CIP-003-8 - Cyber Security — Security Management Controls
A. Introduction

1. Title:

Cyber Security — Security Management Controls

2. Number:

CIP-003-8

3. Purpose:

To specify consistent and sustainable security management controls that
establish responsibility and accountability to protect BES Cyber Systems
against compromise that could lead to misoperation or instability in the Bulk
Electric System (BES).

4. Applicability:
4.1. Functional Entities: For the purpose of the requirements contained herein, thefollowing list of functional entities will be collectively referred to as “Responsible
Entities.” For requirements in this standard where a specific functional entity or subset
of functional entities are the applicable entity or entities, the functional entity orentities are specified explicitly.
4.1.1. Balancing Authority
4.1.2. Distribution Provider that owns one or more of the following Facilities,
systems, and equipment for the protection or restoration of the BES:
4.1.2.1. Each underfrequency Load shedding (UFLS) or undervoltage Loadshedding (UVLS) system that:
4.1.2.1.1. is part of a Load shedding program that is subject to one ormore requirements in a NERC or Regional Reliability
Standard; and4.1.2.1.2. performs automatic Load shedding under a common
control system owned by the Responsible Entity, without
human operator initiation, of 300 MW or more.
4.1.2.2. Each Remedial Action Scheme (RAS) where the RAS is subject to one
or more requirements in a NERC or Regional Reliability Standard.
4.1.2.3. Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4. Each Cranking Path and group of Elements meeting the initialswitching requirements from a Blackstart Resource up to andincluding the first interconnection point of the starting station serviceof the next generation unit(s) to be started.
4.1.3. Generator Operator
4.1.4. Generator Owner
4.1.5. Reliability Coordinator
4.1.6. Transmission Operator
Page 1 of 59

CIP-003-8 - Cyber Security — Security Management Controls

4.1.7. Transmission Owner
4.2. Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in Section 4.1
above are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.
4.2.1. Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or
restoration of the BES:
4.2.1.1. Each UFLS or UVLS System that:
4.2.1.1.1. is part of a Load shedding program that is subject to one ormore requirements in a NERC or Regional Reliability
Standard; and4.2.1.1.2. performs automatic Load shedding under a common
control system owned by the Responsible Entity, without
human operator initiation, of 300 MW or more.
4.2.1.2. Each RAS where the RAS is subject to one or more requirements in a
NERC or Regional Reliability Standard.
4.2.1.3. Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4. Each Cranking Path and group of Elements meeting the initialswitching requirements from a Blackstart Resource up to andincluding the first interconnection point of the starting station serviceof the next generation unit(s) to be started.
4.2.2. Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3. Exemptions: The following are exempt from Standard CIP-003-8:
4.2.3.1. Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2. Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters(ESPs).
4.2.3.3. The systems, structures, and components that are regulated by the
Nuclear Regulatory Commission under a cyber security plan pursuant
to 10 C.F.R. Section 73.54.
4.2.3.4. For Distribution Providers, the systems and equipment that are notincluded in section 4.2.1 above.
Page 2 of 59

CIP-003-8 - Cyber Security — Security Management Controls

5. Effective Dates:
See Implementation Plan for CIP-003-8.
6. Background:Standard CIP-003 exists as part of a suite of CIP Standards related to cyber security, which
require the initial identification and categorization of BES Cyber Systems and requireorganizational, operational, and procedural controls to mitigate risk to BES Cyber Systems.
The term policy refers to one or a collection of written documents that are used tocommunicate the Responsible Entities’ management goals, objectives and expectations for
how the Responsible Entity will protect its BES Cyber Systems. The use of policies alsoestablishes an overall governance foundation for creating a culture of security andcompliance with laws, regulations, and standards.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any naming
or approval structure beyond what is stated in the requirements. An entity should include
as much as it believes necessary in its documented processes, but it must address theapplicable requirements.
The terms program and plan are sometimes used in place of documented processes where
it makes sense and is commonly understood. For example, documented processes
describing a response are typically referred to as plans (i.e., incident response plans andrecovery plans). Likewise, a security plan can describe an approach involving multiple
procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of its
policies, plans, and procedures involving a subject matter. Examples in the standards
include the personnel risk assessment program and the personnel training program. The full
implementation of the CIP Cyber Security Reliability Standards could also be referred to as aprogram. However, the terms program and plan do not imply any additional requirements
beyond what is stated in the standards.
Responsible Entities can implement common controls that meet requirements for multiple
high, medium, and low impact BES Cyber Systems. For example, a single cyber security
awareness program could meet the requirements across multiple BES Cyber Systems.
Measures provide examples of evidence to show documentation and implementation of therequirement. These measures serve to provide guidance to entities in acceptable records ofcompliance and should not be viewed as an all-inclusive list.
Throughout the standards, unless otherwise stated, bulleted items in the requirements andmeasures are items that are linked with an “or,” and numbered items are items that arelinked with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and UVLS.
This particular threshold of 300 MW for UVLS and UFLS was provided in Version 1 of the CIP
Cyber Security Standards. The threshold remains at 300 MW since it is specificallyaddressing UVLS and UFLS, which are last ditch efforts to save the BES. A review of UFLS
Page 3 of 59

CIP-003-8 - Cyber Security — Security Management Controls

tolerances defined within Regional Reliability Standards for UFLS program requirements todate indicates that the historical value of 300 MW represents an adequate and reasonable
threshold value for allowable UFLS operational tolerances.

Page 4 of 59

CIP-003-8 - Cyber Security — Security Management Controls
B. Requirements and Measures

R1. Each Responsible Entity shall review and obtain CIP Senior Manager approval at least
once every 15 calendar months for one or more documented cyber security policies
that collectively address the following topics: [Violation Risk Factor: Medium] [TimeHorizon: Operations Planning]
1.1.

For its high impact and medium impact BES Cyber Systems, if any:
1.1.1. Personnel and training (CIP-004);
1.1.2. Electronic Security Perimeters (CIP-005) including Interactive Remote
Access;1.1.3. Physical security of BES Cyber Systems (CIP-006);
1.1.4. System security management (CIP-007);
1.1.5. Incident reporting and response planning (CIP-008);
1.1.6. Recovery plans for BES Cyber Systems (CIP-009);
1.1.7. Configuration change management and vulnerability assessments (CIP010);
1.1.8. Information protection (CIP-011); and1.1.9. Declaring and responding to CIP Exceptional Circumstances.

1.2.

For its assets identified in CIP-002 containing low impact BES Cyber Systems, if
any:
1.2.1. Cyber security awareness;
1.2.2. Physical security controls;
1.2.3. Electronic access controls;
1.2.4. Cyber Security Incident response;
1.2.5. Transient Cyber Assets and Removable Media malicious code risk
mitigation; and1.2.6. Declaring and responding to CIP Exceptional Circumstances.

M1. Examples of evidence may include, but are not limited to, policy documents; revisionhistory, records of review, or workflow evidence from a document management
system that indicate review of each cyber security policy at least once every 15
calendar months; and documented approval by the CIP Senior Manager for each cybersecurity policy.
R2. Each Responsible Entity with at least one asset identified in CIP-002 containing low
impact BES Cyber Systems shall implement one or more documented cyber security
plan(s) for its low impact BES Cyber Systems that include the sections in Attachment 1.
[Violation Risk Factor: Lower] [Time Horizon: Operations Planning]

Page 5 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Note: An inventory, list, or discrete identification of low impact BES Cyber Systems ortheir BES Cyber Assets is not required. Lists of authorized users are not required.
M2. Evidence shall include each of the documented cyber security plan(s) that collectively
include each of the sections in Attachment 1 and additional evidence to demonstrate
implementation of the cyber security plan(s). Additional examples of evidence persection are located in Attachment 2.
R3.

Each Responsible Entity shall identify a CIP Senior Manager by name and document
any change within 30 calendar days of the change. [Violation Risk Factor: Medium][Time Horizon: Operations Planning]

M3. An example of evidence may include, but is not limited to, a dated and approved
document from a high level official designating the name of the individual identified
as the CIP Senior Manager.
R4. The Responsible Entity shall implement a documented process to delegate authority,
unless no delegations are used. Where allowed by the CIP Standards, the CIP Senior
Manager may delegate authority for specific actions to a delegate or delegates. These
delegations shall be documented, including the name or title of the delegate, thespecific actions delegated, and the date of the delegation; approved by the CIP Senior
Manager; and updated within 30 days of any change to the delegation. Delegation
changes do not need to be reinstated with a change to the delegator. [Violation Risk
Factor: Lower] [Time Horizon: Operations Planning]
M4. An example of evidence may include, but is not limited to, a dated document,
approved by the CIP Senior Manager, listing individuals (by name or title) who aredelegated the authority to approve or authorize specifically identified items.

Page 6 of 59

CIP-003-8 - Cyber Security — Security Management Controls
C. Compliance1. Compliance Monitoring Process
1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority”(CEA) means NERC or the Regional Entity in their respective roles of monitoringand enforcing compliance with the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity isrequired to retain specific evidence to demonstrate compliance. For instanceswhere the evidence retention period specified below is shorter than the timesince the last audit, the CEA may ask an entity to provide other evidence to showthat it was compliant for the full time period since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as
identified below unless directed by its CEA to retain specific evidence for alonger period of time as part of an investigation:•

Each Responsible Entity shall retain evidence of each requirement in thisstandard for three calendar years.

•

If a Responsible Entity is found non-compliant, it shall keep information
related to the non-compliance until mitigation is complete and approved orfor the time specified above, whichever is longer.

•

The CEA shall keep the last audit records and all requested and submitted
subsequent audit records.

1.3. Compliance Monitoring and Assessment Processes:•

Compliance Audits•

Self-Certifications•

Spot Checking•

Compliance Investigations•

Self-Reporting•

Complaints

1.4. Additional Compliance Information:
None.

Page 7 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Violation Severity Levels
R#

R1

Time
HorizonOperations
Planning

Violation Severity Levels (CIP-003-8)

VRF

Lower VSL

Moderate VSLHigh VSL

Severe VSL

The Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address twoof the nine topics
required by R1.
(R1.1)The Responsible Entity
documented andimplemented one ormore cyber security
policies for its highimpact and medium
impact BES Cyber
Systems, but did not
address three of the nine
topics required by R1.
(R1.1)The Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address fouror more of the nine
topics required by
R1. (R1.1)

OR

OR

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1
within 15 calendar
months but did

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1
within 16 calendar
months but did

The Responsible Entity
did not complete its
review of the one ormore documented cybersecurity policies for its
high impact and medium
impact BES Cyber
Systems as required by
R1 within 17 calendar
months but did
complete this review inless than or equal to 18

Medium The Responsible
Entity documented
and implemented
one or more cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems, but
did not address oneof the nine topics
required by R1.
(R1.1)OROR
The Responsible
Entity did not haveany documented
cyber security
policies for its highimpact and medium
impact BES Cyber
Systems as requiredby R1. (R1.1)
OR
The Responsible
Entity did not
Page 8 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
HorizonViolation Severity Levels (CIP-003-8)

VRF

Lower VSL

Moderate VSLHigh VSL

Severe VSL

complete this review
in less than or equal
to 16 calendar
months of theprevious review.
(R1.1)

complete this review
in less than or equal
to 17 calendar
months of theprevious review.
(R1.1)

calendar months of theprevious review. (R1.1)

OR

OR

The Responsible
Entity did notcomplete its
approval of the one
or more documented
cyber security
policies for its highimpact and medium
impact BES Cyber
Systems as requiredby R1 by the CIP
Senior Manager
within 15 calendar
months but did
complete thisapproval in less thanor equal to 16
calendar months ofthe previous
approval. (R1.1)

The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1 by
the CIP Senior
Manager within 16
calendar months but
did complete thisapproval in less thanor equal to 17
calendar months ofthe previous
approval. (R1.1)

complete its reviewof the one or more
documented cybersecurity policies as
required by R1
within 18 calendar
months of theprevious review. (R1)ORThe Responsible Entity
did not complete its
approval of the one ormore documented cybersecurity policies for its
high impact and medium
impact BES Cyber
Systems as required by
R1 by the CIP Senior
Manager within 17
calendar months but did
complete this approvalin less than or equal to
18 calendar months ofthe previous approval.
(R1)
OR
The Responsible Entity
documented one ormore cyber security
policies for its assets
identified in CIP-002
containing low impact

OR
The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its high impact andmedium impact BES
Cyber Systems as
required by R1 by
the CIP Senior
Manager within 18
calendar months ofthe previous
approval. (R1.1)
OR

Page 9 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
HorizonViolation Severity Levels (CIP-003-8)

VRF

Lower VSL

Moderate VSL

OR

ORThe Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address oneof the six topics
required by R1.
(R1.2)The Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address twoof the six topics
required by R1.
(R1.2)OROR

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1
within 15 calendar

The Responsible
Entity did notcomplete its reviewof the one or more
documented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1
within 16 calendar

High VSL

Severe VSL

BES Cyber Systems, but
did not address three ofthe six topics required by
R1. (R1.2)

The Responsible
Entity documented
one or more cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems, but
did not address fouror more of the six
topics required by
R1. (R1.2)

OR
The Responsible Entity
did not complete its
review of the one ormore documented cybersecurity policies for its
assets identified in CIP002 containing low
impact BES Cyber
Systems as required by
R1 within 17 calendar
months but did
complete this review inless than or equal to 18
calendar months of theprevious review. (R1.2)
OR
The Responsible Entity
did not complete its
approval of the one ormore documented cybersecurity policies for its

OR
The Responsible
Entity did not haveany documented
cyber security
policies for its assets
identified in CIP-002
containing low
impact BES Cyber
Systems as requiredby R1. (R1.2)
OR
The Responsible
Entity did not

Page 10 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
HorizonViolation Severity Levels (CIP-003-8)

VRF

Lower VSL

Moderate VSLHigh VSL

Severe VSL

months but did
complete this review
in less than or equal
to 16 calendar
months of theprevious review.
(R1.2)

months but did
complete this review
in less than or equal
to 17 calendar
months of theprevious review.
(R1.2)OROR

The Responsible
Entity did notcomplete its
approval of the one
or more documented
cyber security
policies for its assets
identified in CIP-002
containing low
impact BES Cyber
Systems as required
by Requirement R1
by the CIP Senior
Manager within 15
calendar months but
did complete thisapproval in less thanor equal to 16
calendar months of

The Responsible
Entity did notcomplete its
approval of the one
or moredocumented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1 by
the CIP Senior
Manager within 16
calendar months but
did complete thisapproval in less thanor equal to 17

assets identified in CIP002 containing low
impact BES Cyber
Systems as required byRequirement R1 by the
CIP Senior Manager
within 17 calendar
months but did
complete this approvalin less than or equal to
18 calendar months ofthe previous approval.
(R1.2)

complete its
approval of the one
or moredocumented cybersecurity policies for
its assets identified
in CIP-002 containing
low impact BES
Cyber Systems as
required byRequirement R1 by
the CIP Senior
Manager within 18
calendar months ofthe previous
approval. (R1.2)

Page 11 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

R2

Time
HorizonOperations
Planning

Violation Severity Levels (CIP-003-8)

VRF

Lower

Lower VSL

Moderate VSL

the previous
approval. (R1.2)

calendar months ofthe previous
approval. (R1.2)

The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document cybersecurity awarenessaccording toRequirement R2,
Attachment 1,
Section 1. (R2)The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to reinforce cybersecurity practices atleast once every 15
calendar months
according toRequirement R2,
Attachment 1,
Section 1. (R2)ORThe Responsible
Entity implemented
electronic access
controls but failed to
document its cybersecurity plan(s) for
electronic access
controls according toRequirement R2,

OR
The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed

High VSL

Severe VSL

The Responsible Entity
documented the physicalaccess controls for its
assets containing low
impact BES Cyber
Systems, but failed to
implement the physicalsecurity controls
according toRequirement R2,
Attachment 1, Section 2.
(R2)

The Responsible
Entity failed to
document andimplement one ormore cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems according toRequirement R2,
Attachment 1. (R2)ORThe Responsible Entity
documented its cybersecurity plan(s) for
electronic access
controls for its assets
containing low impact
BES Cyber Systems, butfailed to permit only
necessary inbound andoutbound electronic

Page 12 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
HorizonViolation Severity Levels (CIP-003-8)

VRF

Lower VSL
Attachment 1,
Section 3. (R2)ORThe Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document one ormore Cyber Security
Incident responseplan(s) according toRequirement R2,
Attachment 1,
Section 4. (R2)ORThe Responsible
Entity documented
one or more Cyber
Security Incident
response plan(s)within its cybersecurity plan(s) for
its assets containing

Moderate VSLHigh VSL

to document
physical security
controls according toRequirement R2,
Attachment 1,
Section 2. (R2)

access controls
according toRequirement R2,
Attachment 1, Section
3.1. (R2)ORThe Responsible Entity
documented one ormore Cyber Security
Incident response plan(s)within its cyber security
plan(s) for its assets
containing low impact
BES Cyber Systems, butfailed to test each Cyber
Security Incident
response plan(s) at least
once every 36 calendar
months according toRequirement R2,
Attachment 1, Section 4.
(R2)

The Responsible
Entity documented
its cyber security
plan(s) for its assets
containing low
impact BES Cyber
Systems, but failed
to document
electronic access
controls according toRequirement R2,
Attachment 1,
Section 3. (R2)ORThe Responsible
Entity documented
its cyber security
plan(s) for electronic
access controls but

Severe VSL

OR

ORThe Responsible Entity
documented thedetermination ofPage 13 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
HorizonViolation Severity Levels (CIP-003-8)

VRF

Lower VSL

Moderate VSLHigh VSL

low impact BES
Cyber Systems, butfailed to update each
Cyber Security
Incident responseplan(s) within 180
days according toRequirement R2,
Attachment 1,
Section 4. (R2)failed to implement
authentication for all
Dial-up Connectivity
that provides accessto low impact BES
Cyber System(s), per
Cyber Assetcapability according
to Requirement R2,
Attachment 1,
Section 3.2 (R2)

whether an identified
Cyber Security Incident is
a Reportable Cyber
Security Incident, butfailed to notify theElectricity Information
Sharing and Analysis
Center (E-ISAC)
according toRequirement R2,
Attachment 1, Section 4.
(R2)

OR
The Responsible
Entity documented
its plan(s) for
Transient Cyber
Assets andRemovable Media,
but failed to manage
its Transient Cyber
Asset(s) according toRequirement R2,
Attachment 1,
Section 5.1. (R2)ORThe Responsible
Entity documented

OR
The Responsible
Entity documented
one or more incident
response plan(s)within its cybersecurity plan(s) for
its assets containing
low impact BES
Cyber Systems, butfailed to include theprocess for
identification,
classification, andresponse to Cyber
Security Incidents

Severe VSL

OR
The Responsible Entity
documented its plan(s)for Transient Cyber
Assets and Removable
Media, but failed to
implement mitigation for
the introduction ofmalicious code forTransient Cyber Assets
managed by the
Responsible Entity
according toRequirement R2,

Page 14 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-8)

Lower VSL

Moderate VSLHigh VSL

its plan(s) for
Transient Cyber
Assets, but failed to
document theRemovable Media
section(s) according
to Requirement R2,
Attachment 1,
Section 5.3. (R2)

according toRequirement R2,
Attachment 1,
Section 4. (R2)

Attachment 1, Section
5.1. (R2)

Severe VSL

OR

The Responsible Entity
documented its plan(s)The Responsible
for Transient Cyber
Entity documented
Assets and Removableits cyber security
Media, but failed toplan(s) for its assets implement mitigation forcontaining low
the introduction of
impact BES Cybermalicious code for
Systems, but failed
Transient Cyber Assets
to document the
managed by a party
determination ofother than thewhether an
Responsible Entity
identified Cyberaccording toSecurity Incident is a Requirement R2,
Reportable Cyber
Attachment 1, Section
Security Incident and 5.2. (R2)subsequentOR
notification to the
The Responsible Entity
Electricity
Information Sharing documented its plan(s)for Transient Cyber
and Analysis Center(E-ISAC) according to Assets and Removable
Media, but failed toRequirement R2,
implement mitigation forOR

Page 15 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-8)

Lower VSL

Moderate VSL
Attachment 1,
Section 4. (R2)ORThe Responsible
Entity documented
its plan(s) for
Transient Cyber
Assets andRemovable Media,
but failed to
document mitigation
for the introductionof malicious code forTransient Cyber
Assets managed by
the Responsible
Entity according toRequirement R2,
Attachment 1,
Sections 5.1 and 5.3.
(R2)High VSL

Severe VSL

the threat of detected
malicious code on the
Removable Media prior
to connecting
Removable Media to a
low impact BES Cyber
System according toRequirement R2,
Attachment 1, Section
5.3. (R2)ORThe Responsible
Entity documented
its plan(s) for
Transient Cyber

Page 16 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-8)

Lower VSL

Moderate VSLHigh VSL

Severe VSL

Assets andRemovable Media,
but failed to
document mitigation
for the introductionof malicious code forTransient Cyber
Assets managed by aparty other than the
Responsible Entity
according toRequirement R2,
Attachment 1,
Section 5.2. (R2)ORThe Responsible
Entity documented
its plan(s) for
Transient Cyber
Assets andRemovable Media,
but failed to
implement theRemovable Media
section(s) according
to Requirement R2,

Page 17 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-8)

Lower VSL

Moderate VSLHigh VSL

Severe VSL

Attachment 1,
Section 5.3. (R2)R3

R4Operations
Planning

Operations
Planning

Medium The Responsible
Entity has identified
by name a CIP Senior
Manager, but did not
document changes
to the CIP Senior
Manager within 30
calendar days but did
document thischange in less than
40 calendar days ofthe change. (R3)The Responsible
Entity has identified
by name a CIP Senior
Manager, but did
not documentchanges to the CIP
Senior Manager
within 40 calendar
days but did
document thischange in less than
50 calendar days ofthe change. (R3)The Responsible Entity
has identified by name a
CIP Senior Manager, but
did not documentchanges to the CIP
Senior Manager within
50 calendar days but did
document this change inless than 60 calendar
days of the change. (R3)The Responsible
Entity has not
identified, by name,a CIP Senior
Manager.

Lower

The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andspecific actions
delegated, but did

The Responsible Entity
has identified a delegate
by name, title, date ofdelegation, and specificactions delegated, but
did not documentchanges to the delegate

The Responsible
Entity has used
delegated authority
for actions where
allowed by the CIP
Standards, but does
not have a process

The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andspecific actions
delegated, but did

OR
The Responsible
Entity has identified
by name a CIP Senior
Manager, but did
not documentchanges to the CIP
Senior Manager
within 60 calendar
days of the change.
(R3)

Page 18 of 59

CIP-003-8 - Cyber Security — Security Management Controls

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-003-8)

Lower VSL

Moderate VSLHigh VSL

Severe VSL

not documentchanges to thedelegate within 30
calendar days but did
document thischange in less than
40 calendar days ofthe change. (R4)

not documentchanges to thedelegate within 40
calendar days but
did document thischange in less than
50 calendar days ofthe change. (R4)within 50 calendar days
but did document thischange in less than 60
calendar days of thechange. (R4)

to delegate actions
from the CIP Senior
Manager. (R4)OR
The Responsible
Entity has identified
a delegate by name,title, date ofdelegation, andspecific actions
delegated, but did
not documentchanges to thedelegate within 60
calendar days of thechange. (R4)

D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

None.

Page 19 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Version History
VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify therequirements and to bring thecompliance elements into conformancewith the latest guidelines for developing
compliance elements of standards.

ChangeTracking

3/24/06

Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
responsible entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.
3

12/16/09

Updated Version Number from -2 to -3
In Requirement 1.6, deleted thesentence pertaining to removing
component or system from service inorder to perform testing, in response to
FERC order issued September 30, 2009.

3

12/16/09

Approved by the NERC Board ofTrustees.

3

3/31/10

Approved by FERC.

4

1/24/11

Approved by the NERC Board ofTrustees.

5

11/26/12

Adopted by the NERC Board ofTrustees.

Modified tocoordinate withother CIP
standards and torevise format touse RBS Template.

Page 20 of 59

CIP-003-8 - Cyber Security — Security Management Controls

ChangeTracking

VersionDate

Action5

11/22/13

FERC Order issued approving CIP-003-5.

6

11/13/14

Adopted by the NERC Board ofTrustees.

Addressed two
FERC directives
from Order No.
791 related to
identify, assess,and correct
language andcommunication
networks.

6

2/12/15

Adopted by the NERC Board ofTrustees.

Replaces theversion adopted
by the Board on
11/13/2014.
Revised version
addresses
remaining
directives from
Order No. 791
related totransient devices
and low impact
BES Cyber
Systems.

6

1/21/16

FERC Order issued approving CIP-003-6.
Docket No. RM15-14-000

7

2/9/17Adopted by the NERC Board ofTrustees.

7

4/19/18

FERC Order issued approving CIP-003-7.
Docket No. RM17-11-000

Revised to address
FERC Order No.
822 directives
regarding (1) thedefinition of LERC
and (2) transientdevices.

Page 21 of 59

CIP-003-8 - Cyber Security — Security Management Controls

VersionDate

8

5/9/19ActionAdopted by the NERC Board ofTrustees.

ChangeTracking

Removed SPS
references.
Revised to address
FERC Order No.
843 regarding
mitigating the riskof malicious code.

8

7/31/2019 FERC Order issued approving CIP-003-8.
Docket No. RD19-5-000.

Page 22 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Attachment 1
Required Sections for Cyber Security Plan(s) for Assets Containing Low Impact BES Cyber
Systems
Responsible Entities shall include each of the sections provided below in the cyber security
plan(s) required under Requirement R2.
Responsible Entities with multiple-impact BES Cyber Systems ratings can utilize policies,
procedures, and processes for their high or medium impact BES Cyber Systems to fulfill thesections for the development of low impact cyber security plan(s). Each Responsible Entity candevelop a cyber security plan(s) either by individual asset or groups of assets.
Section 1. Cyber Security Awareness: Each Responsible Entity shall reinforce, at least once
every 15 calendar months, cyber security practices (which may include associatedphysical security practices).
Section 2. Physical Security Controls: Each Responsible Entity shall control physical access,based on need as determined by the Responsible Entity, to (1) the asset or thelocations of the low impact BES Cyber Systems within the asset, and (2) the Cyber
Asset(s), as specified by the Responsible Entity, that provide electronic access
control(s) implemented for Section 3.1, if any.
Section 3. Electronic Access Controls: For each asset containing low impact BES Cyber
System(s) identified pursuant to CIP-002, the Responsible Entity shall implement
electronic access controls to:
3.1

3.2

Permit only necessary inbound and outbound electronic access as
determined by the Responsible Entity for any communications that are:i.

between a low impact BES Cyber System(s) and a Cyber Asset(s) outside
the asset containing low impact BES Cyber System(s);ii.

using a routable protocol when entering or leaving the asset containing
the low impact BES Cyber System(s); andiii.

not used for time-sensitive protection or control functions between
intelligent electronic devices (e.g., communications using protocol IEC TR61850-90-5 R-GOOSE).

Authenticate all Dial-up Connectivity, if any, that provides access to low
impact BES Cyber System(s), per Cyber Asset capability.

Section 4. Cyber Security Incident Response: Each Responsible Entity shall have one or more
Cyber Security Incident response plan(s), either by asset or group of assets, whichshall include:
4.1

Identification, classification, and response to Cyber Security Incidents;

4.2

Determination of whether an identified Cyber Security Incident is a
Reportable Cyber Security Incident and subsequent notification to the

Page 23 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Electricity Information Sharing and Analysis Center (E-ISAC), unlessprohibited by law;
4.3

Identification of the roles and responsibilities for Cyber Security Incident
response by groups or individuals;

4.4

Incident handling for Cyber Security Incidents;

4.5

Testing the Cyber Security Incident response plan(s) at least once every 36
calendar months by: (1) responding to an actual Reportable Cyber Security
Incident; (2) using a drill or tabletop exercise of a Reportable Cyber Security
Incident; or (3) using an operational exercise of a Reportable Cyber Security
Incident; and4.6

Updating the Cyber Security Incident response plan(s), if needed, within 180
calendar days after completion of a Cyber Security Incident response plan(s)test or actual Reportable Cyber Security Incident.

Section 5. Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation: Each
Responsible Entity shall implement, except under CIP Exceptional Circumstances,
one or more plan(s) to achieve the objective of mitigating the risk of theintroduction of malicious code to low impact BES Cyber Systems through the use of
Transient Cyber Assets or Removable Media. The plan(s) shall include:
5.1

5.2

For Transient Cyber Asset(s) managed by the Responsible Entity, if any, theuse of one or a combination of the following in an ongoing or on-demandmanner (per Transient Cyber Asset capability):•

Antivirus software, including manual or managed updates of signatures
or patterns;•

Application whitelisting; or•Other method(s) to mitigate the introduction of malicious code.

For Transient Cyber Asset(s) managed by a party other than the Responsible
Entity, if any:
5.2.1 Use one or a combination of the following prior to connecting theTransient Cyber Asset to a low impact BES Cyber System (perTransient Cyber Asset capability):•

Review of antivirus update level;•

Review of antivirus update process used by the party;•

Review of application whitelisting used by the party;•

Review use of live operating system and software executable
only from read-only media;•

Review of system hardening used by the party; orPage 24 of 59

CIP-003-8 - Cyber Security — Security Management Controls•

Other method(s) to mitigate the introduction of malicious
code.

5.2.2 For any method used pursuant to 5.2.1, Responsible Entities shalldetermine whether any additional mitigation actions are necessary
and implement such actions prior to connecting the Transient Cyber
Asset.
5.3

For Removable Media, the use of each of the following:
5.3.1 Method(s) to detect malicious code on Removable Media using a
Cyber Asset other than a BES Cyber System; and5.3.2 Mitigation of the threat of detected malicious code on the Removable
Media prior to connecting Removable Media to a low impact BES
Cyber System.

Page 25 of 59

CIP-003-8 - Cyber Security — Security Management Controls

Attachment 2
Examples of Evidence for Cyber Security Plan(s) for Assets Containing Low Impact BES Cyber
Systems
Section 1. Cyber Security Awareness: An example of evidence for Section 1 may include, but is
not limited to, documentation that the reinforcement of cyber security practices
occurred at least once every 15 calendar months. The evidence could be
documentation through one or more of the following methods:•

Direct communications (for example, e-mails, memos, or computer-based
training);•Indirect communications (for example, posters, intranet, or brochures); or•Management support and reinforcement (for example, presentations or
meetings).

Section 2. Physical Security Controls: Examples of evidence for Section 2 may include, but are
not limited to:•Documentation of the selected access control(s) (e.g., card key, locks, perimeter
controls), monitoring controls (e.g., alarm systems, human observation), or otheroperational, procedural, or technical physical security controls that control
physical access to both:a. The asset, if any, or the locations of the low impact BES Cyber Systems within
the asset; andb. The Cyber Asset(s) specified by the Responsible Entity that provide(s)electronic access controls implemented for Attachment 1, Section 3.1, if any.

Section 3. Electronic Access Controls: Examples of evidence for Section 3 may include, but are
not limited to:
1. Documentation showing that at each asset or group of assets containing low
impact BES Cyber Systems, routable communication between a low impact BES
Cyber System(s) and a Cyber Asset(s) outside the asset is restricted by electronic
access controls to permit only inbound and outbound electronic access that the
Responsible Entity deems necessary, except where an entity provides rationalethat communication is used for time-sensitive protection or control functions
between intelligent electronic devices. Examples of such documentation may
include, but are not limited to representative diagrams that illustrate control of
inbound and outbound communication(s) between the low impact BES Cyber
System(s) and a Cyber Asset(s) outside the asset containing low impact BES
Cyber System(s) or lists of implemented electronic access controls (e.g., access
control lists restricting IP addresses, ports, or services; implementing
unidirectional gateways).

Page 26 of 59

CIP-003-8 - Cyber Security — Security Management Controls

2. Documentation of authentication for Dial-up Connectivity (e.g., dial out only to a
preprogrammed number to deliver data, dial-back modems, modems that must
be remotely controlled by the control center or control room, or access control
on the BES Cyber System).
Section 4. Cyber Security Incident Response: An example of evidence for Section 4 may include,
but is not limited to, dated documentation, such as policies, procedures, or process
documents of one or more Cyber Security Incident response plan(s) developed
either by asset or group of assets that include the following processes:
1. to identify, classify, and respond to Cyber Security Incidents; to determine
whether an identified Cyber Security Incident is a Reportable Cyber Security
Incident and for notifying the Electricity Information Sharing and Analysis Center(E-ISAC);
2. to identify and document the roles and responsibilities for Cyber Security
Incident response by groups or individuals (e.g., initiating, documenting,monitoring, reporting, etc.);
3. for incident handling of a Cyber Security Incident (e.g., containment, eradication,or recovery/incident resolution);
4. for testing the plan(s) along with the dated documentation that a test has been
completed at least once every 36 calendar months; and5. to update, as needed, Cyber Security Incident response plan(s) within 180
calendar days after completion of a test or actual Reportable Cyber Security
Incident.
Section 5. Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation:
1. Examples of evidence for Section 5.1 may include, but are not limited to,
documentation of the method(s) used to mitigate the introduction of malicious
code such as antivirus software and processes for managing signature or pattern
updates, application whitelisting practices, processes to restrict communication,or other method(s) to mitigate the introduction of malicious code. If a Transient
Cyber Asset does not have the capability to use method(s) that mitigate theintroduction of malicious code, evidence may include documentation by thevendor or Responsible Entity that identifies that the Transient Cyber Asset does
not have the capability.
2. Examples of evidence for Section 5.2.1 may include, but are not limited to,
documentation from change management systems, electronic mail orprocedures that document a review of the installed antivirus update level;
memoranda, electronic mail, system documentation, policies or contracts fromthe party other than the Responsible Entity that identify the antivirus updateprocess, the use of application whitelisting, use of live operating systems or
system hardening performed by the party other than the Responsible Entity;
evidence from change management systems, electronic mail or contracts that

Page 27 of 59

CIP-003-8 - Cyber Security — Security Management Controls

identifies the Responsible Entity’s acceptance that the practices of the party
other than the Responsible Entity are acceptable; or documentation of othermethod(s) to mitigate malicious code for Transient Cyber Asset(s) managed by aparty other than the Responsible Entity. If a Transient Cyber Asset does not havethe capability to use method(s) that mitigate the introduction of malicious code,
evidence may include documentation by the Responsible Entity or the party
other than the Responsible Entity that identifies that the Transient Cyber Asset
does not have the capability.
Examples of evidence for Attachment 1, Section 5.2.2 may include, but are notlimited to, documentation from change management systems, electronic mail, or
contracts that identifies a review to determine whether additional mitigation isnecessary and has been implemented prior to connecting the Transient Cyber
Asset managed by a party other than the Responsible Entity.
3. Examples of evidence for Section 5.3.1 may include, but are not limited to,
documented process(es) of the method(s) used to detect malicious code such as
results of scan settings for Removable Media, or implementation of on-demandscanning. Examples of evidence for Section 5.3.2 may include, but are not limited
to, documented process(es) for the method(s) used for mitigating the threat ofdetected malicious code on Removable Media, such as logs from the method(s)used to detect malicious code that show the results of scanning and themitigation of detected malicious code on Removable Media or documented
confirmation by the entity that the Removable Media was deemed to be free ofmalicious code.

Page 28 of 59

CIP-003-8 Supplemental Material

Guidelines and Technical Basis

Section 4 – Scope of Applicability of the CIP Cyber Security Standards

Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. In addition to the set of BES Facilities, Control Centers, and other systems andequipment, the list includes the set of systems and equipment owned by Distribution Providers.
While the NERC Glossary term “Facilities” already includes the BES characteristic, the additionaluse of the term BES here is meant to reinforce the scope of applicability of these Facilities
where it is used, especially in this applicability scoping section. This in effect sets the scope ofFacilities, systems, and equipment that is subject to the standards.
Requirement R1:

In developing policies in compliance with Requirement R1, the number of policies and theircontent should be guided by a Responsible Entity's management structure and operating
conditions. Policies might be included as part of a general information security program for theentire organization, or as components of specific programs. The Responsible Entity has theflexibility to develop a single comprehensive cyber security policy covering the required topics,
or it may choose to develop a single high-level umbrella policy and provide additional policy
detail in lower level documents in its documentation hierarchy. In the case of a high-levelumbrella policy, the Responsible Entity would be expected to provide the high-level policy aswell as the additional documentation in order to demonstrate compliance with CIP-003-8,
Requirement R1.
If a Responsible Entity has any high or medium impact BES Cyber Systems, the one or morecyber security policies must cover the nine subject matter areas required by CIP-003-8,
Requirement R1, Part 1.1. If a Responsible Entity has identified from CIP-002 any assets
containing low impact BES Cyber Systems, the one or more cyber security policies must cover
the six subject matter areas required by Requirement R1, Part 1.2.
Responsible Entities that have multiple-impact rated BES Cyber Systems are not required tocreate separate cyber security policies for high, medium, or low impact BES Cyber Systems. The
Responsible Entities have the flexibility to develop policies that cover all three impact ratings.
Implementation of the cyber security policy is not specifically included in CIP-003-8,
Requirement R1 as it is envisioned that the implementation of this policy is evidenced throughsuccessful implementation of CIP-003 through CIP-011. However, Responsible Entities areencouraged not to limit the scope of their cyber security policies to only those requirements in
NERC cyber security Reliability Standards, but to develop a holistic cyber security policy

Page 29 of 59

CIP-003-8 Supplemental Material
appropriate for its organization. Elements of a policy that extend beyond the scope of NERC’s
cyber security Reliability Standards will not be considered candidates for potential violations
although they will help demonstrate the organization’s internal culture of compliance andposture towards cyber security.
For Part 1.1, the Responsible Entity may consider the following for each of the required topics
in its one or more cyber security policies for medium and high impact BES Cyber Systems, if any:
1.1.1 Personnel and training (CIP-004)•

Organization position on acceptable background investigations•

Identification of possible disciplinary action for violating this policy•

Account management

1.1.2 Electronic Security Perimeters (CIP-005) including Interactive Remote Access•

Organization stance on use of wireless networks•

Identification of acceptable authentication methods•

Identification of trusted and untrusted resources•

Monitoring and logging of ingress and egress at Electronic Access Points•

Maintaining up-to-date anti-malware software before initiating Interactive Remote
Access•

Maintaining up-to-date patch levels for operating systems and applications used toinitiate Interactive Remote Access•

Disabling VPN “split-tunneling” or “dual-homed” workstations before initiating
Interactive Remote Access•

For vendors, contractors, or consultants: include language in contracts that requires
adherence to the Responsible Entity’s Interactive Remote Access controls

1.1.3 Physical security of BES Cyber Systems (CIP-006)•

Strategy for protecting Cyber Assets from unauthorized physical access•Acceptable physical access control methods•

Monitoring and logging of physical ingress

1.1.4 System security management (CIP-007)•

Strategies for system hardening•

Acceptable methods of authentication and access control•

Password policies including length, complexity, enforcement, prevention of brute
force attempts•

Monitoring and logging of BES Cyber Systems

Page 30 of 59

CIP-003-8 Supplemental Material
1.1.5 Incident reporting and response planning (CIP-008)•

Recognition of Cyber Security Incidents•

Appropriate notifications upon discovery of an incident•

Obligations to report Cyber Security Incidents

1.1.6 Recovery plans for BES Cyber Systems (CIP-009)•

Availability of spare components•

Availability of system backups

1.1.7 Configuration change management and vulnerability assessments (CIP-010)•

Initiation of change requests•

Approval of changes•

Break-fix processes

1.1.8 Information protection (CIP-011)•

Information access control methods•

Notification of unauthorized information disclosure•

Information access on a need-to-know basis

1.1.9 Declaring and responding to CIP Exceptional Circumstances•

Processes to invoke special procedures in the event of a CIP Exceptional
Circumstance•

Processes to allow for exceptions to policy that do not violate CIP requirements

For Part 1.2, the Responsible Entity may consider the following for each of the required topics
in its one or more cyber security policies for assets containing low impact BES Cyber Systems, if
any:
1.2.1 Cyber security awareness•

Method(s) for delivery of security awareness•

Identification of groups to receive cyber security awareness1.2.2 Physical security controls•

Acceptable approach(es) for selection of physical security control(s)1.2.3 Electronic access controls•

Acceptable approach(es) for selection of electronic access control(s)1.2.4 Cyber Security Incident response•

Recognition of Cyber Security Incidents

Page 31 of 59

CIP-003-8 Supplemental Material•

Appropriate notifications upon discovery of an incident•

Obligations to report Cyber Security Incidents

1.2.5 Transient Cyber Assets and Removable Media Malicious Code Risk Mitigation•

Acceptable use of Transient Cyber Asset(s) and Removable Media•

Method(s) to mitigate the risk of the introduction of malicious code to low impact
BES Cyber Systems from Transient Cyber Assets and Removable Media•

Method(s) to request Transient Cyber Asset and Removable Media

1.2.6 Declaring and responding to CIP Exceptional Circumstances•

Process(es) to declare a CIP Exceptional Circumstance•

Process(es) to respond to a declared CIP Exceptional Circumstance

Requirements relating to exceptions to a Responsible Entity’s security policies were removed
because it is a general management issue that is not within the scope of a reliability
requirement. It is an internal policy requirement and not a reliability requirement. However,Responsible Entities are encouraged to continue this practice as a component of their cybersecurity policies.
In this and all subsequent required approvals in the NERC CIP Reliability Standards, theResponsible Entity may elect to use hardcopy or electronic approvals to the extent that there issufficient evidence to ensure the authenticity of the approving party.
Requirement R2:

The intent of Requirement R2 is for each Responsible Entity to create, document, andimplement one or more cyber security plan(s) that address the security objective for theprotection of low impact BES Cyber Systems. The required protections are designed to be partof a program that covers the low impact BES Cyber Systems collectively at an asset level (basedon the list of assets containing low impact BES Cyber Systems identified in CIP-002), but not at
an individual device or system level.

Page 32 of 59

CIP-003-8 Supplemental Material
Requirement R2, Attachment 1

As noted, Attachment 1 contains the sections that must be included in the cyber security
plan(s). The intent is to allow entities that have a combination of high, medium, and low impact
BES Cyber Systems the flexibility to choose, if desired, to cover their low impact BES Cyber
Systems (or any subset) under their programs used for the high or medium impact BES Cyber
Systems rather than maintain two separate programs. The purpose of the cyber security plan(s)in Requirement R2 is for Responsible Entities to use the cyber security plan(s) as a means of
documenting their approaches to meeting the subject matter areas. The cyber security plan(s)can be used to reference other policies and procedures that demonstrate “how” theResponsible Entity is meeting each of the subject matter areas, or Responsible Entities candevelop comprehensive cyber security plan(s) that contain all of the detailed implementation
content solely within the cyber security plan itself. To meet the obligation for the cyber security
plan, the expectation is that the cyber security plan contains or references sufficient details to
address the implementation of each of the required subject matters areas.
Guidance for each of the subject matter areas of Attachment 1 is provided below.
Requirement R2, Attachment 1, Section 1 – Cyber Security AwarenessThe intent of the cyber security awareness program is for entities to reinforce good cybersecurity practices with their personnel at least once every 15 calendar months. The entity has
the discretion to determine the topics to be addressed and the manner in which it willcommunicate these topics. As evidence of compliance, the Responsible Entity should be able toproduce the awareness material that was delivered according to the delivery method(s) (e.g.,posters, emails, or topics at staff meetings, etc.). The standard drafting team does not intend
for Responsible Entities to be required to maintain lists of recipients and track the reception of
the awareness material by personnel.
Although the focus of the awareness is cyber security, it does not mean that only technologyrelated topics can be included in the program. Appropriate physical security topics (e.g.,
tailgating awareness and protection of badges for physical security, or “If you see something,say something” campaigns, etc.) are valid for cyber security awareness. The intent is to cover
topics concerning any aspect of the protection of BES Cyber Systems.
Requirement R2, Attachment 1, Section 2 – Physical Security Controls

The Responsible Entity must document and implement methods to control physical access to(1) the asset or the locations of low impact BES Cyber Systems within the asset, and (2) Cyber
Assets that implement the electronic access control(s) specified by the Responsible Entity in
Attachment 1, Section 3.1, if any. If these Cyber Assets implementing the electronic access
controls are located within the same asset as the low impact BES Cyber Asset(s) and inherit thesame physical access controls and the same need as outlined in Section 2, this may be noted by
the Responsible Entity in either its policies or cyber security plan(s) to avoid duplicate
documentation of the same controls.
The Responsible Entity has the flexibility to select the methods used to meet the objective ofcontrolling physical access to (1) the asset(s) containing low impact BES Cyber System(s) or the
low impact BES Cyber Systems themselves and (2) the electronic access control Cyber Assets
specified by the Responsible Entity, if any. The Responsible Entity may use one or a

Page 33 of 59

CIP-003-8 Supplemental Material
combination of physical access controls, monitoring controls, or other operational, procedural,or technical physical security controls. Entities may use perimeter controls (e.g., fences withlocked gates, guards, or site access policies, etc.) or more granular areas of physical access
control in areas where low impact BES Cyber Systems are located, such as control rooms orcontrol houses.
The security objective is to control the physical access based on need as determined by the
Responsible Entity. The need for physical access can be documented at the policy level. The
standard drafting team did not intend to obligate an entity to specify a need for each physicalaccess or authorization of an individual for physical access.
Monitoring as a physical security control can be used as a complement or an alternative tophysical access control. Examples of monitoring controls include, but are not limited to: (1)alarm systems to detect motion or entry into a controlled area, or (2) human observation of acontrolled area. Monitoring does not necessarily require logging and maintaining logs but could
include monitoring that physical access has occurred or been attempted (e.g., door alarm, or
human observation, etc.). The standard drafting team’s intent is that the monitoring does notneed to be per low impact BES Cyber System but should be at the appropriate level to meet the
security objective of controlling physical access.
User authorization programs and lists of authorized users for physical access are not required
although they are an option to meet the security objective.
Requirement R2, Attachment 1, Section 3 – Electronic Access Controls

Section 3 requires the establishment of electronic access controls for assets containing low
impact BES Cyber Systems when there is routable protocol communication or Dial-up
Connectivity between Cyber Asset(s) outside of the asset containing the low impact BES Cyber
System(s) and the low impact BES Cyber System(s) within such asset. The establishment ofelectronic access controls is intended to reduce the risks associated with uncontrolledcommunication using routable protocols or Dial-up Connectivity.
When implementing Attachment 1, Section 3.1, Responsible Entities should note that electronic
access controls to permit only necessary inbound and outbound electronic access are requiredfor communications when those communications meet all three of the criteria identified in
Attachment 1, Section 3.1. The Responsible Entity should evaluate the communications andwhen all three criteria are met, the Responsible Entity must document and implement
electronic access control(s).
When identifying electronic access controls, Responsible Entities are provided flexibility in theselection of the electronic access controls that meet their operational needs while meeting thesecurity objective of allowing only necessary inbound and outbound electronic access to low
impact BES Cyber Systems that use routable protocols between a low impact BES Cyber
System(s) and Cyber Asset(s) outside the asset.
In essence, the intent is for Responsible Entities to determine whether there is communication
between a low impact BES Cyber System(s) and a Cyber Asset(s) outside the asset containing
low impact BES Cyber System(s) that uses a routable protocol when entering or leaving theasset or Dial-up Connectivity to the low impact BES Cyber System(s). Where such

Page 34 of 59

CIP-003-8 Supplemental Material
communication is present, Responsible Entities should document and implement electronic
access control(s). Where routable protocol communication for time-sensitive protection orcontrol functions between intelligent electronic devices that meets the exclusion language ispresent, Responsible Entities should document that communication, but are not required toestablish any specific electronic access controls.
The inputs to this requirement are the assets identified in CIP-002 as containing low impact BES
Cyber System(s); therefore, the determination of routable protocol communications or Dial-up
Connectivity is an attribute of the asset. However, it is not intended for communication thatprovides no access to or from the low impact BES Cyber System(s), but happens to be located at
the asset with the low impact BES Cyber System(s), to be evaluated for electronic access
controls.
Electronic Access Control Exclusion
In order to avoid future technology issues, the obligations for electronic access controls exclude
communications between intelligent electronic devices that use routable communication
protocols for time-sensitive protection or control functions, such as IEC TR-61850-90-5 RGOOSE messaging. Time-sensitive in this context generally means functions that would be
negatively impacted by the latency introduced in the communications by the required
electronic access controls. This time-sensitivity exclusion does not apply to SCADA
communications which typically operate on scan rates of 2 seconds or greater. While
technically time-sensitive, SCADA communications over routable protocols can withstand thedelay introduced by electronic access controls. Examples of excluded time-sensitive
communications are those communications which may necessitate the tripping of a breakerwithin a few cycles. A Responsible Entity using this technology is not expected to implement theelectronic access controls noted herein. This exception was included so as not to inhibit thefunctionality of the time-sensitive characteristics related to this technology and not to preclude
the use of such time-sensitive reliability enhancing functions if they use a routable protocol in
the future.
Considerations for Determining Routable Protocol Communications

To determine whether electronic access controls need to be implemented, the Responsible
Entity has to determine whether there is communication between a low impact BES Cyber
System(s) and a Cyber Asset(s) outside the asset containing the low impact BES Cyber System(s)that uses a routable protocol when entering or leaving the asset.
When determining whether a routable protocol is entering or leaving the asset containing the
low impact BES Cyber System(s), Responsible Entities have flexibility in identifying an approach.
One approach is for Responsible Entities to identify an “electronic boundary” associated withthe asset containing low impact BES Cyber System(s). This is not an Electronic Security
Perimeter per se, but a demarcation that demonstrates the routable protocol communicationentering or leaving the asset between a low impact BES Cyber System and Cyber Asset(s)outside the asset to then have electronic access controls implemented. This electronic
boundary may vary by asset type (Control Center, substation, generation resource) and thespecific configuration of the asset. If this approach is used, the intent is for the Responsible
Entity to define the electronic boundary such that the low impact BES Cyber System(s) locatedPage 35 of 59

CIP-003-8 Supplemental Material
at the asset are contained within the “electronic boundary.” This is strictly for determining
which routable protocol communications and networks are internal or inside or local to theasset and which are external to or outside the asset.
Alternatively, the Responsible Entity may find the concepts of what is inside and outside to be
intuitively obvious for a Cyber Asset(s) outside the asset containing low impact BES Cyber
System(s) communicating to a low impact BES Cyber System(s) inside the asset. This may be thecase when a low impact BES Cyber System(s) is communicating with a Cyber Asset many miles
away and a clear and unambiguous demarcation exists. In this case, a Responsible Entity may
decide not to identify an “electronic boundary,” but rather to simply leverage the unambiguous
asset demarcation to ensure that the electronic access controls are placed between the low
impact BES Cyber System(s) and the Cyber Asset(s) outside the asset.
Determining Electronic Access Controls

Once a Responsible Entity has determined that there is routable communication between a low
impact BES Cyber System(s) and a Cyber Asset(s) outside the asset containing the low impact
BES Cyber System(s) that uses a routable protocol when entering or leaving the asset containing
the low impact BES Cyber System(s), the intent is for the Responsible Entity to document andimplement its chosen electronic access control(s). The control(s) are intended to allow only
“necessary” inbound and outbound electronic access as determined by the Responsible Entity.
However the Responsible Entity chooses to document the inbound and outbound accesspermissions and the need, the intent is that the Responsible Entity is able to explain thereasons for the electronic access permitted. The reasoning for “necessary” inbound andoutbound electronic access controls may be documented within the Responsible Entity’s cybersecurity plan(s), within a comment on an access control list, a database, spreadsheet or otherpolicies or procedures associated with the electronic access controls.
Concept Diagrams

The diagrams on the following pages are provided as examples to illustrate various electronic
access controls at a conceptual level. Regardless of the concepts or configurations chosen by
the Responsible Entity, the intent is to achieve the security objective of permitting only
necessary inbound and outbound electronic access for communication between low impact BES
Cyber Systems and Cyber Asset(s) outside the asset containing the low impact BES Cyber
System(s) using a routable protocol when entering or leaving the asset.
NOTE:•

This is not an exhaustive list of applicable concepts.

•

The same legend is used in each diagram; however, the diagram may not contain all of thearticles represented in the legend.

Page 36 of 59

CIP-003-8 Supplemental Material
Reference Model 1 – Host-based Inbound & Outbound Access Permissions

The Responsible Entity may choose to utilize a host-based firewall technology on the low
impact BES Cyber System(s) itself that manages the inbound and outbound electronic accesspermissions so that only necessary inbound and outbound electronic access is allowed between
the low impact BES Cyber System(s) and the Cyber Asset(s) outside the asset containing the low
impact BES Cyber System(s). When permitting the inbound and outbound electronic accesspermissions using access control lists, the Responsible Entity could restrict communication(s)using source and destination addresses or ranges of addresses. Responsible Entities could also
restrict communication(s) using ports or services based on the capability of the electronic
access control, the low impact BES Cyber System(s), or the application(s).

Routable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Low impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 1

Page 37 of 59

CIP-003-8 Supplemental Material
Reference Model 2 – Network-based Inbound & Outbound Access Permissions

The Responsible Entity may choose to use a security device that permits only necessary
inbound and outbound electronic access to the low impact BES Cyber System(s) within theasset containing the low impact BES Cyber System(s). In this example, two low impact BES
Cyber Systems are accessed using the routable protocol that is entering or leaving the asset
containing the low impact BES Cyber System(s). The IP/Serial converter is continuing the samecommunications session from the Cyber Asset(s) that are outside the asset to the low impact
BES Cyber System(s). The security device provides the electronic access controls to permit only
necessary inbound and outbound routable protocol access to the low impact BES Cyber
System(s). When permitting the inbound and outbound electronic access permissions using
access control lists, the Responsible Entity could restrict communication(s) using source anddestination addresses or ranges of addresses. Responsible Entities could also restrict
communication(s) using ports or services based on the capability of the electronic access
control, the low impact BES Cyber System(s), or the application(s).

Routable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Cyber Asset(s) providing electronic access controls

Network
Low impact
BES Cyber
System

IP/Serial
Converter

SerialNon-routable
ProtocolLow impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 2

Page 38 of 59

CIP-003-8 Supplemental Material
Reference Model 3 – Centralized Network-based Inbound & Outbound Access
Permissions

The Responsible Entity may choose to utilize a security device at a centralized location that may
or may not be at another asset containing low impact BES Cyber System(s). The electronic
access control(s) do not necessarily have to reside inside the asset containing the low impact
BES Cyber System(s). A security device is in place at “Location X” to act as the electronic access
control and permit only necessary inbound and outbound routable protocol access between
the low impact BES Cyber System(s) and the Cyber Asset(s) outside each asset containing low
impact BES Cyber System(s). Care should be taken that electronic access to or between each
asset is through the Cyber Asset(s) determined by the Responsible Entity to be performing
electronic access controls at the centralized location. When permitting the inbound andoutbound electronic access permissions using access control lists, the Responsible Entity could
restrict communication(s) using source and destination addresses or ranges of addresses.
Responsible Entities could also restrict communication(s) using ports or services based on thecapability of the electronic access control, the low impact BES Cyber System(s), or theapplication(s).
Firewall, Router Access Control List,
Gateway or Other Security Device(Cyber Asset(s) performing electronic
access controls)

Location X

Routable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Routable
ProtocolRoutable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Routable
Protocol`Non BES Cyber
Systsem

Network

Network

Low impact
BES Cyber
System

Low impact
BES Cyber
SystemNon BES Cyber
SystemAsset containing low impact BES Cyber System(s)Asset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 3

Page 39 of 59

CIP-003-8 Supplemental Material
Reference Model 4 – Uni-directional Gateway

The Responsible Entity may choose to utilize a uni-directional gateway as the electronic access
control. The low impact BES Cyber System(s) is not accessible (data cannot flow into the low
impact BES Cyber System) using the routable protocol entering the asset due to theimplementation of a “one-way” (uni-directional) path for data to flow. The uni-directional
gateway is configured to permit only the necessary outbound communications using theroutable protocol communication leaving the asset.

Routable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Uni-directional
Gateway(Cyber Asset(s) performing
electronic access controls

Low impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 4

Page 40 of 59

CIP-003-8 Supplemental Material
Reference Model 5 – User Authentication

This reference model demonstrates that Responsible Entities have flexibility in choosing
electronic access controls so long as the security objective of the requirement is met. The
Responsible Entity may choose to utilize a non-BES Cyber Asset located at the asset containing
the low impact BES Cyber System that requires authentication for communication from the
Cyber Asset(s) outside the asset. This non-BES Cyber System performing the authentication
permits only authenticated communication to connect to the low impact BES Cyber System(s),meeting the first half of the security objective to permit only necessary inbound electronic
access. Additionally, the non-BES Cyber System performing authentication is configured suchthat it permits only necessary outbound communication meeting the second half of the security
objective. Often, the outbound communications would be controlled in this networkarchitecture by permitting no communication to be initiated from the low impact BES Cyber
System. This configuration may be beneficial when the only communication to a device is foruser-initiated interactive access.
Routable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Non-BES Cyber System(Cyber Asset(s)performing electronic
access controls)

SerialNon-routable
ProtocolLow impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 5

Page 41 of 59

CIP-003-8 Supplemental Material
Reference Model 6 – Indirect Access

In implementing its electronic access controls, the Responsible Entity may identify that it has
indirect access between the low impact BES Cyber System and a Cyber Asset outside the asset
containing the low impact BES Cyber System through a non-BES Cyber Asset located within theasset. This indirect access meets the criteria of having communication between the low impact
BES Cyber System and a Cyber Asset outside the asset containing the low impact BES Cyber
System. In this reference model, it is intended that the Responsible Entity implement electronic
access controls that permit only necessary inbound and outbound electronic access to the low
impact BES Cyber System. Consistent with the other reference models provided, the electronic
access in this reference model is controlled using the security device that is restricting thecommunication that is entering or leaving the asset.
Routable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)Routable
ProtocolDMZ

Firewall, Router Access Control List,
Gateway or Other Security Device(Cyber Asset(s) performing electronic
access controls)
Network
Non-BES Cyber Asset

Low impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 6

Page 42 of 59

CIP-003-8 Supplemental Material
Reference Model 7 – Electronic Access Controls at assets containing low impact BES
Cyber Systems and ERC

In this reference model, there is both a routable protocol entering and leaving the asset
containing the low impact BES Cyber System(s) that is used by Cyber Asset(s) outside the asset
and External Routable Connectivity because there is at least one medium impact BES Cyber
System and one low impact BES Cyber System within the asset using the routable protocol
communications. The Responsible Entity may choose to leverage an interface on the medium
impact Electronic Access Control or Monitoring Systems (EACMS) to provide electronic access
controls for purposes of CIP-003. The EACMS is therefore performing multiple functions – as a
medium impact EACMS and as implementing electronic access controls for an asset containing
low impact BES Cyber Systems.
Routable
ProtocolRoutable communications
entering or leaving the asset
containing low impact BES
Cyber System(s)ERC
Network

EAP

ESPInterface
Firewall, Router Access Control List,
Gateway or Other Security Device(Cyber Asset(s) performing electronic
access control)

Medium impact
BES Cyber
System with ERC

Network

Non-BES Cyber
System

Low impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s) and medium impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 7

Page 43 of 59

CIP-003-8 Supplemental Material
Reference Model 8 – Physical Isolation and Serial Non-routable Communications –No Electronic Access Controls Required

In this reference model, the criteria from Attachment 1, Section 3.1 requiring theimplementation of electronic access controls are not met. This reference model demonstrates
three concepts:
1) The physical isolation of the low impact BES Cyber System(s) from the routable protocol
communication entering or leaving the asset containing the low impact BES Cyber
System(s), commonly referred to as an ‘air gap’, mitigates the need to implement therequired electronic access controls;2) The communication to the low impact BES Cyber System from a Cyber Asset outside theasset containing the low impact BES Cyber System(s) using only a serial non-routable
protocol where such communication is entering or leaving the asset mitigates the needto implement the required electronic access controls.
3) The routable protocol communication between the low impact BES Cyber System(s) andother Cyber Asset(s), such as the second low impact BES Cyber System depicted, may
exist without needing to implement the required electronic access controls so long as
the routable protocol communications never leaves the asset containing the low impact
BES Cyber System(s).

Page 44 of 59

CIP-003-8 Supplemental Material

No routable communicationentering or leaving the asset
containing low impact BES
Cyber System(s)Routable communicationentering or leaving the asset
containing low impact BES
Cyber System(s), but nocommunication between a
low impact BES Cyber System
and a Cyber Asset outside
the asset

Routable
ProtocolSerialNon-routable
ProtocolNon-BES Cyber Asset

Air Gap

Low impact
BES Cyber
SystemNon-BES Cyber Asset

Low impact
BES Cyber
SystemAsset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Non-BES Cyber Asset
Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 8

Page 45 of 59

CIP-003-8 Supplemental Material
Reference Model 9 – Logical Isolation - No Electronic Access Controls Required

In this reference model, the criteria from Attachment 1, Section 3.1 requiring theimplementation of electronic access controls are not met. The Responsible Entity has logicallyisolated the low impact BES Cyber System(s) from the routable protocol communicationentering or leaving the asset containing low impact BES Cyber System(s). The logical network
segmentation in this reference model permits no communication between a low impact BES
Cyber System and a Cyber Asset outside the asset. Additionally, no indirect access exists
because those non-BES Cyber Assets that are able to communicate outside the asset are strictly
prohibited from communicating to the low impact BES Cyber System(s). The low impact BES
Cyber System(s) is on an isolated network segment with logical controls preventing routable
protocol communication into or out of the network containing the low impact BES Cyber
System(s) and these communications never leave the asset using a routable protocol.

Page 46 of 59

CIP-003-8 Supplemental Material

No communication ispermitted between thecontrol network segment
and the non-control network
segment

Routable communicationentering or leaving the asset
containing low impact BES
Cyber System(s), but nocommunication between a
low impact BES Cyber System
and a Cyber Asset outside
the asset

Routable
ProtocolNetwork Device
with logical network segmentation(Cyber Asset(s) providing electronic access controls)

Low impact
BES Cyber
SystemNon-BES Cyber Asset

Low impact
BES Cyber
SystemControl Network Segment

Non-BES Cyber Asset
Non-Control Network Segment

Asset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 9

Page 47 of 59

CIP-003-8 Supplemental Material
Reference Model 10 - Serial Non-routable Communications Traversing an Isolated
Channel on a Non-routable Transport Network – No Electronic Access Controls
RequiredIn this reference model, the criteria from Attachment 1, Section 3.1 requiring theimplementation of electronic access controls are not met. This reference model depicts
communication between a low impact BES Cyber System and a Cyber Asset outside the asset
containing the low impact BES Cyber System over a serial non-routable protocol which istransported across a wide-area network using a protocol independent transport that may carryroutable and non-routable communication such as a Time-Division Multiplexing (TDM) network,a Synchronous Optical Network (SONET), or a Multiprotocol Label Switching (MPLS) network.
While there is routable protocol communication entering or leaving the asset containing low
impact BES Cyber Systems(s) and there is communication between a low impact BES Cyber
System and a Cyber Asset outside the asset, the communication between the low impact BES
Cyber System and the Cyber Asset outside the asset is not using the routable protocol
communication. This model is related to Reference Model 9 in that it relies on logical isolation
to prohibit the communication between a low impact BES Cyber System and a Cyber Assetoutside the asset from using a routable protocol.

Page 48 of 59

CIP-003-8 Supplemental Material

SerialNon-routable
ProtocolChannelRoutable
ProtocolChannelRoutable communicationentering or leaving the asset
containing low impact BES
Cyber System(s)ProtocolIndependent
Transport

No communication ispermitted between the serial
non-routable protocol
network and the routable
protocol network

FA IL

FA IL

ACTIV E

FA IL

FA IL

ACTIV ECP U

ACTIV E

ACTIV ESE RIA L

DC-34
(S M)

DC-3

ETHERNET
1

2

LOS

LOS

TX

TX

CONS OLE

3

4

5

6

LOS

LOAD

KE Y

TX

Laser hazard

Non-BES Cyber Asset
Network

Low impact
BES Cyber
SystemSerialNon-routable
ProtocolNon-BES Cyber Asset

Asset containing low impact BES Cyber System(s)Non-routable Protocol

Routable Protocol

Communication between a
low impact BES Cyber System anda Cyber Asset outside the asset

Reference Model 10

Page 49 of 59

CIP-003-8 Supplemental Material
Dial-up Connectivity

Dial-up Connectivity to a low impact BES Cyber System is set to dial out only (no auto-answer)
to a preprogrammed number to deliver data. Incoming Dial-up Connectivity is to a dialback
modem, a modem that must be remotely controlled by the control center or control room, hassome form of access control, or the low impact BES Cyber System has access control.
Insufficient Access Controls

Some examples of situations that would lack sufficient access controls to meet the intent of thisrequirement include:•

An asset has Dial-up Connectivity and a low impact BES Cyber System is reachable via an
auto-answer modem that connects any caller to the Cyber Asset that has a default
password. There is no practical access control in this instance.

•

A low impact BES Cyber System has a wireless card on a public carrier that allows the
BES Cyber System to be reachable via a public IP address. In essence, low impact BES
Cyber Systems should not be accessible from the Internet and search engines such as
Shodan.

•Dual-homing or multiple-network interface cards without disabling IP forwarding in the
non-BES Cyber Asset within the DMZ to provide separation between the low impact BES
Cyber System(s) and the external network would not meet the intent of “controlling”
inbound and outbound electronic access assuming there was no other host-based
firewall or other security devices on the non-BES Cyber Asset.

Requirement R2, Attachment 1, Section 4 – Cyber Security Incident Response

The entity should have one or more documented Cyber Security Incident response plan(s) that
include each of the topics listed in Section 4. If, in the normal course of business, suspicious
activities are noted at an asset containing low impact BES Cyber System(s), the intent is for theentity to implement a Cyber Security Incident response plan that will guide the entity inresponding to the incident and reporting the incident if it rises to the level of a Reportable
Cyber Security Incident.
Entities are provided the flexibility to develop their Attachment 1, Section 4 Cyber Security
Incident response plan(s) by asset or group of assets. The plans do not need to be on a per
asset site or per low impact BES Cyber System basis. Entities can choose to use a single
enterprise-wide plan to fulfill the obligations for low impact BES Cyber Systems.
The plan(s) must be tested once every 36 months. This is not an exercise per low impact BES
Cyber Asset or per type of BES Cyber Asset but rather is an exercise of each incident response
plan the entity created to meet this requirement. An actual Reportable Cyber Security Incident
counts as an exercise as do other forms of tabletop exercises or drills. NERC-led exercises suchas GridEx participation would also count as an exercise provided the entity’s response plan isfollowed. The intent of the requirement is for entities to keep the Cyber Security Incident
response plan(s) current, which includes updating the plan(s), if needed, within 180 days
following a test or an actual incident.
For low impact BES Cyber Systems, the only portion of the definition of Cyber Security Incident
that would apply is‚ “A malicious act or suspicious event that disrupts, or was an attempt toPage 50 of 59

CIP-003-8 Supplemental Material
disrupt, the operation of a BES Cyber System.” The other portion of that definition is not to be
used to require ESPs and PSPs for low impact BES Cyber Systems.
Requirement R2, Attachment 1, Section 5 – Transient Cyber Assets and Removable
Media Malicious Code Risk Mitigation

Most BES Cyber Assets and BES Cyber Systems are isolated from external public or untrusted
networks, and therefore Transient Cyber Assets and Removable Media are needed to transport
files to and from secure areas to maintain, monitor, or troubleshoot critical systems. Transient
Cyber Assets and Removable Media are a potential means for cyber-attack. To protect the BES
Cyber Assets and BES Cyber Systems, CIP-003 Requirement R2, Attachment 1, Section 5
requires Responsible Entities to document and implement a plan for how they will mitigate therisk of malicious code introduction to low impact BES Cyber Systems from Transient Cyber
Assets and Removable Media. The approach of defining a plan allows the Responsible Entity to
document processes that are supportable within its organization and in alignment with its
change management processes.
Transient Cyber Assets can be one of many types of devices from a specially-designed device formaintaining equipment in support of the BES to a platform such as a laptop, desktop, or tablet
that may interface with or run applications that support BES Cyber Systems and is capable oftransmitting executable code to the BES Cyber Asset(s) or BES Cyber System(s). Note: Cyber
Assets connected to a BES Cyber System for less than 30 days due to an unplanned removal,such as premature failure, are not intended to be identified as Transient Cyber Assets.
Removable Media subject to this requirement include, among others, floppy disks, compact
disks, USB flash drives, external hard drives, and other flash memory cards/drives that containnonvolatile memory.
Examples of these temporarily connected devices include, but are not limited to:•

Diagnostic test equipment;•

Equipment used for BES Cyber System maintenance; or•Equipment used for BES Cyber System configuration.

To meet the objective of mitigating risks associated with the introduction of malicious code at
low impact BES Cyber Systems, Section 5 specifies the capabilities and possible security
methods available to Responsible Entities based upon asset type and ownership.
With the list of options provided in Attachment 1, the entity has the discretion to use theoption(s) that is most appropriate. This includes documenting its approach for how and whenthe entity reviews the Transient Cyber Asset under its control or under the control of parties
other than the Responsible Entity. The entity should avoid implementing a security functionthat jeopardizes reliability by taking actions that would negatively impact the performance or
support of the Transient Cyber Asset or BES Cyber Asset.

Page 51 of 59

CIP-003-8 Supplemental Material
Malicious Code Risk Mitigation
The terms “mitigate”, “mitigating”, and “mitigation” are used in Section 5 in Attachment 1 toaddress the risks posed by malicious code when connecting Transient Cyber Assets andRemovable Media to BES Cyber Systems. Mitigation is intended to mean that entities reduce
security risks presented by connecting the Transient Cyber Asset or Removable Media. When
determining the method(s) to mitigate the introduction of malicious code, it is not intended forentities to perform and document a formal risk assessment associated with the introduction ofmalicious code.
Per Transient Cyber Asset Capability
As with other CIP standards, the requirements are intended for an entity to use the method(s)that the system is capable of performing. The use of “per Transient Cyber Asset capability” is toeliminate the need for a Technical Feasibility Exception when it is understood that the device
cannot use a method(s). For example, for malicious code, many types of appliances are notcapable of implementing antivirus software; therefore, because it is not a capability of those
types of devices, implementation of the antivirus software would not be required for thosedevices.
Requirement R2, Attachment 1, Section 5.1 - Transient Cyber Asset(s) Managed by
the Responsible Entity

For Transient Cyber Assets and Removable Media that are connected to both low impact andmedium/high impact BES Cyber Systems, entities must be aware of the differing levels of
requirements and manage these assets under the program that matches the highest impact
level to which they will connect.

Section 5.1: Entities are to document and implement their plan(s) to mitigate malicious code
through the use of one or more of the protective measures listed, based on the capability of theTransient Cyber Asset.
The Responsible Entity has the flexibility to apply the selected method(s) to meet the objectiveof mitigating the introductions of malicious code either in an on-going or in an on-demandmanner. An example of managing a device in an on-going manner is having the antivirus
solution for the device managed as part of an end-point security solution with current signatureor pattern updates, regularly scheduled systems scans, etc. In contrast, for devices that areused infrequently and the signatures or patterns are not kept current, the entity may manage
those devices in an on-demand manner by requiring an update to the signatures or patterns
and a scan of the device before the device is connected to ensure that it is free of malicious
code.
Selecting management in an on-going or on-demand manner is not intended to imply that thecontrol has to be verified at every single connection. For example, if the device is managed in
an on-demand manner, but will be used to perform maintenance on several BES Cyber Asset(s),the Responsible Entity may choose to document that the Transient Cyber Asset has been
updated before being connected as a Transient Cyber Asset for the first use of thatmaintenance work. The intent is not to require a log documenting each connection of aTransient Cyber Asset to a BES Cyber Asset.

Page 52 of 59

CIP-003-8 Supplemental Material
The following is additional discussion of the methods to mitigate the introduction of malicious
code.
•

Antivirus software, including manual or managed updates of signatures or patterns,
provides flexibility to manage Transient Cyber Asset(s) by deploying antivirus or
endpoint security tools that maintain a scheduled update of the signatures or patterns.
Also, for devices that do not regularly connect to receive scheduled updates, entities
may choose to update the signatures or patterns and scan the Transient Cyber Assetprior to connection to ensure no malicious software is present.

•

Application whitelisting is a method of authorizing only the applications and processes
that are necessary on the Transient Cyber Asset. This reduces the risk that malicious
software could execute on the Transient Cyber Asset and impact the BES Cyber Asset or
BES Cyber System.

•

When using methods other than those listed, entities need to document how the othermethod(s) meet the objective of mitigating the risk of the introduction of malicious
code.

If malicious code is discovered on the Transient Cyber Asset, it must be mitigated prior toconnection to a BES Cyber System to prevent the malicious code from being introduced into the
BES Cyber System. An entity may choose to not connect the Transient Cyber Asset to a BES
Cyber System to prevent the malicious code from being introduced into the BES Cyber System.
Entities should also consider whether the detected malicious code is a Cyber Security Incident.
Requirement R2, Attachment 1, Section 5.2 - Transient Cyber Asset(s) Managed by a
Party Other than the Responsible Entity

Section 5 also recognizes the lack of direct control over Transient Cyber Assets that aremanaged by parties other than the Responsible Entity. This lack of control, however, does not
obviate the Responsible Entity’s responsibility to ensure that methods have been deployed tomitigate the introduction of malicious code to low impact BES Cyber System(s) from Transient
Cyber Assets it does not manage. Section 5 requires entities to review the other party’s security
practices with respect to Transient Cyber Assets to help meet the objective of the requirement.
The use of “prior to connecting the Transient Cyber Assets” is intended to ensure that the
Responsible Entity conducts the review before the first connection of the Transient Cyber Assetto help meet the objective to mitigate the introduction of malicious code. The SDT does notintend for the Responsible Entity to conduct a review for every single connection of that
Transient Cyber Asset once the Responsible Entity has established the Transient Cyber Asset ismeeting the security objective. The intent is to not require a log documenting each connectionof a Transient Cyber Asset to a BES Cyber Asset.
To facilitate these controls, Responsible Entities may execute agreements with other parties toprovide support services to BES Cyber Systems and BES Cyber Assets that may involve the useof Transient Cyber Assets. Entities may consider using the Department of Energy Cybersecurity
Procurement Language for Energy Delivery dated April 2014. 1 Procurement language may unify
1 http://www.energy.gov/oe/downloads/cybersecurity-procurement-language-energy-delivery-april-2014

Page 53 of 59

CIP-003-8 Supplemental Material
the other party and entity actions supporting the BES Cyber Systems and BES Cyber Assets. CIP
program attributes may be considered including roles and responsibilities, access controls,monitoring, logging, vulnerability, and patch management along with incident response andback up recovery may be part of the other party’s support. Entities may consider the “General
Cybersecurity Procurement Language” and “The Supplier’s Life Cycle Security Program” whendrafting Master Service Agreements, Contracts, and the CIP program processes and controls.
Section 5.2.1: Entities are to document and implement their process(es) to mitigate theintroduction of malicious code through the use of one or more of the protective measureslisted.
•Review the use of antivirus software and signature or pattern levels to ensure that thelevel is adequate to the Responsible Entity to mitigate the risk of malicious software
being introduced to an applicable system.

•

Review the antivirus or endpoint security processes of the other party to ensure that
their processes are adequate to the Responsible Entity to mitigate the risk of
introducing malicious software to an applicable system.

•

Review the use of application whitelisting used by the other party to mitigate the risk of
introducing malicious software to an applicable system.

•

Review the use of live operating systems or software executable only from read-only
media to ensure that the media is free from malicious software itself. Entities should
review the processes to build the read-only media as well as the media itself.

•

Review system hardening practices used by the other party to ensure that unnecessary
ports, services, applications, etc. have been disabled or removed. This method intends
to reduce the attack surface on the Transient Cyber Asset and reduce the avenues bywhich malicious software could be introduced.

Section 5.2.2: The intent of this section is to ensure that after conducting the selected review
from Section 5.2.1, if there are deficiencies identified, actions mitigating the risk of theintroduction of malicious code to low impact BES Cyber Systems must be completed prior toconnecting the device(s) to an applicable system.
Requirement R2, Attachment 1, Section 5.3 - Removable Media

Entities have a high level of control for Removable Media that are going to be connected totheir BES Cyber Assets.
Section 5.3: Entities are to document and implement their process(es) to mitigate theintroduction of malicious code through the use of one or more method(s) to detect malicious
code on the Removable Media before it is connected to a BES Cyber Asset. When using themethod(s) to detect malicious code, it is expected to occur from a system that is not part of the
BES Cyber System to reduce the risk of propagating malicious code into the BES Cyber System

Page 54 of 59

CIP-003-8 Supplemental Material
network or onto one of the BES Cyber Assets. If malicious code is discovered, it must be
removed or mitigated to prevent it from being introduced into the BES Cyber Asset or BES
Cyber System. Entities should also consider whether the detected malicious code is a Cyber
Security Incident. Frequency and timing of the methods used to detect malicious code wereintentionally excluded from the requirement because there are multiple timing scenarios thatcan be incorporated into a plan to mitigate the risk of malicious code. The SDT does not intend
to obligate a Responsible Entity to conduct a review for every single connection of Removable
Media, but rather to implement its plan(s) in a manner that protects all BES Cyber Systems
where Removable Media may be used. The intent is to not require a log documenting eachconnection of Removable Media to a BES Cyber Asset.
As a method to detect malicious code, entities may choose to use Removable Media with onboard malicious code detection tools. For these tools, the Removable Media are still used inconjunction with a Cyber Asset to perform the detection. For Section 5.3.1, the Cyber Asset
used to perform the malicious code detection must be outside of the BES Cyber System.
Requirement R3:

The intent of CIP-003-8, Requirement R3 is effectively unchanged since prior versions of thestandard. The specific description of the CIP Senior Manager has now been included as adefined term rather than clarified in the Reliability Standard itself to prevent any unnecessary
cross-reference to this standard. It is expected that the CIP Senior Manager will play a key rolein ensuring proper strategic planning, executive/board-level awareness, and overall program
governance.
Requirement R4:

As indicated in the rationale for CIP-003-8, Requirement R4, this requirement is intended todemonstrate a clear line of authority and ownership for security matters. The intent of the SDT
was not to impose any particular organizational structure, but, rather, the intent is to afford the
Responsible Entity significant flexibility to adapt this requirement to its existing organizational
structure. A Responsible Entity may satisfy this requirement through a single delegation
document or through multiple delegation documents. The Responsible Entity can make use of
the delegation of the delegation authority itself to increase the flexibility in how this applies to
its organization. In such a case, delegations may exist in numerous documentation records aslong as the collection of these documentation records shows a clear line of authority back to
the CIP Senior Manager. In addition, the CIP Senior Manager could also choose not to delegate
any authority and meet this requirement without such delegation documentation.
The Responsible Entity must keep its documentation of the CIP Senior Manager and any
delegations up-to-date. This is to ensure that individuals do not assume any undocumented
authority. However, delegations do not have to be re-instated if the individual who delegated
the task changes roles or the individual is replaced. For instance, assume that John Doe isnamed the CIP Senior Manager and he delegates a specific task to the Substation MaintenanceManager. If John Doe is replaced as the CIP Senior Manager, the CIP Senior Manager
documentation must be updated within the specified timeframe, but the existing delegation to

Page 55 of 59

CIP-003-8 Supplemental Material
the Substation Maintenance Manager remains in effect as approved by the previous CIP Senior
Manager, John Doe.

Page 56 of 59

CIP-003-8 Supplemental Material
Rationale:

During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:

One or more security policies enable effective implementation of the requirements of the cybersecurity Reliability Standards. The purpose of policies is to provide a management andgovernance foundation for all requirements that apply to a Responsible Entity’s BES Cyber
Systems. The Responsible Entity can demonstrate through its policies that its management
supports the accountability and responsibility necessary for effective implementation of therequirements.
Annual review and approval of the cyber security policies ensures that the policies are kept-upto-date and periodically reaffirms management’s commitment to the protection of its BES
Cyber Systems.
Rationale for Requirement R2:

In response to FERC Order No. 791, Requirement R2 requires entities to develop and implement
cyber security plans to meet specific security control objectives for assets containing low impact
BES Cyber System(s). The cyber security plan(s) covers five subject matter areas: (1) cybersecurity awareness; (2) physical security controls; (3) electronic access controls; (4) Cyber
Security Incident response; and (5) Transient Cyber Asset and Removable Media Malicious CodeRisk Mitigation. This plan(s), along with the cyber security policies required under Requirement
R1, Part 1.2, provides a framework for operational, procedural, and technical safeguards for low
impact BES Cyber Systems.
Considering the varied types of low impact BES Cyber Systems across the BES, Attachment 1
provides Responsible Entities flexibility on how to apply the security controls to meet the
security objectives. Additionally, because many Responsible Entities have multiple-impact rated
BES Cyber Systems, nothing in the requirement prohibits entities from using their high andmedium impact BES Cyber System policies, procedures, and processes to implement security
controls required for low impact BES Cyber Systems, as detailed in Requirement R2,
Attachment 1.
Responsible Entities will use their identified assets containing low impact BES Cyber System(s)(developed pursuant to CIP-002) to substantiate the sites or locations associated with low
impact BES Cyber System(s). However, there is no requirement or compliance expectation for
Responsible Entities to maintain a list(s) of individual low impact BES Cyber System(s) and theirassociated cyber assets or to maintain a list of authorized users.
Rationale for Modifications to Sections 2 and 3 of Attachment 1 (Requirement R2):
Requirement R2 mandates that entities develop and implement one or more cyber security
plan(s) to meet specific security objectives for assets containing low impact BES Cyber
System(s). In Paragraph 73 of FERC Order No. 822, the Commission directed NERC to modify“…the Low Impact External Routable Connectivity definition to reflect the commentary in the
Guidelines and Technical Basis section of CIP-003-6…to provide needed clarity to the definition

Page 57 of 59

CIP-003-8 Supplemental Material
and eliminate ambiguity surrounding the term ‘direct’ as it is used in the proposed
definition…within one year of the effective date of this Final Rule.”
The revisions to Section 3 incorporate select language from the LERC definition into Attachment
1 and focus the requirement on implementing electronic access controls for asset(s) containing
low impact BES Cyber System(s). This change requires the Responsible Entity to permit only
necessary inbound and outbound electronic access when using a routable protocol entering or
leaving the asset between low impact BES Cyber System(s) and a Cyber Asset(s) outside theasset containing low impact BES Cyber system(s). When this communication is present,
Responsible Entities are required to implement electronic access controls unless that
communication meets the following exclusion language (previously in the definition of LERC)
contained in romanette (iii): “not used for time-sensitive protection or control functions
between intelligent electronic devices (e.g. communications using protocol IEC TR-61850-90-5
R-GOOSE)”.
The revisions to Section 2 of Attachment 1 complement the revisions to Section 3;
consequently, the requirement now mandates the Responsible Entity control physical access to“the Cyber Asset(s), as specified by the Responsible Entity, that provide electronic access
control(s) implemented for Section 3.1, if any.” The focus on electronic access controls rather
than on the Low Impact BES Cyber System Electronic Access Points (LEAPs) eliminates the needfor LEAPs.
Given these revisions to Sections 2 and 3, the NERC Glossary terms: Low Impact External
Routable Connectivity (LERC) and Low Impact BES Cyber System Electronic Access Point (LEAP)
will be retired.
Rationale for Section 5 of Attachment 1 (Requirement R2):
Requirement R2 mandates that entities develop and implement one or more cyber security
plan(s) to meet specific security objectives for assets containing low impact BES Cyber
System(s). In Paragraph 32 of FERC Order No. 822, the Commission directed NERC to “…provide
mandatory protection for transient devices used at Low Impact BES Cyber Systems based on
the risk posed to bulk electric system reliability.” Transient devices are potential vehicles for
introducing malicious code into low impact BES Cyber Systems. Section 5 of Attachment 1 isintended to mitigate the risk of malware propagation to the BES through low impact BES Cyber
Systems by requiring entities to develop and implement one or more plan(s) to address the risk.
The cyber security plan(s) along with the cyber security policies required under Requirement
R1, Part 1.2, provide a framework for operational, procedural, and technical safeguards for low
impact BES Cyber Systems.
Rationale for Requirement R3:

The identification and documentation of the single CIP Senior Manager ensures that there isclear authority and ownership for the CIP program within an organization, as called for inBlackout Report Recommendation 43. The language that identifies CIP Senior Manager
responsibilities is included in the Glossary of Terms used in NERC Reliability Standards so that it
may be used across the body of CIP standards without an explicit cross-reference.

Page 58 of 59

CIP-003-8 Supplemental Material
FERC Order No. 706, Paragraph 296, requests consideration of whether the single senior
manager should be a corporate officer or equivalent. As implicated through the defined term,
the senior manager has “the overall authority and responsibility for leading and managing
implementation of the requirements within this set of standards” which ensures that the senior
manager is of sufficient position in the Responsible Entity to ensure that cyber security receives
the prominence that is necessary. In addition, given the range of business models forresponsible entities, from municipal, cooperative, federal agencies, investor owned utilities,
privately owned utilities, and everything in between, the SDT believes that requiring the CIP
Senior Manager to be a “corporate officer or equivalent” would be extremely difficult tointerpret and enforce on a consistent basis.
Rationale for Requirement R4:

The intent of the requirement is to ensure clear accountability within an organization forcertain security matters. It also ensures that delegations are kept up-to-date and that
individuals do not assume undocumented authority.
In FERC Order No. 706, Paragraphs 379 and 381, the Commission notes that Recommendation
43 of the 2003 Blackout Report calls for “clear lines of authority and ownership for security
matters.” With this in mind, the Standard Drafting Team has sought to provide clarity in therequirement for delegations so that this line of authority is clear and apparent from the
documented delegations.

Page 59 of 59