NERC Critical Infrastructure Protection standards (CIP-005, CIP-007, CIP-013, CIP-015), approved by FERC
Mandatory cybersecurity standards for the systems that run the power grid: an electronic security perimeter around control systems, access and security-event management, supply chain risk management plans for vendors of control system hardware and software, and monitoring of network traffic inside the trusted zone to detect anomalous activity.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Provenance of the actor's software and hardware C-A3 | Required by the text | CIP-013: supply chain risk management plans covering vendor products, including verification of software integrity and authenticity | high | 1 case |
| Containment and isolation C-E5 | Required by the text | CIP-005: electronic security perimeter and controlled remote access to control systems | high | 5 cases |
| Independent audit log C-V1 | Required by the text | CIP-007 security event logging and CIP-015 internal network security monitoring | high | 1 case |
| Actor identity verification C-A1 | Implied | CIP-004 and CIP-007 access management and authentication for control systems | medium | 4 cases |