NERC CIP-012-1 Update for Improved Communication and Data Security
Stay compliant with NERC CIP-012-1 guidelines by implementing plans to protect real-time assessment and monitoring data during transmission between Control Centers. Learn the scope, effective date, and technical rationale for roles and responsibilities outlined in this update.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
NERC CIP-012-1 Update Christine Hasha, Compliance April 2021
CIP-012 - Communication between Control Centers (FERC Order) R1. The Responsible Entity shall implement, except under CIP Exceptional Circumstances, one or more documented plan(s) to mitigate the risks posed by unauthorized disclosure and unauthorized modification of Real-time Assessment and Real-time monitoring data while being transmitted between any applicable Control Centers. The Responsible Entity is not required to include oral communications in its plan. The plan shall include: [Violation Risk Factor: Medium] [Time Horizon: Operations Planning] 1.1. Identification of security protection used to mitigate the risks posed by unauthorized disclosure and unauthorized modification of Real-time Assessment and Real-time monitoring data while being transmitted between Control Centers; 1.2. Identification of where the Responsible Entity applied security protection for transmitting Real-time Assessment and Real-time monitoring data between Control Centers; and 1.3. If the Control Centers are owned or operated by different Responsible Entities, identification of the responsibilities of each Responsible Entity for applying security protection to the transmission of Real-time Assessment and Real-time monitoring data between those Control Centers. 2
CIP-012-1 Implementation Effective Date Significant Changes Requires implementation of a plan to protect against unauthorized disclosure or modification of Real-time Assessment and Real- time monitoring data while being transmitted between any Control Center. 24 month implementation period. Approved by FERC. Initiatives Limited to ICCP between ERCOT and Market Participants based on TOP-003 and IRO-010 data spec http://www.ercot.com/content/wcm/key_documents_lists/89338/NERC_IRO-010_and_TOP-003_Mapping_Document_V7.xlsx New equipment being distributed under PR306-01 WAN Refresh equipment includes VoIP and multi-point VPN capability. Testing of WAN encryption in ERCOT test lab. Testing with of WAN encryption with identified Market Participant volunteers. Assumptions Configurations will be consistent between ERCOT and Market Participants, regardless of NERC registration requirements. Risks Risk of data latency for ICCP telemetry due to use of encryption expectation is that latency may be a few milliseconds at most. More complex configurations to manage the encryption. Lack of participation from Market Participants in scheduling and roll out of solution. FERC has issued an order to increase scope of requirements. Upcoming Readiness Milestones Pilot in ERCOT test WAN. Testing to Market Participant sites to obtain metrics on data latency. 7/1/2022 4
CIP-012-1 Technical Rationale for Roles & Responsibilities The requirements do not explicitly require formal agreements between Responsible Entities partnering for protection of applicable data. It is strongly recommended, however, that these partnering entities develop agreements, or use existing ones, to define responsibilities to ensure the security objective is met. An example noted in FERC Order No. 822, paragraph 59 is, if several registered entities have joint responsibility for a cryptographic key management system used between their respective Control Centers, they should have the prerogative to come to a consensus on which organization administers that particular key management system." 5
CIP-012-1 Considerations Address roles and responsibilities in the WAN agreement (ERCOT Nodal Protocols Section 23 Form K) and Coordinated Functional Registration (CFR). ERCOT s role: Management of WAN provider Management of the encryption keys Coordination of troubleshooting and maintenance Physical security of WAN equipment located in ERCOT data centers Market Participant s role: Physical security of WAN equipment located in MP data centers 6
CIP-012-1 Between Control Centers In Scope Physically secured area Physically secured area Entity Alpha s Primary Control Center Entity Alpha s Backup Control Center CIP-012 Demarcation Point CIP-012 Demarcation Point WAN Router WAN Router Telco Telco Demarcation Point Demarcation Point ESP Firewall ESP Firewall Encrypted Communications Operator Workstations Application Server Database Server ICCP Server Operator Workstations Application Server Database Server ICCP Server Communications Carrier CIP-012 Demarcation Point Entity Beta s Control Center WAN Router ESP Firewall Operator Workstations Application Server Database Server ICCP Server 7
CIP-012-1 Between Control Centers Out of Scope Entity Alphas Primary Control Center Entity Betas Control Center WAN Router WAN Router Telco Telco Demarcation Point Demarcation Point ESP Firewall ESP Firewall Operator Workstations Application Server Database Server ICCP Server Operator Workstations Application Server Database Server ICCP Server Communications Carrier Telco Telco Demarcation Point Demarcation Point 3rd Party WAN Router WAN Router Firewall Firewall Server Server Server 8
