FERC Releases Staff Report on Lessons Learned from CIP Reliability Audits

guest · Dec 3, 2020

FERC Releases Staff Report on Lessons Learned from CIP Audits
December 1, 2020
https://www.tripwire.com/state-of-s...ases-staff-report-lessons-learned-cip-audits/

In October, the Federal Energy Regulatory Commission (FERC) released its “2020 Staff Report Lessons Learned from Commission-Led CIP Reliability Audits.” The report summarizes the Commission’s observations from Critical Infrastructure Protection (CIP) audits performed in conjunction with staff from Regional Entities and the North American Electric Reliability Corporation (NERC).

In doing so, the report is careful to point out that while a majority of the cyber security elements adopted by the audited utilities met the minimum requirements of the standards, potential compliance infractions still came to the surface. Additionally, the report includes recommendations that are outside the guise of the CIP requirements.
Click to expand...

I found it especially interesting that none of the lessons learned included in this year’s report overlap with those cited in the 2019 report.
That being said, the Commission lessons appear to be trending toward procedural driven rather than remediable by a technical control.
Click to expand...

2020 Staff Report - Lessons Learned from Commission-Led CIP Reliability Audits
(PDF): https://cms.ferc.gov/sites/default/files/2020-10/2020%20CIP%20Audits%20Report.pdf

During the CIP Audits, staff found that most of the cyber security protection processes and procedures adopted by the registered entities met the mandatory requirements of the CIP Reliability Standards. However, there were also potential compliance infractions found. Additionally, staff observed practices that could improve security, but are not required by the CIP Reliability Standards. Therefore, this report includes recommendations regarding cyber security practices that are voluntary.
Click to expand...

CIP Reliability Standards
The CIP Reliability Standards are designed to mitigate the cyber security and physical security risks to BES facilities, systems, and equipment, which, if destroyed, degraded, or otherwise rendered unavailable as a result of a cyber security incident, would affect the reliable operation of the Bulk-Power System. [...]
Click to expand...

Log in or Sign up

FERC Releases Staff Report on Lessons Learned from CIP Reliability Audits

guest Guest

Log in or Sign up

FERC Releases Staff Report on Lessons Learned from CIP Reliability Audits

guest Guest

Useful Searches