CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
A. Introduction

1.

Title:

Cyber Security — Incident Reporting and Response Planning

2.

Number:

CIP-008-6

3.

Purpose: To mitigate the risk to the reliable operation of the BES as the result of a
Cyber Security Incident by specifying incident response requirements.

4.

Applicability:
4.1.

Functional Entities: For the purpose of the requirements contained herein,
the following list of functional entities will be collectively referred to as“Responsible Entities.” For requirements in this standard where a specificfunctional entity or subset of functional entities are the applicable entity orentities, the functional entity or entities are specified explicitly.
4.1.1 Balancing Authority
4.1.2 Distribution Provider that owns one or more of the following Facilities,
systems, and equipment for the protection or restoration of the BES:
4.1.2.1 Each underfrequency Load shedding (UFLS) or undervoltage
Load shedding (UVLS) system that:
4.1.2.1.1 is part of a Load shedding program that is subject
to one or more requirements in a NERC or Regional
Reliability Standard; and4.1.2.1.2 performs automatic Load shedding under acommon control system owned by the Responsible
Entity, without human operator initiation, of 300
MW or more.
4.1.2.2 Each Remedial Action Scheme where the Remedial Action
Scheme is subject to one or more requirements in a NERC or
Regional Reliability Standard.
4.1.2.3 Each Protection System (excluding UFLS and UVLS) thatapplies to Transmission where the Protection System issubject to one or more requirements in a NERC or Regional
Reliability Standard.
4.1.2.4 Each Cranking Path and group of Elements meeting the initialswitching requirements from a Blackstart Resource up to andincluding the first interconnection point of the starting station
service of the next generation unit(s) to be started.
4.1.3 Generator Operator
4.1.4 Generator Owner
4.1.5 Reliability Coordinator

Page 1 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
4.1.6 Transmission Operator
4.1.7 Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1
above are those to which these requirements are applicable. For requirementsin this standard where a specific type of Facilities, system, or equipment or
subset of Facilities, systems, and equipment are applicable, these are specified
explicitly.
4.2.1 Distribution Provider: One or more of the following Facilities, systems
and equipment owned by the Distribution Provider for the protection
or restoration of the BES:
4.2.1.1 Each UFLS or UVLS System that:
4.2.1.1.1 is part of a Load shedding program that is subject
to one or more requirements in a NERC or Regional
Reliability Standard; and4.2.1.1.2 performs automatic Load shedding under acommon control system owned by the Responsible
Entity, without human operator initiation, of 300
MW or more.
4.2.1.2 Each Remedial Action Scheme where the Remedial Action
Scheme is subject to one or more requirements in a NERC or
Regional Reliability Standard.
4.2.1.3 Each Protection System (excluding UFLS and UVLS) thatapplies to Transmission where the Protection System issubject to one or more requirements in a NERC or Regional
Reliability Standard.
4.2.1.4 Each Cranking Path and group of Elements meeting the initialswitching requirements from a Blackstart Resource up to andincluding the first interconnection point of the starting station
service of the next generation unit(s) to be started.
4.2.2 Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3 Exemptions: The following are exempt from Standard CIP-008-6:
4.2.3.1 Cyber Assets at Facilities regulated by the Canadian Nuclear
Safety Commission.
4.2.3.2 Cyber Assets associated with communication networks anddata communication links between discrete Electronic Security
Perimeters.

Page 2 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
4.2.3.3 The systems, structures, and components that are regulatedby the Nuclear Regulatory Commission under a cyber security
plan pursuant to 10 C.F.R. Section 73.54.
4.2.3.4 For Distribution Providers, the systems and equipment thatare not included in section 4.2.1 above.
4.2.3.5 Responsible Entities that identify that they have no BES Cyber
Systems categorized as high impact or medium impact
according to the CIP-002 identification and categorization
processes.
5.

Effective Dates:
See Implementation Plan for CIP-008-6.

6.

Background:Standard CIP-008 exists as part of a suite of CIP Standards related to cyber security.
CIP-002 requires the initial identification and categorization of BES Cyber Systems. CIP003, CIP-004, CIP-005, CIP-006, CIP-007, CIP-008, CIP-009, CIP-010, and CIP-011
require a minimum level of organizational, operational, and procedural controls to
mitigate risk to BES Cyber Systems.
Most requirements open with, “Each Responsible Entity shall implement one or more
documented [processes, plan, etc.] that include the applicable items in [Table
Reference].” The referenced table requires the applicable items in the procedures forthe requirement’s common subject matter.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any
particular naming or approval structure beyond what is stated in the requirements.
An entity should include as much as it believes necessary in its documented processes,
but must address the applicable requirements in the table.
The terms program and plan are sometimes used in place of documented processes
where it is commonly understood. For example, documented processes describing a
response are typically referred to as plans (i.e., incident response plans and recovery
plans). Likewise, a security plan can describe an approach involving multiple
procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of
its policies, plans and procedures involving a particular subject matter. Examples inthe standards include the personnel risk assessment program and the personnel
training program. The full implementation of the CIP Cyber Security Standards could
also be referred to as a program. However, the terms program and plan do not imply
any additional requirements beyond what is stated in the standards.

Page 3 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
Responsible Entities can implement common controls that meet requirements for
multiple high and medium impact BES Cyber Systems. For example, a single training
program could meet the requirements for training personnel across multiple BES
Cyber Systems.
Measures for the initial requirement are simply the documented processes
themselves. Measures in the table rows provide examples of evidence to show
documentation and implementation of applicable items in the documented processes.
These measures serve to provide guidance to entities in acceptable records ofcompliance and should not be viewed as an all-inclusive list.
Throughout the standards, unless otherwise stated, bulleted items in therequirements and measures are items that are linked with an “or,” and numbered
items are items that are linked with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and
UVLS. This particular threshold of 300 MW for UVLS and UFLS was provided in Version
1 of the CIP Cyber Security Standards. The threshold remains at 300 MW since it isspecifically addressing UVLS and UFLS, which are last ditch efforts to save the Bulk
Electric System. A review of UFLS tolerances defined within regional reliability
standards for UFLS program requirements to date indicates that the historical value of
300 MW represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.
“Applicable Systems” Columns in Tables:
Each table has an “Applicable Systems” column to further define the scope of systems
to which a specific requirement row applies. The CSO706 SDT adapted this conceptfrom the National Institute of Standards and Technology (“NIST”) Risk Management
Framework as a way of applying requirements more appropriately based on impact
and connectivity characteristics. The following conventions are used in the“Applicable Systems” column as described.
•

High Impact BES Cyber Systems – Applies to BES Cyber Systems categorized ashigh impact according to the CIP-002 identification and categorization processes.

•

Medium Impact BES Cyber Systems – Applies to BES Cyber Systems categorized as
medium impact according to the CIP-002 identification and categorization
processes.

Page 4 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
B. Requirements and Measures
R1.

Each Responsible Entity shall document one or more Cyber Security Incident response plan(s) that collectively include eachof the applicable requirement parts in CIP-008-6 Table R1 – Cyber Security Incident Response Plan Specifications. [Violation
Risk Factor: Lower] [Time Horizon: Long Term Planning].

M1. Evidence must include each of the documented plan(s) that collectively include each of the applicable requirement parts in
CIP-008-6 Table R1 – Cyber Security Incident Response Plan Specifications.
CIP-008-6 Table R1 – Cyber Security Incident Response Plan Specifications
Part
1.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

EACMS

Requirements
One or more processes to identify,classify, and respond to Cyber
Security Incidents.

Measures
An example of evidence may include,
but is not limited to, dated
documentation of Cyber Security
Incident response plan(s) that include
the process(es) to identify, classify,
and respond to Cyber Security
Incidents.

Page 5 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R1 – Cyber Security Incident Response Plan Specifications
Part
1.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

EACMS

Requirements
One or more processes:
1.2.1 That include criteria toevaluate and define
attempts to compromise;
1.2.2 To determine if an identified
Cyber Security Incident is:•

A Reportable Cyber
Security Incident; or•An attempt tocompromise, as
determined byapplying the criteria
from Part 1.2.1, one ormore systems
identified in the“Applicable Systems”
column for this Part;
and

Measures
Examples of evidence may include,
but are not limited to, dated
documentation of Cyber Security
Incident response plan(s) that provide
guidance or thresholds fordetermining which Cyber Security
Incidents are also Reportable Cyber
Security Incidents or a Cyber Security
Incident that is determined to be an
attempt to compromise a system
identified in the “Applicable Systems”
column including justification forattempt determination criteria anddocumented processes for
notification.

1.2.3 To provide notification per
Requirement R4.

Page 6 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R1 – Cyber Security Incident Response Plan Specifications
Part
1.3

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:

The roles and responsibilities of Cyber
Security Incident response groups orindividuals.

An example of evidence may include,
but is not limited to, dated Cyber
Security Incident response process(es)or procedure(s) that define roles andresponsibilities (e.g., monitoring,
reporting, initiating, documenting,etc.) of Cyber Security Incident
response groups or individuals.

Incident handling procedures for
Cyber Security Incidents.

An example of evidence may include,
but is not limited to, dated Cyber
Security Incident response process(es)or procedure(s) that address incident
handling (e.g., containment,
eradication, recovery/incident
resolution).

•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•
1.4

EACMS

High Impact BES Cyber Systems andtheir associated:
•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

EACMS

Page 7 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
R2. Each Responsible Entity shall implement each of its documented Cyber Security Incident response plans to collectively
include each of the applicable requirement parts in CIP-008-6 Table R2 – Cyber Security Incident Response Plan
Implementation and Testing. [Violation Risk Factor: Lower] [Time Horizon: Operations Planning and Real-Time Operations].
M2. Evidence must include, but is not limited to, documentation that collectively demonstrates implementation of each of theapplicable requirement parts in CIP-008-6 Table R2 – Cyber Security Incident Response Plan Implementation and Testing.
CIP-008-6 Table R2 – Cyber Security Incident Response Plan Implementation and Testing
Part
2.1

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:

Test each Cyber Security Incident
response plan(s) at least once every
15 calendar months:

Examples of evidence may include,
but are not limited to, dated evidenceof a lessons-learned report that
includes a summary of the test or acompilation of notes, logs, andcommunication resulting from thetest. Types of exercises may include
discussion or operations based
exercises.

•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

EACMS

•
•
•

By responding to an actual
Reportable Cyber Security
Incident;
With a paper drill or tabletop
exercise of a Reportable Cyber
Security Incident; orWith an operational exercise of aReportable Cyber Security
Incident.

Page 8 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R2 – Cyber Security Incident Response Plan Implementation and Testing
Part
2.2

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:

Use the Cyber Security Incident
response plan(s) under Requirement
R1 when responding to a Reportable
Cyber Security Incident, responding toa Cyber Security Incident that
attempted to compromise a system
identified in the “Applicable Systems”
column for this Part, or performing an
exercise of a Reportable Cyber
Security Incident. Document
deviations from the plan(s) taken
during the response to the incident or
exercise.

Examples of evidence may include,
but are not limited to, incident
reports, logs, and notes that were
kept during the incident response
process, and follow-up
documentation that describes
deviations taken from the plan during
the incident response or exercise.

Retain records related to Reportable
Cyber Security Incidents and Cyber
Security Incidents that attempted tocompromise a system identified in the“Applicable Systems” column for thisPart as per the Cyber Security Incident
response plan(s) under Requirement
R1.

An example of evidence may include,
but is not limited to, dated
documentation, such as security logs,
police reports, emails, response forms
or checklists, forensic analysis results,
restoration records, and post-incident
review notes related to Reportable
Cyber Security Incidents and a Cyber
Security Incident that is determined
to be an attempt to compromise asystem identified in the “Applicable
Systems” column.

•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

2.3

EACMS

High Impact BES Cyber Systems andtheir associated:
•

EACMS

Medium Impact BES Cyber Systems
and their associated:
•

EACMS

Page 9 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
R3. Each Responsible Entity shall maintain each of its Cyber Security Incident response plans according to each of theapplicable requirement parts in CIP-008-6 Table R3 – Cyber Security Incident Response Plan Review, Update, andCommunication. [Violation Risk Factor: Lower] [Time Horizon: Operations Assessment].
M3. Evidence must include, but is not limited to, documentation that collectively demonstrates maintenance of each Cyber
Security Incident response plan according to the applicable requirement parts in CIP-008-6 Table R3 – Cyber Security
Incident Response Plan Review, Update, and Communication.

Page 10 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R3 – Cyber Security Incident Response Plan
Review, Update, and Communication
Part
3.1

Applicable Systems

Requirements

High Impact BES Cyber Systems andtheir associated:

No later than 90 calendar days after
completion of a Cyber Security Incident
response plan(s) test or actual• EACMS
Reportable Cyber Security Incident
Medium Impact BES Cyber Systems and response:
their associated:
3.1.1. Document any lessons learned• EACMSor document the absence ofany lessons learned;
3.1.2. Update the Cyber Security
Incident response plan basedon any documented lessons
learned associated with theplan; and3.1.3. Notify each person or groupwith a defined role in the Cyber
Security Incident response planof the updates to the Cyber
Security Incident response plan
based on any documented
lessons learned.

Measures
An example of evidence may include,
but is not limited to, all of thefollowing:
1. Dated documentation of post
incident(s) review meeting notes
or follow-up report showing
lessons learned associated with
the Cyber Security Incident
response plan(s) test or actual
Reportable Cyber Security Incident
response or dated documentation
stating there were no lessons
learned;2. Dated and revised Cyber Security
Incident response plan showing
any changes based on the lessons
learned; and3. Evidence of plan update
distribution including, but notlimited to:• Emails;• USPS or other mail service;• Electronic distribution system;or• Training sign-in sheets.

Page 11 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R3 – Cyber Security Incident Response Plan
Review, Update, and Communication
Part
3.2

Applicable Systems

Requirements

High Impact BES Cyber Systems andtheir associated:

Measures

No later than 60 calendar days after achange to the roles or responsibilities,
Cyber Security Incident response• EACMS
groups or individuals, or technology
Medium Impact BES Cyber Systems and that the Responsible Entity determines
their associated:would impact the ability to execute theplan:• EACMSAn example of evidence may include,
but is not limited to:

3.2.1. Update the Cyber Security
Incident response plan(s); and2. Evidence of plan update
distribution including, but notlimited to:• Emails;• USPS or other mail service;• Electronic distribution
system; or• Training sign-in sheets.

3.2.2. Notify each person or groupwith a defined role in the Cyber
Security Incident response planof the updates.

1. Dated and revised Cyber
Security Incident response planwith changes to the roles or
responsibilities, responders or
technology; andPage 12 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
R4. Each Responsible Entity shall notify the Electricity Information Sharing and Analysis Center (E-ISAC) and, if subject to thejurisdiction of the United States, the United States National Cybersecurity and Communications Integration Center(NCCIC), 1 or their successors, of a Reportable Cyber Security Incident and a Cyber Security Incident that was an attempt tocompromise, as determined by applying the criteria from Requirement R1, Part 1.2.1, a system identified in the “Applicable
Systems” column, unless prohibited by law, in accordance with each of the applicable requirement parts in CIP-008-6 Table
R4 – Notifications and Reporting for Cyber Security Incidents. [Violation Risk Factor: Lower] [Time Horizon: Operations
Assessment].
M4. Evidence must include, but is not limited to, documentation that collectively demonstrates notification of each determined
Reportable Cyber Security Incident and a Cyber Security Incident that was an attempt to compromise a system identified in
the “Applicable Systems” column according to the applicable requirement parts in CIP-008-6 Table R4 – Notifications andReporting for Cyber Security Incidents.
CIP-008-6 Table R4 – Notifications and Reporting for Cyber Security Incidents
Part
4.1

Applicable Systems
High Impact BES Cyber Systems
and their associated:
•

EACMS

Medium Impact BES Cyber
Systems and their associated:
•

EACMS

Requirements
Initial notifications and updates shall
include the following attributes, at aminimum, to the extent known:
4.1.1 The functional impact;
4.1.2 The attack vector used; andMeasures
Examples of evidence may include,
but are not limited to, dated
documentation of initial
notifications and updates to the EISAC and NCCIC.

4.1.3 The level of intrusion that wasachieved or attempted.

1

The National Cybersecurity and Communications Integration Center (NCCIC) is the successor organization of the Industrial Control Systems
Cyber Emergency Response Team (ICS-CERT). In 2017, NCCIC realigned its organizational structure and integrated like functions previously
performed independently by the ICS-CERT and the United States Computer Emergency Readiness Team (US-CERT).
Page 13 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
CIP-008-6 Table R4 – Notifications and Reporting for Cyber Security Incidents
Part
4.2

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems
and their associated:

After the Responsible Entity’s
determination made pursuant todocumented process(es) in
Requirement R1, Part 1.2, provide initial
notification within the following
timelines:

Examples of evidence may include,
but are not limited to, dated
documentation of notices to the EISAC and NCCIC.

•

EACMS

Medium Impact BES Cyber
Systems and their associated:
•

4.3

EACMS

High Impact BES Cyber Systems
and their associated:
•

EACMS

Medium Impact BES Cyber
Systems and their associated:••

One hour after thedetermination of a Reportable
Cyber Security Incident.

•

By the end of the next calendar
day after determination that a
Cyber Security Incident was an
attempt to compromise asystem identified in the“Applicable Systems” column forthis Part.

Provide updates, if any, within 7
calendar days of determination of new
or changed attribute information
required in Part 4.1.

Examples of evidence may include,
but are not limited to, dated
documentation of submissions to
the E-ISAC and NCCIC.

EACMS

Page 14 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
C. Compliance1. Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
The Regional Entity shall serve as the Compliance Enforcement Authority (“CEA”) unless theapplicable entity is owned, operated, or controlled by the Regional Entity. In such cases the
ERO or a Regional Entity approved by FERC or other applicable governmental authority shallserve as the CEA.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity is required toretain specific evidence to demonstrate compliance. For instances where the evidence
retention period specified below is shorter than the time since the last audit, the CEA may ask
an entity to provide other evidence to show that it was compliant for the full time period
since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as identified below
unless directed by its CEA to retain specific evidence for a longer period of time as part of aninvestigation:•

Each Responsible Entity shall retain evidence of each requirement in this standard forthree calendar years.

•

If a Responsible Entity is found non-compliant, it shall keep information related to thenon-compliance until mitigation is complete and approved or for the time specified
above, whichever is longer.

•

The CEA shall keep the last audit records and all requested and submitted subsequent
audit records.

1.3. Compliance Monitoring and Assessment Processes:•

Compliance Audit•

Self-Certification•

Spot Checking•

Compliance Investigation•

Self-Reporting•

Complaint

1.4. Additional Compliance Information:
None

Page 15 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning
2. Table of Compliance Elements
R#
R1

Time
HorizonLong Term
Planning

Violation Severity Levels (CIP-008-6)

VRF
Lower

Lower VSL
N/A

Moderate VSL
N/AHigh VSL

Severe VSL

The Responsible Entity
has developed the
Cyber Security
Incident responseplan(s), but the plan
does not include theroles and
responsibilities ofCyber Security
Incident responsegroups or individuals.
(1.3)

The Responsible Entity
has not developed a
Cyber Security
Incident response planwith one or more
processes to identify,classify, and respond
to Cyber Security
Incidents. (1.1)
OR

The Responsible Entity
has developed a Cyber
OR
Security Incident
The Responsible Entity response plan, but thehas developed theplan does not include
Cyber Security
one or more
Incident response
processes to identify
plan(s), but the plan
Reportable Cyberdoes not include
Security Incidents or aincident handling
Cyber Security
procedures for Cyber
Incident that was an
Security Incidents.
attempt to(1.4)
compromise, as
determined byOR
applying the criteria
The Responsible Entity from Part 1.2.1, a
has developed a Cyber system identified inPage 16 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-008-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

Security Incident
the “Applicable
response plan, but the Systems” column forplan does not include Part 1.2. (1.2)
one or more processes
to provide notification
per Requirement R4.
(1.2)
OR
The Responsible Entity
has developed a Cyber
Security Incident
response plan, but theplan does not include
one or more processes
that include criteria toevaluate and define
attempts tocompromise. (1.2)
R2

Operations
Planning
Real-time
Operations

Lower

The Responsible Entity
has not tested the
Cyber Security
Incident responseplan(s) within 15
calendar months, notexceeding 16 calendar
months between testsof the plan(s). (2.1)

The Responsible Entity
has not tested the
Cyber Security
Incident responseplan(s) within 16
calendar months, notexceeding 17 calendar
months between testsof the plan(s). (2.1)

The Responsible Entity
has not tested the
Cyber Security
Incident responseplan(s) within 17
calendar months, notexceeding 18 calendar
months between testsof the plan(s). (2.1)

The Responsible Entity
has not tested the
Cyber Security
Incident responseplan(s) within 18
calendar months
between tests of theplan(s). (2.1)
ORPage 17 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-008-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

OR

The Responsible Entity
The Responsible Entity did not retain relevant
records related to
did not document
Reportable Cyberdeviations, if any,
from the plan during a Security Incidents or
Cyber Security
test or when a
Incidents that were an
Reportable Cyber
attempt toSecurity Incident or acompromise a system
Cyber Security
identified in the
Incident that was an“Applicable Systems”
attempt tocompromise a system column for Part 2.3.
(2.3)
identified in the“Applicable Systems”
column for Part 2.2
occurs. (2.2)
R3

Operations
Assessment

Lower

The Responsible Entity
has not notified each
person or group witha defined role in the
Cyber Security
Incident response
plan of updates to the
Cyber Security
Incident response
plan within greaterthan 90 but less than
120 calendar days of atest or actual incident

The Responsible Entity
has not updated the
Cyber Security
Incident response plan
based on any
documented lessons
learned within 90 andless than 120 calendar
days of a test or actual
incident response to aReportable Cyber

The Responsible Entity
has neither
documented lessons
learned nor
documented theabsence of any lessons
learned within 90 andless than 120 calendar
days of a test or actual
incident response to aReportable Cyber

The Responsible Entity
has neither
documented lessons
learned nor
documented theabsence of any
lessons learned within
120 calendar days of atest or actual incident
response to aReportable Cyber

Page 18 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-008-6)
Lower VSL
response to aReportable Cyber
Security Incident.
(3.1.3)Moderate VSLHigh VSL

Security Incident.
(3.1.2)

Security Incident.
(3.1.1)OROR

The Responsible Entity
has not notified each
person or group with adefined role in the
Cyber Security
Incident response planof updates to the
Cyber Security
Incident response plan
within 120 calendar
days of a test or actual
incident response to aReportable Cyber
Security Incident.
(3.1.3)The Responsible Entity
has not updated the
Cyber Security
Incident response plan
based on any
documented lessons
learned within 120
calendar days of a testor actual incident
response to aReportable Cyber
Security Incident.
(3.1.2)OR
The Responsible Entity
has not updated the
Cyber Security
Incident responseplan(s) or notified
each person or groupwith a defined role
within 60 and lessthan 90 calendar days

Severe VSL
Security Incident.
(3.1.1)OR
The Responsible Entity
has not updated the
Cyber Security
Incident responseplan(s) or notified
each person or groupwith a defined role
within 90 calendar
days of any of thefollowing changes thatthe responsible entity
Page 19 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-008-6)
Lower VSL

Moderate VSLHigh VSLof any of the followingchanges that the
responsible entity
determines would
impact the ability to
execute the plan: (3.2)

determines would
impact the ability to
execute the plan: (3.2)• Roles or
responsibilities, or• Cyber Security
Incident responsegroups or individuals,or• Technology
changes.
R4

Operations
Assessment

Lower

The Responsible Entity
notified E-ISAC and
NCCIC, or theirsuccessors, of a Cyber
Security Incident that
was an attempt tocompromise a system
identified in the“Applicable Systems”
column for Part 4.2
but failed to notify or
update E-ISAC or
NCCIC, or theirsuccessors, within the

The Responsible Entity
failed to notify E-ISAC
or NCCIC, or theirsuccessors, of a Cyber
Security Incident that
was an attempt tocompromise, as
determined byapplying the criteria
from Requirement R1,
Part 1.2.1, a system
identified in the“Applicable Systems”
column. (R4)

Severe VSL• Roles or
responsibilities, or• Cyber Security
Incident responsegroups or individuals,or• Technology
changes.

The Responsible Entity
notified E-ISAC and
NCCIC, or theirsuccessors, of aReportable Cyber
Security Incident but
failed to notify or
update E-ISAC or
NCCIC, or theirsuccessors, within thetimelines pursuant toPart 4.2. (4.2)

The Responsible Entity
failed to notify E-ISAC
and NCCIC, or theirsuccessors, of aReportable Cyber
Security Incident. (R4)

OR
Page 20 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
HorizonViolation Severity Levels (CIP-008-6)

VRF

Lower VSL
timelines pursuant toPart 4.2. (4.2)
OR
The Responsible Entity
notified E-ISAC and
NCCIC, or theirsuccessors, of aReportable Cyber
Security Incident or a
Cyber Security
Incident that was an
attempt tocompromise a system
identified in the“Applicable Systems”
column for Part 4.3
but failed to report on
one or more of theattributes within 7days after
determination of theattribute(s) not
reported pursuant toPart 4.1. (4.3)

Moderate VSLHigh VSL

Severe VSL

The Responsible Entity
failed to notify E-ISAC
or NCCIC, or theirsuccessors, of aReportable Cyber
Security Incident. (R4)OR
The Responsible Entity
notified E-ISAC and
NCCIC, or theirsuccessors, of aPage 21 of 24

CIP-008-6 — Cyber Security — Incident Reporting and Response Planning

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-008-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL

Reportable Cyber
Security Incident or a
Cyber Security
Incident that was an
attempt tocompromise a system
identified in the“Applicable Systems”
column for Part 4.1
but failed to report on
one or more of theattributes after
determination
pursuant to Part 4.1.
(4.1)
D. Regional Variances

None.

E. Interpretations

None.

F. Associated Documents

None.

Page 22 of 24

CIP-008-6 - Cyber Security — Incident Reporting and Response Planning
Version History

VersionDate

1

1/16/06

R3.2 — Change “Control Center” to “control
center.”9/30/09

Modifications to clarify the requirements and tobring the compliance elements into
conformance with the latest guidelines fordeveloping compliance elements of standards.
Removal of reasonable business judgment.
Replaced the RRO with the RE as a Responsible
Entity.
Rewording of Effective Date.
Changed compliance monitor to Compliance
Enforcement Authority.

2

ActionChange Tracking
3/24/06

Updated version number from -2 to -3
In Requirement 1.6, deleted the sentence
pertaining to removing component or systemfrom service in order to perform testing, in
response to FERC order issued September 30,
2009.

3

3

12/16/09

Approved by the NERC Board of Trustees.

3

3/31/10

Approved by FERC.

4

12/30/10

Modified to add specific criteria for Critical
Asset identification.

Update4

1/24/11

Approved by the NERC Board of Trustees.

UpdateModified tocoordinate withother CIP
standards and torevise format touse RBS
Template.

5

11/26/12

Adopted by the NERC Board of Trustees.

5

11/22/13

FERC Order issued approving CIP-008-5.

5

7/9/14

FERC Letter Order issued approving VRFs andVSLs revisions to certain CIP standards.

Update

CIP-008-5
Requirement R2,
VSL table under
Severe, changed

Page 23 of 24

CIP-008-6 - Cyber Security — Incident Reporting and Response Planning
VersionDate

ActionChange Tracking
from 19 to 18
calendar months.

6

2/6/2019

Adopted by the NERC Board of Trustees.

Modified toaddress directives
in FERC Order No.
848

Page 24 of 24