centers This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered Entity:
More informationStandard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Description of Current Draft
More informationCIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 3 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
More information2017 MRO Performance Areas and an Update on Inherent Risk Assessments
MIDWEST RELIABILITY ORGANIZATION 2017 MRO Performance Areas and an Update on Inherent Risk Assessments Adam Flink, Risk Assessment and Mitigation Engineer November 16, 2016 Improving RELIABILITY and mitigating
More informationFRCC Disturbance Reporting Processes and Procedures
Page 1 of 13 FRCC Disturbance Reporting Processes and FRCC RE OP 001-3.2 Effective Date: September 29, 2016 Version: 3.2 3000 Bayport Drive, Suite 600 Tampa, Florida 33607-8410 (813) 289-5644 - Phone (813)
More informationERO Certification and Review Procedure
ERO Certification and Review Procedure Reliability Assurance December 15, 2016 3353 Peachtree Road NE Suite 600, North Tower Atlanta, GA 30326 404-446-2560 www.nerc.com 1 of 16 Table of Contents Table
More informationA. Introduction. B. Requirements and Measures
A. Introduction 1. Title: Communications 2. Number: COM-001-3 3. Purpose: To establish Communication capabilities necessary to maintain reliability. 4. Applicability: 4.1. Functional Entities: 4.1.1. Transmission
More informationInformation Security Controls Policy
Information Security Controls Policy Classification: Policy Version Number: 1-00 Status: Published Approved by (Board): University Leadership Team Approval Date: 30 January 2018 Effective from: 30 January
More informationCOM Operating Personnel Communications Protocols. October 31, 2013
COM-002-4 Operating Personnel Communications Protocols October 31, 2013 Agenda Introductory Remarks: Mark Lauby Project 2007 02 Background COM 002 4 Requirements Implementation Plan Compliance VSL/VRF
More informationTexas Reliability Entity, Inc. Strategic Plan for 2017 TEXAS RE STRATEGIC PLAN FOR 2017 PAGE 1 OF 13
Texas Reliability Entity, Inc. Strategic Plan for 2017 TEXAS RE STRATEGIC PLAN FOR 2017 PAGE 1 OF 13 I. Vision A highly reliable and secure bulk power system in the Electric Reliability Council of Texas
More informationCOMPASS FOR THE COMPLIANCE WORLD. Asia Pacific ICS Security Summit 3 December 2013
COMPASS FOR THE COMPLIANCE WORLD Asia Pacific ICS Security Summit 3 December 2013 THE JOURNEY Why are you going - Mission Where are you going - Goals How will you get there Reg. Stnd. Process How will
More informationMisoperation Information Data Analysis System
Misoperation Information Data Analysis System User Guide October, 2017 NERC Report Title Report Date I Table of Contents Preface... iv Overview... v Chapter 1: User Setup... 1-1 Creating an Account...
More informationInformation Technology Branch Organization of Cyber Security Technical Standard
Information Technology Branch Organization of Cyber Security Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 1 November 20, 2014 Approved:
More informationRegistration & Certification Update
Registration & Certification Update Processes, Procedures and Responsibilities September 9, 2011 Topics Purpose and Background Organization Certification New Entity Provisional Certification Change/Expanding
More informationCYBERSECURITY RISK ASSESSMENT
CYBERSECURITY RISK ASSESSMENT ACME Technologies, LLC Page 1 of 46 TABLE OF CONTENTS EXECUTIVE SUMMARY 3 ASSESSMENT SCOPE & CONTEXT 4 RISK ASSESSMENT SCOPE 4 RISK MANAGEMENT OVERVIEW 4 ENTERPRISE RISK MANAGEMENT
More informationConsideration of Issues and Directives Federal Energy Regulatory Commission Order No. 791 June 2, 2014
Federal Energy Regulatory Commission Order No. 791 June 2, 2014 67 and 76 67. For the reasons discussed below, the Commission concludes that the identify, assess, and correct language, as currently proposed
More informationCIP Cyber Security Configuration Change Management and Vulnerability Assessments
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
More informationCIP Cyber Security Systems Security Management
A. Introduction 1. Title: Cyber Security System Security Management 2. Number: CIP-007-5 3. Purpose: To manage system security by specifying select technical, operational, and procedural requirements in
More informationStandards Authorization Request Form
Standards Authorization Request Form When completed, email this form to: sarcomm@nerc.com NERC welcomes suggestions to improve the reliability of the bulk power system through improved reliability standards.
More informationGrid Security & NERC
Grid Security & NERC Janet Sena, Senior Vice President, Policy and External Affairs Southern States Energy Board 2017 Associate Members Winter Meeting February 27, 2017 Recent NERC History Energy Policy
More informationNovember 9, Revisions to the Violation Risk Factors for Reliability Standards IRO and TOP
!! November 9, 2016 VIA ELECTRONIC FILING Jim Crone Director, Energy Division Manitoba Innovation, Energy and Mines 1200-155 Carlton Street Winnipeg MB R3C 3H8 RE: Revisions to the Violation Risk Factors
More informationSummary of FERC Order No. 791
Summary of FERC Order No. 791 On November 22, 2013, the Federal Energy Regulatory Commission ( FERC or Commission ) issued Order No. 791 adopting a rule that approved Version 5 of the Critical Infrastructure
More informationViolation Risk Factor and Violation Severity Level Justifications Project Modifications to CIP Standards
Violation Risk Factor and Violation Severity Level Justifications Project 2016-02 Modifications to CIP Standards This document provides the standard drafting team s (SDT s) justification for assignment
More informationUnofficial Comment Form Project Operating Personnel Communications Protocols COM-002-4
Project 2007-02 Operating Personnel Communications Protocols COM-002-4 Please DO NOT use this form. Please use the electronic comment form to submit comments on the proposed draft COM 002 4 (Operating
More informationStandard Development Timeline
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Description of Current Draft
More informationReliability Standard Audit Worksheet 1
Reliability Standard Audit Worksheet 1 PRC-004-3 Protection System Misoperation Identification and Correction This section to be completed by the Compliance Enforcement Authority. Audit ID: Registered
More informationSecurity and Privacy Breach Notification
Security and Privacy Breach Notification Version Approval Date Owner 1.1 May 17, 2017 Privacy Officer 1. Purpose To ensure that the HealthShare Exchange of Southeastern Pennsylvania, Inc. (HSX) maintains
More informationThis draft standard is being posted for an initial comment and ballot. The draft includes modifications to meet the directives of FERC Order No. 791.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Development Steps Completed
More informationExternal Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
More informationGridEx IV Initial Lessons Learned and Resilience Initiatives
GridEx IV Initial Lessons Learned and Resilience Initiatives LeRoy T. Bunyon, MBA, CBCP Sr. Lead Analyst, Business Continuity 2017 GridEx IV GridEx is a NERC-sponsored, North American grid resilience exercise
More informationMIS5206-Section Protecting Information Assets-Exam 1
Your Name Date 1. Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances? a. Policies b. Standards c. Procedures d. Guidelines
More informationICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update)
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update) June 2017 INSERT YEAR HERE Contact Information: Jeremy Dalpiaz AVP, Cyber and Data Security Policy Jeremy.Dalpiaz@icba.org ICBA Summary
More information151 FERC 61,066 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION ORDER DENYING REHEARING. (Issued April 23, 2015)
151 FERC 61,066 UNITED STATES OF AMERICA FEDERAL ENERGY REGULATORY COMMISSION Before Commissioners: Norman C. Bay, Chairman; Philip D. Moeller, Cheryl A. LaFleur, Tony Clark, and Colette D. Honorable.
More information1. Post for 45-day comment period and pre-ballot review. 7/26/ Conduct initial ballot. 8/30/2010
Standard CIP 011 1 Cyber Security Protection Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes
More informationStandard Development Timeline
CIP-008-6 Incident Reporting and Response Planning Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard
More informationQuébec Reliability Standards Compliance Monitoring and Enforcement Program Implementation Plan Annual Implementation Plan
Québec Reliability Standards Compliance Monitoring and Enforcement Program Implementation Plan 2017 Annual Implementation Plan Effective Date: January 1, 2017 Approved by the Régie: December 1, 2016 Table
More informationThis section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective.
Standard Development Timeline This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes effective. Description of Current Draft
More information01.0 Policy Responsibilities and Oversight
Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities
More informationStandard CIP Cyber Security Physical Security
A. Introduction 1. Title: Cyber Security Physical Security of Critical Cyber Assets 2. Number: CIP-006-3 3. Purpose: Standard CIP-006-3 is intended to ensure the implementation of a physical security program
More information