UPDATE: Suggest you read Joe Weiss’s comment, especially the first paragraph. While Joe and I cordially disagree on the impact of the existing NERC CIP on an asset owner’s security posture, I would bow to his understanding of the FERC/NERC innerworkings and politics. Is the fact that a NOPR was issued at all instructive? Joe says you bet it is.

—————————————-

To be accurate, FERC issued a Notice of Proposed Rulemaking (NOPR) on July 20th for the NERC/ERO Critical Infrastructure Protection (CIP) reliability standards. There is now a 60-day window to comment and then FERC will issue the rules subject to any comment induced modifications.

The NOPR is a 197-page document, although the 197 pages have a lot of white space like a high school term paper so it is not too daunting. Here are the highlights I have gleaned from the document.

1) FERC proposes to approve NERC CIP-002 through CIP-009. There probably wasn’t any choice that would not introduce significant, multiple year delays. Still this is a big deal even if you choose to read no further.

2) Paragraph 33 below shows that FERC wants more specific statements on how to implement and measure security principles in the existing CIP’s. My sense is this was not in the existing NERC CIP’s because it would have been difficult to reach agreement on specific, mandatory controls. Look how long it took to reach agreement on more general requirements. The how or specificity is a natural growth of the standards.

The Commission generally agrees that use of performance-based standards is a part of the design of cyber security safeguards for the Bulk-Power System’s critical assets. However . . . performance-based standards may not always be appropriate, for example, in situations where “the ‘how’ may be inextricably linked to the Reliability Standard and may need to be specified to ensure the enforceability of the standard.” Accordingly, where necessary, the Commission proposes to direct NERC to modify the CIP Reliability Standards to address the “how”. Moreover, the Commission is concerned that, while NERC explains that the CIP Reliability Standards are performance-based, the CIP Reliability Standards do not provide a mechanism to measure performance or otherwise determine whether a responsible entity has met the goals of a particular requirement set forth in the standards.

3) FERC proposes to accept NERC’s implementation plan which concludes with auditable compliance in 2009/2010 dependent on the entity and requirement. There are intermediate stages, such as substantially compliant and compliant prior to the 2009/2010 deadline. I wrote back in Jan 2006 that this schedule was a bit lenient, but given limited work over the past 18 months many entities are going to need all the remaining time to meet the compliance schedule.

4) The flexibility provided by “Reasonable Business Judgment” will be removed in 2009 and the ability to use a lack of “Technical Feasibility” to skip a requirement will require additional documentation. This along with point 2 in this blog entry indicate that FERC is focused on allowing less discretion by the asset owners. I like the requirement to review the “Technical Feasibility” annually and have a plan to remove these exceptions. This is very similar to policy exception procedures we work into security documents.

5) FERC has proposed NERC make 59 modifications to the 8 CIP standards. Here are some of the more interesting modifications:

• Provide additional guidance on the risk based assessment methodology in CIP-002
• Asset owners will need to periodically report policy exceptions to a Regional Entity, who is also responsible for CIP audit. This is designed to prevent or at least check an asset owner from taking “too much latitude in excusing itself from compliance with its cyber security policy”. (CIP-003, R3)
• “require immediate revocation of access privileges when an employee, contractor, or vendor no longer performs a function that requires authorized physical or electronic access to a critical cyber asset for any reason (including disciplinary action, transfer, retirement or termination).” (CIP-004 R4) Immediate is not possible and cannot be audited so this probably will change. Also, there is typically a different time threshold for those terminated for cause and other changes such as transfers. This is very typical of what we see, and even have written in the past, in policies. R4 needed more rigor, but this likely is unworkable and will loosen, or be regularly violated.
• FERC proposes that asset owners “must implement two or more distinct security measures when constructing an electronic security perimeter” (ESP). (CIP-005 R1) Any security professional will design an architecture with defense in depth, but not necessarily at the perimeter. The NERC ESP is one line of defense, then there are internal defenses, and finally system or application defenses - - multiple different perimeters. Would you build two moats around a castle? Probably not an effective use of your security dollar.
• FERC proposes “strong” authentication should be defined and recommends digital certificates and two-factor authentication (CIP-005 R2.4).
• FERC proposes a weekly manual review of ESP access logs, rather than the proposed 90-day review (CIP-005 R3)
• Similar to the requirement for two security measures at the ESP, FERC proposes at least two security measures at the physical security perimeter (CIP-006)
• FERC proposes a requirement to collect forensic data in CIP-009 R1.

Again the most important item is FERC proposes to approve the 8 NERC CIP standards.