Citation[]
Federal Energy Regulatory Commission, Mandatory Reliability Standards for Critical Infrastructure Protection (FERC Order No. 706) (Jan. 8, 2008) (full-text).
Overview[]
This Order approved eight Critical Infrastructure Protection (CIP) Reliability Standards submitted to FERC by the North American Electric Reliability Corporation (NERC) which require certain users, owners, and operators of the Bulk-Power System to comply with specific requirements to safeguard critical cyber assets.
The eight CIP Reliability Standards are:
- CIP-002-1 – Cyber Security – Critical Cyber Asset Identification: Requires a responsible entity to identify its critical assets and critical cyber assets using a risk-based assessment methodology.
- CIP-003-1 – Cyber Security – Security Management Controls: Requires a responsible entity to develop and implement security management controls to protect critical cyber assets identified pursuant to CIP-002-1.
- CIP-004-1 – Cyber Security – Personnel & Training: Requires personnel with access to critical cyber assets to have identity verification and a criminal check. It also requires employee training.
- CIP-005-1 – Cyber Security – Electronic Security Perimeters: Requires the identification and protection of an electronic security perimeter and access points. The electronic security perimeter is to encompass the critical cyber assets identified pursuant to the methodology required by CIP-002-1.
- CIP-006-1 – Cyber Security – Physical Security of Critical Cyber Assets: Requires a responsible entity to create and maintain a physical security plan that ensures that all cyber assets within an electronic security perimeter are kept in an identified physical security perimeter.
- CIP-007-1 – Cyber Security – Systems Security Management: Requires a responsible entity to define methods, processes, and procedures for securing the systems identified as critical cyber assets, as well as the non-critical cyber assets within an electronic security perimeter.
- CIP-008-1 – Cyber Security – Incident Reporting and Response Planning: Requires a responsible entity to identify, classify, respond to, and report cyber security incidents related to critical cyber assets.
- CIP-009-1 – Cyber Security – Recovery Plans for Critical Cyber Assets: Requires the establishment of recovery plans for critical cyber assets using established business continuity and disaster recovery techniques and practices.