What is the NERC standard

The North American Electric Reliability Corporation (NERC) is a non-profit association that creates standards for securing major electric power facilities.

NERC CIP

Among these standards, NERC CIP was created with the aim of ensuring the security of the perimeter and of everything related to cyber security.

Where does it apply?

It is a widespread standard in North America, where grid and smart grid facilities cannot avoid applying it! Unlike other standards that are usually discussed, such as NIST or ISA-99, NERC CIP is mandatory for the states involved!

What are the risks of non-compliance?

For those who fail to meet the NERC CIP standard in the North American states, the penalties are heavy. This is what the official document provides:

“Violations of compliance costing up to $1 million penalty per day“

What does the NERC CIP standard provide for?

It is a set of rules and best practices that must be developed during the implementation of power plants and electrical substations and throughout their lifetime.

Some definitions are essential to understand the standard better.

• BES – Bulk Electric System, meaning all the elements and structures that make up the power plant, substation and distribution system.
• BEA – Bulk Electronic Asset, meaning an IT resource which, if made unavailable, degraded or misused for 15 minutes or more, would have an adverse impact on the BES infrastructure.
• IED – Intelligent Electronic Device, the electronic devices that communicate with each other over media and protocols such as Modbus, DNP, IEC 61850 and so on.

For simplicity, we summarise them in this table:

Standard	Purpose	How
CIP-002-5.1a BES Cyber System Categorization	Identify and classify BES IT systems according to the cyber security risk they are exposed to.	By identifying the BES and their functions. Assigning each BES a strategic importance weighting and indicating how it should be protected. Identifying and classifying all BEA resources or systems that could cause problems if compromised. Logically separating the BEA into subsystems and classifying them by degree of criticality, from high (critical) to low.
CIP-003-7 S Security Management Controls	Identify and assign responsibilities for the IT systems related to the BES, according to the cyber security risk they are exposed to.	By drawing up the relevant documentation.
CIP-004-6 Personnel & Training	Minimise the risk of compromise that could lead to malfunction or instability of the BES. Requires that personnel with access to BES systems are trained and aware of cyber security.	By training staff on cyber security.
CIP-005-6 Electronic Security Perimeter(s)	Manage electronic access to the perimeter correctly, so that any vulnerabilities do not compromise the operation of the BES.	By defining the creation of a perimeter around IT systems, as well as the policies to protect all routable protocols (Profinet, DNP3, 104 and so on). Providing secure remote access, putting in place systems with remote session encryption, multi-factor authentication, anti-malware updates, patch updates and robust authentication protocols, to limit access based on roles.
CIP-006-6 Physical Security of BES Cyber Systems	Manage physical access to BES systems.	By implementing a series of activities aimed at limiting and controlling physical access to the BES. For example, by monitoring physical access to systems (cameras) and recording access (access log).
CIP-007-6 System Security Management	Manage system security by specifying certain technical, operational and procedural requirements in support of BES protection.	By implementing system security measures, such as disabling unused ports, restricting removable media, security patches, password management and so on. It also includes the detection of security breaches, malware and so on. Recording any tests and procedures.
CIP-008-5 Incident Reporting and Response Planning	Provide a mitigation and response plan for BES systems in the event of an incident.	By creating an incident response plan that should include the actions, roles and responsibilities of the people involved, as well as details on how incidents should be handled and reported to the governing bodies. This plan must be updated every year and tested.
CIP-009-6 Recovery Plans for BES Cyber Systems	Provide a recovery plan for the BES in the event of an incident.	By providing backup systems, business continuity and recovery information. By identifying those responsible for these processes.
CIP-010-2 Configuration Change Management and Vulnerability	Prevent and detect unauthorised changes to BES IT systems. Record configuration changes and carry out vulnerability assessments of the systems.	By implementing monitoring and prevention systems for system configurations.
CIP-011-2 Information Protection	Prevent unauthorised access to the information of the BES IT system.	By providing robust, encrypted and two-factor authenticated documentation systems.
CIP-014-2 Physical Security	By identifying and also physically protecting the stations and substations that, if compromised, could make the systems unstable or inoperable.	Implementation of physical barriers, law enforcement checks, security personnel and so on.

Considerations

The NERC CIP standard takes up many concepts already familiar to the world of Industrial Cyber Security, but makes it, to all intents and purposes, a regulation that North American countries cannot ignore. Thanks to this approach, the cyber security of electrical facilities is no longer a “costly” option to offer the customer. The hope is that similar standards will be adopted worldwide, even without being a legal obligation.