POWER June 2014 - 33

NERC CIP COMPLIANCE
operation, misoperation, or non-operation,
adversely impact one or more Facilities,
systems, or equipment, which, if destroyed,
degraded, or otherwise rendered unavailable
when needed, would affect the reliable operation
of the Bulk Electric System. "
This isn't an easy definition to digest, but
it essentially says that the cyber asset must
have an impact on the Bulk Electric System
within 15 minutes if it is misused, degraded,
lost, or compromised. " Impact on the BES "
typically means impact on the generating
station that hinders or prevents it from fulfilling
its purpose (that is, generating power
when required).
For example, the DCS will very likely
have an impact in under 15 minutes, so the
component cyber assets will be BES cyber
assets. In another example, characteristics
of a particular coal-handling system might
allow it to be inoperable for hours or days
before the plant has to shut down, so its
coal-handling cyber components won't be
BES cyber assets.
The best starting point for inventorying
cyber assets is the control system drawings,
network drawings, and IP address lists. Generator
control becomes the starting point, and
other systems are next (Table 1). In a typical
control system, about half the devices are ITtype
technology (computers or networking)
and the remainder are control system devices
(including DCS controllers, serial converters,
and PLCs). All these cyber assets require inspection
and inventory, plus a determination
on whether or not each cyber asset meets the
BES cyber asset definition (it affects the BES
within 15 minutes).
Once BES cyber assets have been identified,
they need to be grouped into BES Cyber
Systems. This is an exercise left to the discretion
of the generator. Generators can reduce
compliance paperwork by grouping many
BES Cyber Assets into a single large BES Cyber
System. However, if a generator defines
the BES Cyber Systems too expansively, the
generator may end up including BES cyber
assets that don't meet the definition, unnecessarily
increasing the compliance effort.
As a general rule, most consultants familiar
with CIP will create BES Cyber Systems by
grouping cyber assets that work together to
fulfill a function (such as control, continuous
emissions monitoring system, or protection).
Take It from the Top
The top-down approach starts with the BES
Reliability Operating Services (BROS),
which are discussed in the " Guidelines and
Technical Basis " of CIP-002-5. The BROS
are reliability services that BES facilities can
provide to the grid. Table 2 identifies those
BROS that would typically apply to generaJune
2014 | POWER
Table 2. BES Reliability Operating Services. Source: CIP-002-5.1 Guidelines and
Technical Basis
Entity registration
Dynamic response
Balancing load and generation
Controlling frequency
Controlling voltage
Managing constraints
Monitoring and control
Restoration
Situational awareness
Inter-entity coordination
X
X
tion owners (GO) and generation operators
(GOP). (If the BROS don't make immediate
sense, refer to Table 1, which lists potential
BES Cyber Systems in a power plant.)
The systems that fulfill one or more BROS
should all be considered " potential BES Cyber
Systems. " But because a BES Cyber
System is composed of BES Cyber Assets,
you need to go back to the BES Cyber Asset
definition and make sure it still applies.
For instance, if a " potential BES Cyber System "
doesn't have a 15-minute impact on the
Bulk Electric System, then it won't be a BES
Cyber System, even though it does fulfill a
BROS function.
Before a " potential BES Cyber System "
becomes an actual one, there is one more step
to take. The generator needs to go back to the
definition of BES cyber asset (cited above)
and make sure each " potential BES Cyber
System " meets the definition. In particular,
some " potential BES Cyber Systems " may
not pass, as they don't have a 15-minute impact
on the BES.
To summarize the top-down approach:
Identify the BES Reliability Operating Services
that are performed by the generating
station and then identify the BES Cyber
Systems that execute or enable one or more
BROS. The BES Cyber System classification
as Medium or Low depends on the impact
level of the plant.
Large Plants
If a generating facility meets Criterion 2.1
of Attachment 1, there is a further provision
in that criterion that states: " the only BES
Cyber Systems that meet this criterion are
those shared BES Cyber Systems that could,
within 15 minutes, adversely impact the reliable
operation of any combination of units
that in aggregate equal or exceed 1500 MW
in a single Interconnection. "
This statement indicates that the generating
facility could be Medium impact, but it
may have few or no Medium-impact BES
Cyber Systems, because a BES Cyber Syswww.powermag.com
X
X
RC
BA TOP TO DP GOP GO
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
tem has to have the capability of affecting the
entire generating station. A good example of
this condition is a DCS that controls only 800
MW of generation at a 1,600-MW facility
and has no capability to affect the full 1,600
MW at the site. In this example, the plant
would be Medium impact, but the DCS is a
Low-impact BES Cyber System.
Generators looking to reduce their CIP
compliance burden by taking advantage of
this provision need to keep in mind that simply
stating that the BES Cyber Systems cannot
affect 1,500 MW will not be sufficient.
They will need to prove this position by
showing the work related to the identification
of BES Cyber Systems through the bottomup
and top-down approaches. The generator
must also document why each BES Cyber
System doesn't affect 1,500 MW and show
that it isn't networked with other BES Cyber
Systems that do affect 1,500 MW.
Complex Determinations
The asset identification process in NERC
CIP Version 5 is much more complicated
than it was in CIP Versions 1 through 3. If a
generating station will be classified as Low
impact in V5, the process won't be excessively
difficult. But owners of Medium-impact
generating stations will require a deep
understanding of how to identify cyber assets
in scope. The cost and effort required
to achieve NERC CIP V5 compliance will
depend heavily on this understanding. ■
-Tom Alrich (tom.alrich@honeywell
.com) is energy sector security lead for
Honeywell International and focuses on
the electric power industry and compliance
with NERC regulations for cyber
and physical security. Donovan Tindill,
CISSP, senior security & compliance consultant,
Honeywell Industrial IT Solutions,
specializes in cybersecurity for industrial
automation and control systems for a
wide variety of industries and has been
involved with NERC CIP compliance
since 2005.
33
http://www.powermag.com
POWER June 2014

Table of Contents for the Digital Edition of POWER June 2014
