WHITE PAPER (TRIPWIRE)

Achieving Resilience While
Fulfilling NERC CIP Requirements
Compliance and Beyond with Tripwire

Fortra White Paper

Achieving Resilience While Fulfilling NERC CIP Requirements

Some of our nation’s most critical physical infrastructure

Similar trade-offs occur on the part of those providing

is represented by the national Bulk Electric Systems (BES).

oversight, seeking effective supervision without onerous

Today’s digital world relies upon this interconnected network

micromanagement. Optimally, participants in the BES seekof power generation and transmission systems morenot to simply comply with the rules by doing the minimum

than ever. To ensure the reliability and resilience of thatnecessary but rather to operate a safe and reliablenetwork, providers must continually manage threats to thesystem in light of both requirements and cost constraints.

infrastructure, including many that relate to cybersecurity.

Such a system meets the needs of customers and other

Meanwhile, providers must also continuously manage

stakeholders while also complying with industry standards

costs and other resources to meet customer demands andof practice.

maintain reasonable utility rates for customers.
To keep the lights on, regional power providers have beencollaborating and interoperating for almost a century. This
cooperation introduces dependencies and heightens theneed for consistent standards of practice. Each member
has a responsibility to the joint network to follow thosepractices, thus supporting the safety and reliability of theentire system. Imbalance or failure in the system can havea devastating impact, as shown by the 2021 Texas power
outages that impacted at least 4.5 million customers. Since
1968, the North American Electric Reliability Corporation(NERC)1 has played an important part in governing resilience
standards and practices for the network.
Risk management is a continual balance among benefits,risks, and resources. Convenient electrical power brings
many benefits, but, of course, such power isn’t free. In
addition to the direct cost of generating and distributing
power, providers must also account for various risks—fromtree limbs to vandalism to cybersecurity attacks—that might
jeopardize the availability of those functions. Providers anddistributors continually work together, applying practicalcritical infrastructure protection from an evolving set of
threats and vulnerabilities, natural and man-made.
Like that changing risk landscape, the methods forresponding to that risk must continually evolve. Throughout
the 21st century, NERC has coordinated that response
through a set of reliability standards known as theCritical Infrastructure Protection (CIP) standards. These
requirements demand a constant review of the riskbalance described above. Providers know that personnel,processes, and technology are needed to manage risks;
they also understand that market demands (and utility ratepressure) limit the resources available for risk management.

Fortra.com

Challenges of Meeting NERC CIP
Requirements
NERC CIP includes 13 cybersecurity and physicalinfrastructure security standards, comprised of 44
management, administrative, and technical controls.
Meeting this broad set of requirements is crucial yet
challenging, especially with limited resources. In fact, attimes, just documenting and explaining compliance candraw resources away from other activities, including risk
management operations.
Other challenges include:• Manual processes are insufficient for meeting NERC
CIP baselines. Human solutions can’t keep pace withtoday’s high-speed digital environments. Manual
procedures (unsupported by automated tools andprocesses) can be prone to errors.
• Difficulty staying current with changes to thestandards based on evolving risk landscape. CIP
processes change over time—each revision of the NERC
CIP standard expands the scope of critical assets andthe technical requirements to secure them.
• Difficulty understanding requirements. Clarity ofstandards has improved over time, but it can bechallenging to understand specific complianceneeds, expectations of each auditor, and means
to demonstrate fulfillment. Providers specialize inenergy production, not security risk management, andsometimes find it difficult to understand and achieve
what’s expected.
• Challenges of securing a geographically dispersed
BES infrastructure. Many providers have hundreds ofsystems spread across broad regions, with many thatPage 2

Fortra White Paper

are often located in difficult terrain. Such a systemdepends upon sensors and interfaces for continual
reporting, and those sensors represent both potential
failure points and attack surfaces.
• Difficulty maintaining situational awareness of a broad

Achieving Resilience While Fulfilling NERC CIP Requirements

Proven Automation Solutions Drive
Reliability and Compliance

Tripwire’s proven automation solutions ensure effective
continuous cybersecurity monitoring and CIP compliance.
Human-based protection, detection, and responseand varying set of cyber assets. Manually collected dataprocesses are error-prone and often less efficient than

may be insufficient or out of date, a challenge that isautomated methods. Automation is a force multiplier,accentuated by the many types of platforms that enable,consistently performing routine tasks and freeing valuablecontrol, and monitor this critical infrastructure. Out-of-personnel to focus their attention on enterprise priorities.

date and inaccurate inventory and security posture
information often leads to negative audit findings.
• Change management challenges hinder protection,

Tripwire has been meeting the mission-critical network
infrastructure needs of industrial enterprises for decades.
Tripwire builds on this history with more than 25 years as adetection, and response activity. Even the mostleader in cybersecurity. These solutions help you accomplish

comprehensive documentation and compliance acrosscritical tasks such as:

the full breadth of the organization must be continually
updated for new/replacement assets, locations,facilities, and technologies.
While these challenges can be daunting, the need forcost-effective risk management has never been greater.
Nation-state attacks on the Ukrainian power system, aterrorist attack on a Pacific Gas and Electric substation, andeven a recent issue at a municipal water treatment plant in
Florida all highlight the heightened need for vigilance andpreparedness.2 And this mounting pressure occurs at a time
when providers are faced with increasingly limited personnel
and resources.

A Cost-Effective Solution for Resilience
and Compliance

For nearly ten years, Fortra’s Tripwire NERC CIP Solution Suite
has been enabling a risk-based approach for hundreds ofmembers of the North American bulk power system. Our
engineers stay current about changes to both technology
and standards, helping you stay continually compliant
and resilient. That ongoing intelligence enables Tripwire’s
automation solution—keeping you current about changes
to industry practices, updates to NERC CIP policies, andmethods to efficiently apply new controls to new asset
classes when needed. These proven products are backed
by the expertise of Tripwire’s professional services, skilled
practitioners who help you apply the proper controls,
generate the appropriate documentation, and meetdemanding deadlines for changing regulations.

Fortra.com

Identifying and Managing Cyber Assets

For both network defense and compliance, your teamneeds to be continually aware of what’s on the network—
confirming availability of trusted devices, ensuring thatcritical cyber assets haven’t gone missing, and verifyingthat rogue devices have not appeared on the scene.
That challenge is amplified for those in the energy sector
where assets include industrial control system (ICS)
technology. Tripwire brings extensive ICS experience toenable continuous discovery, threat monitoring, and realtime change management on a broad array of SCADA(Supervisory Control and Data Acquisition) components,
Human-Machine Interface (HMI) systems, Remote Terminal
Units (RTUs), and Programmable Logic Controllers (PLCs).
Industrial operators count on Tripwire to decipher over 40of the most common industrial communication protocols—
more than any other ICS visibility solution.

Managing Security Configuration Management
Change and file integrity monitoring (FIM) are Tripwire’s

DNA. We help you continually monitor for anomalies andchanges that might be suspicious (or that might lead to
non-compliance) and provide alerts and other actions
so that you can rapidly respond. For example, Tripwire®
Enterprise is trusted by thousands of organizations toprovide sophisticated security configuration management(SCM) and FIM. The only constant in cybersecurity is change,and Tripwire has been the proven leader in security change
management since 1997.

Page 3Fortra White Paper

Documenting Ports and Services

CIP requires that your organization be able to record, track,and justify every one of the hundreds of ports, protocols,and services on your hosts and traversing your networks.
Auditors tell us this is one of the biggest challenges theysee in the field, so Tripwire provides the tools to provide theevidence you need and the confidence your managers
expect. Those same tools provide a proactive approachthrough detailed “allow lists” of ports, services, users,
applications, and other elements, enabling your security
managers to decide what’s permitted on your platforms.
Our profiler continuously monitors these characteristics andimmediately detects anomalies, providing detailed reporting
about unauthorized changes.

Continuous Monitoring and Incident Response

Achieving Resilience While Fulfilling NERC CIP Requirements

Proven Success for Internal Reviews
and External Audits
One of the most critical questions that our customers

are asked is, “You claim to have effective processes andprocedures for managing cybersecurity risk and NERC CIP
compliance, but how do you know?” Not knowing can becostly. Violations of CIP Reliability Standards can result insignificant penalties; some have said as much as $1 million
per day. Yet, like many standards, the broad applicabilityof CIP requirements means that the standards are nonspecific about exactly how to comply and exactly how todemonstrate conformance.
The road to accountability and performance can be toughto find, but Tripwire’s solutions provide a clear pathway forcustomer success. Auditors and regulators trust Tripwire’sCIP requirements demand sophisticated security event

automation, baselines, and reports. They recognize thatmonitoring, configuration monitoring, vulnerability

the NERC CIP Solution Suite covers 23 of NERC CIP’s 44

assessment, and log review. These same processes arerequirements. While every audit is subject to the findings offoundational to vigilant network defense. Tripwire provides

individual reviewers, Tripwire’s engineers understand what

holistic visibility that continuously collects and reports what’ssuch auditors have previously expected to see, how they

happening throughout your critical information technology

expect it to be documented, and how to use Tripwire’s built-in(IT) and operational technology (OT) infrastructures. In

system understanding to support evidence and conformance.

addition to real-time collection to detect and respondto suspicious activities, Tripwire provides an integrated
workflow to respond to events of interest. Whether bycreating a work ticket, sending a notification email, or
running a command, Tripwire’s solutions work together toboth support real-time security situational awareness andeffective service management to prioritize and addresschanges and vulnerabilities.

Tripwire’s suite brings relevant information together toproduce reports that are directly aligned with updated
requirements. Consider CIP-007, Cyber Security – Systems
Security Management, which includes a requirementthat only necessary ports and services may be enabled
on applicable assets. Tripwire Enterprise provides adetailed report, by asset, that lists each port or service
discovered, the justification for each, and date/timestamp

Trusted Advisors Enable Trustworthy andCompliant Infrastructure

information for the discovery. The report also lists any

Automation itself will not fulfill the objectives, but is very

immediate follow-up. This example of audit-ready evidence

powerful when combined with our NERC CIP-specific rulesets,

illustrates that Tripwire’s suite helps an entity stay vigilant

templates, custom reports, dashboards, and utility extensions.

against adversaries and remain prepared to demonstrate

We understand best practices for BES providers—as wecompliance with the reliability standards.

bring the experience of hundreds of practitioners to help you

Another control that is frequently flagged by auditors is CIP-comply, we learn from our discussions with auditors. As welearn, we pass that intelligence along through our baselines,product updates, and professional services.

ports that have changed or lack justification, enabling

010, Configuration Change Management and Vulnerability
Assessments. Compliance with these requirements includes
the need for asset management, understanding of baseline
configuration for each Cyber Asset, and documentation ofchanges to the baseline. Each CIP requirement has specific

Fortra.com

Page 4

Fortra White Paper

Achieving Resilience While Fulfilling NERC CIP Requirements

and stringent evidentiary criteria—evidence that Tripwire hasbuilt into Tripwire Enterprise’s comprehensive reports thatreviewers have come to know and trust.

Beyond Compliance:
Secure, Reliable, Resilient Systems

While compliance with mandatory requirements, such as

While CIP compliance is critical, Tripwire Enterprise also

those in NERC CIP, is crucial, the safety and reliability of anallows you to conform, without additional burden, with aentity’s information and technology are paramount. The

broad array of other standards. The same out-of-the-box

Tripwire NERC CIP Solution Suite provides enterprise security

solution applies Tripwire Enterprise’s intelligence to reportstaff with continual awareness of what’s on the networks:

enterprise alignment with guidelines from the National

what assets are expected to be reporting, which might be

Institute of Standards and Technology (NIST) guidelines andmissing, and what activity is suspicious.  

with controls such as those from Center for Internet Security(CIS), Sarbanes-Oxley (SOX), and Payment Card Industry
Data Security Standard (PCI DSS). Flexible reports based on
automated evidence collection enable the entity to always
be ready to prove compliance, whether for the boardroom,
internal audit, or an external regulator.

Our host-based intrusion detection and continuous
monitoring/system hardening reports quickly highlightchanges and help separate the good changes from thebad changes. Tripwire’s correlation engines apply the MITRE
ATT&CK framework to provide context to observations,
helping operators quickly recognize adversaries’ tactics,

Tripwire’s professional services staff are experts in NERC

techniques, and procedures (TTPs). Many advisories,

CIP compliance and can help apply the proper controls,

such as those from the FBI and the U.S. CISA (an entity ofgenerate appropriate documentation, and meet demanding

the Department of Homeland Security), often use ATT&CK

deadlines for changing regulations. Tripwire’s reliablereferences to provide warnings or after-action analysis, so thisautomated tools and experienced professionals combine

Tripwire correlation helps providers put such alerts in context.

to help you stay prepared to defend against skilled cyberadversaries while always ready for compliance reviews.

TRIPWIRE COVERAGE OF NERC CIP REQUIREMENTS
13 Standards & 44 Requirements – Tripwire Covers 23

CIP-002

CIP-003

CIP-004

CIP-005

CIP-006

CIP-007

CIP-008

CIP-011

CIP-012

CIP-013

CIP-014BES Cyber
SystemIdentification
andCategorization

Security
Management
Controls

Training andPersonnel
Security

Electronic
Security
Perimeter

PhysicalSecurity of BES
Cyber Systems

Systems
Security
Management

Incident
Recovery Plans Configuration
Reportingfor BES Cyber
Changeand Response
Systems
Management
Planning
andVulnerability
Assessments

Information
Protection

Control Center
Communication Network

Supply Chain
Management

PhysicalSecurity1

BES Cyber
SystemIdentification

Cyber Security Awareness
Policy for High/
MediumSystems

Electronic
Security
Perimeter

PhysicalSecurity Plan

Ports andServices

Cyber Security
Incident
Response Plan

Recovery Plan
Specifications

ConfigurationChangeManagement

Information
Protection

Physical &Logical Risk
Mitigation for
DataRiskManagement
PlanTransmission
Station Physical
Security

2RegularApproval

Cyber Security
Policy for Low
Systems

Interactive
Visitor Control
Remote Access Program
Management

Security PatchManagement

Cyber Security
Incident
Response Plan
Implementation andTesting

Recovery Plan
Implementation andTesting

Configuration
Monitoring

BES Cyber
Asset Reuse
and Disposal

Proof ofImplementation

Proof of
Implementation

Third Party
Verificationof Physical
Security

CIP Senior
ManagerApproval

Primary Control
CenterTraining

3

Identification of Personnel Risk
Senior Manager Assessment
Program

4

Delegation ofAuthority

56Fortra.com

Maintenanceand Testing
Program

CIP-009

CIP-010

Malicious Code Cyber Security Recovery Plan Vulnerability
Prevention
Incident
Review, Update Assessments
Response Plan andReview, Update, CommuniCommunication
cationAccessManagement
ProgramSecurity Event
Monitoring

Access
Revocation
Program

System AccessControls

Transient
Cyber Assets
and Removable Media

Evaluate
Potential
Threats &Vulnerabilities
PhysicalSecurity Plan
Third Party
Review of Plans

Page 5Fortra White Paper

Achieving Resilience While Fulfilling NERC CIP Requirements

Conclusion

Schedule Your Demo Todaya broader set of risks than ever before. In addition to theSolution Suite and answer any of your questions.

forces of nature that have historically challenged the electric

Visit tripwire.com/demo

Those responsible for power generation and distribution face

Let us take you through a demo of the Tripwire NERC CIP

grid, such providers must prepare for and thwart increasing
threats from hackers, terrorists, and even nation-states.
Many organizations have limited personnel for addressingthese risks—in some cases a single individual. Requirements
such as the NERC Critical Infrastructure Protection standard
provide the necessary oversight to ensure that, in thisinterdependent system, all are fulfilling that responsibility,
but providers may find it difficult to understand, conform,and document compliance with such standards. Tripwire’s
NERC CIP Solution Suite, paired with specialized engineeringexpertise in the electrical reliability field, will help ensurethat organizations can meet their consumers’ needs fora safe and reliable infrastructure that fulfills the evolving
expectations of industry regulators.

References

1 A brief history of the North American Electric Reliability Corporation
is available from https://www.nerc.com/news/Documents/HistoryofNERC01JUL19.pdf (retrieved Feb 1, 2021, login required)
2 For information about similar issues, please see “Physical Securityof the U.S. Power Grid: High-Voltage Transformer Substations”
Congressional Research Service. July 02, 2015.

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-wp-0423-r1-hm)