SUBNET Solutions Inc - Making Substations More Intelligent
Call: 1.403.270.8885
NERC CIP Solutions
SUBNET CCE BROCHURE
CCE Brochure Download
Continuous Current Evolution (CCE)
WHITE PAPER DOWNLOAD
White Paper Download
Manage Utility IEDs Remotely...
NEWSLETTER
SUBNET Newsletter
The latest in smart grid technology

CIP-007 Systems Security Management: NERC CIP Standard

SUBNET PowerSYSTEM Center can assist electrical utilities to ensure that new cyber assets and changes to existing cyber assets do not adversely affect existing cyber security controls. When it comes to account management, PowerSYSTEM Center can be integrated into existing corporate IT account policies, procedures and directories. Access rights can be managed via Active Directory, RSA, Smart Card or other multi factor authentication technologies. Learn more about PowerSYSTEM Center.

Purpose:
Standard CIP-007 requires Responsible Entities to define methods, processes, and procedures for securing those systems determined to be Critical Cyber Assets, as well as the non-critical Cyber Assets within the Electronic Security Perimeter(s). Standard CIP-007 should be read as part of a group of standards numbered Standards CIP-002 through CIP-009. Responsible Entities should interpret and apply Standards CIP-002 through CIP-009 using reasonable business judgment.

Requirements:
The Responsible Entity shall comply with the following requirements of Standard CIP-007 for all Critical Cyber Assets and other Cyber Assets within the Electronic Security Perimeter(s):

Test Procedures — The Responsible Entity shall ensure that new Cyber Assets and significant changes to existing Cyber Assets within the Electronic Security Perimeter do not adversely affect existing cyber security controls. For purposes of Standard CIP-007, a significant change shall, at a minimum, include implementation of security patches, cumulative service packs, vendor releases, and version upgrades of operating systems, applications, database platforms, or other third-party software or firmware.

Ports and Services — The Responsible Entity shall establish and document a process to ensure that only those ports and services required for normal and emergency operations are enabled.

Security Patch Management — The Responsible Entity, either separately or as a component of the documented configuration management process specified in CIP-003 Requirement R6, shall establish and document a security patch management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s).

Malicious Software Prevention — The Responsible Entity shall use anti-virus software and other malicious software (“malware”) prevention tools, where technically feasible, to detect, prevent, deter, and mitigate the introduction, exposure, and propagation of malware on all Cyber Assets within the Electronic Security Perimeter(s).

Account Management — The Responsible Entity shall establish, implement, and document technical and procedural controls that enforce access authentication of, and accountability for, all user activity, and that minimize the risk of unauthorized system access.

The Responsible Entity shall implement a policy to minimize and manage the scope and acceptable use of administrator, shared, and other generic account privileges including factory default accounts.

At a minimum, the Responsible Entity shall require and use passwords.

Security Status Monitoring — The Responsible Entity shall ensure that all Cyber Assets within the Electronic Security Perimeter, as technically feasible, implement automated tools or organizational process controls to monitor system events that are related to cyber security.

Disposal or Redeployment — The Responsible Entity shall establish formal methods, processes, and procedures for disposal or redeployment of Cyber Assets within the Electronic Security Perimeter(s) as identified and documented in Standard CIP-005.

Cyber Vulnerability Assessment — The Responsible Entity shall perform a cyber vulnerability assessment of all Cyber Assets within the Electronic Security Perimeter at least annually.

Documentation Review and Maintenance — The Responsible Entity shall review and update the documentation specified in Standard CIP-007 at least annually. Changes resulting from modifications to the systems or controls shall be documented within ninety calendar days of the change.

 

Visit the NERC website for more details regarding Critical Infrastructure Protection Standards.

Learn more about how SUBNET can help you meet NERC CIP standards with PowerSYSTEM Center.





Visit the following links to learn more about NERC CIP standards and how SUBNET can help you to comply.

Home > Skip Navigation LinksSolutions > NERC CIP > CIP-007 Systems Security Management
© 2016 SUBNET Solutions Inc. Terms of Use   Privacy Policy   Contact Us  Resources 
------------------------------