CIP-011-2 — Cyber Security — Information Protection
A. Introduction

1.

Title:

Cyber Security — Information Protection

2.

Number:

CIP-011-2

3.

Purpose:To prevent unauthorized access to BES Cyber System Information by
specifying information protection requirements in support of protecting
BES Cyber Systems against compromise that could lead to misoperation
or instability in the Bulk Electric System (BES).

4.

Applicability:

4.1.

Functional Entities: For the purpose of the requirements contained herein, thefollowing list of functional entities will be collectively referred to as “Responsible
Entities.” For requirements in this standard where a specific functional entity or
subset of functional entities are the applicable entity or entities, the functional entity
or entities are specified explicitly.

4.1.1 Balancing Authority
4.1.2 Distribution Provider that owns one or more of the following Facilities, systems,
and equipment for the protection or restoration of the BES:
4.1.2.1 Each underfrequency Load shedding (UFLS) or undervoltage Load shedding(UVLS) system that:
4.1.2.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.1.2.2 Each Special Protection System (SPS) or Remedial Action Scheme (RAS)
where the SPS or RAS is subject to one or more requirements in a NERC or
Regional Reliability Standard.
4.1.2.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3 Generator Operator
4.1.4 Generator Owner
4.1.5 Interchange Coordinator or Interchange Authority
4.1.6 Reliability Coordinator

Page 1 of 16

CIP-011-2 — Cyber Security — Information Protection
4.1.7 Transmission Operator
4.1.8 Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above
are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.

4.2.1 Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or restorationof the BES:
4.2.1.1 Each UFLS or UVLS System that:
4.2.1.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.2.1.2 Each SPS or RAS where the SPS or RAS is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2 Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3 Exemptions: The following are exempt from Standard CIP-011-2:
4.2.3.1 Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2 Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters.
4.2.3.3 The systems, structures, and components that are regulated by the Nuclear
Regulatory Commission under a cyber security plan pursuant to 10 C.F.R.
Section 73.54.
4.2.3.4 For Distribution Providers, the systems and equipment that are not included
in section 4.2.1 above.

Page 2 of 16

CIP-011-2 — Cyber Security — Information Protection
4.2.3.5 Responsible Entities that identify that they have no BES Cyber Systems
categorized as high impact or medium impact according to the CIP-002-5.1
identification and categorization processes.
5.

Effective Dates:
See Implementation Plan for CIP-011-2.

6.

Background:Standard CIP-011 exists as part of a suite of CIP Standards related to cyber security,
which require the initial identification and categorization of BES Cyber Systems andrequire a minimum level of organizational, operational, and procedural controls to
mitigate risk to BES Cyber Systems.
Most requirements open with, “Each Responsible Entity shall implement one or more
documented [processes, plan, etc.] that include the applicable items in [Table
Reference].” The referenced table requires the applicable items in the procedures forthe requirement’s common subject matter.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any
particular naming or approval structure beyond what is stated in the requirements.
An entity should include as much as it believes necessary in its documented processes,
but it must address the applicable requirements in the table.
The terms program and plan are sometimes used in place of documented processes
where it makes sense and is commonly understood. For example, documented
processes describing a response are typically referred to as plans (i.e., incident
response plans and recovery plans). Likewise, a security plan can describe an
approach involving multiple procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of
its policies, plans and procedures involving a subject matter. Examples in thestandards include the personnel risk assessment program and the personnel training
program. The full implementation of the CIP Cyber Security Standards could also bereferred to as a program. However, the terms program and plan do not imply any
additional requirements beyond what is stated in the standards.
Responsible Entities can implement common controls that meet requirements for
multiple high and medium impact BES Cyber Systems. For example, a single training
program could meet the requirements for training personnel across multiple BES
Cyber Systems.
Measures for the initial requirement are simply the documented processes
themselves. Measures in the table rows provide examples of evidence to show
documentation and implementation of applicable items in the documented processes.
These measures serve to provide guidance to entities in acceptable records ofcompliance and should not be viewed as an all-inclusive list.
Page 3 of 16

CIP-011-2 — Cyber Security — Information Protection
Throughout the standards, unless otherwise stated, bulleted items in therequirements and measures are items that are linked with an “or,” and numbered
items are items that are linked with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and
UVLS. This particular threshold of 300 MW for UVLS and UFLS was provided in Version
1 of the CIP Cyber Security Standards. The threshold remains at 300 MW since it isspecifically addressing UVLS and UFLS, which are last ditch efforts to save the BES. A
review of UFLS tolerances defined within regional reliability standards for UFLS
program requirements to date indicates that the historical value of 300 MW
represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.
“Applicable Systems” Columns in Tables:
Each table has an “Applicable Systems” column to further define the scope of systems
to which a specific requirement row applies. The CSO706 SDT adapted this conceptfrom the National Institute of Standards and Technology (“NIST”) Risk Management
Framework as a way of applying requirements more appropriately based on impact
and connectivity characteristics. The following conventions are used in the“Applicable Systems” column as described.
High Impact BES Cyber Systems – Applies to BES Cyber Systems categorized ashigh impact according to the CIP-002-5.1 identification and categorization
processes.

Medium Impact BES Cyber Systems – Applies to BES Cyber Systems categorized
as medium impact according to the CIP-002-5.1 identification and categorization
processes.

Electronic Access Control or Monitoring Systems (EACMS) – Applies to eachElectronic Access Control or Monitoring System associated with a referenced
high impact BES Cyber System or medium impact BES Cyber System. Examples
may include, but are not limited to, firewalls, authentication servers, and log
monitoring and alerting systems.

Physical Access Control Systems (PACS) – Applies to each Physical AccessControl System associated with a referenced high impact BES Cyber System or
medium impact BES Cyber System with External Routable Connectivity.



Protected Cyber Assets (PCA) – Applies to each Protected Cyber Assetassociated with a referenced high impact BES Cyber System or medium impact
BES Cyber System.

Page 4 of 16

CIP-011-2 — Cyber Security — Information Protection
B. Requirements and Measures

R1. Each Responsible Entity shall implement one or more documented information protection program(s) that collectively
includes each of the applicable requirement parts in CIP-011-2 Table R1 – Information Protection. [Violation Risk Factor:
Medium] [Time Horizon: Operations Planning].
M1. Evidence for the information protection program must include the applicable requirement parts in CIP-011-2 Table R1 –Information Protection and additional evidence to demonstrate implementation as described in the Measures column of
the table.

Page 5 of 16

CIP-011-2 — Cyber Security — Information Protection

CIP-011-2 Table R1 – Information Protection
Part
1.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS
Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS

Requirements
Method(s) to identify information thatmeets the definition of BES Cyber
System Information.

Measures
Examples of acceptable evidence
include, but are not limited to:Documented method to identify
BES Cyber System Informationfrom entity’s information
protection program; orIndications on information (e.g.,labels or classification) that identify
BES Cyber System Information as
designated in the entity’s
information protection program; orTraining materials that provide
personnel with sufficientknowledge to recognize BES Cyber
System Information; orRepository or electronic andphysical location designated for
housing BES Cyber System
Information in the entity’s
information protection program.

Page 6 of 16

CIP-011-2 — Cyber Security — Information Protection
CIP-011-2 Table R1 – Information Protection
Part
1.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
and their associated:
1. EACMS; and2. PACS

Requirement
Procedure(s) for protecting andsecurely handling BES Cyber System
Information, including storage, transit,
and use.

MeasureExamples of acceptable evidence
include, but are not limited to:Procedures for protecting andsecurely handling, which include
topics such as storage, security
during transit, and use of BES
Cyber System Information; orRecords indicating that BES Cyber
System Information is handled in amanner consistent with the entity’s
documented procedure(s).

Page 7 of 16

CIP-011-2 — Cyber Security — Information Protection
R2.

Each Responsible Entity shall implement one or more documented process(es) that collectively include the applicablerequirement parts in CIP-011-2 Table R2 – BES Cyber Asset Reuse and Disposal. [Violation Risk Factor: Lower] [Time Horizon:
Operations Planning].

M2. Evidence must include each of the applicable documented processes that collectively include each of the applicablerequirement parts in CIP-011-2 Table R2 – BES Cyber Asset Reuse and Disposal and additional evidence to demonstrate
implementation as described in the Measures column of the table.
CIP-011-2 Table R2 – BES Cyber Asset Reuse and Disposal
Part
2.1

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:
1. EACMS;
2. PACS; and3. PCA

Prior to the release for reuse of
applicable Cyber Assets that contain
BES Cyber System Information(except for reuse within othersystems identified in the “Applicable
Systems” column), the Responsible
Entity shall take action to prevent theunauthorized retrieval of BES Cyber
System Information from the Cyber
Asset data storage media.

Examples of acceptable evidence
include, but are not limited to: Records tracking sanitization
actions taken to prevent
unauthorized retrieval of BES
Cyber System Information such as
clearing, purging, or destroying;or

Medium Impact BES Cyber Systems
and their associated:
1. EACMS;
2. PACS; and3. PCA

Records tracking actions such as
encrypting, retaining in the
Physical Security Perimeter orother methods used to prevent
unauthorized retrieval of BES
Cyber System Information.

Page 8 of 16

CIP-011-2 — Cyber Security — Information Protection
CIP-011-2 Table R2 – BES Cyber Asset Reuse and Disposal
Part
2.2

Applicable Systems

Requirements

High Impact BES Cyber Systems andtheir associated:
1. EACMS;
2. PACS; and3. PCA

Prior to the disposal of applicable
Cyber Assets that contain BES Cyber
System Information, the Responsible
Entity shall take action to prevent theunauthorized retrieval of BES Cyber
System Information from the Cyber
Asset or destroy the data storage
media.

Medium Impact BES Cyber Systems
and their associated:
1. EACMS;
2. PACS; and3. PCA

Measures
Examples of acceptable evidence
include, but are not limited to:Records that indicate that data
storage media was destroyed
prior to the disposal of an
applicable Cyber Asset; orRecords of actions taken toprevent unauthorized retrieval of
BES Cyber System Information
prior to the disposal of an
applicable Cyber Asset.

Page 9 of 16

CIP-011-2 — Cyber Security — Information Protection
C. Compliance1.

Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority” (CEA) means
NERC or the Regional Entity in their respective roles of monitoring and enforcing compliancewith the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity is required toretain specific evidence to demonstrate compliance. For instances where the evidence
retention period specified below is shorter than the time since the last audit, the CEA may ask
an entity to provide other evidence to show that it was compliant for the full time period since
the last audit.
The Responsible Entity shall keep data or evidence to show compliance as identified below
unless directed by its CEA to retain specific evidence for a longer period of time as part of aninvestigation:
Each Responsible Entity shall retain evidence of each requirement in this standard for threecalendar years.



If a Responsible Entity is found non-compliant, it shall keep information related to the noncompliance until mitigation is complete and approved or for the time specified above,
whichever is longer.



The CEA shall keep the last audit records and all requested and submitted subsequent audit
records.

1.3. Compliance Monitoring and Assessment Processes:Compliance Audits

Self-Certifications

Spot CheckingCompliance Violation Investigations



Self-ReportingComplaints

1.4. Additional Compliance Information:
None

Page 10 of 16

CIP-011-2 — Cyber Security — Information Protection
2. Table of Compliance Elements

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-011-2)
Lower VSL

R1

Operations
Planning

MediumN/A

R2

Operations
Planning

Lower

N/A

Moderate VSL
N/AThe Responsible Entity
implemented one or more
documented processes but
did not include processes
for reuse as to prevent theunauthorized retrieval of
BES Cyber System
Information from the BES
Cyber Asset. (2.1)

High VSL

Severe VSL

N/AThe Responsible
Entity has not
documented or
implemented a BES
Cyber System
Information
protection program(R1).

The Responsible Entity
implemented one ormore documented
processes but did notinclude disposal or
media destruction
processes to preventthe unauthorized
retrieval of BES Cyber
System Informationfrom the BES Cyber
Asset. (2.2)

The Responsible
Entity has not
documented or
implemented any
processes forapplicablerequirement partsin CIP-011-2 Table
R2 – BES Cyber
Asset Reuse andDisposal. (R2)

Page 11 of 16

Guidelines and Technical Basis
D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

Guideline and Technical Basis (attached).
Version History

VersionDate

Action1

11/26/12

Adopted by the NERC Board ofTrustees.

1

11/22/13

2

11/13/14

FERC Order issued approving CIP011-1. (Order becomes effective
on 2/3/14.)
Adopted by the NERC Board ofTrustees.

2

2/12/15

Adopted by the NERC Board ofTrustees.

2

1/21/16

FERC Order issued approving CIP011-2. Docket No. RM15-14-000

Change Tracking
Developed to define
the information
protection
requirements incoordination with other
CIP standards and toaddress the balance of
the FERC directives in
its Order 706.

Addressed two FERC
directives from OrderNo. 791 related to
identify, assess, andcorrect language andcommunication
networks.
Replaces the version
adopted by the Board
on 11/13/2014. Revised
version addresses
remaining directives
from Order No. 791
related to transientdevices and low impact
BES Cyber Systems.

Page 12 of 16

Guidelines and Technical Basis
Guidelines and Technical Basis

Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. As specified in the exemption section 4.2.3.5, this standard does not apply to
Responsible Entities that do not have High Impact or Medium Impact BES Cyber Systems under
CIP-002-5.1’s categorization. In addition to the set of BES Facilities, Control Centers, and othersystems and equipment, the list includes the set of systems and equipment owned byDistribution Providers. While the NERC Glossary term “Facilities” already includes the BES
characteristic, the additional use of the term BES here is meant to reinforce the scope of
applicability of these Facilities where it is used, especially in this applicability scoping section.
This in effect sets the scope of Facilities, systems, and equipment that is subject to thestandards.
Requirement R1:
Responsible Entities are free to utilize existing change management and asset management
systems. However, the information contained within those systems must be evaluated, as theinformation protection requirements still apply.
The justification for this requirement is pre-existing from previous versions of CIP and is also
documented in FERC Order No. 706 and its associated Notice of Proposed Rulemaking.
This requirement mandates that BES Cyber System Information be identified. The Responsible
Entity has flexibility in determining how to implement the requirement. The Responsible Entity
should explain the method for identifying the BES Cyber System Information in theirinformation protection program. For example, the Responsible Entity may decide to mark orlabel the documents. Identifying separate classifications of BES Cyber System Information is
not specifically required. However, a Responsible Entity maintains the flexibility to do so if they
desire. As long as the Responsible Entity’s information protection program includes all
applicable items, additional classification levels (e.g., confidential, public, internal use only, etc.)
can be created that go above and beyond the requirements. If the entity chooses to useclassifications, then the types of classifications used by the entity and any associated labelingshould be documented in the entity’s BES Cyber System Information Program.

Page 13 of 16

Guidelines and Technical Basis
The Responsible Entity may store all of the information about BES Cyber Systems in a separate
repository or location (physical and/or electronic) with access control implemented. For
example, the Responsible Entity’s program could document that all information stored in an
identified repository is considered BES Cyber System Information, the program may state that
all information contained in an identified section of a specific repository is considered BES
Cyber System Information, or the program may document that all hard copies of information
are stored in a secured area of the building. Additional methods for implementing therequirement are suggested in the measures section. However, the methods listed in measures
are not meant to be an exhaustive list of methods that the entity may choose to utilize for theidentification of BES Cyber System Information.
The SDT does not intend that this requirement cover publicly available information, such as
vendor manuals that are available via public websites or information that is deemed to be
publicly releasable.
Information protection pertains to both digital and hardcopy information. R1.2 requires one ormore procedures for the protection and secure handling BES Cyber System Information,
including storage, transit, and use. This includes information that may be stored on Transient
Cyber Assets or Removable Media.
The entity’s written Information Protection Program should explain how the entity handles
aspects of information protection including specifying how BES Cyber System Information is tobe securely handled during transit in order to protect against unauthorized access, misuse, or
corruption and to protect confidentiality of the communicated BES Cyber System Information.
For example, the use of a third-party communication service provider instead of organizationowned infrastructure may warrant the use of encryption to prevent unauthorized disclosure of
information during transmission. The entity may choose to establish a trusted communications
path for transit of BES Cyber System Information. The trusted communications path would
utilize a logon or other security measures to provide secure handling during transit. The entity
may employ alternative physical protective measures, such as the use of a courier or locked
container for transmission of information. It is not the intent of this standard to mandate theuse of one particular format for secure handling during transit.
A good Information Protection Program will document the circumstances under which BES
Cyber System Information can be shared with or used by third parties. The organization should
distribute or share information on a need-to-know basis. For example, the entity may specify
that a confidentiality agreement, non-disclosure arrangement, contract, or written agreementof some kind concerning the handling of information must be in place between the entity andthe third party. The entity’s Information Protection Program should specify circumstances forsharing of BES Cyber System Information with and use by third parties, for example, use of anon-disclosure agreement. The entity should then follow their documented program. These
requirements do not mandate one specific type of arrangement.
Requirement R2:
This requirement allows for BES Cyber Systems to be removed from service and analyzed with
their media intact, as that should not constitute a release for reuse. However, following thePage 14 of 16

Guidelines and Technical Basisanalysis, if the media is to be reused outside of a BES Cyber System or disposed of, the entity
must take action to prevent the unauthorized retrieval of BES Cyber System Information fromthe media.
The justification for this requirement is pre-existing from previous versions of CIP and is also
documented in FERC Order No. 706 and its associated Notice of Proposed Rulemaking.
If an applicable Cyber Asset is removed from the Physical Security Perimeter prior to action
taken to prevent the unauthorized retrieval of BES Cyber System Information or destroying thedata storage media, the Responsible Entity should maintain documentation that identifies thecustodian for the data storage media while the data storage media is outside of the Physical
Security Perimeter prior to actions taken by the entity as required in R2.
Media sanitization is the process used to remove information from system media such thatreasonable assurance exists that the information cannot be retrieved or reconstructed. Media
sanitization is generally classified into four categories: Disposal, clearing, purging, anddestroying. For the purposes of this requirement, disposal by itself, with the exception ofcertain special circumstances, such as the use of strong encryption on a drive used in a SAN orother media, should never be considered acceptable. The use of clearing techniques may
provide a suitable method of sanitization for media that is to be reused, whereas purging
techniques may be more appropriate for media that is ready for disposal.
The following information from NIST SP800-88 provides additional guidance concerning thetypes of actions that an entity might take to prevent the unauthorized retrieval of BES Cyber
System Information from the Cyber Asset data storage media:
Clear: One method to sanitize media is to use software or hardware products tooverwrite storage space on the media with non-sensitive data. This process may include
overwriting not only the logical storage location of a file(s) (e.g., file allocation table) but
also may include all addressable locations. The security goal of the overwriting process
is to replace written data with random data. Overwriting cannot be used for media thatare damaged or not rewriteable. The media type and size may also influence whether
overwriting is a suitable sanitization method [SP 800-36].
Purge: Degaussing and executing the firmware Secure Erase command (for ATA drivesonly) are acceptable methods for purging. Degaussing is exposing the magnetic media toa strong magnetic field in order to disrupt the recorded magnetic domains. A degausser
is a device that generates a magnetic field used to sanitize magnetic media. Degaussers
are rated based on the type (i.e., low energy or high energy) of magnetic media they canpurge. Degaussers operate using either a strong permanent magnet or anelectromagnetic coil. Degaussing can be an effective method for purging damaged orinoperative media, for purging media with exceptionally large storage capacities, or for
quickly purging diskettes. [SP 800-36] Executing the firmware Secure Erase command(for ATA drives only) and degaussing are examples of acceptable methods for purging.

Page 15 of 16

Guidelines and Technical Basis
Degaussing of any hard drive assembly usually destroys the drive as the firmware thatmanages the device is also destroyed.
Destroy: There are many different types, techniques, and procedures for media
destruction. Disintegration, Pulverization, Melting, and Incineration are sanitization
methods designed to completely destroy the media. They are typically carried out at an
outsourced metal destruction or licensed incineration facility with the specificcapabilities to perform these activities effectively, securely, and safely. Optical massstorage media, including compact disks (CD, CD-RW, CD-R, CD-ROM), optical disks(DVD), and MO disks, must be destroyed by pulverizing, crosscut shredding or burning.
In some cases such as networking equipment, it may be necessary to contact the
manufacturer for proper sanitization procedure.
It is critical that an organization maintain a record of its sanitization actions to prevent
unauthorized retrieval of BES Cyber System Information. Entities are strongly encouraged toreview NIST SP800-88 for guidance on how to develop acceptable media sanitization processes.
Rationale:

During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:
The SDT’s intent of the information protection program is to prevent unauthorized access to
BES Cyber System Information.
Rationale for Requirement R2:
The intent of the BES Cyber Asset reuse and disposal process is to prevent the unauthorized
dissemination of BES Cyber System Information upon reuse or disposal.

Page 16 of 16