CIP-003-6 — Cyber Security — Security Management Controls
A. Introduction

1.

Title:

Cyber Security — Security Management Controls

2.

Number:

CIP-003-6

3.

Purpose:To specify consistent and sustainable security management controls that
establish responsibility and accountability to protect BES Cyber Systems against
compromise that could lead to misoperation or instability in the Bulk Electric System(BES).

4.

Applicability:

4.1.

Functional Entities: For the purpose of the requirements contained herein, thefollowing list of functional entities will be collectively referred to as “Responsible
Entities.” For requirements in this standard where a specific functional entity or
subset of functional entities are the applicable entity or entities, the functional entity
or entities are specified explicitly.

4.1.1 Balancing Authority
4.1.2 Distribution Provider that owns one or more of the following Facilities, systems,
and equipment for the protection or restoration of the BES:
4.1.2.1 Each underfrequency Load shedding (UFLS) or undervoltage Load shedding(UVLS) system that:
4.1.2.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.1.2.2 Each Special Protection System (SPS) or Remedial Action Scheme (RAS)
where the SPS or RAS is subject to one or more requirements in a NERC or
Regional Reliability Standard.
4.1.2.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3 Generator Operator
4.1.4 Generator Owner
4.1.5 Interchange Coordinator or Interchange Authority
4.1.6 Reliability Coordinator

Page 1 of 40

CIP-003-6 — Cyber Security — Security Management Controls
4.1.7 Transmission Operator
4.1.8 Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above
are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.

4.2.1 Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or restorationof the BES:
4.2.1.1 Each UFLS or UVLS System that:
4.2.1.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.2.1.2 Each SPS or RAS where the SPS or RAS is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2 Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3 Exemptions: The following are exempt from Standard CIP-003-6:
4.2.3.1 Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2 Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters (ESPs).
4.2.3.3 The systems, structures, and components that are regulated by the Nuclear
Regulatory Commission under a cyber security plan pursuant to 10 C.F.R.
Section 73.54.
4.2.3.4 For Distribution Providers, the systems and equipment that are not included
in section 4.2.1 above.

Page 2 of 40

CIP-003-6 — Cyber Security — Security Management Controls
5.

Effective Dates:
See Implementation Plan for CIP-003-6.

6.

Background:Standard CIP-003 exists as part of a suite of CIP Standards related to cyber security,
which require the initial identification and categorization of BES Cyber Systems andrequire organizational, operational, and procedural controls to mitigate risk to BES
Cyber Systems.
The term policy refers to one or a collection of written documents that are used tocommunicate the Responsible Entities’ management goals, objectives andexpectations for how the Responsible Entity will protect its BES Cyber Systems. The
use of policies also establishes an overall governance foundation for creating aculture of security and compliance with laws, regulations, and standards.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any
naming or approval structure beyond what is stated in the requirements. An entity
should include as much as it believes necessary in its documented processes, but it
must address the applicable requirements.
The terms program and plan are sometimes used in place of documented processes
where it makes sense and is commonly understood. For example, documented
processes describing a response are typically referred to as plans (i.e., incident
response plans and recovery plans). Likewise, a security plan can describe an
approach involving multiple procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of
its policies, plans, and procedures involving a subject matter. Examples in thestandards include the personnel risk assessment program and the personnel training
program. The full implementation of the CIP Cyber Security Reliability Standards
could also be referred to as a program. However, the terms program and plan do not
imply any additional requirements beyond what is stated in the standards.
Responsible Entities can implement common controls that meet requirements for
multiple high, medium, and low impact BES Cyber Systems. For example, a single
cyber security awareness program could meet the requirements across multiple BES
Cyber Systems.
Measures provide examples of evidence to show documentation and implementationof the requirement. These measures serve to provide guidance to entities in
acceptable records of compliance and should not be viewed as an all-inclusive list.
Throughout the standards, unless otherwise stated, bulleted items in therequirements and measures are items that are linked with an “or,” and numbered
items are items that are linked with an “and.”

Page 3 of 40

CIP-003-6 — Cyber Security — Security Management Controls
Many references in the Applicability section use a threshold of 300 MW for UFLS and
UVLS. This particular threshold of 300 MW for UVLS and UFLS was provided in
Version 1 of the CIP Cyber Security Standards. The threshold remains at 300 MW
since it is specifically addressing UVLS and UFLS, which are last ditch efforts to savethe BES. A review of UFLS tolerances defined within Regional Reliability Standards for
UFLS program requirements to date indicates that the historical value of 300 MW
represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.

Page 4 of 40

CIP-003-6 — Cyber Security — Security Management Controls
B. Requirements and Measures

R1. Each Responsible Entity shall review and obtain CIP Senior Manager approval at least
once every 15 calendar months for one or more documented cyber security policies
that collectively address the following topics: [Violation Risk Factor: Medium] [TimeHorizon: Operations Planning]
1.1

For its high impact and medium impact BES Cyber Systems, if any:
1.1.1. Personnel and training (CIP-004);
1.1.2. Electronic Security Perimeters (CIP-005) including Interactive Remote
Access;1.1.3. Physical security of BES Cyber Systems (CIP-006);
1.1.4. System security management (CIP-007);
1.1.5. Incident reporting and response planning (CIP-008);
1.1.6. Recovery plans for BES Cyber Systems (CIP-009);
1.1.7. Configuration change management and vulnerability assessments (CIP010);
1.1.8. Information protection (CIP-011); and1.1.9. Declaring and responding to CIP Exceptional Circumstances.

1.2

For its assets identified in CIP-002 containing low impact BES Cyber Systems, if
any:
1.2.1. Cyber security awareness;
1.2.2. Physical security controls;
1.2.3. Electronic access controls for Low Impact External Routable
Connectivity (LERC) and Dial-up Connectivity; and1.2.4. Cyber Security Incident response

M1. Examples of evidence may include, but are not limited to, policy documents; revisionhistory, records of review, or workflow evidence from a document management
system that indicate review of each cyber security policy at least once every 15
calendar months; and documented approval by the CIP Senior Manager for each cybersecurity policy.
R2. Each Responsible Entity with at least one asset identified in CIP-002 containing low
impact BES Cyber Systems shall implement one or more documented cyber security
plan(s) for its low impact BES Cyber Systems that include the sections in Attachment 1.
[Violation Risk Factor: Lower] [Time Horizon: Operations Planning]
Note: An inventory, list, or discrete identification of low impact BES Cyber Systems ortheir BES Cyber Assets is not required. Lists of authorized users are not required.

Page 5 of 40

CIP-003-6 — Cyber Security — Security Management Controls
M2. Evidence shall include each of the documented cyber security plan(s) that collectively
include each of the sections in Attachment 1 and additional evidence to demonstrate
implementation of the cyber security plan(s). Additional examples of evidence persection are located in Attachment 2.
R3.

Each Responsible Entity shall identify a CIP Senior Manager by name and document
any change within 30 calendar days of the change. [Violation Risk Factor: Medium][Time Horizon: Operations Planning]

M3. An example of evidence may include, but is not limited to, a dated and approved
document from a high level official designating the name of the individual identified
as the CIP Senior Manager.
R4. The Responsible Entity shall implement a documented process to delegate authority,
unless no delegations are used. Where allowed by the CIP Standards, the CIP Senior
Manager may delegate authority for specific actions to a delegate or delegates. These
delegations shall be documented, including the name or title of the delegate, thespecific actions delegated, and the date of the delegation; approved by the CIP Senior
Manager; and updated within 30 days of any change to the delegation. Delegation
changes do not need to be reinstated with a change to the delegator. [Violation Risk
Factor: Lower] [Time Horizon: Operations Planning]
M4. An example of evidence may include, but is not limited to, a dated document,
approved by the CIP Senior Manager, listing individuals (by name or title) who aredelegated the authority to approve or authorize specifically identified items.

Page 6 of 40

CIP-003-6 — Cyber Security — Security Management Controls
C. Compliance1.

Compliance Monitoring Process
1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority”(CEA) means NERC or the Regional Entity in their respective roles of monitoringand enforcing compliance with the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity isrequired to retain specific evidence to demonstrate compliance. For instanceswhere the evidence retention period specified below is shorter than the timesince the last audit, the CEA may ask an entity to provide other evidence to showthat it was compliant for the full time period since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as
identified below unless directed by its CEA to retain specific evidence for alonger period of time as part of an investigation:
Each Responsible Entity shall retain evidence of each requirement in thisstandard for three calendar years.



If a Responsible Entity is found non-compliant, it shall keep information
related to the non-compliance until mitigation is complete and approved orfor the time specified above, whichever is longer.



The CEA shall keep the last audit records and all requested and submitted
subsequent audit records.

1.3. Compliance Monitoring and Assessment Processes:
Compliance Audits
Self-Certifications
Spot Checking
Compliance Investigations
Self-Reporting
Complaints
1.4. Additional Compliance Information:
None

Page 7 of 40

CIP-003-6 — Cyber Security — Security Management Controls
2. Table of Compliance Elements
R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

R1

Operations
Planning

Medium The Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address oneof the nine topics
required by R1.
(R1.1)

Moderate VSLHigh VSLThe Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address twoof the nine topics
required by R1.
(R1.1)The Responsible Entity
documented andimplemented one ormore cyber security
policies for its highimpact and medium
impact BES Cyber
Systems, but did not
address three of the nine
topics required by R1.
(R1.1)OROR

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1
within 15 calendar
months but did

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1
within 16 calendar
months but did

The Responsible Entity
did not complete its
review of the one ormore documented cybersecurity policies for its
high impact and medium
impact BES Cyber
Systems as required by
R1 within 17 calendar
months but did
complete this review inless than or equal to 18

OR

Page 8 of 40

Severe VSL
The Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address fouror more of the nine
topics required by
R1. (R1.1)
OR
The Responsible
Entity did not haveany documented
cyber security
policies for its highimpact and medium
impact BES Cyber
Systems as requiredby R1. (R1.1)
ORCIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL

complete this review
in less than or equal
to 16 calendar
months of theprevious review.
(R1.1)

complete this review
in less than or equal
to 17 calendar
months of theprevious review.
(R1.1)OROR

The Responsible
Entity did notcomplete its
approval of the one
or more documented
cyber security
policies for its highimpact and medium
impact BES Cyber
Systems as requiredby R1 by the CIP
Senior Manager
within 15 calendar
months but did
complete thisapproval in less thanor equal to 16
calendar months of

The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1 by
the CIP Senior
Manager within 16
calendar months but
did complete thisapproval in less thanor equal to 17
calendar months ofHigh VSL
calendar months of theprevious review. (R1.1)
OR
The Responsible Entity
did not complete its
approval of the one ormore documented cybersecurity policies for its
high impact and medium
impact BES Cyber
Systems as required by
R1 by the CIP Senior
Manager within 17
calendar months but did
complete this approvalin less than or equal to
18 calendar months ofthe previous approval.
(R1)
OR
The Responsible Entity
documented one ormore cyber security
policies for its assets
identified in CIP-002
containing low impact

Page 9 of 40

Severe VSL
The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies as
required by R1
within 18 calendar
months of theprevious review. (R1)ORThe Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1 by
the CIP Senior
Manager within 18
calendar months of

CIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL

the previous
approval. (R1.1)

the previous
approval. (R1.1)

OR

OR

The Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address oneof the four topics
required by R1.
(R1.2)The Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address twoof the four topics
required by R1.
(R1.2)OROR

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as

High VSLBES Cyber Systems, but
did not address three ofthe four topics requiredby R1. (R1.2)
OR
The Responsible Entity
did not complete its
review of the one ormore documented cybersecurity policies for its
assets identified in CIP002 containing low
impact BES Cyber
Systems as required by
R1 within 17 calendar
months but did
complete this review inless than or equal to 18
calendar months of theprevious review. (R1.2)
OR
The Responsible Entity
did not complete its
approval of the one ormore documented cybersecurity policies for its

Page 10 of 40

Severe VSL
the previous
approval. (R1.1)
OR
The Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address anyof the four topics
required by R1.
(R1.2)OR
The Responsible
Entity did not haveany documented
cyber security
policies for its assets
identified in CIP-002
containing low
impact BES Cyber
Systems as requiredby R1. (R1.2)

CIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL

required byRequirement R1
within 15 calendar
months but did
complete this review
in less than or equal
to 16 calendar
months of theprevious review.
(R1.2)

required byRequirement R1
within 16 calendar
months but did
complete this review
in less than or equal
to 17 calendar
months of theprevious review.
(R1.2)OROR

The Responsible
Entity did notcomplete its
approval of the one
or more documented
cyber security
policies for its assets
identified in CIP-002
containing low
impact BES Cyber
Systems as required
by Requirement R1
by the CIP Senior
Manager within 15
calendar months but
did complete this

The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1 by
the CIP Senior
Manager within 16
calendar months but

High VSL
assets identified in CIP002 containing low
impact BES Cyber
Systems as required byRequirement R1 by the
CIP Senior Manager
within 17 calendar
months but did
complete this approvalin less than or equal to
18 calendar months ofthe previous approval.
(R1.2)

Page 11 of 40

Severe VSL
OR
The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1 by
the CIP Senior
Manager within 18
calendar months ofthe previous
approval. (R1.2)

CIP-003-6 — Cyber Security — Security Management Controls

R#

R2

Time
HorizonOperations
Planning

VRF

Lower

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL

approval in less thanor equal to 16
calendar months ofthe previous
approval. (R1.2)

did complete thisapproval in less thanor equal to 17
calendar months ofthe previous
approval. (R1.2)

The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document cybersecurity awarenessaccording to CIP-0036, Requirement R2,
Attachment 1,
Section 1. (R2)The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to reinforce cybersecurity practices atleast once every 15
calendar months
according to CIP003-6, Requirement
R2, Attachment 1,
Section 1. (R2)ORThe Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES CyberORThe Responsible
Entity documented
one or more incident
response plans

High VSLThe Responsible Entity
documented one ormore Cyber Security
Incident response plans
within its cyber security
plan(s) for its assets
containing low impact
BES Cyber Systems, butfailed to test each Cyber
Security Incident
response plan(s) at least
once every 36 calendar
months according to CIP003-6, Requirement R2,
Attachment 1, Section 4.
(R2)
OR
The Responsible Entity
documented thedetermination ofPage 12 of 40

Severe VSL

The Responsible
Entity failed to
document or
implement one ormore cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems according to
CIP-003-6,
Requirement R2,
Attachment 1. (R2)

CIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL

Systems, but failed
to document one ormore Cyber Security
Incident responseplans according to
CIP-003-6,
Requirement R2,
Attachment 1,
Section 4. (R2)within its cybersecurity plan(s) for
its assets containing
low impact BES
Cyber Systems, butfailed to include theprocess for
identification,
classification, andresponse to Cyber
Security Incidents
according to CIP003-6, Requirement
R2, Attachment 1,
Section 4. (R2)ORThe Responsible
Entity documented
one or more Cyber
Security Incident
response plans
within its cybersecurity plan(s) for
its assets containing
low impact BES
Cyber Systems, butfailed to update each
Cyber Security
Incident responseplan(s) within 180
days according to
CIP-003-6,
Requirement R2,(R2)
OR
The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document thedetermination ofHigh VSL
whether an identified
Cyber Security Incident is
a Reportable Cyber
Security Incident, butfailed to notify theElectricity Sector
Information Sharing andAnalysis Center (ES-ISAC)
according to CIP-003-6,
Requirement R2,
Attachment 1, Section 4.
(R2)
OR
The Responsible Entity
documented andimplemented electronic
access controls for LERC,
but failed to implement
a LEAP or permit
inbound and outboundaccess according to CIP003-6, Requirement R2,
Attachment 1, Section 3.
(R2)
ORPage 13 of 40

Severe VSLCIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL
Attachment 1,
Section 4. (R2)Moderate VSL
whether an
identified Cyber
Security Incident is a
Reportable Cyber
Security Incident andsubsequent
notification to theElectricity Sector
Information Sharing
and Analysis Center(ES-ISAC) according
to CIP-003-6,
Requirement R2,
Attachment 1,
Section 4.
OR
The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document
physical security
controls according to
CIP-003-6,

High VSLThe Responsible Entity
documented andimplemented electronic
access controls for its
assets containing low
impact BES Cyber
Systems, but failed to
document andimplement
authentication of all
Dial-up Connectivity, ifany, that provides accessto low impact BES Cyber
Systems according to
CIP-003-6, Requirement
R2, Attachment 1,
Section 3. (R2)ORThe Responsible Entity
documented the physicalaccess controls for its
assets containing low
impact BES Cyber
Systems, but failed to
implement the physicalsecurity controls
according to CIP-003-6,

Page 14 of 40

Severe VSLCIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSL
Requirement R2,
Attachment 1,
Section 2. (R2)High VSL

Severe VSL

Requirement R2,
Attachment 1, Section 2.
(R2)

OR
The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document
electronic access
controls according to
CIP-003-6,
Requirement R2,
Attachment 1,
Section 3. (R2)R3

Operations
Planning

Medium The Responsible
Entity has identified
by name a CIP Senior
Manager, but did not
document changes
to the CIP Senior
Manager within 30

The Responsible
Entity has identified
by name a CIP Senior
Manager, but did
not documentchanges to the CIP
Senior Manager

The Responsible Entity
has identified by name a
CIP Senior Manager, but
did not documentchanges to the CIP
Senior Manager within
50 calendar days but did
Page 15 of 40

The Responsible
Entity has not
identified, by name,a CIP Senior
Manager.
ORCIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

R4

Operations
Planning

Lower

Moderate VSLHigh VSL

Severe VSL

calendar days but did
document thischange in less than
40 calendar days ofthe change. (R3)within 40 calendar
days but did
document thischange in less than
50 calendar days ofthe change. (R3)document this change inless than 60 calendar
days of the change. (R3)The Responsible
Entity has identified
by name a CIP Senior
Manager, but did
not documentchanges to the CIP
Senior Manager
within 60 calendar
days of the change.
(R3)

The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andspecific actions
delegated, but did
not documentchanges to thedelegate within 30
calendar days but did
document thischange in less than
40 calendar days ofthe change. (R4)The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andspecific actions
delegated, but did
not documentchanges to thedelegate within 40
calendar days but
did document thischange in less than
50 calendar days ofthe change. (R4)The Responsible Entity
has identified a delegate
by name, title, date ofdelegation, and specificactions delegated, but
did not documentchanges to the delegate
within 50 calendar days
but did document thischange in less than 60
calendar days of thechange. (R4)The Responsible
Entity has used
delegated authority
for actions where
allowed by the CIP
Standards, but does
not have a process
to delegate actions
from the CIP Senior
Manager. (R4)

Page 16 of 40

OR
The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andCIP-003-6 — Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL
specific actions
delegated, but did
not documentchanges to thedelegate within 60
calendar days of thechange. (R4)

D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

None.

Page 17 of 40

CIP-003-6 — Cyber Security — Security Management Controls
Version History
VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify the requirements
and to bring the compliance elements
into conformance with the latest
guidelines for developing complianceelements of standards.

Change Tracking
3/24/06

Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
responsible entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.
3

12/16/09

Updated Version Number from -2 to -3
In Requirement 1.6, deleted the sentence
pertaining to removing component or
system from service in order to performtesting, in response to FERC order issued
September 30, 2009.

3

12/16/09

Approved by the NERC Board of Trustees.

3

3/31/10

Approved by FERC.

4

1/24/11

Approved by the NERC Board of Trustees.

5

11/26/12

Adopted by the NERC Board of Trustees.

5

11/22/13

FERC Order issued approving CIP-003-5.

6

11/13/14

Adopted by the NERC Board of Trustees.

Modified tocoordinate withother CIP
standards and torevise format touse RBS Template.

Addressed two
FERC directives
from Order No.
791 related to
identify, assess,and correct

Page 18 of 40

CIP-003-6 — Cyber Security — Security Management Controls

VersionDate

ActionChange Tracking
language andcommunication
networks.

6

2/12/15

Adopted by the NERC Board of Trustees.

6

1/21/16

FERC Order issued approving CIP-003-6.
Docket No. RM15-14-000

Replaces theversion adopted
by the Board on
11/13/2014.
Revised version
addresses
remaining
directives from
Order No. 791
related totransient devices
and low impact
BES Cyber
Systems.

Page 19 of 40

CIP-003-6 — Cyber Security — Security Management Controls
CIP-003-6 - Attachment 1
Required Sections for Cyber Security Plan(s) for Assets Containing Low Impact BES Cyber
Systems
Responsible Entities shall include each of the sections provided below in the cyber security
plan(s) required under Requirement R2.
Responsible Entities with multiple-impact BES Cyber Systems ratings can utilize policies,
procedures, and processes for their high or medium impact BES Cyber Systems to fulfill thesections for the development of low impact cyber security plan(s). Each Responsible Entity candevelop a cyber security plan(s) either by individual asset or groups of assets.
Section 1. Cyber Security Awareness: Each Responsible Entity shall reinforce, at least once
every 15 calendar months, cyber security practices (which may include associatedphysical security practices).
Section 2. Physical Security Controls: Each Responsible Entity shall control physical access,based on need as determined by the Responsible Entity, to (1) the asset or thelocations of the low impact BES Cyber Systems within the asset and (2) the Low
Impact BES Cyber System Electronic Access Points (LEAPs), if any.
Section 3. Electronic Access Controls: Each Responsible Entity shall:
3.1

For LERC, if any, implement a LEAP to permit only necessary inbound andoutbound bi-directional routable protocol access; and3.2

Implement authentication for all Dial-up Connectivity, if any, that provides accessto low impact BES Cyber Systems, per Cyber Asset capability.

Section 4. Cyber Security Incident Response: Each Responsible Entity shall have one or more
Cyber Security Incident response plan(s), either by asset or group of assets, whichshall include:
4.1

Identification, classification, and response to Cyber Security Incidents;

4.2

Determination of whether an identified Cyber Security Incident is a Reportable
Cyber Security Incident and subsequent notification to the Electricity Sector
Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law;

4.3

Identification of the roles and responsibilities for Cyber Security Incident responseby groups or individuals;

4.4

Incident handling for Cyber Security Incidents;

4.5

Testing the Cyber Security Incident response plan(s) at least once every 36
calendar months by: (1) responding to an actual Reportable Cyber Security
Incident; (2) using a drill or tabletop exercise of a Reportable Cyber Security

Page 20 of 40

CIP-003-6 — Cyber Security — Security Management Controls
Incident; or (3) using an operational exercise of a Reportable Cyber Security
Incident; and4.6

Updating the Cyber Security Incident response plan(s), if needed, within 180
calendar days after completion of a Cyber Security Incident response plan(s) testor actual Reportable Cyber Security Incident.

Page 21 of 40

CIP-003-6 — Cyber Security — Security Management Controls
CIP-003-6 - Attachment 2
Examples of Evidence for Cyber Security Plan(s) for Assets Containing Low Impact BES Cyber
Systems
Section 1 - Cyber Security Awareness: An example of evidence for Section 1 may include, but is
not limited to, documentation that the reinforcement of cyber security practices occurred atleast once every 15 calendar months. The evidence could be documentation through one ormore of the following methods:


Direct communications (for example, e-mails, memos, or computer-based training);Indirect communications (for example, posters, intranet, or brochures); orManagement support and reinforcement (for example, presentations or meetings).

Section 2 - Physical Security Controls: Examples of evidence for Section 2 may include, but are
not limited to:Documentation of the selected access control(s) (e.g., card key, locks, perimeter
controls), monitoring controls (e.g., alarm systems, human observation), or otheroperational, procedural, or technical physical security controls that control physicalaccess to both:a. The asset, if any, or the locations of the low impact BES Cyber Systems within theasset; andb. The Cyber Asset, if any, containing a LEAP.

Section 3 - Electronic Access Controls: Examples of evidence for Section 3 may include, but are
not limited to:Documentation showing that inbound and outbound connections for any LEAP(s) are
confined to only those the Responsible Entity deems necessary (e.g., by restricting IP
addresses, ports, or services); and documentation of authentication for Dial-up
Connectivity (e.g., dial out only to a preprogrammed number to deliver data, dial-backmodems, modems that must be remotely controlled by the control center or control
room, or access control on the BES Cyber System).

Section 4 - Cyber Security Incident Response: An example of evidence for Section 4 may include,
but is not limited to, dated documentation, such as policies, procedures, or process documentsof one or more Cyber Security Incident response plan(s) developed either by asset or group ofassets that include the following processes:
1. to identify, classify, and respond to Cyber Security Incidents; to determine whether an
identified Cyber Security Incident is a Reportable Cyber Security Incident and for
notifying the Electricity Sector Information Sharing and Analysis Center (ES-ISAC);

Page 22 of 40

CIP-003-6 — Cyber Security — Security Management Controls
2. to identify and document the roles and responsibilities for Cyber Security Incident
response by groups or individuals (e.g., initiating, documenting, monitoring, reporting,etc.);
3. for incident handling of a Cyber Security Incident (e.g., containment, eradication, or
recovery/incident resolution);
4. for testing the plan(s) along with the dated documentation that a test has been
completed at least once every 36 calendar months; and5. to update, as needed, Cyber Security Incident response plan(s) within 180 calendar days
after completion of a test or actual Reportable Cyber Security Incident.

Page 23 of 40

Guidelines and Technical Basis
Guidelines and Technical Basis

Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. In addition to the set of BES Facilities, Control Centers, and other systems andequipment, the list includes the set of systems and equipment owned by Distribution Providers.
While the NERC Glossary term “Facilities” already includes the BES characteristic, the additionaluse of the term BES here is meant to reinforce the scope of applicability of these Facilities
where it is used, especially in this applicability scoping section. This in effect sets the scope ofFacilities, systems, and equipment that is subject to the standards.
Requirement R1:
In developing policies in compliance with Requirement R1, the number of policies and theircontent should be guided by a Responsible Entity's management structure and operating
conditions. Policies might be included as part of a general information security program for theentire organization, or as components of specific programs. The Responsible Entity has theflexibility to develop a single comprehensive cyber security policy covering the required topics,
or it may choose to develop a single high-level umbrella policy and provide additional policy
detail in lower level documents in its documentation hierarchy. In the case of a high-levelumbrella policy, the Responsible Entity would be expected to provide the high-level policy aswell as the additional documentation in order to demonstrate compliance with CIP-003-6,
Requirement R1.
If a Responsible Entity has any high or medium impact BES Cyber Systems, the one or morecyber security policies must cover the nine subject matter areas required by CIP-003-6,
Requirement R1, Part 1.1. If a Responsible Entity has identified from CIP-002 any assets
containing low impact BES Cyber Systems, the one or more cyber security policies must cover
the four subject matter areas required by Requirement R1, Part 1.2.
Responsible Entities that have multiple-impact rated BES Cyber Systems are not required tocreate separate cyber security policies for high, medium, or low impact BES Cyber Systems. The
Responsible Entities have the flexibility to develop policies that cover all three impact ratings.
Implementation of the cyber security policy is not specifically included in CIP-003-6,
Requirement R1 as it is envisioned that the implementation of this policy is evidenced throughPage 24 of 40

Guidelines and Technical Basis
successful implementation of CIP-003 through CIP-011. However, Responsible Entities areencouraged not to limit the scope of their cyber security policies to only those requirements in
NERC cyber security Reliability Standards, but to develop a holistic cyber security policy
appropriate for its organization. Elements of a policy that extend beyond the scope of NERC’s
cyber security Reliability Standards will not be considered candidates for potential violations
although they will help demonstrate the organization’s internal culture of compliance andposture towards cyber security.
For Part 1.1, the Responsible Entity should consider the following for each of the required
topics in its one or more cyber security policies for medium and high impact BES Cyber Systems,
if any:1.1.1 Personnel and training (CIP-004)
Organization position on acceptable background investigations



Identification of possible disciplinary action for violating this policyAccount management

1.1.2 Electronic Security Perimeters (CIP-005) including Interactive Remote Access

Organization stance on use of wireless networks



Identification of acceptable authentication methods

Identification of trusted and untrusted resources

Monitoring and logging of ingress and egress at Electronic Access Points



Maintaining up-to-date anti-malware software before initiating Interactive Remote
Access

Maintaining up-to-date patch levels for operating systems and applications used toinitiate Interactive Remote Access

Disabling VPN “split-tunneling” or “dual-homed” workstations before initiating
Interactive Remote AccessFor vendors, contractors, or consultants: include language in contracts that requires
adherence to the Responsible Entity’s Interactive Remote Access controls

1.1.3 Physical security of BES Cyber Systems (CIP-006)
Strategy for protecting Cyber Assets from unauthorized physical access

Acceptable physical access control methods

Monitoring and logging of physical ingress

1.1.4 System security management (CIP-007)
Strategies for system hardening

Acceptable methods of authentication and access control

Page 25 of 40

Guidelines and Technical BasisPassword policies including length, complexity, enforcement, prevention of brute force
attemptsMonitoring and logging of BES Cyber Systems

1.1.5 Incident reporting and response planning (CIP-008)


Recognition of Cyber Security IncidentsAppropriate notifications upon discovery of an incidentObligations to report Cyber Security Incidents

1.1.6 Recovery plans for BES Cyber Systems (CIP-009)


Availability of spare components



Availability of system backups

1.1.7 Configuration change management and vulnerability assessments (CIP-010)


Initiation of change requests

Approval of changes



Break-fix processes

1.1.8 Information protection (CIP-011)
Information access control methods



Notification of unauthorized information disclosureInformation access on a need-to-know basis

1.1.9 Declaring and responding to CIP Exceptional Circumstances


Processes to invoke special procedures in the event of a CIP Exceptional CircumstanceProcesses to allow for exceptions to policy that do not violate CIP requirements

Requirements relating to exceptions to a Responsible Entity’s security policies were removed
because it is a general management issue that is not within the scope of a reliability
requirement. It is an internal policy requirement and not a reliability requirement. However,Responsible Entities are encouraged to continue this practice as a component of their cybersecurity policies.
In this and all subsequent required approvals in the NERC CIP Reliability Standards, theResponsible Entity may elect to use hardcopy or electronic approvals to the extent that there issufficient evidence to ensure the authenticity of the approving party.
Requirement R2:
Using the list of assets containing low impact BES Cyber Systems from CIP-002, the intent of therequirement is for each Responsible Entity to create, document, and implement one or morecyber security plan(s) that addresses objective criteria for the protection of low impact BES
Cyber Systems. The protections required by Requirement R2 reflect the level of risk that misuse
Page 26 of 40

Guidelines and Technical Basisor the unavailability of low impact BES Cyber Systems poses to the BES. The intent is that therequired protections are part of a program that covers the low impact BES Cyber Systems
collectively either at an asset or site level (assets containing low impact BES Cyber Systems), but
not at an individual device or system level.
There are four subject matter areas, as identified in Attachment 1, that must be covered by thecyber security plan: (1) cyber security awareness, (2) physical security controls, (3) electronic
access controls for LERC and Dial-up Connectivity, and (4) Cyber Security Incident response.
Requirement R2, Attachment 1
As noted, Attachment 1 contains the sections that must be in the cyber security plan(s). The
intent is to allow entities that have a combination of high, medium, and low impact BES Cyber
Systems the flexibility to choose, if desired, to cover their low impact BES Cyber Systems (or any
subset) under their programs used for the high or medium impact BES Cyber Systems rather
than maintain two separate programs. Guidance for each of the four subject matter areas of
Attachment 1 is provided below.
Requirement R2, Attachment 1, Section 1 – Cyber Security AwarenessThe intent of the cyber security awareness program is for entities to reinforce good cybersecurity practices with their personnel at least once every 15 calendar months. The entity has
the discretion to determine the topics to be addressed and the manner in which it willcommunicate these topics. As evidence of compliance, the Responsible Entity should be able toproduce the awareness material that was delivered according to the delivery method(s) (e.g.,posters, emails, or topics at staff meetings, etc.). The Responsible Entity is not required tomaintain lists of recipients and track the reception of the awareness material by personnel.
Although the focus of the awareness is cyber security, it does not mean that only technologyrelated topics can be included in the program. Appropriate physical security topics (e.g.,
tailgating awareness and protection of badges for physical security, or “If you see something,say something” campaigns, etc.) are valid for cyber security awareness. The intent is to cover
topics concerning any aspect of the protection of BES Cyber Systems.
Requirement R2, Attachment 1, Section 2 – Physical Security Controls
The Responsible Entity must document and implement methods to control physical access to(1) low impact BES Cyber Systems at assets containing low impact BES Cyber System(s) and (2)LEAPs, if any. If the LEAP is located within the BES asset and inherits the same controls outlined
in Section 2, this can be noted by the Responsible Entity in either its policies or cyber security
plan(s) to avoid duplicate documentation of the same controls.
The Responsible Entity has the flexibility in the selection of the methods used to meet theobjective to control physical access to the asset(s) containing low impact BES Cyber Systems,
the low impact BES Cyber Systems themselves, or LEAPs, if any. The Responsible Entity may use
one or a combination of access controls, monitoring controls, or other operational, procedural,or technical physical security controls. Entities may use perimeter controls (e.g., fences withlocked gates, guards, or site access policies, etc.) or more granular areas of physical access
control in areas where low impact BES Cyber Systems are located, such as control rooms orPage 27 of 40

Guidelines and Technical Basiscontrol houses. User authorization programs and lists of authorized users for physical accessare not required although they are an option to meet the security objective.
The objective is to control the physical access based on need as determined by the Responsible
Entity. The need can be documented at the policy level for access to the site or systems,
including LEAPs. The requirement does not obligate an entity to specify a need for each accessor authorization of a user for access.
Monitoring as a physical security control can be used as a complement or an alternative toaccess control. Examples of monitoring controls include, but are not limited to: (1) alarmsystems to detect motion or entry into a controlled area, or (2) human observation of acontrolled area. Monitoring does not necessarily require logging and maintaining logs but could
include monitoring that physical access has occurred or been attempted (e.g., door alarm, or
human observation, etc.). The monitoring does not need to be per low impact BES Cyber
System but should be at the appropriate level to meet the security objective.
Requirement R2, Attachment 1, Section 3 – Electronic Access Controls
Section 3 requires the establishment of boundary protections for low impact BES Cyber Systems
when the low impact BES Cyber Systems have bi-directional routable protocol communication
or Dial-up Connectivity to devices external to the asset containing the low impact BES Cyber
Systems. The establishment of boundary protections is intended to control communication
either into the asset containing low impact BES Cyber System(s) or to the low impact BES Cyber
System itself to reduce the risks associated with uncontrolled communication using routable
protocols or Dial-up Connectivity. The term “electronic access control” is used in the general
sense, i.e., to control access, and not in the specific technical sense requiring authentication,authorization, and auditing. The Responsible Entity is not required to establish LERC
communication or a LEAP if there is no bi-directional routable protocol communication or Dialup Connectivity present. In the case where there is no external bi-directional routable protocol
communication or Dial-up Connectivity, the Responsible Entity can document the absence ofsuch communication in its low impact cyber security plan(s).
The defined terms LERC and LEAP are used to avoid confusion with the similar terms used forhigh and medium impact BES Cyber Systems (e.g., External Routable Connectivity (ERC) or
Electronic Access Point (EAP)). To future-proof the standards, and in order to avoid futuretechnology issues, the definitions specifically exclude “point-to-point communications between
intelligent electronic devices that use routable communication protocols for time-sensitive
protection or control functions between Transmission station or substation assets containing
low impact BES Cyber Systems,” such as IEC 61850 messaging. This does not exclude Control
Center communication but rather excludes the communication between the intelligent
electronic devices themselves. A Responsible Entity using this technology is not expected to
implement a LEAP. This exception was included so as not to inhibit the functionality of the timesensitive requirements related to this technology nor to preclude the use of such time-sensitive
reliability enhancing functions if they use a routable protocol in the future.
When determining whether there is LERC to the low impact BES Cyber System, the definition
uses the phrases “direct user-initiated interactive access or a direct device-to-device connection

Page 28 of 40

Guidelines and Technical Basisto a low impact BES Cyber System(s) from a Cyber Asset outside the asset containing those low
impact BES Cyber System(s) via a bi-directional routable protocol connection.” The intent of“direct” in the definition is to indicate LERC exists if a person is sitting at another device outsideof the asset containing the low impact BES Cyber System, and the person can connect to logon,
configure, read, or interact, etc. with the low impact BES Cyber System using a bi-directionalroutable protocol within a single end-to-end protocol session even if there is a serial-toroutable protocol conversion. The reverse case would also be LERC, in which the individual sits
at the low impact BES Cyber System and connects to a device outside the asset containing low
impact BES Cyber Systems using a single end-to-end bi-directional routable protocol session.
Additionally, for “device-to-device connection,” LERC exists if the Responsible Entity has devices
outside of the asset containing the low impact BES Cyber System sending or receiving bidirectional routable communication to or from the low impact BES Cyber System.
When identifying a LEAP, Responsible Entities are provided flexibility in the selection of theinterface on a Cyber Asset that controls the LERC. Examples include, but are not limited to, theinternal (facing the low impact BES Cyber Systems) interface on an external or host-based
firewall, the internal interface on a router that has implemented an access control list (ACL), or
other security device. The entity also has flexibility with respect to the location of the LEAP.
LEAPs are not required to reside at the asset containing the low impact BES Cyber Systems.
Furthermore, the entity is not required to establish a unique physical LEAP per asset containing
low impact BES Cyber Systems. Responsible Entities can have a single Cyber Asset containing
multiple LEAPs that controls the LERC for more than one asset containing low impact BES Cyber
Systems. Locating the Cyber Asset with multiple LEAPs at an external location with multiple
assets containing low impact BES Cyber Systems “behind” it, however, should not allow
uncontrolled access to assets containing low impact BES Cyber Systems sharing a Cyber Assetcontaining the LEAP(s).
In Reference Model 4, the communication flows through an IP/Serial converter. LERC iscorrectly identified in this Reference Model because the IP/Serial converter in this instance isdoing nothing more than extending the communication between the low impact BES Cyber
System and the Cyber Asset outside the asset containing the low impact BES Cyber System. In
contrast, Reference Model 6 has placed a Cyber Asset that performs a complete break orinterruption that does not allow the user or device data flow to directly communicate with the
low impact BES Cyber System. The Cyber Asset in Reference Model 6 is preventing extending
access to the low impact BES Cyber System from the Cyber Asset outside the asset containing
the low impact BES Cyber System. The intent is that if the IP/Serial converter that is deployed
only does a “pass-through” of the data flow communication, then that “pass-through” data
flow communication is LERC and a LEAP is required. However, if that IP/Serial converter
performs some type of authentication in the data flow at the asset containing the low impact
BES Cyber System before the communication can be sent to the low impact BES Cyber System,
then that type of IP/Serial converter implementation is not LERC.
A Cyber Asset that contains interface(s) that only perform the function of a LEAP does not meetthe definition of Electronic Access Control or Monitoring System (EACMS) associated withmedium or high impact BES Cyber Systems and is not subject to the requirements applicable toan EACMS. However, a Cyber Asset may contain some interfaces that function as a LEAP andPage 29 of 40

Guidelines and Technical Basisother interfaces that function as an EAP for high or medium impact BES Cyber Systems. In thiscase, the Cyber Asset would also be subject to the requirements applicable to the EACMS
associated with the medium or high impact BES Cyber Systems.
Examples of sufficient access controls may include:

Any LERC for the asset passes through a LEAP with explicit inbound andoutbound access permissions defined, or equivalent method by which both
inbound and outbound connections are confined to only those that the
Responsible Entity deems necessary (e.g., IP addresses, ports, or services).

As shown in Reference Model 1 below, the low impact BES Cyber System has ahost-based firewall that is controlling the inbound and outbound access. In thismodel, it is also possible that the host-based firewall could be on a non-BES
Cyber Asset. The intent is that the host-based firewall controls the inbound andoutbound access between the low impact BES Cyber System and the Cyber
Asset in the business network.



As shown in Reference Model 5 below, a non-BES Cyber Asset has been placed
between the low impact BES Cyber System on the substation network and the
Cyber Asset in the business network. The expectation is that the non-BES Cyber
Asset has provided a “protocol break” so that access to the low impact BES
Cyber System is only from the non-BES Cyber Asset that is located within theasset containing the low impact BES Cyber System.

Dial-up Connectivity to a low impact BES Cyber System is set to dial out only
(no auto-answer) to a preprogrammed number to deliver data. Incoming Dialup Connectivity is to a dialback modem, a modem that must be remotely
controlled by the control center or control room, has some form of access
control, or the low impact BES Cyber System has access control.

Some examples of situations that would lack sufficient access controls to meet the intent of thisrequirement include:

An asset has Dial-up Connectivity and a low impact BES Cyber System isreachable via an auto-answer modem that connects any caller to the Cyber
Asset that has a default password. There is no practical access control in thisinstance.

An asset has LERC due to a BES Cyber System within it having a wireless cardon a public carrier that allows the BES Cyber System to be reachable via apublic IP address. In essence, low impact BES Cyber Systems should not be
accessible from the Internet and search engines such as Shodan.



In Reference Model 5, using just dual-homing or multiple-network interface
cards without disabling IP forwarding in the non-BES Cyber Asset within the
DMZ to provide separation between the low impact BES Cyber System and thebusiness network would not meet the intent of “controlling” inbound andPage 30 of 40

Guidelines and Technical Basisoutbound electronic access assuming there was no other host-based firewall orother security device on that non-BES Cyber Asset.
The following diagrams provide reference examples intended to illustrate how to determine
whether there is LERC and for implementing a LEAP. While these diagrams identify several
possible configurations, Responsible Entities may have additional configurations not identified
below.

Page 31 of 40

Guidelines and Technical Basis

Page 32 of 40

Guidelines and Technical Basis

Page 33 of 40

Guidelines and Technical Basis

Page 34 of 40

Guidelines and Technical Basis

Page 35 of 40

Guidelines and Technical Basis

Page 36 of 40

Guidelines and Technical Basis

Requirement R2, Attachment 1, Section 4 – Cyber Security Incident Response
The entity should have one or more documented Cyber Security Incident response plan(s) that
include each of the topics listed in Section 4. If, in the normal course of business, suspicious
activities are noted at an asset containing low impact BES Cyber Systems, the intent is for theentity to implement a Cyber Security Incident response plan that will guide the entity inresponding to the incident and reporting the incident if it rises to the level of a Reportable
Cyber Security Incident.
Entities are provided the flexibility to develop their Attachment 1, Section 4 Cyber Security
Incident response plan(s) by asset or group of assets. The plans do not need to be on a per
asset site or per low impact BES Cyber System basis. Entities can choose to use a single
enterprise-wide plan to fulfill the obligations for low impact BES Cyber Systems.

Page 37 of 40

Guidelines and Technical Basis
The plan(s) must be tested once every 36 months. This is not an exercise per low impact BES
Cyber Asset or per type of BES Cyber Asset but rather is an exercise of each incident response
plan the entity created to meet this requirement. An actual Reportable Cyber Security Incident
counts as an exercise as do other forms of tabletop exercises or drills. NERC-led exercises suchas GridEx participation would also count as an exercise provided the entity’s response plan isfollowed. The intent of the requirement is for entities to keep the Cyber Security Incident
response plan(s) current, which includes updating the plan(s), if needed, within 180 days
following a test or an actual incident.
For low impact BES Cyber Systems, the only portion of the definition of Cyber Security Incident
that would apply is‚ “A malicious act or suspicious event that disrupts, or was an attempt to
disrupt, the operation of a BES Cyber System.” The other portion of that definition is not to be
used to require ESPs and PSPs for low impact BES Cyber Systems.
Requirement R3:
The intent of CIP-003-6, Requirement R3 is effectively unchanged since prior versions of thestandard. The specific description of the CIP Senior Manager has now been included as adefined term rather than clarified in the Reliability Standard itself to prevent any unnecessary
cross-reference to this standard. It is expected that the CIP Senior Manager will play a key rolein ensuring proper strategic planning, executive/board-level awareness, and overall program
governance.
Requirement R4:
As indicated in the rationale for CIP-003-6, Requirement R4, this requirement is intended todemonstrate a clear line of authority and ownership for security matters. The intent of the SDT
was not to impose any particular organizational structure, but, rather, the intent is to afford the
Responsible Entity significant flexibility to adapt this requirement to its existing organizational
structure. A Responsible Entity may satisfy this requirement through a single delegation
document or through multiple delegation documents. The Responsible Entity can make use of
the delegation of the delegation authority itself to increase the flexibility in how this applies to
its organization. In such a case, delegations may exist in numerous documentation records aslong as the collection of these documentation records shows a clear line of authority back to
the CIP Senior Manager. In addition, the CIP Senior Manager could also choose not to delegate
any authority and meet this requirement without such delegation documentation.
The Responsible Entity must keep its documentation of the CIP Senior Manager and any
delegations up-to-date. This is to ensure that individuals do not assume any undocumented
authority. However, delegations do not have to be re-instated if the individual who delegated
the task changes roles or the individual is replaced. For instance, assume that John Doe isnamed the CIP Senior Manager and he delegates a specific task to the Substation MaintenanceManager. If John Doe is replaced as the CIP Senior Manager, the CIP Senior Manager
documentation must be updated within the specified timeframe, but the existing delegation to
the Substation Maintenance Manager remains in effect as approved by the previous CIP Senior
Manager, John Doe.

Page 38 of 40

Guidelines and Technical Basis
Rationale:

During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:
One or more security policies enable effective implementation of the requirements of the cybersecurity Reliability Standards. The purpose of policies is to provide a management andgovernance foundation for all requirements that apply to a Responsible Entity’s BES Cyber
Systems. The Responsible Entity can demonstrate through its policies that its management
supports the accountability and responsibility necessary for effective implementation of therequirements.
Annual review and approval of the cyber security policies ensures that the policies are kept-upto-date and periodically reaffirms management’s commitment to the protection of its BES
Cyber Systems.
Rationale for Requirement R2:
In response to FERC Order No. 791, Requirement R2 requires entities to develop and implement
cyber security plans to meet specific security control objectives for assets containing low impact
BES Cyber Systems. The cyber security plan(s) covers four subject matter areas: (1) cybersecurity awareness; (2) physical security controls; (3) electronic access controls; and (4) Cyber
Security Incident response. This plan(s), along with the cyber security policies required under
Requirement R1, Part 1.2, provides a framework for operational, procedural, and technicalsafeguards for low impact BES Cyber Systems.
Considering the varied types of low impact BES Cyber Systems across the BES, Attachment 1
provides Responsible Entities flexibility on how to apply the security controls to meet the
security objectives. Additionally, because many Responsible Entities have multiple-impact rated
BES Cyber Systems, nothing in the requirement prohibits entities from using their high andmedium impact BES Cyber System policies, procedures, and processes to implement security
controls required for low impact BES Cyber Systems, as detailed in Requirement R2,
Attachment 1.
Responsible Entities will use their identified assets containing low impact BES Cyber System(s)(developed pursuant to CIP-002) to substantiate the sites or locations associated with low
impact BES Cyber Systems. However, there is no requirement or compliance expectation for
Responsible Entities to maintain a list(s) of individual low impact BES Cyber Systems and theirassociated cyber assets or to maintain a list of authorized users.

Page 39 of 40

Guidelines and Technical Basis

Rationale for Requirement R3:
The identification and documentation of the single CIP Senior Manager ensures that there isclear authority and ownership for the CIP program within an organization, as called for inBlackout Report Recommendation 43. The language that identifies CIP Senior Manager
responsibilities is included in the Glossary of Terms used in NERC Reliability Standards so that it
may be used across the body of CIP standards without an explicit cross-reference.
FERC Order No. 706, Paragraph 296, requests consideration of whether the single senior
manager should be a corporate officer or equivalent. As implicated through the defined term,
the senior manager has “the overall authority and responsibility for leading and managing
implementation of the requirements within this set of standards” which ensures that the senior
manager is of sufficient position in the Responsible Entity to ensure that cyber security receives
the prominence that is necessary. In addition, given the range of business models forresponsible entities, from municipal, cooperative, federal agencies, investor owned utilities,
privately owned utilities, and everything in between, the SDT believes that requiring the CIP
Senior Manager to be a “corporate officer or equivalent” would be extremely difficult tointerpret and enforce on a consistent basis.
Rationale for Requirement R4:
The intent of the requirement is to ensure clear accountability within an organization forcertain security matters. It also ensures that delegations are kept up-to-date and that
individuals do not assume undocumented authority.
In FERC Order No. 706, Paragraphs 379 and 381, the Commission notes that Recommendation
43 of the 2003 Blackout Report calls for “clear lines of authority and ownership for security
matters.” With this in mind, the Standard Drafting Team has sought to provide clarity in therequirement for delegations so that this line of authority is clear and apparent from the
documented delegations.

Page 40 of 40