CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
A. Introduction

1.

Title:

Cyber Security — Recovery Plans for BES Cyber Systems

2.

Number:

CIP-009-6

3.

Purpose:To recover reliability functions performed by BES Cyber Systems by
specifying recovery plan requirements in support of the continued
stability, operability, and reliability of the BES.

4.

Applicability:

4.1.

Functional Entities: For the purpose of the requirements contained herein, thefollowing list of functional entities will be collectively referred to as “Responsible
Entities.” For requirements in this standard where a specific functional entity or
subset of functional entities are the applicable entity or entities, the functional entity
or entities are specified explicitly.

4.1.1 Balancing Authority
4.1.2 Distribution Provider that owns one or more of the following Facilities, systems,
and equipment for the protection or restoration of the BES:
4.1.2.1 Each underfrequency Load shedding (UFLS) or undervoltage Load shedding(UVLS) system that:
4.1.2.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.1.2.2 Each Special Protection System or Remedial Action Scheme where theSpecial Protection System or Remedial Action Scheme is subject to one ormore requirements in a NERC or Regional Reliability Standard.
4.1.2.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3 Generator Operator
4.1.4 Generator Owner
4.1.5 Interchange Coordinator or Interchange Authority
4.1.6 Reliability Coordinator

Page 1 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
4.1.7 Transmission Operator
4.1.8 Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above
are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.

4.2.1 Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or restorationof the BES:
4.2.1.1 Each UFLS or UVLS System that:
4.2.1.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.2.1.2 Each Special Protection System or Remedial Action Scheme where theSpecial Protection System or Remedial Action Scheme is subject to one ormore requirements in a NERC or Regional Reliability Standard.
4.2.1.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2 Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3 Exemptions: The following are exempt from Standard CIP-009-6:
4.2.3.1 Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2 Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters.
4.2.3.3 The systems, structures, and components that are regulated by the Nuclear
Regulatory Commission under a cyber security plan pursuant to 10 C.F.R.
Section 73.54.

Page 2 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
4.2.3.4 For Distribution Providers, the systems and equipment that are not included
in section 4.2.1 above.
4.2.3.5 Responsible Entities that identify that they have no BES Cyber Systems
categorized as high impact or medium impact according to the CIP-002-5.1
identification and categorization processes.
5.

Effective Dates:
See Implementation Plan for CIP-009-6.

6.

Background:Standard CIP-009 exists as part of a suite of CIP Standards related to cyber security,
which require the initial identification and categorization of BES Cyber Systems andrequire a minimum level of organizational, operational, and procedural controls to
mitigate risk to BES Cyber Systems.
Most requirements open with, “Each Responsible Entity shall implement one or more
documented [processes, plan, etc.] that include the applicable items in [Table
Reference].” The referenced table requires the applicable items in the procedures forthe requirement’s common subject matter.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any
particular naming or approval structure beyond what is stated in the requirements.
An entity should include as much as it believes necessary in their documented
processes, but they must address the applicable requirements in the table.
The terms program and plan are sometimes used in place of documented processes
where it makes sense and is commonly understood. For example, documented
processes describing a response are typically referred to as plans (i.e., incident
response plans and recovery plans). Likewise, a security plan can describe an
approach involving multiple procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of
its policies, plans and procedures involving a subject matter. Examples in thestandards include the personnel risk assessment program and the personnel training
program. The full implementation of the CIP Cyber Security Standards could also bereferred to as a program. However, the terms program and plan do not imply any
additional requirements beyond what is stated in the standards.
Responsible Entities can implement common controls that meet requirements for
multiple high and medium impact BES Cyber Systems. For example, a single training
program could meet the requirements for training personnel across multiple BES
Cyber Systems.
Measures for the initial requirement are simply the documented processes
themselves. Measures in the table rows provide examples of evidence to show

Page 3 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
documentation and implementation of applicable items in the documented processes.
These measures serve to provide guidance to entities in acceptable records ofcompliance and should not be viewed as an all-inclusive list.
Throughout the standards, unless otherwise stated, bulleted items in therequirements and measures are items that are linked with an “or,” and numbered
items are items that are linked with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and
UVLS. This particular threshold of 300 MW for UVLS and UFLS was provided in Version
1 of the CIP Cyber Security Standards. The threshold remains at 300 MW since it isspecifically addressing UVLS and UFLS, which are last ditch efforts to save the Bulk
Electric System. A review of UFLS tolerances defined within regional reliability
standards for UFLS program requirements to date indicates that the historical value of
300 MW represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.
“Applicable Systems” Columns in Tables:
Each table has an “Applicable Systems” column to further define the scope of systems
to which a specific requirement row applies. The CSO706 SDT adapted this conceptfrom the National Institute of Standards and Technology (“NIST”) Risk Management
Framework as a way of applying requirements more appropriately based on impact
and connectivity characteristics. The following conventions are used in the“Applicable Systems” column as described.
High Impact BES Cyber Systems – Applies to BES Cyber Systems categorized ashigh impact according to the CIP-002-5.1 identification and categorization
processes.

Medium Impact BES Cyber Systems – Applies to BES Cyber Systems categorized as
medium impact according to the CIP-002-5.1 identification and categorization
processes.

Medium Impact BES Cyber Systems at Control Centers – Only applies to BES Cyber
Systems located at a Control Center and categorized as medium impact according
to the CIP-002-5.1 identification and categorization processes.

Electronic Access Control or Monitoring Systems (EACMS) – Applies to eachElectronic Access Control or Monitoring System associated with a referenced highimpact BES Cyber System or medium impact BES Cyber System. Examples include,
but are not limited to firewalls, authentication servers, and log monitoring andalerting systems.

Physical Access Control Systems (PACS) – Applies to each Physical Access Control
System associated with a referenced high impact BES Cyber System or medium
impact BES Cyber System with External Routable Connectivity.

Page 4 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
B. Requirements and Measures
R1.

Each Responsible Entity shall have one or more documented recovery plan(s) that collectively include each of theapplicable requirement parts in CIP-009-6 Table R1 – Recovery Plan Specifications. [Violation Risk Factor: Medium] [TimeHorizon: Long Term Planning].

M1. Evidence must include the documented recovery plan(s) that collectively include the applicable requirement parts in CIP009-6 Table R1 – Recovery Plan Specifications.

CIP-009-6 Table R1 – Recovery Plan Specifications
Part
1.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Requirements
Conditions for activation of therecovery plan(s).

Measures
An example of evidence may include,
but is not limited to, one or moreplans that include language identifying
conditions for activation of therecovery plan(s).

Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS

Page 5 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
CIP-009-6 Table R1 – Recovery Plan Specifications
Part
1.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Requirements

Measures

Roles and responsibilities of
responders.

An example of evidence may include,
but is not limited to, one or morerecovery plans that include language
identifying the roles andresponsibilities of responders.

One or more processes for the backup
and storage of information required
to recover BES Cyber System
functionality.

An example of evidence may include,
but is not limited to, documentationof specific processes for the backup
and storage of information required torecover BES Cyber System
functionality.

Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS
1.3

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS

Page 6 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
CIP-009-6 Table R1 – Recovery Plan Specifications
Part
1.4

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

One or more processes to verify the
successful completion of the backup
processes in Part 1.3 and to address
any backup failures.

An example of evidence may include,
but is not limited to, logs, workflow orother documentation confirming thatthe backup process completed
successfully and backup failures, ifany, were addressed.

One or more processes to preservedata, per Cyber Asset capability, fordetermining the cause of a Cyber
Security Incident that triggers
activation of the recovery plan(s).
Data preservation should not impedeor restrict recovery.

An example of evidence may include,
but is not limited to, procedures topreserve data, such as preserving acorrupted drive or making a data
mirror of the system before
proceeding with recovery.

Medium Impact BES Cyber Systems at
Control Centers and their associated:
1. EACMS; and2. PACS
1.5

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS

Page 7 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
R2.

Each Responsible Entity shall implement its documented recovery plan(s) to collectively include each of the applicablerequirement parts in CIP-009-6 Table R2 – Recovery Plan Implementation and Testing. [Violation Risk Factor: Lower] [TimeHorizon: Operations Planning and Real-time Operations.]

M2. Evidence must include, but is not limited to, documentation that collectively demonstrates implementation of each of theapplicable requirement parts in CIP-009-6 Table R2 – Recovery Plan Implementation and Testing.
CIP-009-6 Table R2 – Recovery Plan Implementation and Testing
Part
2.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems at
Control Centers and their associated:
1. EACMS; and2. PACS

Requirements

Measures

Test each of the recovery plans
referenced in Requirement R1 at least
once every 15 calendar months:

An example of evidence may include,
but is not limited to, dated evidence ofa test (by recovering from an actual
incident, with a paper drill or tabletop
exercise, or with an operational
exercise) of the recovery plan at least
once every 15 calendar months. For
the paper drill or full operational
exercise, evidence may include
meeting notices, minutes, or otherrecords of exercise findings.



By recovering from an actual
incident;With a paper drill or tabletop
exercise; orWith an operational exercise.

Page 8 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
CIP-009-6 Table R2 – Recovery Plan Implementation and Testing
Part
2.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems at
Control Centers and their associated:
1. EACMS; and2. PACS

2.3

High Impact BES Cyber Systems

Requirements

Measures

Test a representative sample ofinformation used to recover BES Cyber
System functionality at least once
every 15 calendar months to ensurethat the information is useable and iscompatible with current
configurations.

An example of evidence may include,
but is not limited to, operational logs
or test results with criteria for testing
the usability (e.g. sample tape load,browsing tape contents) andcompatibility with current system
configurations (e.g. manual or
automated comparison checkpoints
between backup media contents andcurrent configuration).

An actual recovery that incorporates
the information used to recover BES
Cyber System functionality substitutes
for this test.
Test each of the recovery plans
referenced in Requirement R1 at least
once every 36 calendar months
through an operational exercise of therecovery plans in an environment
representative of the production
environment.

Examples of evidence may include, but
are not limited to, dated
documentation of:

An actual recovery response may
substitute for an operational exercise.

 An actual recovery response that
occurred within the 36 calendar
month timeframe that exercised
the recovery plans.

 An operational exercise at least
once every 36 calendar months
between exercises, that
demonstrates recovery in a
representative environment; orPage 9 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
R3.

Each Responsible Entity shall maintain each of its recovery plan(s) in accordance with each of the applicable requirement partsin CIP-009-6 Table R3 – Recovery Plan Review, Update and Communication. [Violation Risk Factor: Lower] [Time Horizon:
Operations Assessment].

M3. Acceptable evidence includes, but is not limited to, each of the applicable requirement parts in CIP-009-6 Table R3 – Recovery
Plan Review, Update and Communication.

Page 10 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
CIP-009-6 Table R3 – Recovery Plan Review, Update and Communication
Part
3.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems at
Control Centers and their associated:
1. EACMS; and2. PACS

Requirements

Measures

No later than 90 calendar days after
completion of a recovery plan test or
actual recovery:

An example of evidence may include,
but is not limited to, all of thefollowing:

3.1.1. Document any lessons learned
associated with a recovery plan
test or actual recovery or
document the absence of any
lessons learned;

1. Dated documentation ofidentified deficiencies or lessons
learned for each recovery plan
test or actual incident recovery
or dated documentation stating
there were no lessons learned;

3.1.2. Update the recovery plan basedon any documented lessons
learned associated with theplan; and3.1.3. Notify each person or groupwith a defined role in therecovery plan of the updates tothe recovery plan based on any
documented lessons learned.

2. Dated and revised recovery planshowing any changes based on
the lessons learned; and3. Evidence of plan update
distribution including, but notlimited to: Emails;


USPS or other mail service;Electronic distribution
system; orTraining sign-in sheets.

Page 11 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
CIP-009-6 Table R3 – Recovery Plan Review, Update and Communication
Part
3.2

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

No later than 60 calendar days after achange to the roles or responsibilities,
responders, or technology that the
Responsible Entity determines would
impact the ability to execute therecovery plan:

An example of evidence may include,
but is not limited to, all of thefollowing:

Medium Impact BES Cyber Systems at
Control Centers and their associated:
1. EACMS; and2. PACS

3.2.1. Update the recovery plan; and3.2.2. Notify each person or groupwith a defined role in therecovery plan of the updates.

1. Dated and revised recovery
plan with changes to the roles
or responsibilities,
responders, or technology;
and
2. Evidence of plan update
distribution including, but notlimited to: Emails;
 USPS or other mail service; Electronic distribution
system; or Training sign-in sheets.

Page 12 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
C. Compliance1.

Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority” (CEA) means
NERC or the Regional Entity in their respective roles of monitoring and enforcing compliancewith the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity is required toretain specific evidence to demonstrate compliance. For instances where the evidence
retention period specified below is shorter than the time since the last audit, the CEA may ask
an entity to provide other evidence to show that it was compliant for the full time period since
the last audit.
The Responsible Entity shall keep data or evidence to show compliance as identified below
unless directed by its CEA to retain specific evidence for a longer period of time as part of aninvestigation:
Each Responsible Entity shall retain evidence of each requirement in this standard for threecalendar years.



If a Responsible Entity is found non-compliant, it shall keep information related to the noncompliance until mitigation is complete and approved or for the time specified above,
whichever is longer.



The CEA shall keep the last audit records and all requested and submitted subsequent audit
records.

1.3. Compliance Monitoring and Assessment Processes:
Compliance Audits
Self-Certifications
Spot Checking
Compliance Investigations
Self-Reporting
Complaints
1.4. Additional Compliance Information:
None

Page 13 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
2. Table of Compliance Elements
R#

Time
Horizon

VRF

Violation Severity Levels (CIP-009-6)
Lower VSL

R1Longterm
Planning

MediumN/A

Moderate VSL
The Responsible
Entity has developed
recovery plan(s), but
the plan(s) do notaddress one of therequirements
included in Parts 1.2
through 1.5.

High VSL

Severe VSL

The Responsible
Entity has developed
recovery plan(s), but
the plan(s) do notaddress two of therequirements
included in Parts 1.2
through 1.5.

The Responsible
Entity has notcreated recoveryplan(s) for BES Cyber
Systems.
OR
The Responsible
Entity has createdrecovery plan(s) for
BES Cyber Systems,
but the plan(s) does
not address theconditions for
activation in Part 1.1.
OR
The Responsible
Entity has createdrecovery plan(s) for
BES Cyber Systems,
but the plan(s) does
not address three ormore of therequirements in Parts
1.2 through 1.5.

Page 14 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
R#

R2

Time
HorizonOperations
Planning
Real-time
Operations

VRF

Lower

Violation Severity Levels (CIP-009-6)
Lower VSL

Moderate VSLHigh VSLThe Responsible
Entity has not tested
the recovery plan(s)according to R2 Part
2.1 within 15
calendar months,
not exceeding 16
calendar months
between tests of theplan. (2.1)

The Responsible
Entity has not tested
the recovery plan(s)within 16 calendar
months, notexceeding 17
calendar months
between tests of theplan. (2.1)

The Responsible
Entity has not tested
the recovery plan(s)according to R2 Part
2.1 within 17
calendar months,
not exceeding 18
calendar months
between tests of theplan. (2.1)

OR

The Responsible
Entity has not tested
a representative
sample of theinformation used in
the recovery of BES
Cyber System
functionality
according to R2 Part
2.2 within 16
calendar months,
not exceeding 17
calendar months
between tests. (2.2)

The Responsible
Entity has not tested
a representative
sample of theinformation used in
the recovery of BES
Cyber System
functionality
according to R2 Part
2.2 within 15
calendar months,
not exceeding 16
calendar months
between tests. (2.2)
OR
The Responsible
Entity has not tested

OR

OR
The Responsible
Entity has not tested
the recovery plan

Severe VSL

OR
The Responsible
Entity has not tested
a representative
sample of theinformation used in
the recovery of BES
Cyber System
functionality
according to R2 Part
2.2 within 17
calendar months,
not exceeding 18
calendar months
between tests. (2.2)
OR
The Responsible
Entity has not tested

The Responsible
Entity has not tested
the recovery plan(s)according to R2 Part
2.1 within 18
calendar months
between tests of theplan. (2.1)
OR
The Responsible
Entity has not tested
a representative
sample of theinformation used in
the recovery of BES
Cyber System
functionality
according to R2 Part
2.2 within 18
calendar months
between tests. (2.2)
OR
The Responsible
Entity has not tested
the recovery plan(s)according to R2 Part
2.3 within 39
calendar months

Page 15 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
R#

Time
Horizon

VRF

Violation Severity Levels (CIP-009-6)
Lower VSL

R3

Operations
Assessment

Lower

Moderate VSLHigh VSL

Severe VSL

the recovery plan
according to R2 Part
2.3 within 36
calendar months,
not exceeding 37
calendar months
between tests. (2.3)

according to R2 Part
2.3 within 37
calendar months,
not exceeding 38
calendar months
between tests. (2.3)

the recovery plan
according to R2 Part
2.3 within 38
calendar months,
not exceeding 39
calendar months
between tests. (2.3)

between tests of theplan. (2.3)

The Responsible
Entity has not
notified each person
or group with adefined role in therecovery plan(s) of
updates within 90
and less than 120
calendar days of the
update being
completed. (3.1.3)

The Responsible
Entity has not
updated the recoveryplan(s) based on any
documented lessons
learned within 90
and less than 120
calendar days of eachrecovery plan test or
actual recovery.
(3.1.2)The Responsible
Entity has neither
documented lessons
learned nor
documented theabsence of any
lessons learned
within 90 and lessthan 120 calendar
days of eachrecovery plan test or
actual recovery.
(3.1.1)The Responsible
Entity has neither
documented lessons
learned nor
documented theabsence of any
lessons learned
within 120 calendar
days of eachrecovery plan test or
actual recovery.
(3.1.1)OR
The Responsible
Entity has not
notified each person
or group with adefined role in therecovery plan(s) of
updates within 120
calendar days of theOR
The Responsible
Entity has not
updated the recoveryplan(s) based on any
documented lessons
learned within 120
calendar days of each
Page 16 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
R#

Time
Horizon

VRF

Violation Severity Levels (CIP-009-6)
Lower VSL

Moderate VSL
update being
completed. (3.1.3)
ORHigh VSL

Severe VSL

recovery plan test or
actual recovery.
(3.1.2)The Responsible
Entity has not
updated the recoveryplan(s) or notified
each person or groupwith a defined role
within 60 and lessthan 90 calendar
days of any of thefollowing changes
that the responsible
entity determines
would impact theability to execute theplan: (3.2)

OR• Roles or
responsibilities, or• Responders, or• Technology
changes.

• Roles or
responsibilities, or• Responders, or• Technology
changes.

The Responsible
Entity has not
updated the recoveryplan(s) or notified
each person or groupwith a defined role
within 90 calendar
days of any of thefollowing changes
that the responsible
entity determines
would impact theability to execute theplan: (3.2)

Page 17 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems
D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

None.

Version History
VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify therequirements and to bring thecompliance elements into conformancewith the latest guidelines for developing
compliance elements of standards.

Change Tracking
3/24/06

Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
responsible entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.
3

12/16/09

Updated Version Number from -2 to -3
In Requirement 1.6, deleted thesentence pertaining to removing
component or system from service inorder to perform testing, in response to
FERC order issued September 30, 2009.

3

12/16/09

3

3/31/104

1/24/11

Approved by the NERC Board ofTrustees.
Approved by FERC.
Approved by the NERC Board ofTrustees.

Page 18 of 25

CIP-009-6 — Cyber Security — Recovery Plans for BES Cyber Systems

VersionDate

Action5

11/26/12

Adopted by the NERC Board ofTrustees.

5

11/22/13

FERC Order issued approving CIP-009-5.

6

11/13/14

Adopted by the NERC Board ofTrustees.

6

1/21/16

FERC Order issued approving CIP-009-6.
Docket No. RM15-14-000

Change Tracking
Modified tocoordinate withother CIP
standards and torevise format touse RBS
Template.

Addressed FERC
directives from
Order No. 791

Page 19 of 25

Guidelines and Technical Basis
Guidelines and Technical Basis
Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. As specified in the exemption section 4.2.3.5, this standard does not apply to
Responsible Entities that do not have High Impact or Medium Impact BES Cyber Systems under
CIP-002-5.1’s categorization. In addition to the set of BES Facilities, Control Centers, and othersystems and equipment, the list includes the set of systems and equipment owned byDistribution Providers. While the NERC Glossary term “Facilities” already includes the BES
characteristic, the additional use of the term BES here is meant to reinforce the scope of
applicability of these Facilities where it is used, especially in this applicability scoping section.
This in effect sets the scope of Facilities, systems, and equipment that is subject to thestandards.
Requirement R1:
The following guidelines are available to assist in addressing the required components of arecovery plan:

NERC, Security Guideline for the Electricity Sector: Continuity of Business Processes andOperations Operational Functions, September 2011, online at
http://www.nerc.com/docs/cip/sgwg/Continuity%20of%20Business%20and%20Operation
al%20Functions%20FINAL%20102511.pdf

National Institute of Standards and Technology, Contingency Planning Guide for Federal
Information Systems, Special Publication 800-34 revision 1, May 2010, online at
http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov112010.pdf

The term recovery plan is used throughout this Reliability Standard to refer to a documented
set of instructions and resources needed to recover reliability functions performed by BES
Cyber Systems. The recovery plan may exist as part of a larger business continuity or disasterrecovery plan, but the term does not imply any additional obligations associated with thosedisciplines outside of the Requirements.

Page 20 of 25

Guidelines and Technical Basis
A documented recovery plan may not be necessary for each applicable BES Cyber System. For
example, the short-term recovery plan for a BES Cyber System in a specific substation may be
managed on a daily basis by advanced power system applications such as state estimation,
contingency and remedial action, and outage scheduling. One recovery plan for BES Cyber
Systems should suffice for several similar facilities such as those found in substations or power
plants.
For Part 1.1, the conditions for activation of the recovery plan should consider viable threats to
the BES Cyber System such as natural disasters, computing equipment failures, computing
environment failures, and Cyber Security Incidents. A business impact analysis for the BES Cyber
System may be useful in determining these conditions.
For Part 1.2, entities should identify the individuals required for responding to a recovery
operation of the applicable BES Cyber System.
For Part 1.3, entities should consider the following types of information to recover BES Cyber
System functionality:
1. Installation files and media;
2. Current backup tapes and any additional documented configuration settings;
3. Documented build or restoration procedures; and4. Cross site replication storage.
For Part 1.4, the processes to verify the successful completion of backup processes should
include checking for: (1) usability of backup media, (2) logs or inspection showing that
information from current, production system could be read, and (3) logs or inspection showingthat information was written to the backup media. Test restorations are not required for thisRequirement Part. The following backup scenarios provide examples of effective processes toverify successful completion and detect any backup failures:Periodic (e.g. daily or weekly) backup process – Review generated logs or job status
reports and set up notifications for backup failures.



Non-periodic backup process– If a single backup is provided during the commissioning of
the system, then only the initial and periodic (every 15 months) testing must be done.
Additional testing should be done as necessary and can be a part of the configuration
change management program.



Data mirroring – Configure alerts on the failure of data transfer for an amount of time
specified by the entity (e.g. 15 minutes) in which the information on the mirrored disk
may no longer be useful for recovery.



Manual configuration information – Inspect the information used for recovery prior tostoring initially and periodically (every 15 months). Additional inspection should be done
as necessary and can be a part of the configuration change management program.

The plan must also include processes to address backup failures. These processes should specify
the response to failure notifications or other forms of identification.

Page 21 of 25

Guidelines and Technical Basis
For Part 1.5, the recovery plan must include considerations for preservation of data to
determine the cause of a Cyber Security Incident. Because it is not always possible to initiallyknow if a Cyber Security Incident caused the recovery activation, the data preservation
procedures should be followed until such point a Cyber Security Incident can be ruled out. CIP008 addresses the retention of data associated with a Cyber Security Incident.
Requirement R2:
A Responsible Entity must exercise each BES Cyber System recovery plan every 15 months.
However, this does not necessarily mean that the entity must test each plan individually. BES
Cyber Systems that are numerous and distributed, such as those found at substations, may not
require an individual recovery plan and the associated redundant facilities since reengineeringand reconstruction may be the generic response to a severe event. Conversely, there is typically
one control center per bulk transmission service area that requires a redundant or backup
facility. Because of these differences, the recovery plans associated with control centers differ agreat deal from those associated with power plants and substations.
A recovery plan test does not necessarily cover all aspects of a recovery plan and failure
scenarios, but the test should be sufficient to ensure the plan is up to date and at least one
restoration process of the applicable cyber systems is covered.
Entities may use an actual recovery as a substitute for exercising the plan every 15 months.
Otherwise, entities must exercise the plan with a paper drill, tabletop exercise, or operational
exercise. For more specific types of exercises, refer to the FEMA Homeland Security Exercise
and Evaluation Program (HSEEP). It lists the following four types of discussion-based exercises:seminar, workshop, tabletop, and games. In particular, it defines that, “A tabletop exercise
involves key personnel discussing simulated scenarios in an informal setting. [Table top
exercises (TTX)] can be used to assess plans, policies, and procedures.”
The HSEEP lists the following three types of operations-based exercises: Drill, functional
exercise, and full-scale exercise. It defines that, “[A] full-scale exercise is a multi-agency, multijurisdictional, multi-discipline exercise involving functional (e.g., joint field office, Emergency
operation centers, etc.) and ‘boots on the ground’ response (e.g., firefighters decontaminating
mock victims).”
For Part 2.2, entities should refer to the backup and storage of information required to recover
BES Cyber System functionality in Requirement Part 1.3. This provides additional assurance thatthe information will actually recover the BES Cyber System as necessary. For most complex
computing equipment, a full test of the information is not feasible. Entities should determine
the representative sample of information that provides assurance in the processes for
Requirement Part 1.3. The test must include steps for ensuring the information is useable andcurrent. For backup media, this can include testing a representative sample to make sure theinformation can be loaded, and checking the content to make sure the information reflects thecurrent configuration of the applicable Cyber Assets.

Page 22 of 25

Guidelines and Technical Basis
Requirement R3:
This requirement ensures entities maintain recovery plans. There are two requirement parts
that trigger plan updates: (1) lessons learned and (2) organizational or technology changes.
The documentation of lessons learned is associated with each recovery activation, and it
involves the activities as illustrated in Figure 1, below. The deadline to document lessons
learned starts after the completion of the recovery operation in recognition that complex
recovery activities can take a few days or weeks to complete. The process of conducting
lessons learned can involve the recovery team discussing the incident to determine gaps or
areas of improvement within the plan. It is possible to have a recovery activation without any
documented lessons learned. In such cases, the entity must retain documentation of theabsence of any lessons learned associated with the recovery activation.
4/14
Complete Plan
Update Activities

1/1 - 1/14
Recovery operation(Actual or Exercise)

1/1 - 1/14
Incident

1/14 - 4/14
Document Lessons Learned, Update Plan, and Distribute Updates

1/1

4/14

Figure 1: CIP-009-6 R3 Timeline

The activities necessary to complete the lessons learned include updating the plan anddistributing those updates. Entities should consider meeting with all of the individuals involvedin the recovery and documenting the lessons learned as soon after the recovery activation as
possible. This allows more time for making effective updates to the plan, obtaining any
necessary approvals, and distributing those updates to the recovery team.
The plan change requirement is associated with organization and technology changes
referenced in the plan and involves the activities illustrated in Figure 2, below. Organizationalchanges include changes to the roles and responsibilities people have in the plan or changes tothe response groups or individuals. This may include changes to the names or contact
information listed in the plan. Technology changes affecting the plan may include referenced
information sources, communication systems, or ticketing systems.

Page 23 of 25

Guidelines and Technical Basis
1/1
Organization andTechnology Changes

3/1
Complete Plan
Update Activities

1/1 - 3/1
Update Plan and Distribute Updates

1/1

3/1

Figure 2: Timeline for Plan Changes in 3.2

When notifying individuals of response plan changes, entities should keep in mind that recovery
plans may be considered BES Cyber System Information, and they should take the appropriate
measures to prevent unauthorized disclosure of recovery plan information. For example, therecovery plan itself, or other sensitive information about the recovery plan, should be redacted
from Email or other unencrypted transmission.
Rationale:
During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:
Preventative activities can lower the number of incidents, but not all incidents can beprevented. A preplanned recovery capability is, therefore, necessary for rapidly recoveringfrom incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited,
and restoring computing services so that planned and consistent recovery action to restore BES
Cyber System functionality occurs.
Rationale for Requirement R2:
The implementation of an effective recovery plan mitigates the risk to the reliable operation of
the BES by reducing the time to recover from various hazards affecting BES Cyber Systems. Thisrequirement ensures continued implementation of the response plans.
Requirement Part 2.2 provides further assurance in the information (e.g. backup tapes,
mirrored hot-sites, etc.) necessary to recover BES Cyber Systems. A full test is not feasible inmost instances due to the amount of recovery information, and the Responsible Entity must
determine a sampling that provides assurance in the usability of the information.

Page 24 of 25

Guidelines and Technical Basis
Rationale for Requirement R3:
To improve the effectiveness of BES Cyber System recovery plan(s) following a test, and toensure the maintenance and distribution of the recovery plan(s). Responsible Entities achieve
this by (i) performing a lessons learned review in 3.1 and (ii) revising the plan in 3.2 based on
specific changes in the organization or technology that would impact plan execution. In bothinstances when the plan needs to change, the Responsible Entity updates and distributes theplan.

Page 25 of 25