The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are a set of cybersecurity regulations designed to secure the assets and systems that are essential for the reliable operation of the North American bulk power system (BPS). These standards were established to protect against cyber threats and vulnerabilities that could potentially disrupt the electric grid.
- CIP-002 Critical Cyber Asset Identification: This requires utilities to identify their critical cyber assets could have a significant impact on the reliable operation of the grid.
- CIP-003 Security Management Controls: This establishes requirements for the development of cybersecurity policies and procedures, including security awareness training, incident response, and access control.
- CIP-004 Personnel and Training: This focuses on ensuring that utility personnel with access to critical cyber assets are appropriately trained and qualified for their roles.
- CIP-005 Electronic Security Perimeter: This mandates the creation of an electronic security perimeter to protect critical cyber assets from unauthorized access and communication.
- CIP-006 Physical Security of Critical Cyber Assets: This address the physical security measures that must be in place to protect critical cyber assets from physical threats and unauthorized access.
- CIP-007 Systems Security Management: This sets requirements for manging system access and protecting against malware, including antivirus software and patch management.
- CIP-008 Incident Reporting and Response Planning: This focuses on the development and implementation of an incident response plan to address cybersecurity incidents.
- CIP-009 Recovery Plans for Critical Cyber Assets: This requires utilities to develop recovery plans for critical cyber assets to minimize the impact of a cybersecurity incident.
- CIP-010 Configuration Change Management and Vulnerability Assessments: This addresses the management of configuration changes and regular vulnerability assessments to identify and remediate potential weaknesses.
- CIP-011 Information Protection: This focuses on the protection of sensitive information related to the cybersecurity of critical assets.
- CIP-012 Reliability Standard: This helps to maintain situational awareness and reliable bulk electric system operations by protecting the confidentiality and integrity of Real-time Assessment and Real-time monitoring data transmitted between Control Centers.
- CIP-013 Supply Chain Risk Management: This requires mitigating cyber security risks to the reliable operation of the Bulk Electric System (BES) by implementing security controls for Supply chain risk management of BES Cyber Systems.
- CIP-014 Physical Security: This specifically addresses the physical security of substations and other facilities.
- CIP-015 Cyber Security for Low Impact BES Cyber Systems: This provides cybersecurity requirements for low-impact systems that are part of the Bulk Electric System (BES).
GRIDsentry offers all its product portfolio with NERC CIP Standards which are responsible for complying and ensuring the security of Power utilities.
