CIP-002-5.1a: BES Cyber System Categorization
- R1, R1.1, R1.2, R1.3: Identify/categorize BES Cyber Systems by High/Medium/Low impact
- R2, R2.1, R2.2: Review categorization and obtain approval every 15 months
CIP-003-9: Security Management Controls
- Attachment 1 Section 3.1: Permit only necessary routable inbound/outbound electronic access for Low Impact
- Attachment 1 Section 4.5: Test cyber security incident response plan every 36 months
CIP-003-8: Security Management Controls
- Attachment 1 Section 5: Plan to mitigate malicious code risk from TCA/Removable Media
- Attachment 1 Sections 5.1, 5.2: Use methods like anti-virus or white-listing for TCA
CIP-004-7: Personnel & Training
- R4.2: Verify active access authorizations quarterly
- R4.3: Verify user account privileges every 15 months
- R5.1: Initiate access removal within 24 hours of termination/IRA
- R5.2, R6.3: Revoke access by next calendar day for reassignments/BCSI
CIP-005-7: Electronic Security Perimeter(s)
- R1.3: EAPs must require access permissions, reason, and deny all other access
- R2.1: Interactive Remote Access must utilize an Intermediate System
- R2.3: Require multi-factor authentication for all Interactive Remote Access sessions
CIP-006-6: Physical Security of BES Cyber Systems
- R1.4, R1.5: Monitor physical access points for unauthorized access; alert response personnel within 15 minutes
- R1.6, R1.7: Monitor PACS for unauthorized physical access; alert response personnel within 15 minutes
- R1.8: Log authorized unescorted physical entry with identity, date, time
- R1.9: Retain physical access logs for 90 calendar days
- R2.2: Log visitor entry/exit, name, date, time, contact
- R2.3: Retain visitor logs for 90 calendar days
- R1.10: Restrict physical access to communication components outside PSPs or use encryption/monitoring
CIP-007-6: System Security Management
- R2.1: Patch management process: track, evaluate, install security patches
- R2.2: Evaluate patches every 35 days
- R2.3, R2.4: Apply patch or implement mitigation plan within 35 days
- R1.1: Enable only necessary logical network accessible ports, where technically feasible
- R5.5: Enforce minimum 8-character length and 3 character types for passwords
- R5.6: Enforce password change/obligation at least every 15 months, if feasible
- R5.7: Limit unsuccessful authentication attempts or generate alerts, if feasible
- R4.1: Log successful/failed logins and detected malicious code
- R4.2: Generate alerts for malicious code detection and logging failure
- R4.4: Review logged event summarization/sampling every 15 days
- R4.3: Retain event logs for last 90 consecutive days
- R2.4: Method(s) to determine active vendor remote access sessions
- R2.5: Method(s) to disable active vendor remote access
- Attachment 1 Section 6: Implement process to mitigate vendor remote access risks
CIP-008-6: Incident Reporting and Response Planning
- R1.1, R1.2, R1.4: Plan must include processes to identify, classify, respond, and handle cyber incidents
- R4, R4.2: Notify E-ISAC/NCCIC within 1 hour or by next day for Reportable Incidents/Attempts
CIP-009-6: Recovery Plans for BES Cyber Systems
- R1.3: Document process for backup and storage of recovery information
- R1.4: Process to verify successful backup completion and address failures
- R2.2: Test representative sample of recovery information usability every 15 months
- R2.3: Test recovery plans every 36 months via operational exercise
CIP-010-4: Configuration Change Management
- R1.6: Verify software source identity and integrity prior to configuration changes
- R1.1: Develop configuration baseline including OS, software, ports, patches
- R1.2: Authorize and document changes deviating from existing baseline configuration
- R1.3: Update baseline within 30 days after configuration change
- R2.1: Monitor baseline configuration changes and investigate unauthorized changes every 35 days
- R3.1: Conduct paper or active vulnerability assessment every 15 months
- R3.2: Active assessment every 36 months for High Impact, if feasible
- R3.3: Perform active vulnerability assessment before adding new Cyber Assets to production
- R3.4: Document assessment results, remediation action plans, planned daes, execution status
- R4: Documented plan for Transient Cyber Assets and Removable Media
- Attachment 1 Section 2.2: Mitigation of malicious code risk for vendor TCA
CIP-011-3: Information Protection
- R2.1, R2.2: Prevent unauthorized BCSI retrieval prior to reuse or disposal of Cyber Assets
- R1.1: Document method(s) to identify BCSI
- R1.2: Protect and securely handle BCSI against confidentiality compromise
CIP-012-2: Communications Between Control Centers
- R1: Plan to mitigate risks to confidentiality, integrity, availability of real-time data
- R1.3: Method(s) to initiate communication link recovery
CIP-013-2: Supply Chain Risk Management
- R1.1: Identify and assess cyber security risks during procurement planning
- R1.2.5: Require verification of vendor software integrity and authenticity
CIP-015-1: Internal Network Security Monitoring
- R1.1, R1.2, R1.3: Monitor network data feeds to detect/evaluate anomalous activity
- R2: Retain anomalous network activity data until investigation action is complete
