What Cyber Security Frameworks are relevant to Energy Central members, and why?

Kathryn, you asked Richard "if a Utility were to strive to meet the various NIST references you mentioned, then they would be much more secure and yet also be NERC CIP compliant as a natural output from those security measures?"  Not necessarily but you are on the right track with your thinking. 

As a former "prosecuting attorney" for WECC litigating against entities that were in violation of the CIP standards, I saw both small and large registered entities seriously violate the standards and struggle with systemic violations of CIP standards. For example, I prosecuted two of the largest utilities in North America for major systemic CIP violations.  Each of those entities had thrown millions of dollars at their compliance programs. There were other smaller registered entities with much less invested but much more robust CIP compliance programs that were often used as exemplars in the Western Interconnection. I no longer believe that CIP compliance effectiveness was a result of large budgets.  One reason for failures were the gaps and silos within the company where one part of the company was focusing on being compliant with CIP standards, another with NIST, another with SOX, etc.  Each part of the company was doing its own thing but as a whole, the company ultimately failed to focus uniformly on the tasks leading to the main goal of all of these regulatory schemes---protection of physical assets, cyber assets, data, etc.

Very generally speaking, you should first continue to ask yourself, what tasks need to be done when trying to identify and protect assets, detect and respond to threats, recovery of cyber or physical asset or data.  Second, focus on concepts like identifying and managing assets, understanding your business environment and key players within it, managing and monitoring the governance (regulatory regimes your subject to), assessing risk, etc.  Third, once you take those steps, you can better see where particular standards or protocols fit (e.g. CIP, NIST, CIS, COBIT, ISA, ISO, etc.).  If you look past the naming conventions, acronyms, numbers, and legalese, you will see that each of these regulatory regimes gives you a task or objective that deals with identification, protection, detection, recovery, etc.  Once you draft your policies and procedures with these tasks and objectives in mind instead of simply complying with a standard, you will be much more likely to be secure and also NERC CIP compliant (and SOX complaint, and NIST compliant, etc.) as a natural output of your planning and implementing.

Can you see how you have formed the foundation for real protection and compliance and how this process, though more tedious up front, would be easier to maintain in the long run?  How a program like this would take a more holistic look at compliance and protection from a company wide view instead of piecemeal?  How a compliance program with these foundations would be more dynamic allowing you to meet future environmental and regulatory changes? 

HERE IS A VALUABLE TOOL:  NERC working groups already went though and compared the tasks and objectives inherent in NERC CIP, NIST, CIS CSC, COBIT, ISA, ISO and did a “direct line” comparison between them.  They gave you a cheat sheet on how to build the foundation for your compliance program and still be compliant with the variety of regulatory regimes you are subject to.  Look down at the bottom under “Technical Reference Documents”, then the list under “Approved Technical reference Documents” and then click on the Excel spreadsheet, “Technical Reference Document: Assessing and Reducing Risk Tool.”  Once open, look at the tabs along the bottom and select “Cyber Security Framework”  Find it here.  https://www.nerc.com/comm/Pages/Reliability-and-Security-Guidelines.aspx

https://www.nist.gov/publications/guide-lte-security

Several utilities are interested and investing in private LTE systems as a foundation to their grid modernization strategy. In addition to being a robust guide to LTE security, it drives the point home of how building security from the ground up has clear advantages, as opposed to legacy systems that may pose a threat as a weak link.

If the request is related to projects inside the USA, NERC CIP would be my first choice.  That is something that the US critical installations ask for, like military installations.  There are many sites where info related to NERC CIP can be found.  The one that I found interesting is:

https://www.ispartnersllc.com/blog/nerc-cip-consistent-compliance/

(Author: Anthony Jones)

Quoting here:

The North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) is a plan comprised of a set of requirements. The NERC CIP developed and designed a series of standards intended to protect any assets used to operate North America’s Bulk Electric System (BES). North America includes, for the purposes of NERC CIP, the United States, Canada and Mexico.

Key requirements…these are things to pay attention to (from the above source):

• Program Development and Management
• Compliance Audits and Assessments
• Patch Management
• Vulnerability Assessment and Management
• Incident Reporting of Cybersecurity Events and Quick Response Planning
• Mock Audits
• On-the-Spot and Unplanned Audits
• Asset Identification and Configuration Management
• Reliability Standard Audit Worksheet Development
• Systems Security Assessments and Management
• Personnel Training
• Policy, Process and Procedure Planning
• Development, Documentation and Evidence Reporting
• Security Information and Event Management
• Recovery Planning