CIP-002-5.1a: BES Cyber System Categorization
- R1, R1.1, R1.2, R1.3: Identify/categorize BES Cyber Systems by High/Medium/Low impact
- R2, R2.1, R2.2: Review categorization and obtain approval every 15 months
CIP-003-9: Security Management Controls
- Att 1 Sec 3.1: Permit only necessary routable inbound/outbound electronic access for Low Impact
- Att 1 Sec 6: Implement process to mitigate vendor remote access risks
- Att 1 Sec 4.5: Test cyber security incident response plan every 36 months
CIP-003-8: Security Management Controls
- Att 1 Sec 5: Plan to mitigate malicious code risk from TCA/Removable Media
- Att 1 Sec 5.1, 5.2: Malicious code risk mitigation for TCA
CIP-004-7: Personnel & Training
- R5.1: Initiate access removal within 24 hours of termination/IRA
- R5.2, R6.3: Revoke access by next calendar day for reassignments/BCSI
- R4.2: Verify active access authorizations quarterly
- R4.3: Verify user account privileges every 15 months
CIP-005-7: Electronic Security Perimeter(s)
- R1.3: EAPs must require access permissions, reason, and deny all other access
- R2.1: Interactive Remote Access must utilize an Intermediate System
- R2.3: Require multi-factor authentication for all Interactive Remote Access sessions
- R2.4: Method(s) to determine active vendor remote access sessions
- R2.5: Method(s) to disable active vendor remote access
CIP-006-6: Physical Security of BES Cyber Systems
- R1.10: Restrict physical access or apply encryption/monitoring
- R1.4, R1.5: Monitor physical access points and alert within 15 minutes
- R1.6, R1.7: Monitor PACS for unauthorized physical access; alert response personnel within 15 minutes
- R1.8: Log authorized unescorted physical entry with identity, date, time
- R1.9: Retain physical access logs for 90 calendar days
- R2.2: Log visitor entry/exit, name, date, time, contact
- R2.3: Retain visitor logs for 90 calendar days
CIP-007-6: System Security Management
- R2.1: Patch management process: track, evaluate, install security patches
- R2.2: Evaluate patches every 35 days
- R2.3, R2.4: Apply patch or implement mitigation plan within 35 days
- R1.1: Enable only necessary logical network accessible ports, where technically feasible
- R5.5: Enforce minimum 8-character length and 3 character types for passwords
- R5.6: Enforce password change/obligation at least every 15 months, if feasible
- R5.7: Limit unsuccessful authentication attempts or generate alerts, if feasible
- R4.1: Log successful/failed logins and detected malicious code
- R4.2: Generate alerts for malicious code detection and logging failure
- R4.4: Review logged event summarization/sampling every 15 days
- R4.3: Retain event logs for last 90 consecutive days
CIP-008-6: Incident Reporting and Response Planning
- R1.1, R1.2, R1.4: Identify, classify, respond, and handle cyber incidents
- R4, R4.2: Notify E-ISAC/NCCIC within required timelines
CIP-009-6: Recovery Plans for BES Cyber Systems
- R2.3: Test recovery plans every 36 months
- R1.3: Document process for backup and storage of recovery information
- R1.4: Verify successful backup completion and address failures
- R2.2: Test representative sample of recovery information usability every 15 months
CIP-010-4: Configuration Change Management
- R1.6: Verify software source identity and integrity prior to configuration changes
- R1.1: Develop configuration baseline including OS, software, ports, patches
- R1.3: Update baseline within 30 days after configuration change
- R1.2: Authorize and document changes deviating from existing baseline configuration
- R2.1: Monitor baseline configuration changes and investigate unauthorized changes every 35 days
- R3.1: Conduct paper or active vulnerability assessment every 15 months
- R3.2: Active assessment every 36 months for High Impact, if feasible
- R3.3: Perform active vulnerability assessment before adding new Cyber Assets to production
- R3.4: Document assessment results, remediation action plans, planned dates, execution status
- R4: Documented plan for Transient Cyber Assets and Removable Media
CIP-011-3: Information Protection
- R2.1, R2.2: Prevent unauthorized BCSI retrieval prior to reuse or disposal of Cyber Assets
- R1.1: Document method(s) to identify BCSI
- R1.2: Protect and securely handle BCSI against confidentiality compromise
CIP-012-1: Communications Between Control Centers
- R1: Plan to mitigate risks to confidentiality, integrity, availability of real-time data
- R1.3: Method(s) to initiate communication link recovery
CIP-013-2: Supply Chain Risk Management
- R1.1: Identify and assess cyber security risks during procurement planning
- R1.2.5: Require verification of vendor software integrity and authenticity
CIP-015-1: Internal Network Security Monitoring
- R1.1, R1.2, R1.3: Monitor network data feeds to detect/evaluate anomalous activity
- R2: Retain anomalous activity data until investigation is complete
