CI P Cyber Security Update CI P Cyber Security Update John Lim - - PowerPoint PPT Presentation
CI P Cyber Security Update CI P Cyber Security Update John Lim John Lim Consolidated Edison Co. of New York, Inc. December 1, 2010 1 Disclaim er Materials presented or discussed here are the presenters own and do not necessarily
John Lim John Lim Consolidated Edison Co. of New York, Inc.
December 1, 2010 1
December 1, 2010 2
December 1, 2010 3
Approved by NERC Standards Com m ittee I nform al Com m ents Forms Forms Webinars Workshops Other venues (regional meetings, etc.) Formal response to each comment not
December 1, 2010 4
Form al Com m ents ( 4 5 days)
Concurrent Ballot Pool formation/ Pre-Ballot
Ballot (Last 15 days) All comments must be responded to.
Re-ballot
Can make changes to standard between ballots As many as required for consensus
December 1, 2010 5
Version 2 ( CI P-0 0 2 -2 – CI P-0 0 9 -2 )
Phase 1 Low Hanging Fruits for FERC 706 Directives Became Effective 4/ 2010
Version 3 ( CI P-0 0 2 -3 – CI P-0 0 9 -3 ) Version 3 ( CI P 0 0 2 3
90 day FERC directed changes to Version 2 Effective 10/ 2010
December 1, 2010 6
CI P-0 0 2 -4
1 t f l ti / t b ll t S t b 2010
1st formal posting/ concurrent ballot: September 2010
2nd Ballot – In Progress Target: Complete by 12/ 2010
g p y
CI P-0 0 5 -4
Urgent Action: Response to Remote Access Vulnerability Separate Drafting Team Intent to File to FERC with CIP-002-4 package
CI P-1 0 & CI P-0 1 1
Concept Paper: July 2009 Informal Posting: CIP-002-4 12/ 2009 (not the same as the
current CIP-002-4)
Informal Posting: CIP-010 and CIP-011 07/ 2010 Target: 2011
December 1, 2010 7
Target: 2011
CI P-0 0 2 -4 – Narrow Scope
N if li ti f th d l i f
Non-uniform application of methodologies for
identifying Critical Assets, resulting in wide variation in the types and number of critical assets across regions regions.
Replace the Entity defined Risk-Based Methodology
requirement with a bright-line based criteria requirement for identifying Critical Assets requirement for identifying Critical Assets.
FERC Order 706 comments and directives regarding
CIP 002 (Para 329) Requirement for oversight is CIP-002. (Para. 329). Requirement for oversight is significantly mitigated.
External perceptions of insufficiency of the Entity
defined methodologies in identification of Critical
December 1, 2010 8
defined methodologies in identification of Critical Assets.
Replace Risk-Based Methodology with Bright-line
Generation Transmission Transmission Control Centers Minor changes to R2 – Identification of Critical Minor changes to R2
No changes to CIP-003-CIP-009 except
Reference Document and Implementation Plan
December 1, 2010 9
In “expedited revision” Process In expedited revision Process Addresses Remote Access vulnerability Follows Urgent Action Formal comments Follows Urgent Action Formal comments
1st Ballot: 9/ 18
Currently in 30 day review (November 12
In expedited revision process Ballot in last 10 days
December 1, 2010 10
Categorized list of BES Cyber Systems Categorized list of BES Cyber Systems Based on Impact on Functions
High High Medium Low
Basis for Application of Appropriate
Formal Comment: 7/ 2011
December 1, 2010 11
Posted for informal comment May 2010
SDT reviewed comments and feedback received
SDT determined it was infeasible to address all of SDT determined it was infeasible to address all of
Efforts on updating CIP-011 have been
December 1, 2010 12
Address remaining FERC Order 706 Address remaining FERC Order 706
2 or more diverse security measures for
Active vulnerability assessments every 3 years
Incorporate forensic data collection and
Consideration of adapting the NIST Consideration of adapting the NIST
December 1, 2010 13
Policy focuses on high-level subject areas. Policy focuses on high level subject areas. To draft standards at a higher level to
STD will attempt to preserve the effort
December 1, 2010 14
December 1, 2010 15