Genetec Guides Utility Companies on Security System Support for NERC CIP Compliance

How to select a security system that supports compliance with NERC CIP

Genetec has published a guide for utility companies on how to select a security system that supports compliance with the Critical Infrastructure Protection plan (CIP) of the North American Electric Reliability Corporation (NERC). The 12 published NERC standards are aimed at regulating, enforcing, monitoring and managing the security of the Bulk Electric System (BES) in North America. A subset of the full guidance follows.

CIP-002-5.1a: Cybersecurity – management controls. The goal is to categorize different BES Cyber Systems based on potential impact levels to understand how to manage vulnerabilities better and protect assets while regularly maintaining and reviewing them. Look for a security system that can provide an up-to-date breakdown of all connected devices and their statuses, to simplify the review process and quickly identify any that require immediate attention.

CIP-005-6: Cybersecurity - electronic security perimeter(s). This standard aims to secure access to BES Cyber Systems by keeping critical assets within a designated electronic security perimeter and closely monitoring them in case of suspicious activity. Organizations should ensure all security systems connected to the network infrastructure require secure authentication, encrypted communications, and users that have role-based permissions to access critical assets. Make sure an activity trail report of access is available to simplify investigations/audits.

CIP-008-6: Cybersecurity – incident reporting and response planning. To comply, put in place procedures to identify, classify, and respond to cybersecurity incidents and keep complete records of the incident and management process to report to the Electricity Information Sharing and Analysis Center (E-ISAC) for forensic analysis. A centralized security system that keeps a complete log of network activity and access, as well as a full history of the asset configuration data, will simplify investigation and recovery when required. Utilities should look for technology partners that can provide emergency support in case of a catastrophic system failure or cyberattacks.

CIP-013-1: Cybersecurity – supply chain risk management. Utilities should aim to develop a plan to identify and assess risk to BES posed by vendor products or services. It is important to ensure all critical vendors that are supporting the smooth functioning of the BES have clear cybersecurity guidelines in place that will not put the BES at risk. Ensure system providers do not have access to your system by default without consent, particularly in system-to-system remote access. Here are six questions to ask vendors to manage supply chain risk better.

Featured

  • The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    Over the past two years, the Biden Administration has taken a series of steps centered on quantum and cybersecurity. Read Now

  • IoT Saves the Day

    IoT Saves the Day

    Today, creating a safe environment across schools, hotels, office buildings, housing complexes and other facilities has become a necessity. There are so many dangers lurking in buildings of all sizes and shapes from fire hazards, vaping issues, chemical/air quality issues, intruders and so much more. Read Now

  • One Pane, Less Pain

    One Pane, Less Pain

    Just because a solution is built on an open-standards platform doesn’t ensure that all the vendors’ systems will work together as promised. Some features may not be supported, or not supported to their fullest potential. Read Now

  • Revamping Wrigley Field

    Revamping Wrigley Field

    When talking about baseball in the United States, it’s hard not to think of the Chicago Cubs and Wrigley Field. With a history spanning more than 100 years, the Chicago Cubs are one of the most recognized teams in professional sports. Read Now

Featured Cybersecurity

Webinars

New Products

  • HID Signo Readers

    HID Signo Readers

    HID Global has announced its HID® Signo™ Biometric Reader 25B that is designed to capture and read fingerprints in real-world applications and conditions. 3

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • Camden Door Controls Application Spec Guide

    Camden Door Controls Application Spec Guide

    Camden Door Controls, an industry-leading provider of innovative, high quality door activation and locking products, has published a new application spec guide for specification writers designing a wireless barrier-free restroom control system. 3