FERC Approves New Reliability Standards For Cyber Security

The Federal Energy Regulatory Commission (FERC) recently approved eight new mandatory critical infrastructure protection (CIP) reliability standards to protect the nation’s bulk power system against potential disruptions from cyber security breaches.

These reliability standards were developed by the North American Electric Reliability Corporation (NERC), which FERC has designated as the electric reliability organization (ERO).

“Today, we achieve a milestone by adopting the first mandatory and enforceable reliability standards that address cyber security concerns on the bulk power system in the United States,” FERC Chairman Joseph T. Kelliher said. “The electric industry now can move on to the implementation of the standards in conjunction with improvement of these standards in order to increase the security and reliability of the bulk power system.”

Additional actions in the final rule direct the ERO to develop modifications to these reliability standards, via its reliability standards development process, and then submit them to FERC for approval. The modifications directed for development concern various oversight and technical issues pertaining to cyber protections. These include removal of language that allowed variable implementation of standards based on “reasonable business judgment” and a new framework of accountability surrounding exceptions based on technical feasibility.

The final rule also directs NERC to monitor the development and implementation of cyber security standards by the National Institute of Standards and Technology (NIST) to “determine if they contain provisions that will protect the Bulk-Power System better than the CIP Reliability Standards,” FERC said. But FERC did not direct NERC to adopt the NIST standards because that could lead to possible delays in putting into place any mandatory and enforceable standards.

The mandatory reliability standards require certain users, owners and operators of the bulk power system to establish policies, plans and procedures to safeguard physical and electronic access to control systems, to train personnel on security matters, to report security incidents, and to be prepared to recover from a cyber incident.

The eight CIP reliability standards address the following topics:

  • Critical Cyber Asset Identification.
  • Security Management Controls.
  • Personnel and Training.
  • Electronic Security Perimeters.
  • Physical Security of Critical Cyber Assets.
  • Systems Security Management.
  • Incident Reporting and Response Planning.
  • Recovery Plans for Critical Cyber Assets.

The eight reliability standards were submitted to FERC for approval on Aug. 28, 2006. In December 2006, FERC staff issued a preliminary analysis of the cyber security reliability standards, and allowed for public comment. On July 20, 2007, FERC issued a Notice of Proposed Rulemaking proposing to approve the standards, proposing future modifications, and seeking public comment.

The final rule, “Mandatory Reliability Standards for Critical Infrastructure Protection,” takes effect 60 days from the later of either the date Congress receives the agency notice of the rule, or the date the rule is published in the Federal Register.

Featured

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities