CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
A. Introduction
1.

Title:

Cyber Security — BES Cyber System Categorization

2.

Number:

CIP-002-5.1a

3.

Purpose: To identify and categorize BES Cyber Systems and their associated BES
Cyber Assets for the application of cyber security requirements commensurate withthe adverse impact that loss, compromise, or misuse of those BES Cyber Systems
could have on the reliable operation of the BES. Identification and categorization of
BES Cyber Systems support appropriate protection against compromises that could
lead to misoperation or instability in the BES.

4.

Applicability:

4.1.

Functional Entities: For the purpose of the requirements contained herein, thefollowing list of functional entities will be collectively referred to as “Responsible
Entities.” For requirements in this standard where a specific functional entity or
subset of functional entities are the applicable entity or entities, the functional entity
or entities are specified explicitly.

4.1.1. Balancing Authority
4.1.2. Distribution Provider that owns one or more of the following Facilities, systems,
and equipment for the protection or restoration of the BES:
4.1.2.1. Each underfrequency load shedding (UFLS) or undervoltage load shedding(UVLS) system that:
4.1.2.1.1. is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2. performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.1.2.2. Each Special Protection System or Remedial Action Scheme where theSpecial Protection System or Remedial Action Scheme is subject to one ormore requirements in a NERC or Regional Reliability Standard.
4.1.2.3. Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4. Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3. Generator Operator
4.1.4. Generator Owner

Page 1 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
4.1.5. Interchange Coordinator or Interchange Authority
4.1.6. Reliability Coordinator
4.1.7. Transmission Operator
4.1.8. Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above
are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.

4.2.1. Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or restorationof the BES:
4.2.1.1. Each UFLS or UVLS System that:
4.2.1.1.1. is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2. performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.2.1.2. Each Special Protection System or Remedial Action Scheme where theSpecial Protection System or Remedial Action Scheme is subject to one ormore requirements in a NERC or Regional Reliability Standard.
4.2.1.3. Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4. Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2. Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3. Exemptions: The following are exempt from Standard CIP-002-5.1a:4.2.3.1. Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2. Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters.

Page 2 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
4.2.3.3. The systems, structures, and components that are regulated by the Nuclear
Regulatory Commission under a cyber security plan pursuant to 10 C.F.R.
Section 73.54.
4.2.3.4. For Distribution Providers, the systems and equipment that are not included
in section 4.2.1 above.
5.

6.

Effective Dates:
1.

24 Months Minimum – CIP-002-5.1a shall become effective on the later of July
1, 2015, or the first calendar day of the ninth calendar quarter after the effective
date of the order providing applicable regulatory approval.

2.

In those jurisdictions where no regulatory approval is required CIP-002-5.1a shallbecome effective on the first day of the ninth calendar quarter following Boardof Trustees’ approval, or as otherwise made effective pursuant to the laws
applicable to such ERO governmental authorities.

Background:This standard provides “bright-line” criteria for applicable Responsible Entities tocategorize their BES Cyber Systems based on the impact of their associated Facilities,
systems, and equipment, which, if destroyed, degraded, misused, or otherwise
rendered unavailable, would affect the reliable operation of the Bulk Electric System.
Several concepts provide the basis for the approach to the standard.
Throughout the standards, unless otherwise stated, bulleted items in therequirements are items that are linked with an “or,” and numbered items are items
that are linked with an “and.”Many references in the Applicability section and the criteria in Attachment 1 of CIP002 use a threshold of 300 MW for UFLS and UVLS. This particular threshold of 300
MW for UVLS and UFLS was provided in Version 1 of the CIP Cyber Security
Standards. The threshold remains at 300 MW since it is specifically addressing UVLS
and UFLS, which are last ditch efforts to save the Bulk Electric System. A review of
UFLS tolerances defined within regional reliability standards for UFLS program
requirements to date indicates that the historical value of 300 MW represents anadequate and reasonable threshold value for allowable UFLS operational tolerances.
BES Cyber Systems
One of the fundamental differences between Versions 4 and 5 of the CIP Cyber
Security Standards is the shift from identifying Critical Cyber Assets to identifying BES
Cyber Systems. This change results from the drafting team’s review of the NIST Risk
Management Framework and the use of an analogous term “information system” as
the target for categorizing and applying security controls.

Page 3 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization

Version 4 Cyber Assets

Version 5 Cyber Assets

BES Cyber System
CCA
CCA
CCA
CCA
AssociatedProtected Cyber
Assets
Non-Critical
Non-Critical Cyber
Cyber Asset
Asset
WithinWithin an
an ESP
ESP

AssociatedElectronic andPhysical AccessControl andMonitoring
Systems
CIP-005-4 R1.5 and
CIP-006-4 R2

In transitioning from Version 4 to Version 5, a BES Cyber System can be viewed simply
as a grouping of Critical Cyber Assets (as that term is used in Version 4). The CIP Cyber
Security Standards use the “BES Cyber System” term primarily to provide a higher level
for referencing the object of a requirement. For example, it becomes possible toapply requirements dealing with recovery and malware protection to a groupingrather than individual Cyber Assets, and it becomes clearer in the requirement thatmalware protection applies to the system as a whole and may not be necessary forevery individual device to comply.
Another reason for using the term “BES Cyber System” is to provide a convenient levelat which a Responsible Entity can organize their documented implementation of therequirements and compliance evidence. Responsible Entities can use the welldeveloped concept of a security plan for each BES Cyber System to document the
programs, processes, and plans in place to comply with security requirements.
It is left up to the Responsible Entity to determine the level of granularity at which toidentify a BES Cyber System within the qualifications in the definition of BES Cyber
System. For example, the Responsible Entity might choose to view an entire plant
control system as a single BES Cyber System, or it might choose to view certain
components of the plant control system as distinct BES Cyber Systems. The
Responsible Entity should take into consideration the operational environment andPage 4 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
scope of management when defining the BES Cyber System boundary in order tomaximize efficiency in secure operations. Defining the boundary too tightly may result
in redundant paperwork and authorizations, while defining the boundary too broadly
could make the secure operation of the BES Cyber System difficult to monitor andassess.
Reliable Operation of the BES
The scope of the CIP Cyber Security Standards is restricted to BES Cyber Systems thatwould impact the reliable operation of the BES. In order to identify BES Cyber
Systems, Responsible Entities determine whether the BES Cyber Systems perform or
support any BES reliability function according to those reliability tasks identified fortheir reliability function and the corresponding functional entity’s responsibilities as
defined in its relationships with other functional entities in the NERC Functional
Model. This ensures that the initial scope for consideration includes only those BES
Cyber Systems and their associated BES Cyber Assets that perform or support thereliable operation of the BES. The definition of BES Cyber Asset provides the basis forthis scoping.
Real-time Operations
One characteristic of the BES Cyber Asset is a real-time scoping characteristic. The
time horizon that is significant for BES Cyber Systems and BES Cyber Assets subject tothe application of these Version 5 CIP Cyber Security Standards is defined as thatwhich is material to real-time operations for the reliable operation of the BES. To
provide a better defined time horizon than “Real-time,” BES Cyber Assets are those
Cyber Assets that, if rendered unavailable, degraded, or misused, would adversely
impact the reliable operation of the BES within 15 minutes of the activation or
exercise of the compromise. This time window must not include in its consideration
the activation of redundant BES Cyber Assets or BES Cyber Systems: from the cybersecurity standpoint, redundancy does not mitigate cyber security vulnerabilities.
Categorization Criteria
The criteria defined in Attachment 1 are used to categorize BES Cyber Systems into
impact categories. Requirement 1 only requires the discrete identification of BES
Cyber Systems for those in the high impact and medium impact categories. All BES
Cyber Systems for Facilities not included in Attachment 1 – Impact Rating Criteria,
Criteria 1.1 to 1.4 and Criteria 2.1 to 2.11 default to be low impact.
This general process of categorization of BES Cyber Systems based on impact on thereliable operation of the BES is consistent with risk management approaches for the
purpose of application of cyber security requirements in the remainder of the Version
5 CIP Cyber Security Standards.
Electronic Access Control or Monitoring Systems, Physical Access Control Systems,
and Protected Cyber Assets that are associated with BES Cyber Systems

Page 5 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
BES Cyber Systems have associated Cyber Assets, which, if compromised, pose athreat to the BES Cyber System by virtue of: (a) their location within the Electronic
Security Perimeter (Protected Cyber Assets), or (b) the security control function they
perform (Electronic Access Control or Monitoring Systems and Physical Access Control
Systems). These Cyber Assets include:
Electronic Access Control or Monitoring Systems (“EACMS”) – Examples include:
Electronic Access Points, Intermediate Systems, authentication servers (e.g.,
RADIUS servers, Active Directory servers, Certificate Authorities), security event
monitoring systems, and intrusion detection systems.
Physical Access Control Systems (“PACS”)– Examples include: authentication
servers, card systems, and badge control systems.
Protected Cyber Assets (“PCA”) – Examples may include, to the extent they arewithin the ESP: file servers, ftp servers, time servers, LAN switches, networked
printers, digital fault recorders, and emission monitoring systems.
B. Requirements and Measures
R1.

Each Responsible Entity shall implement a process that considers each of thefollowing assets for purposes of parts 1.1 through 1.3: [Violation Risk Factor:
High][Time Horizon: Operations Planning]i.Control Centers and backup Control Centers;ii.Transmission stations and substations;iii.Generation resources;
iv.Systems and facilities critical to system restoration, including Blackstart
Resources and Cranking Paths and initial switching requirements;
v.Special Protection Systems that support the reliable operation of the Bulk
Electric System; andvi.For Distribution Providers, Protection Systems specified in Applicability
section 4.2.1 above.
1.1.
1.2.
1.3.

Identify each of the high impact BES Cyber Systems according to
Attachment 1, Section 1, if any, at each asset;
Identify each of the medium impact BES Cyber Systems according to
Attachment 1, Section 2, if any, at each asset; andIdentify each asset that contains a low impact BES Cyber System
according to Attachment 1, Section 3, if any (a discrete list of low impact
BES Cyber Systems is not required).

M1. Acceptable evidence includes, but is not limited to, dated electronic or physical lists
required by Requirement R1, and Parts 1.1 and 1.2.

Page 6 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
R2.

The Responsible Entity shall: [Violation Risk Factor: Lower] [Time Horizon: Operations
Planning]
2.1

Review the identifications in Requirement R1 and its parts (and updatethem if there are changes identified) at least once every 15 calendar
months, even if it has no identified items in Requirement R1, and2.2

Have its CIP Senior Manager or delegate approve the identifications
required by Requirement R1 at least once every 15 calendar months,
even if it has no identified items in Requirement R1.

M2. Acceptable evidence includes, but is not limited to, electronic or physical dated
records to demonstrate that the Responsible Entity has reviewed and updated, where
necessary, the identifications required in Requirement R1 and its parts, and has had its
CIP Senior Manager or delegate approve the identifications required in Requirement
R1 and its parts at least once every 15 calendar months, even if it has none identified
in Requirement R1 and its parts, as required by Requirement R2.
C. Compliance1. Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
The Regional Entity shall serve as the Compliance Enforcement Authority (“CEA”)
unless the applicable entity is owned, operated, or controlled by the Regional
Entity. In such cases the ERO or a Regional Entity approved by FERC or otherapplicable governmental authority shall serve as the CEA.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity isrequired to retain specific evidence to demonstrate compliance. For instanceswhere the evidence retention period specified below is shorter than the timesince the last audit, the CEA may ask an entity to provide other evidence to showthat it was compliant for the full time period since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as
identified below unless directed by its CEA to retain specific evidence for alonger period of time as part of an investigation:
Each Responsible Entity shall retain evidence of each requirement in thisstandard for three calendar years.



If a Responsible Entity is found non-compliant, it shall keep information
related to the non-compliance until mitigation is complete and approved orfor the time specified above, whichever is longer.

Page 7 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
The CEA shall keep the last audit records and all requested and submitted
subsequent audit records.

1.3. Compliance Monitoring and Assessment Processes:Compliance Audit

Self-Certification

Spot CheckingCompliance Investigation

Self-ReportingComplaint

1.4. Additional Compliance Information


NonePage 8 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
2. Table of Compliance Elements
R#

R1

Time
HorizonOperations
Planning

VRF

High

Violation Severity Levels (CIP-002-5.1a)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

For Responsible
Entities with morethan a total of 40 BES
assets in Requirement
R1, five percent or
fewer BES assets havenot been consideredaccording toRequirement R1;

For Responsible
Entities with morethan a total of 40 BES
assets in Requirement
R1, more than five
percent but less thanor equal to 10 percent
of BES assets have notbeen considered,according toRequirement R1;

For Responsible
Entities with morethan a total of 40 BES
assets in Requirement
R1, more than 10
percent but less thanor equal to 15 percent
of BES assets have notbeen considered,according toRequirement R1;

For Responsible
Entities with morethan a total of 40 BES
assets in Requirement
R1, more than 15
percent of BES assets
have not been
considered, according
to Requirement R1;

OR

OR

OR
For Responsible
Entities with a total of
40 or fewer BES assets,
2 or fewer BES assets
in Requirement R1,
have not been
considered according
to Requirement R1;
OR
For Responsible
Entities with morethan a total of 100
high and medium
impact BES CyberORFor Responsible
Entities with a total of
For Responsible
For Responsible
40 or fewer BES assets,
Entities with a total of Entities with a total of more than six BES
40 or fewer BES assets, 40 or fewer BES assets, assets in Requirement
more than two, butmore than four, but
R1, have not beenfewer than or equal to fewer than or equal to considered according
four BES assets in
six BES assets in
to Requirement R1;
Requirement R1, have Requirement R1, have OR
not been considered
not been considered
For Responsible
according toaccording to
Entities with more
Requirement R1;
Requirement R1;
than a total of 100
ORORhigh and medium
impact BES Cyber

Page 9 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-002-5.1a)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

Systems, five percent
or fewer of identified
BES Cyber Systems
have not been
categorized or havebeen incorrectly
categorized at a lower
category;

For Responsible
Entities with morethan a total of 100
high and medium
impact BES Cyber
Systems, more than
five percent but lessthan or equal to 10
percent of identified
BES Cyber Systems
have not been
categorized or havebeen incorrectly
categorized at a lower
category;

For Responsible
Entities with morethan a total of 100
high or medium
impact BES Cyber
Systems, more than 10
percent but less thanor equal to 15 percent
of identified BES Cyber
Systems have not been
categorized or havebeen incorrectly
categorized at a lower
category;

Systems, more than 15
percent of identified
BES Cyber Systems
have not been
categorized or havebeen incorrectly
categorized at a lower
category;OR
For Responsible
Entities with a total of
100 or fewer high andmedium impact BES
Cyber Systems, five or
fewer identified BES
Cyber Systems havenot been categorizedor have been
incorrectly categorized
at a lower category.
OR
For Responsible
Entities with morethan a total of 100
high and medium
impact BES Cyber

OR

OR

For Responsible
For Responsible
Entities with a total of
Entities with a total of 100 or fewer high or
100 or fewer high and medium impact andmedium impact and
BES Cyber Assets,
BES Cyber Systems,
more than 10 but lessmore than five but less than or equal to 15
than or equal to 10
identified BES Cyber
identified BES Cyber
Assets have not been
Systems have not been categorized or havecategorized or havebeen incorrectly
been incorrectly

Page 10 of 37

OR
For Responsible
Entities with a total of
100 or fewer high andmedium impact BES
Cyber Systems, morethan 15 identified BES
Cyber Systems havenot been categorizedor have been
incorrectly categorized
at a lower category.
OR
For Responsible
Entities with morethan a total of 100
high and medium
impact BES CyberCIP-002-5.1a — Cyber Security — BES Cyber System Categorization

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-002-5.1a)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

Systems, five percent
or fewer high or
medium BES Cyber
Systems have not been
identified;categorized at a lower
category.

categorized at a lower
category.

OR

OR

For Responsible
Entities with morethan a total of 100
high and medium
impact BES Cyber
Systems, more than
five percent but lessthan or equal to 10
percent high or
medium BES Cyber
Systems have not been
identified;

For Responsible
Entities with morethan a total of 100
high and medium
impact BES Cyber
Systems, more than 10
percent but less thanor equal to 15 percent
high or medium BES
Cyber Systems havenot been identified;

Systems, more than 15
percent of high or
medium impact BES
Cyber Systems havenot been identified;OR
For Responsible
Entities with a total of
100 or fewer high andmedium impact BES
Cyber Systems, five or
fewer high or medium
BES Cyber Systems
have not been
identified.

OR

OR

For Responsible
For Responsible
Entities with a total of
Entities with a total of 100 or fewer high and100 or fewer high and medium impact BES
medium impact BES
Cyber Systems, more
Cyber Systems, morethan 10 but less than
than five but less than or equal to 15 high oror equal to 10 high or medium BES Cybermedium BES Cyber
Systems have not been
Systems have not been identified.
identified.

Page 11 of 37

OR
For Responsible
Entities with a total of
100 or fewer high andmedium impact BES
Cyber Systems, morethan 15 high or
medium impact BES
Cyber Systems havenot been identified.

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization

R#

R2

Time
HorizonOperations
Planning

VRF

Lower

Violation Severity Levels (CIP-002-5.1a)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

The Responsible Entity
did not complete its
review and update forthe identification
required for R1 within
15 calendar months
but less than or equal
to 16 calendar monthsof the previous review.
(R2.1)The Responsible Entity
did not complete its
review and update forthe identification
required for R1 within
16 calendar months
but less than or equal
to 17 calendar monthsof the previous review.
(R2.1)The Responsible Entity
did not complete its
review and update forthe identification
required for R1 within
17 calendar months
but less than or equal
to 18 calendar monthsof the previous review.
(R2.1)The Responsible Entity
did not complete its
review and update forthe identification
required for R1 within
18 calendar months ofthe previous review.
(R2.1)

OR

OR

OR

OR

The Responsible Entity
failed to complete its
The Responsible Entity The Responsible Entity The Responsible Entity approval of the
did not complete its
failed to complete its
failed to complete its
identifications
approval of theapproval of theapproval of therequired by R1 by theidentifications
identifications
identifications
CIP Senior Manager or
required by R1 by therequired by R1 by therequired by R1 by thedelegate according to
CIP Senior Manager or CIP Senior Manager or CIP Senior Manager or Requirement R2 withindelegate according todelegate according todelegate according to
18 calendar months ofRequirement R2 within Requirement R2 within Requirement R2 within the previous approval.
15 calendar months
16 calendar months
17 calendar months(R2.2)
but less than or equal
but less than or equal
but less than or equal
to 16 calendar months to 17 calendar months to 18 calendar monthsof the previousof the previousof the previous
approval. (R2.2)
approval. (R2.2)
approval. (R2.2)

Page 12 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
D. Regional Variances
None.
E. Interpretations
None.
F. Associated Documents
None.

Page 13 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization

CIP-002-5.1a - Attachment 1
Impact Rating Criteria
The criteria defined in Attachment 1 do not constitute stand-alone compliance requirements,
but are criteria characterizing the level of impact and are referenced by requirements.
1. High Impact Rating (H)Each BES Cyber System used by and located at any of the following:
1.1. Each Control Center or backup Control Center used to perform the functional
obligations of the Reliability Coordinator.
1.2. Each Control Center or backup Control Center used to perform the functional
obligations of the Balancing Authority: 1) for generation equal to or greater than anaggregate of 3000 MW in a single Interconnection, or 2) for one or more of the assetsthat meet criterion 2.3, 2.6, or 2.9.
1.3. Each Control Center or backup Control Center used to perform the functional
obligations of the Transmission Operator for one or more of the assets that meetcriterion 2.2, 2.4, 2.5, 2.7, 2.8, 2.9, or 2.10.
1.4 Each Control Center or backup Control Center used to perform the functional
obligations of the Generator Operator for one or more of the assets that meetcriterion 2.1, 2.3, 2.6, or 2.9.
2. Medium Impact Rating (M)Each BES Cyber System, not included in Section 1 above, associated with any of the following:
2.1. Commissioned generation, by each group of generating units at a single plant location,with an aggregate highest rated net Real Power capability of the preceding 12
calendar months equal to or exceeding 1500 MW in a single Interconnection. For eachgroup of generating units, the only BES Cyber Systems that meet this criterion arethose shared BES Cyber Systems that could, within 15 minutes, adversely impact thereliable operation of any combination of units that in aggregate equal or exceed 1500
MW in a single Interconnection.
2.2. Each BES reactive resource or group of resources at a single location (excluding
generation Facilities) with an aggregate maximum Reactive Power nameplate rating of1000 MVAR or greater (excluding those at generation Facilities). The only BES Cyber
Systems that meet this criterion are those shared BES Cyber Systems that could,
within 15 minutes, adversely impact the reliable operation of any combination of
resources that in aggregate equal or exceed 1000 MVAR.

Page 14 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
2.3. Each generation Facility that its Planning Coordinator or Transmission Plannerdesignates, and informs the Generator Owner or Generator Operator, as necessary to
avoid an Adverse Reliability Impact in the planning horizon of more than one year.
2.4. Transmission Facilities operated at 500 kV or higher. For the purpose of this criterion,
the collector bus for a generation plant is not considered a Transmission Facility, but ispart of the generation interconnection Facility.
2.5. Transmission Facilities that are operating between 200 kV and 499 kV at a single
station or substation, where the station or substation is connected at 200 kV or higher
voltages to three or more other Transmission stations or substations and has an"aggregate weighted value" exceeding 3000 according to the table below. The"aggregate weighted value" for a single station or substation is determined bysumming the "weight value per line" shown in the table below for each incoming andeach outgoing BES Transmission Line that is connected to another Transmission
station or substation. For the purpose of this criterion, the collector bus for ageneration plant is not considered a Transmission Facility, but is part of the generationinterconnection Facility.
Voltage Value of a Line

Weight Value per Lineless than 200 kV (not applicable)(not applicable)

200 kV to 299 kV

700

300 kV to 499 kV

1300

500 kV and above0

2.6. Generation at a single plant location or Transmission Facilities at a single station or
substation location that are identified by its Reliability Coordinator, Planning
Coordinator, or Transmission Planner as critical to the derivation of Interconnection
Reliability Operating Limits (IROLs) and their associated contingencies.
2.7. Transmission Facilities identified as essential to meeting Nuclear Plant Interface
Requirements.
2.8. Transmission Facilities, including generation interconnection Facilities, providing thegeneration interconnection required to connect generator output to the Transmission
Systems that, if destroyed, degraded, misused, or otherwise rendered unavailable,
would result in the loss of the generation Facilities identified by any Generator Owneras a result of its application of Attachment 1, criterion 2.1 or 2.3.
2.9. Each Special Protection System (SPS), Remedial Action Scheme (RAS), or automatedswitching System that operates BES Elements, that, if destroyed, degraded, misused orotherwise rendered unavailable, would cause one or more Interconnection Reliability
Operating Limits (IROLs) violations for failure to operate as designed or cause areduction in one or more IROLs if destroyed, degraded, misused, or otherwise
rendered unavailable.

Page 15 of 37

CIP-002-5.1a — Cyber Security — BES Cyber System Categorization
2.10. Each system or group of Elements that performs automatic Load shedding under acommon control system, without human operator initiation, of 300 MW or more
implementing undervoltage load shedding (UVLS) or underfrequency load shedding(UFLS) under a load shedding program that is subject to one or more requirements in
a NERC or regional reliability standard.
2.11. Each Control Center or backup Control Center, not already included in High Impact
Rating (H) above, used to perform the functional obligations of the Generator
Operator for an aggregate highest rated net Real Power capability of the preceding 12
calendar months equal to or exceeding 1500 MW in a single Interconnection.
2.12. Each Control Center or backup Control Center used to perform the functional
obligations of the Transmission Operator not included in High Impact Rating (H),above.
2.13. Each Control Center or backup Control Center, not already included in High Impact
Rating (H) above, used to perform the functional obligations of the Balancing
Authority for generation equal to or greater than an aggregate of 1500 MW in a single
Interconnection.
3. Low Impact Rating (L)BES Cyber Systems not included in Sections 1 or 2 above that are associated with any of thefollowing assets and that meet the applicability qualifications in Section 4 - Applicability, part
4.2 – Facilities, of this standard:
3.1. Control Centers and backup Control Centers.
3.2. Transmission stations and substations.
3.3. Generation resources.
3.4. Systems and facilities critical to system restoration, including Blackstart Resources andCranking Paths and initial switching requirements.
3.5. Special Protection Systems that support the reliable operation of the Bulk Electric
System.
3.6. For Distribution Providers, Protection Systems specified in Applicability section 4.2.1
above.

Page 16 of 37

Appendix 1
Guidelines and Technical Basis
Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in section 4.1, that is subject to the requirements of thestandard. In addition to the set of BES Facilities, Control Centers, and other systems andequipment, the list includes the qualified set of systems and equipment owned by Distribution
Providers. While the NERC Glossary term “Facilities” already includes the BES characteristic, theadditional use of the term BES here is meant to reinforce the scope of applicability of these
Facilities where it is used, especially in this applicability scoping section. This in effect sets thescope of Facilities, systems, and equipment that is subject to the standards. This section isespecially significant in CIP-002-5.1a and represents the total scope of Facilities, systems, andequipment to which the criteria in Attachment 1 apply. This is important because it determines
the balance of these Facilities, systems, and equipment that are Low Impact once those that
qualify under the High and Medium Impact categories are filtered out.
For the purpose of identifying groups of Facilities, systems, and equipment, whether by locationor otherwise, the Responsible Entity identifies assets as described in Requirement R1 of CIP002-5.1a. This is a process familiar to Responsible Entities that have to comply with versions 1,
2, 3, and 4 of the CIP standards for Critical Assets. As in versions 1, 2, 3, and 4, Responsible
Entities may use substations, generation plants, and Control Centers at single site locations as
identifiers of these groups of Facilities, systems, and equipment.
CIP-002-5.1a
CIP-002-5.1a requires that applicable Responsible Entities categorize their BES Cyber Systems
and associated BES Cyber Assets according to the criteria in Attachment 1. A BES Cyber Asset
includes in its definition, “…that if rendered unavailable, degraded, or misused would, within 15
minutes adversely impact the reliable operation of the BES.”
The following provides guidance that a Responsible Entity may use to identify the BES Cyber
Systems that would be in scope. The concept of BES reliability operating service is useful inproviding Responsible Entities with the option of a defined process for scoping those BES CyberGuidelines and Technical Basis
Systems that would be subject to CIP-002-5.1a. The concept includes a number of named BES
reliability operating services. These named services include:
Dynamic Response to BES conditions
Balancing Load and Generation
Controlling Frequency (Real Power)
Controlling Voltage (Reactive Power)
Managing Constraints
Monitoring & Control
Restoration of BES
Situational AwarenessInter-Entity Real-Time Coordination and Communication
Responsibility for the reliable operation of the BES is spread across all Entity Registrations. Each
entity registration has its own special contribution to reliable operations and the following
discussion helps identify which entity registration, in the context of those functional entities towhich these CIP standards apply, performs which reliability operating service, as a process to
identify BES Cyber Systems that would be in scope. The following provides guidance for
Responsible Entities to determine applicable reliability operations services according to their
Function Registration type.
Entity Registration

RC

Dynamic Response
Balancing Load &Generation

X

Controlling Frequency

BA

TOP

TO

DP

GOP

GO

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

Controlling Voltage
Managing Constraints

X
X

X

X

X

X

X

Monitoring and Control

X

X

Restoration

X

X
X

Situation Awareness

X

X

X

Inter-Entity coordination

X

X

X

X

X

X

Dynamic Response
The Dynamic Response Operating Service includes those actions performed by BES Elements or
subsystems which are automatically triggered to initiate a response to a BES condition. These
actions are triggered by a single element or control device or a combination of these elements
or devices in concert to perform an action or cause a condition in reaction to the triggering
action or condition. The types of dynamic responses that may be considered as potentiallyhaving an impact on the BES are:Page 18 of 37

Guidelines and Technical Basis

Spinning reserves (contingency reserves)
Providing actual reserve generation when called upon (GO,GOP)

Monitoring that reserves are sufficient (BA)Governor ResponseProtection Systems (transmission & generation)Lines, buses, transformers, generators (DP, TO, TOP, GO, GOP)

Zone protection for breaker failure (DP, TO, TOP)

Breaker protection (DP, TO, TOP)

Current, frequency, speed, phase (TO,TOP, GO,GOP)

Special Protection Systems or Remedial Action SchemesSensors, relays & breakers (DP)

Under and Over Voltage relay protection (includes automatic load shedding)Sensors, relays, and breakers, possibly software (DP, TO, TOP)

Under and Over Frequency relay protection (includes automatic load shedding)Control system used to actuate governor response (GO)Sensors, relays & breakers (DP)Power System Stabilizers (GO)Balancing Load and Generation
The Balancing Load and Generation Operations Service includes activities, actions andconditions necessary for monitoring and controlling generation and load in the operations
planning horizon and in real-time. Aspects of the Balancing Load and Generation function
include, but are not limited to:Calculation of Area Control Error (ACE)

Field data sources (real time tie flows, frequency sources, time error, etc) (TO, TOP)

Software used to perform calculation (BA)

Demand Response

Ability to identify load change need (BA)

Ability to implement load changes (TOP,DP)

Manually Initiated Load shedding

Ability to identify load change need (BA)

Ability to implement load changes (TOP, DP)

Page 19 of 37

Guidelines and Technical Basis

Non-spinning reserve (contingency reserve)Know generation status, capability, ramp rate, start time (GO, BA)

Start units and provide energy (GOP)

Controlling Frequency (Real Power)
The Controlling Frequency Operations Service includes activities, actions and conditions which
ensure, in real time, that frequency remains within bounds acceptable for the reliability or
operability of the BES. Aspects of the Controlling Frequency function include, but are limited
to:




Generation Control (such as AGC)


ACE, current generator output, ramp rate, unit characteristics (BA, GOP, GO)

Software to calculate unit adjustments (BA)

Transmit adjustments to individual units (GOP)

Unit controls implementing adjustments (GOP)

Regulation (regulating reserves)Frequency source, schedule (BA)

Governor control system (GO)Controlling Voltage (Reactive Power)
The Controlling Voltage Operations Service includes activities, actions and conditions which
ensure, in real time, that voltage remains within bounds acceptable for the reliability or
operability of the BES. Aspects of the Controlling Voltage function include, but are not limitedto:

Automatic Voltage Regulation (AVR)

Capacitive resources

Status, control (manual or auto), feedback (TOP, TO,DP)

Inductive resources (transformer tap changer, or inductors)Sensors, stator control system, feedback (GO)Status, control (manual or auto), feedback (TOP,TO,DP)

Static VAR Compensators (SVC)

Status, computations, control (manual or auto), feedback (TOP, TO,DP)

Page 20 of 37

Guidelines and Technical BasisManaging Constraints
Managing Constraints includes activities, actions and conditions that are necessary to ensurethat elements of the BES operate within design limits and constraints established for the
reliability and operability of the BES. Aspects of the Managing Constraints include, but are notlimited to:

Available Transfer Capability (ATC) (TOP)Interchange schedules (TOP, RC)

Generation re-dispatch and unit commit (GOP)

Identify and monitor SOL’s & IROL’s (TOP, RC)

Identify and monitor Flow gates (TOP, RC)

Monitoring and Control
Monitoring and Control includes those activities, actions and conditions that provide
monitoring and control of BES Elements. An example aspect of the Control and Operation
function is:All methods of operating breakers and switches

SCADA (TOP, GOP)

Substation automation (TOP)Restoration of BES
The Restoration of BES Operations Service includes activities, actions and conditions necessary
to go from a shutdown condition to an operating condition delivering electric power without
external assistance. Aspects of the Restoration of BES function include, but are not limited to:Restoration including planned cranking pathThrough black start units (TOP, GOP)

Through tie lines (TOP, GOP)

Off-site power for nuclear facilities. (TOP, TO, BA, RC, DP, GO, GOP)Coordination (TOP, TO, BA, RC, DP, GO, GOP)

Situational Awareness
The Situational Awareness function includes activities, actions and conditions established bypolicy, directive or standard operating procedure necessary to assess the current condition of
the BES and anticipate effects of planned and unplanned changes to conditions. Aspects of theSituation Awareness function include:

Page 21 of 37

Guidelines and Technical BasisMonitoring and alerting (such as EMS alarms) (TOP, GOP, RC,BA)

Change management (TOP,GOP,RC,BA)

Current Day and Next Day planning (TOP)Contingency Analysis (RC)

Frequency monitoring (BA, RC)

Inter-Entity Coordination
The Inter-Entity coordination and communication function includes activities, actions, andconditions established by policy, directive, or standard operating procedure necessary for thecoordination and communication between Responsible Entities to ensure the reliability andoperability of the BES. Aspects of the Inter-Entity Coordination and Communication function
include:

Scheduled interchange (BA,TOP,GOP,RC)

Facility operational data and status (TO, TOP, GO, GOP, RC, BA)

Operational directives (TOP, RC, BA)

Applicability to Distribution Providers
It is expected that only Distribution Providers that own or operate facilities that qualify in the
Applicability section will be subject to these Version 5 Cyber Security Standards. Distribution
Providers that do not own or operate any facility that qualifies are not subject to thesestandards. The qualifications are based on the requirements for registration as a Distribution
Provider and on the requirements applicable to Distribution Providers in NERC Standard EOP005.
Requirement R1:
Requirement R1 implements the methodology for the categorization of BES Cyber Systems
according to their impact on the BES. Using the traditional risk assessment equation, it reduces
the measure of the risk to an impact (consequence) assessment, assuming the vulnerability
index of 1 (the Systems are assumed to be vulnerable) and a probability of threat of 1 (100percent). The criteria in Attachment 1 provide a measure of the impact of the BES assets
supported by these BES Cyber Systems.
Responsible Entities are required to identify and categorize those BES Cyber Systems that havehigh and medium impact. BES Cyber Systems for BES assets not specified in Attachment 1,
Criteria 1.1 – 1.4 and Criteria 2.1 – 2.11 default to low impact.

Page 22 of 37

Guidelines and Technical Basis
Attachment 1
Overall Application
In the application of the criteria in Attachment 1, Responsible Entities should note that theapproach used is based on the impact of the BES Cyber System as measured by the bright-line
criteria defined in Attachment 1.
When the drafting team uses the term “Facilities”, there is some latitude to Responsible
Entities to determine included Facilities. The term Facility is defined in the NERC Glossary ofTerms as “A set of electrical equipment that operates as a single Bulk Electric System
Element (e.g., a line, a generator, a shunt compensator, transformer, etc.).” In most cases,
the criteria refer to a group of Facilities in a given location that supports the reliable
operation of the BES. For example, for Transmission assets, the substation may bedesignated as the group of Facilities. However, in a substation that includes equipment that
supports BES operations along with equipment that only supports Distribution operations,
the Responsible Entity may be better served to consider only the group of Facilities that
supports BES operation. In that case, the Responsible Entity may designate the group of
Facilities by location, with qualifications on the group of Facilities that supports reliable
operation of the BES, as the Facilities that are subject to the criteria for categorization of
BES Cyber Systems. Generation Facilities are separately discussed in the Generation section
below. In CIP-002-5.1a, these groups of Facilities, systems, and equipment are sometimes
designated as BES assets. For example, an identified BES asset may be a named substation,
generating plant, or Control Center. Responsible Entities have flexibility in how they group
Facilities, systems, and equipment at a location.



In certain cases, a BES Cyber System may be categorized by meeting multiple criteria. In
such cases, the Responsible Entity may choose to document all criteria that result in the
categorization. This will avoid inadvertent miscategorization when it no longer meets oneof the criteria, but still meets another.



It is recommended that each BES Cyber System should be listed by only one Responsible
Entity. Where there is joint ownership, it is advisable that the owning Responsible Entities
should formally agree on the designated Responsible Entity responsible for compliance withthe standards.

High Impact Rating (H)This category includes those BES Cyber Systems, used by and at Control Centers (and theassociated data centers included in the definition of Control Centers), that perform thefunctional obligations of the Reliability Coordinator (RC), Balancing Authority (BA), Transmission
Operator (TOP), or Generator Operator (GOP), as defined under the Tasks heading of theapplicable Function and the Relationship with Other Entities heading of the functional entity in
the NERC Functional Model, and as scoped by the qualification in Attachment 1, Criteria 1.1,
1.2, 1.3 and 1.4. While those entities that have been registered as the above-named functional
entities are specifically referenced, it must be noted that there may be agreements where somePage 23 of 37

Guidelines and Technical Basisof the functional obligations of a Transmission Operator may be delegated to a Transmission
Owner (TO). In these cases, BES Cyber Systems at these TO Control Centers that perform thesefunctional obligations would be subject to categorization as high impact. The criteria notably
specifically emphasize functional obligations, not necessarily the RC, BA, TOP, or GOP facilities.
One must note that the definition of Control Center specifically refers to reliability tasks for RCs,
Bas, TOPs, and GOPs. A TO BES Cyber System in a TO facility that does not perform or does nothave an agreement with a TOP to perform any of these functional tasks does not meet thedefinition of a Control Center. However, if that BES Cyber System operates any of the facilities
that meet criteria in the Medium Impact category, that BES Cyber System would be categorized
as a Medium Impact BES Cyber System.
The 3000 MW threshold defined in criterion 1.2 for BA Control Centers provides a sufficientdifferentiation of the threshold defined for Medium Impact BA Control Centers. An analysis of
BA footprints shows that the majority of Bas with significant impact are covered under thiscriterion.
Additional thresholds as specified in the criteria apply for this category.
Medium Impact Rating (M)Generation
The criteria in Attachment 1’s medium impact category that generally apply to Generation Owner
and Operator (GO/GOP) Registered Entities are criteria 2.1, 2.3, 2.6, 2.9, and 2.11. Criterion 2.13
for BA Control Centers is also included here.
Criterion 2.1 designates as medium impact those BES Cyber Systems that impact generation
with a net Real Power capability exceeding 1500 MW. The 1500 MW criterion is sourced
partly from the Contingency Reserve requirements in NERC standard BAL-002, whose
purpose is “to ensure the Balancing Authority is able to utilize its Contingency Reserve tobalance resources and demand and return Interconnection frequency within defined limits
following a Reportable Disturbance.” In particular, it requires that “as a minimum, theBalancing Authority or Reserve Sharing Group shall carry at least enough Contingency
Reserve to cover the most severe single contingency.” The drafting team used 1500 MW asa number derived from the most significant Contingency Reserves operated in various Bas
in all regions.
In the use of net Real Power capability, the drafting team sought to use a value that could beverified through existing requirements as proposed by NERC standard MOD-024 and current
development efforts in that area.
By using 1500 MW as a bright-line, the intent of the drafting team was to ensure that BES
Cyber Systems with common mode vulnerabilities that could result in the loss of 1500 MW
or more of generation at a single plant for a unit or group of units are adequately protected.

Page 24 of 37

Guidelines and Technical Basis
The drafting team also used additional time and value parameters to ensure the bright-lines
and the values used to measure against them were relatively stable over the review period.
Hence, where multiple values of net Real Power capability could be used for the Facilities’
qualification against these bright-lines, the highest value was used.


In Criterion 2.3, the drafting team sought to ensure that BES Cyber Systems for thosegeneration Facilities that have been designated by the Planning Coordinator orTransmission Planner as necessary to avoid BES Adverse Reliability Impacts in the planninghorizon of one year or more are categorized as medium impact. In specifying a planninghorizon of one year or more, the intent is to ensure that those are units that are identified
as a result of a “long term” reliability planning, i.e that the plans are spanning an operating
period of at least 12 months: it does not mean that the operating day for the unit isnecessarily beyond one year, but that the period that is being planned for is more than 1
year: it is specifically intended to avoid designating generation that is required to be run toremediate short term emergency reliability issues. These Facilities may be designated as“Reliability Must Run,” and this designation is distinct from those generation Facilities
designated as “must run” for market stabilization purposes. Because the use of the term
“must run” creates some confusion in many areas, the drafting team chose to avoid using
this term and instead drafted the requirement in more generic reliability language. In
particular, the focus on preventing an Adverse Reliability Impact dictates that these units
are designated as must run for reliability purposes beyond the local area. Those units
designated as must run for voltage support in the local area would not generally be given
this designation. In cases where there is no designated Planning Coordinator, theTransmission Planner is included as the Registered Entity that performs this designation.
If it is determined through System studies that a unit must run in order to preserve thereliability of the BES, such as due to a Category C3 contingency as defined in TPL-003, then
BES Cyber Systems for that unit are categorized as medium impact.
The TPL standards require that, where the studies and plans indicate additional actions, thatthese studies and plans be communicated by the Planning Coordinator or Transmission
Planner in writing to the Regional Entity/RRO. Actions necessary for the implementation ofthese plans by affected parties (generation owners/operators and Reliability Coordinatorsor other necessary party) are usually formalized in the form of an agreement and/or
contract.



Criterion 2.6 includes BES Cyber Systems for those Generation Facilities that have been
identified as critical to the derivation of IROLs and their associated contingencies, as
specified by FAC-014-2, Establish and Communicate System Operating Limits, R5.1.1 andR5.1.3.
IROLs may be based on dynamic System phenomena such as instability or voltage collapse.
Derivation of these IROLs and their associated contingencies often considers the effect ofgeneration inertia and AVR response.

Page 25 of 37

Guidelines and Technical Basis

Criterion 2.9 categorizes BES Cyber Systems for Special Protection Systems and Remedial
Action Schemes as medium impact. Special Protection Systems and Remedial Action
Schemes may be implemented to prevent disturbances that would result in exceeding IROLs
if they do not provide the function required at the time it is required or if it operates
outside of the parameters it was designed for. Generation Owners and Generator Operators
which own BES Cyber Systems for such Systems and schemes designate them as medium
impact.



Criterion 2.11 categorizes as medium impact BES Cyber Systems used by and at Control
Centers that perform the functional obligations of the Generator Operator for an aggregate
generation of 1500 MW or higher in a single interconnection, and that have not alreadybeen included in Part 1.



Criterion 2.13 categorizes as medium impact those BA Control Centers that “control” 1500
MW of generation or more in a single interconnection and that have not already been
included in Part 1. The 1500 MW threshold is consistent with the impact level and rationale
specified for Criterion 2.1.

Transmission
The SDT uses the phrases “Transmission Facilities at a single station or substation” and“Transmission stations or substations” to recognize the existence of both stations andsubstations. Many entities in industry consider a substation to be a location with physicalborders (i.e. fence, wall, etc.) that contains at least an autotransformer. Locations also exist
that do not contain autotransformers, and many entities in industry refer to those locations asstations (or switchyards). Therefore, the SDT chose to use both “station” and “substation” torefer to the locations where groups of Transmission Facilities exist.


Criteria 2.2, 2.4 through 2.10, and 2.12 in Attachment 1 are the criteria that are applicable toTransmission Owners and Operators. In many of the criteria, the impact threshold is definedas the capability of the failure or compromise of a System to result in exceeding one or moreInterconnection Reliability Operating Limits (IROLs). Criterion 2.2 includes BES Cyber Systems
for those Facilities in Transmission Systems that provide reactive resources to enhance andpreserve the reliability of the BES. The nameplate value is used here because there is no
NERC requirement to verify actual capability of these Facilities. The value of 1000 MVARs
used in this criterion is a value deemed reasonable for the purpose of determining criticality.



Criterion 2.4 includes BES Cyber Systems for any Transmission Facility at a substation
operated at 500 kV or higher. While the drafting team felt that Facilities operated at 500 kVor higher did not require any further qualification for their role as components of the
backbone on the Interconnected BES, Facilities in the lower EHV range should have additional
qualifying criteria for inclusion in the medium impact category.
Page 26 of 37

Guidelines and Technical Basis
It must be noted that if the collector bus for a generation plant (i.e. the plant is smaller inaggregate than the threshold set for generation in Criterion 2.1) is operated at 500kV, thecollector bus should be considered a Generation Interconnection Facility, and not a
Transmission Facility, according to the “Final Report from the Ad Hoc Group for Generation
Requirements at the Transmission Interface.” This collector bus would not be a facility for a
medium impact BES Cyber System because it does not significantly affect the 500kV
Transmission grid; it only affects a plant which is below the generation threshold.


Criterion 2.5 includes BES Cyber Systems for facilities at the lower end of BES Transmission
with qualifications for inclusion if they are deemed highly likely to have significant impact on
the BES. While the criterion has been specified as part of the rationale for requiring
protection for significant impact on the BES, the drafting team included, in this criterion,
additional qualifications that would ensure the required level of impact to the BES. The
drafting team:

Excluded radial facilities that would only provide support for single generation
facilities.

Specified interconnection to at least three transmission stations or substations toensure that the level of impact would be appropriate.

The total aggregated weighted value of 3,000 was derived from weighted values related tothree connected 345 kV lines and five connected 230 kV lines at a transmission station or
substation. The total aggregated weighted value is used to account for the true impact to the
BES, irrespective of line kV rating and mix of multiple kV rated lines.
Additionally, in NERC’s document “Integrated Risk Assessment Approach – Refinement to
Severity Risk Index”, Attachment 1, the report used an average MVA line loading based on
kV rating:

230 kV –> 700 MVA



345 kV –> 1,300 MVA



500 kV –> 2,000 MVA



765 kV –> 3,000 MVA

In the terms of applicable lines and connecting “other Transmission stations or substations”
determinations, the following should be considered:

For autotransformers in a station, Responsible Entities have flexibility in determining
whether the groups of Facilities are considered a single substation or station
location or multiple substations or stations. In most cases, Responsible Entities
would probably consider them as Facilities at a single substation or station unlessgeographically dispersed. In these cases of these transformers being within the“fence” of the substation or station, autotransformers may not count as separate

Page 27 of 37

Guidelines and Technical Basisconnections to other stations. The use of common BES Cyber Systems may negate
any rationale for any consideration otherwise. In the case of autotransformers thatare geographically dispersed from a station location, the calculation would take into
account the connections in and out of each station or substation location.
Multiple-point (or multiple-tap) lines are considered to contribute a single weightvalue per line and affect the number of connections to other stations. Therefore, asingle 230 kV multiple-point line between three Transmission stations or substations
would contribute an aggregated weighted value of 700 and connect Transmission
Facilities at a single station or substation to two other Transmission stations or
substations.



Multiple lines between two Transmission stations or substations are considered tocontribute multiple weight values per line, but these multiple lines between the twostations only connect one station to one other station. Therefore, two 345 kV lines
between two Transmission stations or substations would contribute an aggregatedweighted value of 2600 and connect Transmission Facilities at a single station or
substation to one other Transmission station or substation.

Criterion 2.5’s qualification for Transmission Facilities at a Transmission station or
substation is based on 2 distinct conditions.
1. The first condition is that Transmission Facilities at a single station or substation
where that station or substation connect, at voltage levels of 200 kV or higher
to three (3) other stations or substations, to three other stations or substations.
This qualification is meant to ensure that connections that operate at voltagesof 500 kV or higher are included in the count of connections to other stations or
substations as well.
2. The second qualification is that the aggregate value of all lines entering or
leaving the station or substation must exceed 3000. This qualification does notinclude the consideration of lines operating at lower than 200 kV, or 500 kV or
higher, the latter already qualifying as medium impact under criterion 2.4. :there is no value to be assigned to lines at voltages of less than 200 kV or 500 kVor higher in the table of values for the contribution to the aggregate value of
3000.
The Transmission Facilities at the station or substation must meet both qualifications to beconsidered as qualified under criterion 2.5.


Criterion 2.6 include BES Cyber Systems for those Transmission Facilities that have been
identified as critical to the derivation of IROLs and their associated contingencies, as specified
by FAC-014-2, Establish and Communicate System Operating Limits, R5.1.1 and R5.1.3.

Page 28 of 37

Guidelines and Technical Basis

Criterion 2.7 is sourced from the NUC-001 NERC standard, Requirement R9.2.2, for the
support of Nuclear Facilities. NUC-001 ensures that reliability of NPIR’s are ensured throughadequate coordination between the Nuclear Generator Owner/Operator and its
Transmission provider “for the purpose of ensuring nuclear plant safe operation andshutdown.” In particular, there are specific requirements to coordinate physical and cybersecurity protection of these interfaces.



Criterion 2.8 designates as medium impact those BES Cyber Systems that impact Transmission
Facilities necessary to directly support generation that meet the criteria in Criteria 2.1(generation Facilities with output greater than 1500 MW) and 2.3 (generation Facilities
generally designated as “must run” for wide area reliability in the planning horizon). The
Responsible Entity can request a formal statement from the Generation owner as to thequalification of generation Facilities connected to their Transmission systems.



Criterion 2.9 designates as medium impact those BES Cyber Systems for those Special
Protection Systems (SPS), Remedial Action Schemes (RAS), or automated switching Systems
installed to ensure BES operation within IROLs. The degradation, compromise orunavailability of these BES Cyber Systems would result in exceeding IROLs if they fail tooperate as designed. By the definition of IROL, the loss or compromise of any of these have
Wide Area impacts.



Criterion 2.10 designates as medium impact those BES Cyber Systems for Systems or
Elements that perform automatic Load shedding, without human operator initiation, of 300
MW or more. The SDT spent considerable time discussing the wording of Criterion 2.10, andchose the term “Each” to represent that the criterion applied to a discrete System or Facility.
In the drafting of this criterion, the drafting team sought to include only those Systems that
did not require human operator initiation, and targeted in particular those underfrequency
load shedding (UFLS) Facilities and systems and undervoltage load shedding (UVLS) systems
and Elements that would be subject to a regional Load shedding requirement to prevent
Adverse Reliability Impact. These include automated UFLS systems or UVLS systems that arecapable of Load shedding 300 MW or more. It should be noted that those qualifying systems
which require a human operator to arm the system, but once armed, trigger automatically,
are still to be considered as not requiring human operator initiation and should be designatedas medium impact. The 300 MW threshold has been defined as the aggregate of the highest
MW Load value, as defined by the applicable regional Load Shedding standards, for thepreceding 12 months to account for seasonal fluctuations.
This particular threshold (300 MW) was provided in CIP, Version 1. The SDT believes that thethreshold should be lower than the 1500MW generation requirement since it is specificallyaddressing UVLS and UFLS, which are last ditch efforts to save the Bulk Electric System andhence requires a lower threshold. A review of UFLS tolerances defined within regionalreliability standards for UFLS program requirements to date indicates that the historical valueof 300 MW represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.

Page 29 of 37

Guidelines and Technical BasisIn ERCOT, the Load acting as a Resource (“LaaR”) Demand Response Program is not part of
the regional load shedding program, but an ancillary services market. In general, similar
demand response programs that are not part of the NERC or regional reliability Load shedding
programs, but are offered as components of an ancillary services market do not qualify under
this criterion.
The language used in section 4 for UVLS and UFLS and in criterion 2.10 of Attachment 1 isdesigned to be consistent with requirements set in the PRC standards for UFLS and UVLS.


Criterion 2.12 categorizes as medium impact those BES Cyber Systems used by and at Control
Centers and associated data centers performing the functional obligations of a Transmission
Operator and that have not already been categorized as high impact.

Criterion 2.13 categorizes as Medium Impact those BA Control Centers that “control” 1500
MW of generation or more in a single Interconnection. The 1500 MW threshold is consistent
with the impact level and rationale specified for Criterion 2.1.

Low Impact Rating (L)BES Cyber Systems not categorized in high impact or medium impact default to low impact. Notethat low impact BES Cyber Systems do not require discrete identification.
Restoration Facilities

Several discussions on the CIP Version 5 standards suggest entities owning Blackstart
Resources and Cranking Paths might elect to remove those services to avoid higher
compliance costs. For example, one Reliability Coordinator reported a 25% reduction ofBlackstart Resources as a result of the Version 1 language, and there could be more entities
that make this choice under Version 5.
In response, the CIP Version 5 drafting team sought informal input from NERC’s Operating
and Planning Committees. The committees indicate there has already been a reduction inBlackstart Resources because of increased CIP compliance costs, environmental rules, andother risks; continued inclusion within Version 5 at a category that would very significantly
increase compliance costs can result in further reduction of a vulnerable pool.
The drafting team moved from the categorization of restoration assets such as Blackstart
Resources and Cranking Paths as medium impact (as was the case in earlier drafts) tocategorization of these assets as low impact as a result of these considerations. This will notrelieve asset owners of all responsibilities, as would have been the case in CIP-002, Versions
1-4 (since only Cyber Assets with routable connectivity which are essential to restoration
assets are included in those versions). Under the low impact categorization, those assets will
be protected in the areas of cyber security awareness, physical access control, and electronic
access control, and they will have obligations regarding incident response. This represents a
net gain to bulk power system reliability, however, since many of those assets do not meetcriteria for inclusion under Versions 1-4.

Page 30 of 37

Guidelines and Technical Basis
Weighing the risks to overall BES reliability, the drafting team determined that this recategorization represents the option that would be the least detrimental to restoration
function and, thus, overall BES reliability. Removing Blackstart Resources and Cranking Paths
from medium impact promotes overall reliability, as the likely alternative is fewer Blackstart
Resources supporting timely restoration when needed.
BES Cyber Systems for generation resources that have been designated as Blackstart
Resources in the Transmission Operator’s restoration plan default to low impact. NERC
Standard EOP-005-2 requires the Transmission Operator to have a Restoration Plan and tolist its Blackstart Resources in its plan, as well as requirements to test these Resources. This
criterion designates only those generation Blackstart Resources that have been designatedas such in the Transmission Operator’s restoration plan. The glossary term Blackstart
Capability Plan has been retired.
Regarding concerns of communication to BES Asset Owners and Operators of their role in the
Restoration Plan, Transmission Operators are required in NERC Standard EOP-005-2 to“provide the entities identified in its approved restoration plan with a description of any
changes to their roles and specific tasks prior to the implementation date of the plan.”

BES Cyber Systems for Facilities and Elements comprising the Cranking Paths and meeting theinitial switching requirements from the Blackstart Resource to the first Interconnection pointof the generation unit(s) to be started, as identified in the Transmission Operator’s
restoration plan, default to the category of low impact: however, these systems are explicitly
called out to ensure consideration for inclusion in the scope of the version 5 CIP standards.
This requirement for inclusion in the scope is sourced from requirements in NERC standard
EOP-005-2, which requires the Transmission Operator to include in its Restoration Plan the
Cranking Paths and initial switching requirements from the Blackstart Resource and theunit(s) to be started.
Distribution Providers may note that they may have BES Cyber Systems that must be scopedin if they have Elements listed in the Transmission Operator’s Restoration Plan that arecomponents of the Cranking Path.

Page 31 of 37

Guidelines and Technical Basis

Use Case: CIP Process Flow
The following CIP use case process flow for a generator Operator/Owner was provided by aparticipant in the development of the Version 5 standards and is provided here as an example
of a process used to identify and categorize BES Cyber Systems and BES Cyber Assets; review,
develop, and implement strategies to mitigate overall risks; and apply applicable security
controls.

Page 32 of 37

Guidelines and Technical Basis
Rationale:
During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for R1:
BES Cyber Systems at each site location have varying impact on the reliable operation of the
Bulk Electric System. Attachment 1 provides a set of “bright-line” criteria that the Responsible
Entity must use to identify these BES Cyber Systems in accordance with the impact on the BES.
BES Cyber Systems must be identified and categorized according to their impact so that theappropriate measures can be applied, commensurate with their impact. These impact
categories will be the basis for the application of appropriate requirements in CIP-003-CIP-011.
Rationale for R2:
The lists required by Requirement R1 are reviewed on a periodic basis to ensure that all BES
Cyber Systems required to be categorized have been properly identified and categorized. The
miscategorization or non-categorization of a BES Cyber System can lead to the application of
inadequate or non-existent cyber security controls that can lead to compromise or misuse that
can affect the real-time operation of the BES. The CIP Senior Manager’s approval ensuresproper oversight of the process by the appropriate Responsible Entity personnel.

Version History

VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify therequirements and to bring thecompliance elements into conformancewith the latest guidelines for developing
compliance elements of standards.
Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
Responsible Entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.

3

12/16/09

Updated version number from -2 to -3.

Change Tracking
3/24/06

UpdatePage 33 of 37

Guidelines and Technical Basis3

3/31/104

12/30/10

4

1/24/115

11/26/12

5.1

9/30/13

5.1

11/22/13

5.1a

11/02/16

5.1a

12/14/2016

Approved by the NERC Board ofTrustees.
Approved by FERC.
Modified to add specific criteria for
Critical Asset identification.
Approved by the NERC Board ofTrustees.
Adopted by the NERC Board ofTrustees.

Replaced “Devices” with “Systems” in adefinition in background section.
FERC Order issued approving CIP-0025.1.
Adopted by the NERC Board ofTrustees.
FERC letter Order approving CIP-0025.1a. Docket No. RD17-2-000.

UpdateUpdateModified tocoordinate withother CIP
standards and torevise format touse RBS
Template.
ErrataPage 34 of 37

Appendix 1

Appendix 1
Requirement Number and Text of Requirement

CIP-002-5.1, Requirement R1
R1. Each Responsible Entity shall implement a process that considers each of the following
assets for purposes of parts 1.1 through 1.3:
i. Control Centers and backup Control Centers;
ii. Transmission stations and substations;iii. Generation resources;
iv. Systems and facilities critical to system restoration, including Blackstart Resources
and Cranking Paths and initial switching requirements;
v. Special Protection Systems that support the reliable operation of the Bulk Electric
System; andvi. For Distribution Providers, Protection Systems specified in Applicability section
4.2.1 above.
1.1. Identify each of the high impact BES Cyber Systems according to Attachment 1, Section
1, if any, at each asset;
1.2. Identify each of the medium impact BES Cyber Systems according to Attachment 1,

Section 2, if any, at each asset; and1.3. Identify each asset that contains a low impact BES Cyber System according to

Attachment 1, Section 3, if any (a discrete list of low impact BES Cyber Systems is not
required).
Attachment 1, Criterion 2.1
2. Medium Impact Rating (M)Each BES Cyber System, not included in Section 1 above, associated with any of thefollowing:
2.1. Commissioned generation, by each group of generating units at a single plant location,with an aggregate highest rated net Real Power capability of the preceding 12 calendar
months equal to or exceeding 1500 MW in a single Interconnection. For each group ofgenerating units, the only BES Cyber Systems that meet this criterion are those shared
BES Cyber Systems that could, within 15 minutes, adversely impact the reliable
operation of any combination of units that in aggregate equal or exceed 1500 MW in asingle Interconnection.

Appendix 1
Questions

Energy Sector Security Consortium, Inc. (EnergySec) submitted a Request for Interpretation(RFI) seeking clarification of Criterion 2.1 of Attachment 1 in Reliability Standard CIP-002-5.1
regarding the use of the phrase “shared BES Cyber Systems.”
The Interpretation Drafting Team identified the following questions in the RFI:
1. Whether the phrase “shared BES Cyber Systems” means that the evaluation for Criterion
2.1 shall be performed individually for each discrete BES Cyber System at a single plant
location, or collectively for groups of BES Cyber Systems?
2. Whether the phrase “shared BES Cyber Systems” refers to discrete BES Cyber Systems
that are shared by multiple units, or groups of BES Cyber Systems that could collectively
impact multiple units?
3. If the phrase applies collectively to groups of BES Cyber Systems, what criteria should be
used to determine which BES Cyber Systems should be grouped for collective
evaluation?
Responses

Question 1: Whether the phrase “shared BES Cyber Systems,” means that the evaluation for
Criterion 2.1 shall be performed individually for each discrete BES Cyber System at a single
plant location, or collectively for groups of BES Cyber Systems?
The evaluation as to whether a BES Cyber System is shared should be performed individually foreach discrete BES Cyber System. In the standard language of CIP-002-5.1, there is no reference
to or obligation to group BES Cyber Systems. Requirement R1, part 1.2 states “Identify each of
the medium impact BES Cyber Systems according to Attachment 1, Section 2…” Further, thepreamble of Section 2 of CIP-002-5.1 Attachment 1 states “Each BES Cyber System…associatedwith any of the following [criteria].” (emphasis added)
Additionally, the Background section of CIP-002-5.1 states that “[i]t is left up to the Responsible
Entity to determine the level of granularity at which to identify a BES Cyber System within thequalifications in the definition of BES Cyber System.” The Background section also provides:
The Responsible Entity should take into consideration the operational
environment and scope of management when defining the BES Cyber Systemboundary in order to maximize efficiency in secure operations. Defining theboundary too tightly may result in redundant paperwork and authorizations,while defining the boundary too broadly could make the secure operation of the
BES Cyber System difficult to monitor and assess.

Page 36 of 37

Appendix 1
Question 2: Whether the phrase “shared BES Cyber Systems” refers to discrete BES Cyber
Systems that are shared by multiple units, or groups of BES Cyber Systems that could
collectively impact multiple units?
The phrase “shared BES Cyber Systems” refers to discrete BES Cyber Systems that are shared bymultiple generation units.
The use of the term “shared” is also clarified in the NERC Frequently Asked Questions (FAQ)
document issued by NERC Compliance to support implementation of the CIP Reliability
Standards. FAQ #49 provides:
Shared BES Cyber Systems are those that are associated with any combination of units
in a single Interconnection, as referenced in CIP-002-5.1, Attachment 1, impact rating
criteria 2.1 and 2.2. For criterion 2.1 “BES Cyber Systems that could, within 15 minutes,
adversely impact the reliable operation of any combination of units that in aggregate
equal or exceed 1500 MW in a single Interconnection.” For criterion 2.2: “BES Cyber
Systems that could, within 15 minutes, adversely impact the reliable operation of any
combination of resources that in aggregate equal or exceed 1000 MVAR. Also refer tothe Lesson Learned for CIP-002-5.1 Requirement R1: Impact Rating of Generation
Resource Shared BES Cyber Systems for further information and examples.
Question 3: If the phrase applies collectively to groups of BES Cyber Systems, what criteria
should be used to determine which BES Cyber Systems should be grouped for collective
evaluation?
The phrase applies to each discrete BES Cyber System.

Page 37 of 37