Tip

NERC CIP training: Understanding 'critical cyber asset identification'

The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards CIP-002 through CIP-009 provide the minimum requirements for utilities and other affected

    Requires Free Membership to View

    Login

enterprises to ensure the Bulk Electric System (BES) is effectively protected from cyberattacks and faults.

Get to know NERC and FERC

Solution providers: Learn how a little information about NERC and FERC regulations will go a long way. 
To be successful in the entire implementation of the NERC CIPs, a utility must ensure that all critical assets and Critical Cyber Assets (CCAs) are properly identified and then properly protected. Therefore, it is an operational imperative to those covered by the NERC CIPs to get CIP-002 done right the first time.

Before diving into the CIP-002 requirements and how to take the right actions, some key terms need to be defined and highlighted to help you better understand this process. These terms are summarized below and defined in the NERC Glossary.

  • BULK ELECTRIC SYSTEM (BES): The electrical generation resources, transmission lines, interconnections with neighboring systems and associated equipment, generally operated at voltages of 100 kV or higher. Protecting the BES is the primary focus of the NERC CIPs.
  • CRITICAL ASSETS: Facilities, systems and equipment which, if destroyed, degraded, or otherwise rendered unavailable, would affect the reliability or operability of the Bulk Electric System. Examples of critical assets include generating plants, major transmission substations and system control centers.
  • CRITICAL CYBER ASSETS (CCAs): Programmable electronic devices and communication networks including hardware, software, and data that are essential to the reliable operation of Critical Assets.

To help you better understand the hierarchy of the BES to the Critical Assets to the CCAs, please see Figure 1.

Handy NERC CIP training resources

NERC CIP-002, Critical Cyber Asset Identification Standard
    
Reliability Standards Audit Worksheet (RSAW) – CIP-002

Frequently Asked Questions CIP-002

NERC Guideline:  Identifying Critical Assets

Ontario:  NERC Cyber Security Standards – Risk-Based Methodology

Western Electric Coordinating Council (WECC) CIP User Group Presentation

NERC Glossary
Identification of Critical Cyber Assets
CIP-002 mandates utilities follow a high-level approach for Critical Cyber Asset identification. A summary of these steps is as follows:

  1. First, the utility must identify and document a risk-based methodology to be used to identify its critical assets. An excellent reference to help utilities with this process development is provided by NERC.

  2. Second, using the risk-based methodology identified above, the utility shall review all of its assets and then identify its critical ones. This must be done at least annually. Of course, the process must be documented and you are expected to follow the procedure and process prepared in #1.

    At a minimum you are expected to consider the following assets:

    1. Control centers and backup control centers.
    2. Transmission substations important to the BES.
    3. Generation resources important to the BES.
    4. "Blackstart" resources -- i.e., those generators and substations needed if there is a complete system blackout and no electric power is available.
    5. Automatic load shedding systems capable of shedding 300 megawatts (MW) or more.
    6. Any other asset deemed critical to the reliable operation of the BES.

  3. Thirdly, using the list of critical assets you developed in #2, you need to prepare a list of CCAs essential to the operation of the critical asset. Examples at control centers could include cybersystems that provide monitoring and control (e.g., SCADA systems), automatic generation control, real-time power system modeling, and real-time inter-utility data exchange.

    Of note, the NERC CIPs mandate that the CCAs must also meet one of the following characteristics. That is, the cyberasset:

    1. Uses a "routable protocol" to communicate.
    2. Uses a "routable protocol" within a control center.
    3. Is dial-up accessible.

Many people are surprised to see that the Critical Cyber Assets are only limited to "routable protocols." The Frequently Asked Questions (FAQs) Cyber Security Standards CIP--002--1 through CIP--009--1, issued by NERC, states: "The Critical Cyber Assets that use non-routable protocols have a limited attack scope; hence, they are less vulnerable than Critical Cyber Assets using routable protocols." This document further notes that "routable protocols" are those that provide switching and routing as described by the Open System Interconnection (OSI) model Layer 3 or higher.

Summary
Overall, getting the list of critical assets and Critical Cyber Assets complete and correct is absolutely essential for the enterprise that is required to follow the NERC CIP requirements. This is not an impossible process; however, a utility and its supporting vendors really need to pay close attention to detail in this process to avoid "surprises" later on in the NERC CIP implementation. Even the Chief Security Officer of NERC, Mr. Michael Assante, has criticized the industry for its failure to adequately and thoroughly identify their critical assets and CCAs. Therefore, NERC has high expectations for utilities to do this process right the first time.

About the author:
Ernie Hayden lives in the Seattle area and has substantial experience in the energy and information security industries. He has been a CISO at an electric utility implementing the NERC CIPs and is currently consulting.

This was first published in February 2010

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top