Version 5 Critical Infrastructure Protection Reliability Standards, 24107-24124 [2013-09643]

Agencies

• DEPARTMENT OF ENERGY
• Federal Energy Regulatory Commission

[Federal Register Volume 78, Number 79 (Wednesday, April 24, 2013)]
[Proposed Rules]
[Pages 24107-24124]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-09643]


-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

18 CFR Part 40

[Docket No. RM13-5-000]


Version 5 Critical Infrastructure Protection Reliability 
Standards

AGENCY: Federal Energy Regulatory Commission.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: Pursuant to section 215 of the Federal Power Act, the 
Commission proposes to approve the Version 5 Critical Infrastructure 
Protection Reliability Standards, CIP-002-5 through CIP-011-1, 
submitted by the North American Electric Reliability Corporation, the 
Commission-certified Electric Reliability Organization. The proposed 
Reliability Standards, which pertain to the cyber security of the bulk 
electric system, represent an improvement over the current Commission-
approved CIP Reliability Standards as they adopt new cyber security 
controls and extend the scope of the systems that are protected by the 
CIP Reliability Standards. The Commission is concerned, however, that 
limited aspects of the proposed CIP version 5 Standards are potentially 
ambiguous and, ultimately, raise questions regarding the enforceability 
of the standards. Therefore, the

[[Page 24108]]

Commission proposes to direct that NERC develop certain modifications 
to the CIP version 5 Standards to address the matters identified by the 
Commission.

DATES: Comments are due June 24, 2013.

ADDRESSES: Comments, identified by docket number, may be filed in the 
following ways:
     Electronic Filing through https://www.ferc.gov. Documents 
created electronically using word processing software should be filed 
in native applications or print-to-PDF format and not a scanned format.
     Mail/Hand Delivery: Those unable to file electronically 
may mail or hand-deliver comments to: Federal Energy Regulatory 
Commission, Secretary of the Commission, 888 First Street NE., 
Washington, DC 20426.
    Instructions: For detailed instructions on submitting comments and 
additional information on the rulemaking process, see the Comment 
Procedures Section of this document.

FOR FURTHER INFORMATION CONTACT:  Jason Christopher (Technical 
Information), Office of Electric Reliability, Division of Reliability 
Standards and Security, Federal Energy Regulatory Commission, 888 First 
Street NE., Washington, DC 20426 Telephone: (202) 502-8256; Austin 
Rappeport (Technical Information), Office of Electric Reliability, 
Division of Reliability Standards and Security, Federal Energy 
Regulatory Commission, 1800 Dual Highway, Suite 201, Hagerstown, MD 
21740, Telephone: (301) 665-1393; Kevin Ryan (Legal Information), 
Office of the General Counsel, Federal Energy Regulatory Commission, 
888 First Street, NE., Washington, DC 20426, Telephone: (202) 502-6840; 
Matthew Vlissides (Legal Information), Office of the General Counsel, 
Federal Energy Regulatory Commission, 888 First Street, NE., 
Washington, DC 20426, Telephone: (202) 502-8408.

SUPPLEMENTARY INFORMATION: 

Notice of Proposed Rulemaking

(Issued April 18, 2013)

    1. Pursuant to section 215 of the Federal Power Act (FPA),\1\ the 
Commission proposes to approve the Version 5 Critical Infrastructure 
Protection (CIP) Reliability Standards, CIP-002-5 through CIP-011-1, 
submitted by the North American Electric Reliability Corporation 
(NERC), the Commission-certified Electric Reliability Organization 
(ERO). The proposed CIP version 5 Standards, which pertain to the cyber 
security of the bulk electric system, represent an improvement over the 
current Commission-approved CIP Reliability Standards as they adopt new 
cyber security controls and extend the scope of the systems that are 
protected by the CIP Reliability Standards.
---------------------------------------------------------------------------

    \1\ 16 U.S.C. 824o (2006).
---------------------------------------------------------------------------

    2. Specifically, the proposed CIP version 5 Standards include 
twelve requirements with new cyber security controls. The new controls 
address Electronic Security Perimeters (CIP-005-5), Systems Security 
Management (CIP-007-5), Incident Reporting and Response Planning (CIP-
008-5), Recovery Plans for BES Cyber Systems (CIP-009-5), and 
Configuration Change Management and Vulnerability Assessments (CIP-010-
1). As discussed below, the proposed new controls will improve the 
security posture of responsible entities and represent an improvement 
in the CIP Reliability Standards.
    3. In addition, NERC has proposed to adopt a new approach to 
identifying and classifying BES Cyber Systems that will require at 
least a minimum classification of ``Low Impact'' for all BES Cyber 
Systems. Specifically, NERC has proposed to categorize BES Cyber 
Systems as having a Low, Medium, or High Impact on the reliable 
operation of the bulk electric system. Once a BES Cyber System has been 
categorized, the responsible entity must comply with the associated 
requirements of the CIP version 5 Standards that pertain to that 
category. As discussed further below, the proposed approach to 
categorizing BES Cyber Systems is a step towards applying the CIP 
protections more comprehensively to better assure the protection of the 
bulk electric system.
    4. While we believe that the proposed CIP version 5 Standards 
improve the currently-approved CIP Reliability Standards, certain 
aspects of the proposal raise concerns regarding the potential 
ambiguity and, ultimately, enforceability of the CIP version 5 
Standards. Specifically, seventeen of the requirements of the suite of 
CIP version 5 Standards include language that requires the responsible 
entity to implement the requirement in a manner to ``identify, assess, 
and correct'' deficiencies.\2\ As explained below, we are concerned 
that this language is unclear with respect to the compliance 
obligations it places on regulated entities and that it is too vague to 
audit and enforce compliance. For example, it is unclear whether the 
inclusion of the ``identify, assess and correct'' language in the 
requirements imposes one obligation on the responsible entity (i.e., to 
ensure the entity has a process in place to identify, assess and 
correct a violation) or two obligations (i.e., to (1) ensure the entity 
has a process in place to identify, assess and correct a violation and 
(2) to ensure that the underlying substantive requirement is not 
violated). Therefore, we seek comment on the meaning of this language 
and on how it will be implemented and enforced. Depending on the 
comments and explanations received, we may determine that it is 
appropriate to direct NERC to develop modifications. For example, the 
modification may seek to direct NERC to clarify both the compliance 
obligations created by this language and the criteria by which auditors 
will be able to determine compliance. Alternatively, we may direct NERC 
to remove this language if it results in requirements that degrade the 
protections afforded by the CIP version 5 Standards and are difficult 
to implement and enforce. The nature of any next steps will depend on 
additional information filed with the Commission.
---------------------------------------------------------------------------

    \2\ See NERC Petition at 33.
---------------------------------------------------------------------------

    5. In addition, we have concerns with one specific provision, 
Requirement R2 of Reliability Standard CIP-003-5, which sets forth the 
single compliance obligation for BES Cyber Systems categorized as Low 
Impact. Requirement R2 requires responsible entities to ``implement * * 
* documented cyber security policies that collectively address * * *'' 
cyber security awareness, physical security controls, electronic access 
controls and incident response to a cyber security incident. We support 
extending the scope of the systems that are protected by the CIP 
Reliability Standards, and believe this is a positive step forward in 
comprehensive protection of assets that could potentially cause cyber 
security risks to the bulk electric system. However, we are concerned 
that CIP-003-5, Requirement R2 simply requires responsible entities to 
implement documented policies and does not provide those entities with 
a clear roadmap of what they need to do in order to protect Low Impact 
BES Cyber Systems.
    6. Beyond the identification of four broad topics, neither this 
Reliability Standard nor the NERC petition indicate the required 
content of such policies or the qualitative expectation for an adequate 
policy. Thus, we are concerned that Requirement R2 is not clear and 
unambiguous regarding what is required of the responsible entities or, 
more important, does not provide adequate cyber security controls for 
Low

[[Page 24109]]

Impact BES Cyber Assets. Accordingly, as discussed in detail below, we 
propose to direct that NERC develop modifications to CIP-003-5, 
Requirement R2, to require that responsible entities adopt specific, 
technically-supported cyber security controls for Low Impact assets.
    7. We also propose to approve the nineteen new or revised 
definitions associated with the proposed Reliability Standards for 
inclusion in the Glossary of Terms Used in NERC Reliability Standards 
(NERC Glossary). In addition, we seek comment on certain aspects of the 
proposed definitions. Depending on the comments and explanations 
received, we may determine that it is appropriate to direct that NERC 
develop modifications to certain proposed definitions to eliminate 
ambiguities and assure that BES Cyber Assets are adequately protected.
    8. We further propose to approve 30 of the 32 Violation Risk 
Factors (VRF). However, we propose to direct NERC to modify the VRF 
assignment for CIP-006-5, Requirement R3 from Lower to Medium, and to 
modify the VRF assigned to CIP-004-5, Requirement R4 from Lower to 
Medium. In addition, we propose to direct NERC to modify the Violation 
Severity Levels (VSL) for the CIP version 5 Standards. We seek comment 
on these proposals.
    9. We propose to approve NERC's proposal to allow responsible 
entities to transition from compliance with the currently-effective CIP 
version 3 Standards to compliance with the CIP version 5 Standards, 
essentially retiring the CIP version 4 Standards prior to mandatory 
compliance. Thus, upon approval of the CIP version 5 Standards in a 
Final Rule in this docket, CIP-002-4 through CIP-009-4 would not become 
effective, and CIP-002-3 through CIP-009-3 would remain in effect and 
would not be retired until the effective date of the CIP version 5 
Standards. However, we also raise questions whether the 24-month and 
36-month implementation periods proposed by NERC for the CIP version 5 
Standards are necessary, and what activities are required to effect the 
transition during the proposed implementation periods.
    10. The Commission recognizes the ongoing challenge of developing 
and maintaining meaningful cyber security requirements that set a 
baseline for protection of the nation's bulk electric system from cyber 
vulnerabilities. Users, owners and operators of the bulk electric 
system must adapt to changing threats and cyber technologies to assure 
the ongoing security of the nation's critical infrastructure. We 
believe that the modified CIP version 5 Standards proposed by NERC 
represent an improvement over the previously approved standards and 
should assist in a more robust cyber security posture for the industry. 
Therefore, we propose to approve the CIP version 5 Standards. However, 
Reliability Standards with unclear requirements or lacking minimum 
controls can create uncertainty and erode an otherwise effective cyber 
security posture. Thus, pursuant to section 215(d)(5), we also propose 
to direct NERC to modify the proposal to remove ambiguous language and 
assure that Low Impact assets have a clear compliance expectation that 
includes specified cyber security controls, in lieu of the proposed 
requirement for unspecified policies, as explained in detail below.

I. Background

A. Section 215 of the FPA

    11. Section 215 of the FPA requires the Commission-certified ERO to 
develop mandatory and enforceable Reliability Standards, subject to 
Commission review and approval. Once approved, the Reliability 
Standards may be enforced in the United States by the ERO subject to 
Commission oversight, or by the Commission independently.\3\ Pursuant 
to the requirements of FPA section 215, the Commission established a 
process to select and certify an ERO \4\ and, subsequently, certified 
NERC as the ERO.\5\
---------------------------------------------------------------------------

    \3\ See 16 U.S.C. 824o(e)(3).
    \4\ Rules Concerning Certification of the Electric Reliability 
Organization; and Procedures for the Establishment, Approval and 
Enforcement of Electric Reliability Standards, Order No. 672, FERC 
Stats. & Regs. ] 31,204, order on reh'g, Order No. 672-A, FERC 
Stats. & Regs. ] 31,212 (2006).
    \5\ N. Am. Elec. Reliability Corp., 116 FERC ] 61,062, order on 
reh'g and compliance, 117 FERC ] 61,126 (2006), aff'd sub nom. Alcoa 
Inc. v. FERC, 564 F.3d 1342 (DC Cir. 2009).
---------------------------------------------------------------------------

B. Order Nos. 706 and 761

Order No. 706
    12. On January 18, 2008, the Commission issued Order No. 706, which 
approved the CIP version 1 Standards to address cyber security of the 
Bulk-Power System.\6\ In Order No. 706, the Commission approved eight 
CIP Reliability Standards (CIP-002-1 through CIP-009-1). While 
approving the CIP version 1 Standards, the Commission also directed 
NERC to develop modifications to the CIP version 1 Standards, intended 
to enhance the protection provided by the CIP Reliability Standards. 
Subsequently, NERC filed the CIP version 2 and CIP version 3 Standards 
in partial compliance with Order No. 706. The Commission approved these 
standards in September 2009 \7\ and March 2010,\8\ respectively.
---------------------------------------------------------------------------

    \6\ Mandatory Reliability Standards for Critical Infrastructure 
Protection, Order No. 706, 122 FERC ] 61,040, order on reh'g, Order 
No. 706-A, 123 FERC ] 61,174 (2008), order on clarification, Order 
No. 706-B, 126 FERC ] 61,229 (2009), order on clarification, Order 
No. 706-C, 127 FERC ] 61,273 (2009).
    \7\ N. Am. Elec. Reliability Corp., 128 FERC ] 61,291, order 
denying reh'g and granting clarification, 129 FERC ] 61,236 (2009).
    \8\ N. Am. Elec. Reliability Corp., 130 FERC ] 61,271 (2010).
---------------------------------------------------------------------------

Order No. 761
    13. On April 19, 2012, the Commission issued Order No. 761, which 
approved the CIP version 4 Standards (CIP-002-4 through CIP-009-4).\9\ 
Reliability Standard CIP-002-4 (Critical Cyber Asset Identification) 
sets forth 17 uniform ``bright line'' criteria for identifying Critical 
Assets. The Commission also accepted NERC's proposed implementation 
schedule for the CIP version 4 Standards, which are to be fully 
implemented and enforceable beginning April 2014.\10\
---------------------------------------------------------------------------

    \9\ Version 4 Critical Infrastructure Protection Reliability 
Standards, Order No. 761, 77 FR 24594 (Apr. 25, 2012), 139 FERC ] 
61,058 (2012) order denying reh'g, 140 FERC ] 61,109 (2012).
    \10\ We note that on February 12, 2013, President Barack Obama 
issued an Executive Order requiring the National Institute of 
Standards and Technology (NIST) to ``lead the development of a 
framework to reduce cyber risks to critical infrastructure.'' NIST 
is required to publish a preliminary version of the framework within 
240 days of the Executive Order and a final version one-year after 
the Executive Order.
---------------------------------------------------------------------------

II. NERC Petition and Proposed CIP Version 5 Standards

A. NERC Petition

    14. In its January 31, 2013 petition, NERC seeks Commission 
approval of the CIP version 5 Standards, nineteen new or revised 
Glossary terms, Violation Risk Factors and Violation Severity Levels, 
and an implementation plan.\11\ NERC maintains that the proposed CIP 
version 5 Standards are just and reasonable, as the proposal meets or 
exceeds each of the guidelines that the Commission identified in Order 
No. 672 for evaluating a proposed Reliability Standard.\12\ NERC 
asserts that the proposed CIP version 5 Standards ``serve the important 
reliability goal of providing a cybersecurity framework for the 
identification and protection of BES

[[Page 24110]]

Cyber Systems * * * to support the reliable operation of the Bulk Power 
System.'' \13\ In addition, NERC states that the proposed CIP version 5 
Standards are ``designed to be clear and unambiguous'' and the 
Commission should approve the CIP standards as ``clearly enforceable.'' 
\14\
---------------------------------------------------------------------------

    \11\ Reliability Standards CIP-002-5 through CIP-011-1 are not 
attached to the notice of proposed rulemaking. The complete text of 
CIP version 5 Standards is available on the Commission's eLibrary 
document retrieval system in Docket No. RM13-5-000 and is posted on 
the ERO's Web site, available at https://www.nerc.com.
    \12\ See Petition at 8 (citing Order No. 672 FERC Stats. Regs. ] 
31,204 at PP 320-337. See also NERC Petition, Exh. G (Order No. 672 
Criteria for Approving Proposed Reliability Standards)).
    \13\ Id. at 10.
    \14\ Id. at 27.
---------------------------------------------------------------------------

    15. Further, NERC maintains that the proposed CIP version 5 
Standards represent a significant improvement to the currently-
effective standards, as the CIP version 5 Standards require responsible 
entities to use a new approach to categorize all cyber systems 
impacting the bulk electric system as having a Low, Medium, or High 
Impact.\15\ NERC states that the new approach to classifying cyber 
systems ``moves away from the CIP version 4 ``bright-line'' approach of 
only identifying Critical Assets (and applying CIP requirements only to 
their associated Critical Cyber Assets), to requiring a minimum 
classification of ``Low Impact'' for all BES Cyber Systems.'' \16\ NERC 
states that the adoption of the Low-Medium-High Impact categorization 
``resulted from a review of the National Institute of Standards and 
Technology (NIST) Risk Management Framework for categorizing and 
applying security controls, a review that was directed by the 
Commission in Order No. 706.'' \17\
---------------------------------------------------------------------------

    \15\ See Id. at 15.
    \16\ Id.
    \17\ Id.
---------------------------------------------------------------------------

    16. NERC also notes the adoption of new language within several of 
the CIP version 5 Standards where the Standard Drafting Team 
incorporated ``a requirement that Responsible Entities implement cyber 
policies in a manner to ``identify, assess, and correct'' 
deficiencies.'' \18\ NERC states that the proposed ``identify, assess, 
and correct'' language is ``[c]onsistent with the NIST Risk Management 
Framework and the Commission's guidance in prior orders,'' asserting 
that the ``implementation of certain CIP version 5 requirements in a 
manner to ``identify, assess, and correct'' deficiencies emulates the 
FERC Policy Statement on Penalty Guidelines.'' \19\ NERC further states 
that the ``identify, assess, and correct'' language ``is included as a 
performance expectation in the requirements, not as an enforcement 
component.'' \20\
---------------------------------------------------------------------------

    \18\ Id. at 33.
    \19\ Id.
    \20\ Id.
---------------------------------------------------------------------------

    17. NERC asserts that the CIP version 5 Standards address ``all 
applicable directives in Order No. 706'' while ``eliminating 
unnecessary documentation requirements to allow entities to focus on 
the reliability and security of the Bulk Power System.'' \21\ 
Accordingly, NERC requests that the Commission approve the proposed CIP 
version 5 Standards, the proposed new and revised definitions, the 
associated Violation Risk Factors and Violation Severity Levels, and 
the proposed implementation plan. NERC requests as an effective date 
for the Reliability Standard, ``the first day of the eighth calendar 
quarter after a Final Rule is issued in this docket.'' \22\
---------------------------------------------------------------------------

    \21\ Id. at 5.
    \22\ Id. at 2.
---------------------------------------------------------------------------

    18. NERC requests prompt Commission action approving the CIP 
version 5 Standards and associated implementation plan.\23\ With regard 
to the implementation plan, NERC states that the proposed language 
``would allow entities to transition from CIP Version 3 to CIP Version 
5, thereby bypassing implementation of CIP Version 4 completely upon 
Commission approval.'' \24\ NERC asserts that prompt approval of the 
CIP version 5 Standards and implementation plan ``would reduce 
uncertainty among Responsible Entities regarding implementation of the 
CIP standards.'' \25\
---------------------------------------------------------------------------

    \23\ Id. at 5.
    \24\ Id. at 4.
    \25\ Id. at 5.
---------------------------------------------------------------------------

B. Proposed CIP Version 5 Standards and NERC Explanation of Provisions

    19. NERC's proposal includes ten new or modified Reliability 
Standards.
    20. CIP-002-5-Cyber Security--BES Cyber System Categorization: 
Proposed CIP-002-5 is the first step in identifying BES Cyber Systems, 
which are assets which must be protected by the cyber security 
standards. If a responsible entity does not identify any BES Cyber 
Systems, it does not have compliance responsibility under the rest of 
the proposed CIP Standards. However, a responsible entity that 
identifies BES Cyber Systems must comply with proposed CIP-003-5 to 
CIP-011-1, according to specific criteria that characterize the impact 
of the identified BES Cyber Systems.
    21. In particular, proposed CIP-002-5 adds two new terms to the 
NERC Glossary that define the assets subject to CIP protections. First, 
NERC defines a BES Cyber Asset as ``[a] Cyber Asset that if rendered 
unavailable, degraded, or misused would, within 15 minutes of its 
required operation, misoperation, or non-operation, adversely impact 
one or more Facilities, systems, or equipment, which, if destroyed, 
degraded, or otherwise rendered unavailable when needed, would affect 
the reliable operation of the Bulk Electric System.'' \26\ Second, NERC 
defines a BES Cyber System as ``[o]ne or more BES Cyber Assets 
logically grouped by a responsible entity to perform one or more 
reliability tasks for a functional entity.'' \27\
---------------------------------------------------------------------------

    \26\ Id. at 14.
    \27\ Id.
---------------------------------------------------------------------------

    22. NERC states that proposed Reliability Standard CIP-002-5 will 
require the identification and categorization of BES Cyber Systems 
according to specific criteria that characterize their impact for the 
application of cyber security requirements commensurate with the 
adverse impact that loss, compromise, or misuse of those BES Cyber 
Systems could have on the reliable operation of the bulk electric 
system.\28\
---------------------------------------------------------------------------

    \28\ Id. at 11.
---------------------------------------------------------------------------

    23. NERC states that proposed CIP-002-5 ``Attachment 1--Impact 
Rating Criteria'' identifies three categories of BES Cyber Systems. The 
High Impact category covers large Control Centers, similar to those 
control centers identified as Critical Assets in CIP-002-4. The Medium 
Impact category covers generation and transmission facilities, similar 
to those identified as Critical Assets in CIP-002-4, along with other 
control centers not identified as Critical Assets in CIP-002-4. The Low 
Impact category covers all other BES Cyber Systems. NERC states that 
the Low Impact Category provides protections for systems not included 
in the CIP version 4 Standards.\29\
---------------------------------------------------------------------------

    \29\ Id.
---------------------------------------------------------------------------

    24. Once a responsible entity identifies a BES Cyber System under 
CIP-002-5, the entity must comply with the controls included in CIP-
003-5 to CIP-011-1 corresponding to its impact category.\30\
---------------------------------------------------------------------------

    \30\ Id.
---------------------------------------------------------------------------

    25. CIP-003-5--Cyber Security--Security Management Controls: NERC 
states that proposed Reliability Standard CIP-003-5 will require 
approval by a CIP Senior Manager of the documented cyber security 
policies related to CIP-004-5 through CIP-009-5, CIP-010-1, and CIP-
011-1. Proposed CIP-003-5, Requirement 2, will require implementation 
of policies related to cyber security awareness, physical security 
controls, electronic access controls, and incident response to a Cyber 
Security Incident for those assets that have Low Impact BES Cyber 
Systems under CIP-002-5's categorization process. According to NERC, a 
requirement that a Cyber

[[Page 24111]]

Security Policy be ``readily available'' was deleted because of general 
confusion around that term and because training requirements in CIP-
004-5 provide for knowledge of reliability policies. NERC states that 
it moved several provisions of requirements related to information 
protection in previous CIP versions to CIP-011-1 and, therefore, 
deleted the requirements from CIP-003-5.\31\
---------------------------------------------------------------------------

    \31\ Id. at 11-12.
---------------------------------------------------------------------------

    26. CIP-004-5--Cyber Security--Personnel and Training: NERC states 
that proposed Reliability Standard CIP-004-5 will require documented 
processes or programs for security awareness, cyber security training, 
personnel risk assessment, and access management. Requirement R2 of 
CIP-004-5 adds specific training roles for visitor control programs, 
electronic interconnectivity supporting the operation and control of 
BES Cyber Systems, and storage media as part of the treatment of BES 
Cyber System Information. NERC states that the drafting team modified 
the requirements pertaining to personnel risk assessments and access 
management in response to lessons learned from implementing previous 
versions. Proposed CIP-004-5, Requirement R3, now specifies that the 
seven year criminal history check covers all locations where the 
individual has resided for six consecutive months or more without 
specifying school, work, etc., and regardless of official residence. 
Proposed CIP-004-5, Requirement R4 now combines the access management 
requirements from CIP-003-4, CIP-004-4, CIP-006-4, and CIP-007-4 into a 
single requirement. These requirements from the CIP version 4 
Standards, as incorporated in Requirement R4, remain largely unchanged 
except to clarify certain terminology. NERC states that combining these 
requirements improves consistency in the authorization and review 
process. Proposed Reliability Standard CIP-004-5 modifies Requirement 
R4 by removing the obligation to maintain a list of authorized 
personnel. NERC explains that the removal is appropriate because the 
list represents only one form of evidence to demonstrate compliance 
that only authorized persons have access. Requirement R5 requires a 
registered entity to revoke a terminated employee's access concurrent 
with his or her termination, to be completed within 24 hours.\32\
---------------------------------------------------------------------------

    \32\ Id. at 12.
---------------------------------------------------------------------------

    27. CIP-005-5--Cyber Security--Electronic Security Perimeter(s): 
NERC states that proposed Reliability Standard CIP-005-5, Requirement 
R1 focuses on the discrete Electronic Access Points rather than the 
logical ``perimeter,'' which is the focus of currently-effective CIP-
005-3. Requirement R1.2 of currently-effective CIP-005 Standard has 
been deleted from the CIP version 5 Standards. NERC explains that 
Requirement R1.2 is definitional and was used to bring dial-up modems 
using non-routable protocols into the scope of previous versions of 
CIP-005. According to NERC, the non-routable blanket exemption included 
in CIP version 1 through version 4 was removed from CIP-002-5. 
Moreover, NERC deleted Requirements R1.1 and R1.3. However, according 
to NERC, the drafting team integrated the underlying concepts from 
Requirements R1.1 and R1.3 into the definitions of Electronic Security 
Perimeter (ESP) and Electronic Access Point (EAP).\33\
---------------------------------------------------------------------------

    \33\ Id.
---------------------------------------------------------------------------

    28. CIP-006-5--Cyber Security--Physical Security of BES Cyber 
Systems: NERC states that proposed CIP-006-5 is intended to manage 
physical access to BES Cyber Systems by specifying a physical security 
plan to protect BES Cyber Systems against compromise that could lead to 
misoperation or instability. Proposed CIP-006-5 reflects the retirement 
of Requirements R8.2 and R8.3 of Commission-approved CIP-006-4, 
concerning the retention of testing records. According to NERC, the 
retention period is now specified in the compliance section of proposed 
CIP-006-5.\34\
---------------------------------------------------------------------------

    \34\ Id.
---------------------------------------------------------------------------

    29. CIP-007-5--Cyber Security--Systems Security Management: NERC 
states that proposed CIP-007-5 addresses system security by specifying 
technical, operational, and procedural requirements in support of 
protecting BES Cyber Systems against compromise that could lead to 
misoperation or instability of the bulk electric system. NERC states 
that it modified CIP-007-5 to conform to the formatting approach of CIP 
version 5, along with changes to address several Commission directives 
and to make the requirements less dependent on specific technology so 
that they will remain relevant for future, yet-unknown developing 
technologies. For example, according to NERC, Requirement R3 is a 
competency-based requirement, i.e., the responsible entity must 
document how it addresses the malware risk for each BES Cyber System, 
but the requirement does not prescribe a particular technical method in 
order to account for potential technological advancement.\35\
---------------------------------------------------------------------------

    \35\ Id. at 12-13.
---------------------------------------------------------------------------

    30. CIP-008-5--Cyber Security--Incident Reporting and Response 
Planning: NERC states that proposed CIP-008-5 mitigates the risk to the 
reliable operation of the bulk electric system resulting from a Cyber 
Security Incident by specifying incident response requirements. 
Proposed Requirement R1 requires responsible entities to report Cyber 
Security Incidents within 1 hour of recognition. Requirement R2 
requires testing to verify response plan effectiveness and consistent 
application in responding to a Cyber Security Incident. Requirement R3 
provides for an after-action review for tests or actual incidents, and 
requires an update to the Cyber Security Incident response plan based 
on those lessons learned. Requirement R3 also establishes a single 
timeline for a responsible entity to determine the lessons learned and 
update recovery plans. Specifically, where previous CIP versions 
specified ``30 calendar days'' for determining the lessons learned, 
followed by additional time for updating recovery plans and 
notification, proposed Requirement R3 combines those activities into a 
single 90-day timeframe.\36\
---------------------------------------------------------------------------

    \36\ Id. at 13.
---------------------------------------------------------------------------

    31. CIP-009-5--Cyber Security--Recovery Plans for BES Cyber 
Systems: NERC explains that proposed CIP-009-5 provides for the 
recovery of the reliability functions performed by BES Cyber Systems by 
specifying a recovery plan to support the continued stability, 
operability, and reliability of the bulk electric system. Requirement 
R1 includes controls to protect data that would be useful in the 
investigation of an event that results in the execution of a Cyber 
System recovery plan. NERC explains that Requirement R2 includes 
operational testing to support the recovery of BES Cyber Systems. 
Requirement R3 establishes a single timeline for a responsible entity 
to determine the lessons learned and update recovery plans, similar to 
CIP-008-5.\37\
---------------------------------------------------------------------------

    \37\ Id.
---------------------------------------------------------------------------

    32. CIP-010-1--Cyber Security--Configuration Change Management and 
Vulnerability Assessments: NERC states that proposed CIP-010-1 is a new 
standard consolidating the configuration change management and 
vulnerability assessment-related requirements from previous versions of 
CIP-003, CIP-005 and CIP-007. Requirement R1 specifies the 
configuration change management requirements. Requirement R2 
establishes the configuration monitoring requirements intended to 
detect unauthorized modifications to BES Cyber Systems. NERC explains 
that

[[Page 24112]]

Requirement R3 establishes the vulnerability assessment requirements 
intended to ensure proper implementation of cyber security controls 
while promoting continuous improvement of a responsible entity's cyber 
security posture.\38\
---------------------------------------------------------------------------

    \38\ Id.
---------------------------------------------------------------------------

    33. CIP-011-1--Cyber Security--Information Protection: NERC states 
that proposed CIP-011-1 is a new standard consolidating the information 
protection requirements from previous versions of CIP-003 and CIP-007. 
Requirement R1 specifies information protection controls to prevent 
unauthorized access to BES Cyber System Information. Requirement R2 
specifies reuse and disposal provisions to prevent unauthorized 
dissemination of protected information.\39\
---------------------------------------------------------------------------

    \39\ Id. at 13-14.
---------------------------------------------------------------------------

III. Discussion

    34. Pursuant to section 215(d) of the FPA, we propose to approve 
the CIP version 5 Standards, CIP-002-5 through CIP-011-1 as just, 
reasonable, not unduly discriminatory or preferential, and in the 
public interest. The proposed CIP version 5 Standards, which pertain to 
the cyber security of the bulk electric system, represent an 
improvement over the current Commission-approved CIP Reliability 
Standards. For example, the CIP version 5 Standards adopt new cyber 
security controls that are intended to safeguard physical and 
electronic access to BES Cyber Systems. Further, NERC proposes a new 
approach to identifying and classifying BES Cyber Systems that will 
require at least a minimum classification of ``Low Impact'' for all BES 
Cyber Systems.
    35. With regard to controls, the proposed CIP version 5 Standards 
include twelve requirements with new cyber security controls. These new 
cyber security controls should improve the defense-in-depth posture of 
users, owners and operators of the Bulk-Power System. For example, 
Requirement R1.3 of proposed Reliability Standard CIP-005-5 requires 
responsible entities to implement inbound and outbound network access 
permissions, and the reason for granting access. All other access is 
denied by default. Implementing outbound access permissions can prevent 
malware from reaching out to a command and control system, potentially 
reducing the effectiveness of the malware. As another example, pursuant 
to proposed CIP-005-5, Requirement R1.5, responsible entities must 
monitor for suspicious inbound and outbound communications at all 
access points to the Electronic Security Perimeter. Monitoring 
communications can detect and help prevent malicious code from 
transferring between networks. Other new controls pertain to increased 
minimum protections for remote access (CIP-005-5, Requirement R2), 
protection against the use of unnecessary physical input/output ports 
(CIP-007-5, Requirement R1.2), testing recovery plans at least once 
every 36 months through an operational exercise (CIP-009-5, Requirement 
R2.3), and developing a baseline configuration of BES Cyber Systems and 
monitoring for unauthorized changes to the baseline configuration (CIP-
010-1, Requirement R1.1 and R2.1). We believe that the proposed new 
controls will improve the security posture of responsible entities and 
represent an improvement in the CIP Reliability Standards.
    36. In addition, NERC has proposed to adopt a new approach to 
identifying and classifying BES Cyber Systems that will require at 
least a minimum classification of ``Low Impact'' for all BES Cyber 
Systems.\40\ Specifically, NERC has proposed to adopt a process that 
will categorize BES Cyber Systems as having a Low, Medium, or High 
Impact on the reliable operation of the bulk electric system. Once a 
responsible entity has categorized its BES Cyber System(s), the 
responsible entity must then apply the associated requirements of the 
remaining CIP Reliability Standards, i.e., CIP-003-5 through CIP-011-1. 
The proposed new approach to categorizing BES Cyber Systems is a step 
towards applying the CIP protections more comprehensively to better 
assure the protection of the bulk electric system.
---------------------------------------------------------------------------

    \40\ See Reliability Standard CIP-002-5.
---------------------------------------------------------------------------

    37. Accordingly, for the reasons discussed above, the Commission 
proposes to approve the CIP version 5 Standards.
    38. We also propose to approve the nineteen new or revised 
definitions associated with the proposed Reliability Standards for 
inclusion in the NERC Glossary. In addition, we seek comment on certain 
aspects of the proposed definitions. Depending on the comments and 
explanations received, we may determine that it is appropriate to 
direct that NERC develop modifications to certain proposed definitions 
to eliminate ambiguities and assure that BES Cyber Assets are 
adequately protected.
    39. We further propose to approve 30 of the 32 Violation Risk 
Factors (VRF). However, we propose to direct NERC to modify the VRF 
assignment for CIP-006-5, Requirement R3 from Lower to Medium, and to 
modify the VRF assigned to CIP-004-5, Requirement R4 from Lower to 
Medium. In addition, we propose to direct NERC to modify the Violation 
Severity Levels (VSL) for the CIP version 5 Standards. We seek comment 
on these proposals.
    40. We propose to approve NERC's proposal to allow responsible 
entities to transition from compliance with the currently-effective CIP 
version 3 Standards to compliance with the CIP version 5 Standards, 
essentially retiring the CIP version 4 Standards prior to mandatory 
compliance. Thus, upon approval of the CIP version 5 Standards in a 
Final Rule in this docket, CIP-002-4 through CIP-009-4 would not become 
effective, and CIP-002-3 through CIP-009-3 would remain in effect and 
would not be retired until the effective date of the CIP version 5 
Standards. However, we also raise questions whether the 24-month and 
36-month implementation periods proposed by NERC for the CIP version 5 
Standards are necessary, and what activities are required to effect the 
transition during the proposed implementation periods.
    41. While we propose to approve the CIP version 5 Standards, we 
have also identified several concerns with certain provisions of the 
CIP version 5 Standards. In particular, as discussed in detail below, 
we are concerned that NERC's proposal to include language that requires 
entities to ``identify, assess, and correct'' deficiencies is unclear 
with respect to the implementation and compliance obligations it 
imposes and that it is too vague to audit and enforce compliance. 
Therefore, as explained below, we seek comment on this language.
    42. Further, the advancement in security resulting from NERC's 
adoption of a tiered asset categorization, including requiring at least 
a minimum classification of ``Low Impact'' for all BES Cyber Systems, 
can be enhanced by: (1) Ensuring that the CIP Reliability Standards are 
clear, unambiguous, and enforceable; (2) ensuring that the scope of 
assets covered by the definition of ``BES Cyber System'' and associated 
terms captures the right assets for protection; and (3) ensuring that 
the minimum protections required for ``Low Impact'' assets are 
reasonable. Thus, we propose to direct that NERC develop a modification 
to CIP-003-5, Requirement R2, to require that responsible entities 
adopt specific, technically-supported cyber security controls for Low 
Impact assets. We discuss these proposed modifications below.
    43. Accordingly, we discuss the following matters below: (A) The

[[Page 24113]]

``identify, assess, and correct'' language; (B) BES Cyber Asset 
categorization; (C) proposed definitions; (D) implementation plan; (E) 
Violation Risk Factor and Violation Severity Level assignments; and (F) 
other technical issues.

A. ``Identify, Assess, and Correct'' Language

NERC Petition
    44. As noted above, 17 requirements of the CIP version 5 Standards 
incorporate ``a requirement that Responsible Entities implement cyber 
policies in a manner to `identify, assess, and correct' deficiencies.'' 
\41\ NERC states that the proposed ``identify, assess, and correct'' 
language is ``[c]onsistent with the NIST Risk Management Framework and 
the Commission's guidance in prior orders,'' asserting that the 
``implementation of certain CIP version 5 requirements in a manner to 
``identify, assess, and correct'' deficiencies emulates the FERC Policy 
Statement on Penalty Guidelines.'' \42\ During the development of the 
CIP version 5 Standards, some commenters were concerned that ``there is 
no clear mechanism with how [the proposed ``identify, assess, and 
correct'' language] will be audited or that there may be inconsistent 
audits across Regions.'' \43\ In response, the drafting team stated 
that the ``intent [of the language] is to change the basis of a 
violation in these requirements so that they are not focused on whether 
there is a deficiency, but on identifying, assessing and correcting 
deficiencies.'' \44\
---------------------------------------------------------------------------

    \41\ Petition at 33.
    \42\ Id.
    \43\ Id. at App. F, Part 2, p. 3435.
    \44\ Id.
---------------------------------------------------------------------------

    45. In addition, the drafting team explained that the CIP version 5 
Standards are written to require documented processes set forth in the 
tables that accompany the requirements. According to the drafting team, 
in moving toward a risk-based approach, ``[e]ntities are to have the 
processes; the processes must meet the requirements in the tables [of 
the CIP standards]; and the entities shall implement those processes in 
a manner that identifies assesses, and corrects deficiencies.'' \45\
---------------------------------------------------------------------------

    \45\ Id. at App. F, Part 2, p. 3436.
---------------------------------------------------------------------------

Discussion
    46. NERC has not sufficiently explained the proposed ``identify, 
assess, and correct'' language, which NERC has elsewhere referred to as 
``self-correcting language.'' \46\ As we explain below, we are 
concerned that this language is unclear with respect to the 
implementation and compliance obligations it places on regulated 
entities and that it is too vague to audit and enforce compliance. 
Therefore, we seek comment on the meaning of this language and on how 
it will be implemented and enforced. Depending on the comments and 
explanations received, we may determine that it is appropriate to 
direct NERC to develop modifications. For example, the modification may 
seek to direct NERC to clarify both the implementation and compliance 
obligations created by this language and the criteria by which auditors 
will be able to determine compliance. Alternatively, we may direct NERC 
to remove this language if it results in requirements that degrade the 
protections afforded by the CIP version 5 Standards and are difficult 
to implement and enforce.
---------------------------------------------------------------------------

    \46\ See North American Electric Reliability Corporation, 
Informational Filing, Docket Nos. RM05-17-000, et al., at 1, n. 3 
(filed December 31, 2012) (NERC refers to the ``identify, assess, 
and correct'' term as ``self correcting language'' in the 
Reliability Standards Development Plan for 2013-2015).
---------------------------------------------------------------------------

    47. Initially, we are concerned that the proposed ``identify, 
assess, and correct'' language is unclear with respect to the 
implementation and compliance obligations it places on regulated 
entities. For example, it is unclear whether the inclusion of the 
``identify, assess and correct'' language in the requirements imposes 
one obligation on the responsible entity (i.e., to ensure the entity 
has a process in place to identify, assess and correct a violation) or 
two obligations (i.e., to (1) ensure the entity has a process in place 
to identify, assess and correct a violation and (2) to ensure that the 
underlying substantive requirement is not violated). In the former 
case, the language could be interpreted or understood to mean that a 
violation of a Requirement occurs only if the responsible entity did 
not identify, assess and correct the deficiencies. In the latter case, 
entities would have to demonstrate that they identify, assess, and 
correct the deficiencies and, in addition, not violate the underlying 
requirement.
    48. The proposed ``identify, assess, and correct'' language is 
ambiguous enough to support both interpretations. Moreover, the 
comments of the drafting team can be read to support both 
interpretations. On one hand, the drafting team stated that the 
``intent [of the language] is to change the basis of a violation in 
these requirements so that they are not focused on whether there is a 
deficiency, but on identifying, assessing and correcting 
deficiencies.'' \47\ This suggests that the language is part of a 
single compliance obligation and does not impose an additional 
obligation not to violate the underlying requirement. On the other 
hand, the drafting team stated that ``[e]ntities are to have the 
processes; the processes must meet the requirements in the tables [of 
the CIP standards]; and the entities shall implement those processes in 
a manner that identifies assesses, and corrects deficiencies.'' \48\ 
This suggests that the language creates a requirement to ``identify, 
assess and correct'' in addition to the obligation to meet the 
underlying substantive requirement imposed by the standard. 
Additionally, it is not clear to what extent the drafting team's 
statement that entities are required to implement processes ``in a 
manner that identifies assesses, and corrects deficiencies'' permits 
auditors and the Commission to evaluate the adequacy of an entity's 
processes or against what criteria they would be evaluated. We seek 
comment on the purpose of this language and the implications for 
reliability of both interpretations.
---------------------------------------------------------------------------

    \47\ NERC Petition at App. F, Part 2, p. 3435.
    \48\ Id. at App. F, Part 2, p. 3436 [emphasis added].
---------------------------------------------------------------------------

    49. Additionally, we are concerned that under either interpretation 
the proposed the ``identify, assess, and correct'' language is too 
vague to be audited. NERC does not explain what is expected of 
responsible entities or the intended meaning of the individual terms 
``identify,'' ``assess,'' ``correct,'' and ``deficiencies'' as they are 
used in CIP version 5.
    50. As to the term ``identify,'' it is not clear whether a 
responsible entity is expected to take steps to recognize past 
deficiencies, ongoing deficiencies, or deficiencies that are likely to 
or may occur in the future. NERC does not explain the scope of 
activities that are implied in the term ``assess,'' which could range 
from a cursory review of an isolated ``deficiency'' to a detailed root-
cause analysis. In addition, NERC has not explained what it means for a 
responsible entity to ``correct'' a deficiency. This term may include 
ending a deficiency, taking measures to address the effect of a 
deficiency, or taking steps to prevent a deficiency from recurring. 
NERC does not explain, nor does the text of the CIP version 5 Standards 
define, the term ``deficiencies.'' It is not clear whether 
``deficiencies'' means ``possible violations,'' as defined in NERC's 
Compliance Monitoring and

[[Page 24114]]

Enforcement Program, or extend to a broader category of matters. In 
short, if a goal of this language is to encourage strong internal 
controls, the language itself provides no basis for distinguishing 
strong controls from weak controls and instead leaves this issue to be 
disputed in future enforcement proceedings. We seek comment on these 
concerns and on any modification that may be necessary to address them.
    51. In addition, the petition does not identify a reasonable 
timeframe for identifying, assessing and correcting deficiencies. 
Without identifying a timeframe it is conceivable that, as long as the 
responsible entity identifies, assesses and corrects a deficiency 
before, or perhaps even when, NERC, the Regional Entities or the 
Commission discover the deficiency, there is no possible violation of 
the CIP Reliability Standards, regardless of the seriousness of the 
deficiency, the duration of the deficiency, or the length of time 
between the identification and correction of the deficiency. We seek 
comment on these concerns and on any modification that may be necessary 
to address them.
    52. The proposed ``identify, assess, and correct'' language allows 
a responsible entity to avoid audit risk. Specifically, since there is 
no required timeframe for identifying, assessing and correcting a 
deficiency, a responsible entity could defer its required assessment of 
its CIP compliance program until just prior to a scheduled audit or 
self-certification. The petition does not explain whether the 
responsible entity is required to disclose the identified deficiencies 
in such cases. Nor is it clear whether the audit team can identify a 
potential violation if the responsible entity identifies the deficiency 
and is in the process of assessing and correcting it, even if the 
deficiency is identified long after it came into existence. It is also 
not clear how prior deficiencies that are identified, assessed and 
corrected are treated in assessing a responsible entity's compliance 
history. We seek comment on these concerns and on any modification that 
may be necessary to address them.
    53. The petition does not explain how NERC will treat multiple 
corrections of deficiencies concerning the same requirement, or the 
quality of the mitigation. It is unclear whether previous corrections 
will be reported or otherwise made known to NERC because they are not 
considered potential violations of the standard. We seek comment on 
these concerns and on any modification that may be necessary to address 
them.
    54. We are also concerned about how performance of the ``identify, 
assess and correct'' phrase can be expected to be uniform or consistent 
among responsible entities absent additional clarification, explanation 
or identification of techniques that Regional Entities and NERC would 
use to determine performance that would comply with requirements that 
include this phrase. NERC indicates that Audit Worksheets will address 
the ``identify, assess and correct'' provisions. However, the Audit 
Worksheets have not been developed or submitted for consideration in 
the petition. We seek comment on these concerns and on any modification 
that may be necessary to address them.
    55. In the petition, NERC states that the ``identify, assess, and 
correct'' language is based upon the assess \49\ and monitor \50\ steps 
of the NIST Risk Management Framework.\51\ NERC does not identify any 
specific source in these steps of the NIST Risk Management Framework 
for the ``identify, assess, and correct'' language. Moreover, both the 
assess and monitor steps of the NIST Risk Management Framework are tied 
to guidance publications that establish clear expectations for 
assessments and continuous monitoring.\52\ As noted above, neither the 
CIP version 5 Standards nor the petition explain what is expected of 
responsible entities under the proposed ``identify, assess, and 
correct'' language. We are not opposed to adopting a process to assess 
and monitor a responsible entity's performance under the CIP 
Reliability Standards and, in fact, support the idea of having such a 
process along with clear, well-developed guidance materials. We are 
concerned, however, that including the assess and monitor processes in 
the language of a Requirement, as proposed by NERC, could render such 
provisions unenforceable. We seek comment on these concerns and on any 
modification that may be necessary to address them.
---------------------------------------------------------------------------

    \49\ SP 800-37 describes the assess step as: ``Assess[ing] the 
security controls using appropriate procedures to determine the 
extent to which the controls are implemented correctly, operating as 
intended, and producing the desired outcome with respect to meeting 
the security requirements for the system.''
    \50\ SP 800-37 describes the monitor step as: ``Monitor[ing] and 
assess[ing] selected security controls in the information system on 
an ongoing basis including assessing security control effectiveness, 
documenting changes to the system or environment of operation, 
conducting security impact analyses of the associated changes, and 
reporting the security state of the system to appropriate 
organizational officials.''
    \51\ See Petition at 32.
    \52\ See SP 800-53A Revision 1, Guide for Assessing the Security 
Revision 1 Controls in Federal Information Systems and Organizations 
and SP 800-137, Information Security Continuous Monitoring (ISCM) 
for Federal Information Systems and Organizations.
---------------------------------------------------------------------------

    56. Depending on the comments and explanations received, we may 
determine that it is appropriate to direct NERC to develop 
modifications. For example, the modification may clarify the 
implementation and compliance obligations created by this language, and 
the standards by which auditors will be able to determine compliance. 
Alternatively, we may direct NERC to remove this language if it results 
in requirements that degrade the protections afforded by the CIP 
version 5 Standards and are difficult to implement and enforce.
    57. We emphasize that our concerns about the proposed ``identify, 
assess, and correct'' language should not be read to prejudge the 
ongoing efforts at NERC to develop changes to the compliance and 
enforcement program, and this NOPR should not be read as a ruling on 
that effort. We support wholly NERC's effort to encourage responsible 
entities to develop internal controls and, moreover, agree that 
responsible entities should have strong internal controls and receive 
recognition for such controls when penalties actually are found 
warranted. Effective internal controls can reduce the need for external 
enforcement processes, and the resources committed by all participants 
to these processes. As the Commission stated in the Revised Policy 
Statement on Penalty Guidelines, ``the Penalty Guidelines served only 
to solidify the importance we place on compliance by providing 
substantial and transparent mitigation credit for effective compliance 
programs.'' \53\ We also acknowledge and agree that the resources 
committed to compliance monitoring and enforcement should be reasonably 
calibrated to the reliability risks presented.
---------------------------------------------------------------------------

    \53\ Revised Policy Statement on Penalty Guidelines, 132 FERC ] 
61,216, at P 109 (2010).
---------------------------------------------------------------------------

B. BES Cyber Asset Categorization and Protection

    58. Proposed Reliability Standard CIP-002-5 requires responsible 
entities to categorize BES Cyber Systems as having a Low, Medium, or 
High Impact. NERC states that proposed CIP-002-5 requires ``the 
identification and categorization of BES Cyber Systems according to 
specific criteria that characterize their impact for the application of 
cyber security requirements commensurate with the adverse impact that 
loss, compromise,

[[Page 24115]]

or misuse of those BES Cyber Systems could have on the reliable 
operation of the [bulk electric system].'' \54\ NERC states that the 
new approach to classifying cyber systems, which requires a minimum 
classification of ``Low Impact'' for all BES Cyber Systems, ``resulted 
from a review of the NIST Risk Management Framework for categorizing 
and applying security controls, a review that was directed by the 
Commission in Order No. 706.'' \55\
---------------------------------------------------------------------------

    \54\ Petition at 11.
    \55\ Id. at 15.
---------------------------------------------------------------------------

    59. NERC's new approach to categorizing BES Cyber Systems is a step 
closer to comprehensively protecting assets that could cause cyber 
security risks to the bulk electric system. However, as discussed 
below, the Commission believes that NERC should consider improving the 
categorization process and should modify the minimum protections 
required for ``Low Impact'' assets to identify specific controls.
1. Reliability Based Criteria
    60. In Order No. 706, the Commission directed NERC to ``monitor the 
development and implementation of the NIST standards to determine if 
they contain provisions that will protect the Bulk-Power System better 
than the CIP Reliability Standards.'' \56\ The incorporation of new 
NIST-like concepts into the CIP Reliability Standards, such as the Low-
Medium-High categorization, is encouraging. However, as discussed 
below, significant differences exist between the NIST Risk Management 
Framework and the proposed CIP version 5 Standards, particularly with 
regard to system identification and categorization.
---------------------------------------------------------------------------

    \56\ Order No. 706, 122 FERC ] 61,040 at P 233.
---------------------------------------------------------------------------

    61. As noted above, proposed Reliability Standard CIP-002-5 
requires each responsible entity to categorize BES Cyber Systems as 
having a Low, Medium, or High Impact based on the adverse impact that 
loss, compromise, or misuse of its BES Cyber Systems could have on the 
reliable operation of the bulk electric system. NERC states that this 
categorization process is based upon the NIST Risk Management 
Framework. The NIST Risk Management Framework, however, utilizes a 
categorization process based on the loss of confidentiality, integrity, 
and availability of systems, as defined in the Federal Information and 
Security Act of 2002.\57\
---------------------------------------------------------------------------

    \57\ See Federal Information and Security Act of 2002, 44 U.S.C. 
3542 (2002) (Confidentiality is defined as preserving authorized 
restrictions on access and disclosure, including a means for 
protecting personal privacy and proprietary information; integrity 
as guarding against improper information modification or 
destruction, and includes ensuring information nonrepudiation and 
authenticity; availability as ensuring timely and reliable access to 
and use of information).
---------------------------------------------------------------------------

    62. The NIST Risk Management Framework requires a low, moderate, or 
high level of protection for devices, systems, and associated data 
based on the criticality of the protected information.\58\ The 
categorization process establishes a foundation for security 
standardization across different types of data, controls, and 
equipment.\59\ While the CIP version 5 Standards share a similar 
grouping of Low-Medium-High categories with the NIST Risk Management 
Framework, the categorization processes proposed under the CIP version 
5 Standards and the NIST Risk Management Framework are different. 
Rather than categorize assets based on the loss of confidentiality, 
integrity, and availability of systems, CIP-002-5 categorizes assets 
based on ``reliability impact.''
---------------------------------------------------------------------------

    \58\ See NIST Special Publication 800-60, at 9. According to 
NIST, ``security categories are based on the potential impact on an 
organization should certain events occur. The potential impacts 
could jeopardize the information and information systems needed by 
the organization to accomplish its assigned mission, protect its 
assets, fulfill its legal responsibilities, maintain its day-to-day 
functions, and protect individuals. Security categories are to be 
used in conjunction with vulnerability and threat information in 
assessing the risk to an organization.''
    \59\ See NIST Special Publication 800-60 at 4-5. NIST states 
that the value of information security categorization is to enable 
organizations ``to proactively implement appropriate information 
security controls based on the assessed potential impact to 
information confidentiality, integrity, and availability and in turn 
to support their mission in a cost-effective manner.''
---------------------------------------------------------------------------

    63. Specifically, the reliability impacts underlying the CIP-002-5 
asset categorizations are based on facility ratings, such as generation 
capacity and voltage levels. For example, the CIP-002-5--Attachment 1 
Impact Rating Criteria establishes a threshold for ``Medium Impact'' 
generation at 1500 MW. This determination is based on the assumption 
that generation facilities with smaller values would have a ``Low 
Impact'' on grid reliability.\60\ However, the petition does not 
contain or reference reliability studies that provide the supporting 
engineering analysis for such thresholds. For example, the ``Medium 
Impact'' thresholds for both generation and transmission do not seem to 
consider the impacts of a coordinated attack on ``Low Impact'' systems, 
such as the loss of several or all 100 kV facilities owned or operated 
by a single entity.
---------------------------------------------------------------------------

    \60\ See Reliability Standard CIP-002-5--BES Cyber System 
Categorization, at Attachment 1.
---------------------------------------------------------------------------

    64. NERC's proposed categorization process is based on facility 
ratings, such as generation capacity and voltage levels. As discussed 
elsewhere, the NIST Risk Management Framework categorizes systems based 
on cyber security principles regarding the confidentiality, integrity, 
and availability of systems.\61\ We accept NERC's proposal at this 
time. However, we may revisit the categorization of assets under the 
CIP Reliability Standards at a later date.
---------------------------------------------------------------------------

    \61\ For example, the ISA99 suite of standards (also known as 
ISA/IEC-62443: ``Security for Industrial Automation and Control 
Systems'') utilizes an approach similar to what is outlined in the 
NIST Framework and further clarifies system impact to mean ``impacts 
that might result from security failures, taking into account the 
consequences of a loss of confidentiality, system integrity, or 
availability of the assets, loss of reliability and manipulation of 
the [industrial control system].'' See ISA/IEC-62443-2-1, 2013 
Draft. Requirement 4.4.2.1. Establishing and Managing the Industrial 
Automated Control System Security Management System. https://isa99.isa.org/Documents/Drafts/ISA-d62443-2-1.pdf.
---------------------------------------------------------------------------

2. Protection of Low Impact BES Cyber Assets
    65. Reliability Standard CIP-003-5, Requirement R2, which pertains 
to the obligations for BES Cyber Systems identified as Low Impact, 
provides:

    R2. Each Responsible Entity for its assets identified in CIP-
002-5, Requirement R1, Part R1.3 [i.e., low impact systems], shall 
implement, in a manner that identifies, assesses, and corrects 
deficiencies, one or more documented cyber security policies that 
collectively address the following topics, and review and obtain CIP 
Senior Manager approval for those policies at least once every 15 
calendar months: * * *
    2.1 Cyber security awareness;
    2.2 Physical security controls;
    2.3 Electronic access controls for external routable protocol 
connections and Dial-up Connectivity; and
    2.4 Incident response to a Cyber Security Incident.
    An inventory, list, or discrete identification of low impact BES 
Cyber Systems or their BES Cyber Assets is not required.

    This is the only CIP version 5 Requirement applicable to Low Impact 
systems.
    66. NERC states that the proposed CIP version 5 Standards require a 
minimum classification of ``Low Impact'' for all BES Cyber Systems that 
are not classified as either ``Medium'' or ``High'' Impact. The 
proposed new approach to identify Low Impact BES Cyber Systems is a 
positive step towards applying the CIP Reliability Standards in a more 
comprehensive manner to better assure the protection of the bulk 
electric system. However, we have concerns regarding Requirement R2 of 
Reliability Standard CIP-003-5, which sets forth the single compliance 
obligation for BES Cyber Systems categorized as Low

[[Page 24116]]

Impact. Requirement R2 requires responsible entities to ``implement * * 
* documented cyber security policies that collectively address * * * '' 
cyber security awareness, physical security controls, electronic access 
controls and incident response to a cyber security incident. Further, 
CIP-003-5, Requirement R2, simply requires responsible entities to 
implement documented policies, which could allow insufficient 
protection to Low Impact BES Cyber Assets.
    67. Under the proposed CIP version 5 Standards, a responsible 
entity is required to document and implement both policies and 
procedures to perform the specific requirements of CIP-003-5 through 
CIP-011-1 for systems identified as High or Medium Impact pursuant to 
the criteria in proposed CIP-002-5.\62\ By contrast, a responsible 
entity is only required to have ``documented cyber security policies'' 
for Low Impact BES Cyber Systems; there is no requirement to implement 
actual cyber security protections.\63\ While the Commission believes 
that an individual Medium or High Impact asset will have higher 
potential reliability impacts as compared to an individual Low Impact 
asset, the Reliability Standards must also enumerate specific, 
technically-supported cyber security controls for Low Impact assets.
---------------------------------------------------------------------------

    \62\ See Reliability Standard CIP-003-5--Cyber Security--
Security Management Controls, at Requirement R1.
    \63\ See Reliability Standard CIP-003-5--Cyber Security--
Security Management Controls, at Requirement R2.
---------------------------------------------------------------------------

    68. We support NERC's efforts to increase the scope of systems that 
are protected by the CIP Reliability Standards, but the lack of 
specificity regarding the content of the four policies covering Low 
Impact BES Cyber Systems raises the prospect of an ambiguous 
Reliability Standard that will be difficult for responsible entities to 
implement.
    69. Our concern is highlighted by NERC's supporting materials for 
proposed Reliability Standard CIP-003-5. For example, while Requirement 
R2.3 requires responsible entities to have policies on electronic 
access controls, the Guidelines and Technical Basis for CIP-003-5 
pertaining to Requirement R2.3 states that ``electronic access 
control'' is not meant ``in the specific technical sense requiring 
authentication, authorization, and auditing.'' \64\ However, it is 
unclear how an entity can perform electronic access control without 
some form of authentication or authorization. We also question whether 
the proposal to require a policy document can be considered 
implementing ``electronic perimeter protection,'' which NERC states is 
required at every impact level to implement a ``mutual distrust'' 
posture across all BES Cyber Systems.\65\
---------------------------------------------------------------------------

    \64\ See Reliability Standard CIP-003-5--Cyber Security--
Security Management Controls, at Page 18.
    \65\ See Petition at 40.
---------------------------------------------------------------------------

    70. We are concerned that NERC's proposal to limit the protections 
for Low Impact BES Cyber Systems to documented policies, as opposed to 
requiring specific cyber security protections, results in ambiguity 
that may lead to inconsistent and inefficient implementation of the CIP 
Reliability Standards with regard to Low Impact BES Cyber Systems, and 
may not provide an adequate roadmap for responsible entities to follow 
to ensure the reliable operation of the bulk electric system. 
Therefore, pursuant to section 215(d)(5) of the FPA, we propose to 
direct NERC to develop a modification to CIP-003-5, Requirement R2, to 
require responsible entities to adopt specific, technically-supported 
cyber security controls for Low Impact assets, as opposed to the 
proposed unspecified policies. We seek comment on this proposal. In 
particular, we seek comment on the value of adopting specific controls 
for Low Impact assets that reflect their cyber security risk level, 
similar to the NIST Risk Management Framework.
    71. Also, we seek comment on the lack of a requirement to have an 
inventory, list or discrete identification of Low Impact BES Cyber 
Systems. The definition of BES Cyber Systems is a threshold for 
determining applicability of the CIP Reliability Standards, so we 
assume responsible entities will in fact start by identifying all 
covered systems. If so, the rationale or benefit for not requiring an 
inventory, list or identification is unclear.

C. Proposed Definitions

    72. The proposed CIP version 5 Standards include nineteen 
definitions for inclusion in the NERC Glossary. This includes the 
addition of fifteen new definitions and four revised definitions, as 
well as the retirement of two definitions.\66\ We propose to approve 
the proposed definitions for inclusion in the NERC Glossary.
---------------------------------------------------------------------------

    \66\ Newly proposed definitions include BES Cyber Asset, BES 
Cyber System, BES Cyber System Information, CIP Exceptional 
Circumstances, CIP Senior Manager, Control Center, Dial-up 
Connectivity, Electronic Access Control or Monitoring Systems 
(EACMS), Electronic Access Point (EAP), External Routable 
Connectivity, Interactive Remote Access, Intermediate System, 
Physical Access Control Systems (PACS), Protected Cyber Assets 
(PCA), and Reportable Cyber Security Incident. Revised definitions 
include Cyber Assets, Cyber Security Incident, Electronic Security 
Perimeter (ESP), and Physical Security Perimeter (PSP). Retired 
definitions include Critical Assets and Critical Cyber Assets.
---------------------------------------------------------------------------

    73. We also seek comment on certain aspects of the proposed 
definitions. After receiving comments, depending on the adequacy of the 
explanations provided in response to our questions, we may direct NERC 
to develop modifications to certain proposed definitions to eliminate 
ambiguities and assure that BES Cyber Assets are adequately protected.
Definition--BES Cyber Asset
    74. In its Petition, NERC proposes the following definition of a 
BES Cyber Asset:

    A Cyber Asset that if rendered unavailable, degraded, or misused 
would, within 15 minutes of its required operation, misoperation, or 
non-operation, adversely impact one or more Facilities, systems, or 
equipment, which, if destroyed, degraded, or otherwise rendered 
unavailable when needed, would affect the reliable operation of the 
Bulk Electric System. Redundancy of affected Facilities, systems, 
and equipment shall not be considered when determining adverse 
impact. Each BES Cyber Asset is included in one or more BES Cyber 
Systems. (A Cyber Asset is not a BES Cyber Asset if, for 30 
consecutive calendar days or less, it is directly connected to a 
network within an ESP, a Cyber Asset within an ESP, or to a BES 
Cyber Asset, and it is used for data transfer, vulnerability 
assessment, maintenance, or troubleshooting purposes.)

    75. The first step in determining whether the substantive 
requirements of the CIP Reliability Standards apply is the 
identification of BES Cyber Assets pursuant to CIP-002-5. If an entity 
does not identify a BES Cyber Asset, the remaining CIP Reliability 
Standards do not apply. Thus, a clear understanding of the definition 
of BES Cyber Asset is important to assure accurate and consistent 
application of the CIP version 5 Standards.
    76. The definition begins with ``[a] Cyber Asset that if rendered 
unavailable, degraded, or misused would, within 15 minutes of its 
required operation, misoperation, or non-operation, adversely impact 
one or more Facilities, systems, or equipment * * *.'' The CIP version 
4 Standards include a 15 minute parameter for the identification of 
Critical Cyber Assets associated with generation units at a single 
plant location with an aggregate highest rated net Real Power 
capability of the preceding 12 months equal to or exceeding 1500 MW in 
a single

[[Page 24117]]

Interconnection.\67\ The drafting team adopted the 15 minute parameter 
in CIP version 4 in recognition of a concern that ``there may be 
Facilities which, while essential to the reliability and operability of 
the generation facility, may not have real-time operational impact 
within the specified real-time operations impact window of 15 
minutes.'' \68\ An example considered during the development of CIP 
version 4 was a coal-handling facility, the outage of which typically 
does not disrupt operations until after at least a short period of 
time. Thus, the 15 minute language found in the CIP version 4 Standards 
is tailored to address a specific concern with one class of assets. 
NERC now proposes to adopt similar 15 minute language in relation to 
all Cyber Assets associated with all classes of assets without 
explanation.
---------------------------------------------------------------------------

    \67\ See Reliability Standard CIP-002-4a (Critical Cyber Asset 
Identification), at Requirement R2.
    \68\ NERC Petition, Docket No. RM11-11-000, at 16 (filed Feb. 
10, 2011).
---------------------------------------------------------------------------

    77. We seek comment on the purpose and effect of the 15 minute 
limitation. In particular, we seek comment on the types of Cyber Assets 
that would meet the ``within 15 minutes'' caveat. Further, we seek 
comment on the types of assets or devices that the 15 minute language 
would exclude and, in particular, whether the caveat ``within 15 
minutes'' exempts devices that have an impact on the reliable operation 
of the bulk electric system. We also seek comment on whether the use of 
a specified time period as a basis for identifying assets for 
protection is consistent with the procedures adopted under other cyber 
security standards, such as the NIST Risk Management Framework, that 
apply to industrial control and Supervisory Control and Data 
Acquisition (SCADA) systems, as well as traditional information 
technology systems.
    78. The proposed definition of BES Cyber Asset also provides that 
``[a] Cyber Asset is not a BES Cyber Asset if, for 30 consecutive 
calendar days or less, it is directly connected to a network within an 
[Electronic Security Perimeter], a Cyber Asset within an [Electronic 
Security Perimeter], or to a BES Cyber Asset, and it is used for data 
transfer, vulnerability assessment, maintenance, or troubleshooting 
purposes.'' We seek comment on the purpose and anticipated effect of 
this provision in identifying BES Cyber Assets. Specifically, we seek 
comment on whether the clause could result in the introduction of 
malicious code or new attack vectors to an otherwise trusted and 
protected system, as demonstrated in recent real-world incidents.\69\ 
In addition, we seek comment on the types of Cyber Assets used for 
``data transfer, vulnerability assessment, maintenance, or 
troubleshooting purposes,'' as this language is used in the proposed 
BES Cyber Asset definition. If the terms cited here leave unreasonable 
gaps in the applicability of the CIP Reliability Standards, we will 
direct appropriate modifications.
---------------------------------------------------------------------------

    \69\ See Department of Homeland Security Industrial Control 
Systems Cyber Emergency Response Team (ICS-CERT) Monthly Monitor 
(October-December 2012) at 1. Available at https://ics-cert.us-cert.gov/pdf/ICS-CERT_Monthly_Monitor_Oct-Dec2012.pdf. The 
October-December 2012 ICS-CERT Monthly Monitor describes two recent 
situations where malware was introduced into two electric generation 
industrial control systems (ICS) through removable media (i.e., USB 
drive) that was being used to back-up a control system environment 
and update software.
---------------------------------------------------------------------------

Definition--Control Center

    79. NERC proposes the following definition of a control center:

    One or more facilities hosting operating personnel that monitor 
and control the Bulk Electric System (BES) in real-time to perform 
the reliability tasks, including their associated data centers, of: 
1) a Reliability Coordinator, 2) a Balancing Authority, 3) a 
Transmission Operator for transmission Facilities at two or more 
locations, or 4) a Generator Operator for generation Facilities at 
two or more locations.

    80. We seek comment on the meaning of the phrase ``generation 
Facilities at two or more locations'' and, specifically, whether the 
phrase includes two or more units at one generation plant and/or two or 
more geographically dispersed units.
Definition--Cyber Asset
    81. NERC's currently-effective Glossary definition of Cyber Asset 
provides:

Programmable electronic devices and communication networks including 
hardware, software, and data.

NERC proposes the following definition of a Cyber Asset:

Programmable electronic devices, including the hardware, software, 
and data in those devices.

Thus, NERC's proposed definition of Cyber Asset removes the phrase 
``communication networks.'' We note that the FPA defines 
``cybersecurity incident'' as follows:

A malicious act or suspicious event that disrupts, or was an attempt 
to disrupt, the operation of those programmable electronic devices 
and communication networks, including hardware, software and data 
that are essential to the reliable operation of the bulk power 
system.[\70\]

    \70\ 16 U.S.C. 824o(a)(8) (2006) (emphasis added).

Thus, it appears that NERC's revised definition of Cyber Asset removes 
a type of asset the statute defines as essential to the reliable 
operation of the Bulk-Power System.
    82. We seek from NERC and other commenters an explanation for the 
purpose and intended effect of removing ``communication networks'' from 
the definition of a Cyber Asset. Further, we seek comment whether the 
removal of ``communication networks'' from the definition could create 
a gap in cyber security and the CIP Reliability Standards. In addition, 
we seek comment on the purpose and intended effect of the phrase ``data 
in those devices'' and, in particular, whether the phrase excludes data 
being transferred between devices.
Reliability Tasks
    83. The term ``reliability tasks'' is an undefined term used in 
NERC's proposed definitions of BES Cyber System, Control Center, and 
Reportable Cyber Security Incident. For example, the proposed 
definition of BES Cyber System provides:

One or more BES Cyber Assets logically grouped by a responsible 
entity to perform one or more reliability tasks for a functional 
entity.

    84. We are concerned that the use of the undefined term 
``reliability tasks'' will likely lead to confusion during 
implementation and result in interpretation requests. We seek comment 
on the meaning and scope of the phrase ``reliability tasks'' and 
whether there is a common understanding of this phrase to assure 
accurate and consistent implementation of the definitions and, hence, 
the CIP version 5 Standards.\71\
---------------------------------------------------------------------------

    \71\ We note that the term ``reliability tasks'' is used in the 
NERC Functional Model to register entities based upon their 
responsibilities for the reliable operation of the Bulk-Power 
System.
---------------------------------------------------------------------------

Intermediate Devices
    85. NERC proposes to define Electronic Access Control or Monitoring 
Systems (EACMS) and Interactive Remote Access as follows:

EACMS--Cyber Assets that perform electronic access control or 
electronic access monitoring of the Electronic Security Perimeter(s) 
or BES Cyber Systems. This includes Intermediate Devices.

Interactive Remote Access--[* * *] Remote access originates from a 
Cyber Asset that is not an Intermediate Device and not located 
within any of the Responsible Entity's

[[Page 24118]]

Electronic Security Perimeter(s) or at a defined Electronic Access 
Point (EAP). [* * *]

Both proposed definitions include the undefined term ``intermediate 
devices.'' The proposed defined term ``Intermediate Systems'' was 
originally referred to as ``Intermediate Device'' in previous draft 
versions of the CIP version 5 Standards.\72\ This inconsistency may 
lead to confusion in application of the CIP version 5 Standards.
---------------------------------------------------------------------------

    \72\ The first balloted draft of the proposed CIP version 5 
Standards included a definition for ``Intermediate Device.'' The 
name of this term did not change to ``Intermediate System'' until 
the fourth and final balloted draft.
---------------------------------------------------------------------------

    86. Therefore, we seek comment on whether the proposed defined term 
``Intermediate Systems'' is the appropriate reference in the proposed 
definitions of Electronic Access Control or Monitoring Systems (EACMS) 
and Interactive Remote Access, as opposed to the undefined term 
``intermediate devices.''

D. Implementation Plan

    87. NERC's proposed implementation plan for the CIP version 5 
Standards addresses two distinct issues. First, NERC proposes language 
that would provide a transition from CIP version 3 to CIP version 5, 
thereby bypassing implementation of CIP version 4. Specifically, the 
proposed language provides:

    Notwithstanding any order to the contrary, CIP-002-4 through 
CIP-009-4 do not become effective, and CIP-002-3 through CIP-009-3 
remain in effect and are not retired until the effective date of the 
Version 5 CIP Cyber Security Standards under this implementation 
plan.

NERC states that the proposed language is intended to alleviate 
uncertainty resulting from ``industry stakeholders not knowing whether 
the Commission will act on CIP Version 5 prior to the CIP Version 4 
effective date, April 1, 2014 * * *.'' \73\
---------------------------------------------------------------------------

    \73\ Petition at 43.
---------------------------------------------------------------------------

    88. Second, NERC proposes a 24-month implementation period for 
``High Impact'' and ``Medium Impact'' BES Cyber Systems, and a 36-month 
implementation period for ``Low Impact'' BES Cyber Systems. The NERC 
petition does not provide an explanation or justification for the 
proposed implementation periods.
    89. We propose to approve the implementation plan for the CIP 
version 5 Standards to allow responsible entities to transition from 
compliance with the currently-effective CIP version 3 Standards to 
compliance with the CIP version 5 Standards, essentially retiring the 
CIP version 4 Standards prior to mandatory compliance. Thus, upon 
approval of the CIP version 5 Standards in a Final Rule in this docket, 
CIP-002-4 through CIP-009-4 would not become effective, and CIP-002-3 
through CIP-009-3 would remain in effect and would not be retired until 
the effective date of the CIP version 5 Standards. However, we do not 
see why the 24-month and 36-month implementation periods proposed by 
NERC for the CIP version 5 Standards are necessary.
    90. We seek comment on the activities and any other considerations 
that justify 24-month and 36-month implementation periods for the CIP 
version 5 Standards. We seek an explanation of the activities that 
responsible entities will have to undertake to achieve timely 
compliance with the CIP version 5 Standards. We also seek comment on 
whether responsible entities can achieve compliance with the CIP 
version 5 Standards in a shorter period for those Cyber Assets that 
responsible entities have identified to comply with the currently-
effective CIP Reliability Standards. Finally, we seek comment on the 
feasibility of a shorter implementation period and the reasonable time 
frame for a shorter implementation period. If the comments do not 
provide reasonable justification for the proposed implementation 
periods, we will direct appropriate modifications.

E. Violation Risk Factor/Violation Severity Level Assignments

    91. NERC requests approval of the Violation Risk Factors (VRF) and 
Violation Severity Levels (VSL) assigned to the CIP version 5 
Standards. In particular, NERC requests approval of 32 VRFs, one set 
for each requirement in the proposed CIP version 5 Standards. As 
explained below, we seek comment on our proposal to accept 30 VRFs and 
to direct NERC to develop modifications to two VRFs. Specifically, we 
seek comment on our proposal to direct NERC to modify the VRF 
assignment for CIP-006-5, Requirement R3 from Lower to Medium, and to 
modify the VRF assigned to CIP-004-5, Requirement R4 from Lower to 
Medium. In addition, we propose to direct NERC to modify the VSLs for 
the CIP version 5 Standards.
Lower VRF for Maintenance and Testing of Physical Access Control 
Systems
    92. NERC assigns a Lower VRF to proposed CIP-006-5, Requirement R3, 
which addresses the maintenance and testing of Physical Access Control 
Systems (PACS). The NERC mapping document comparing the CIP version 4 
and CIP version 5 Standards identifies CIP-006-4, Requirement R8, which 
addresses the maintenance and testing of all physical security 
mechanisms, as the comparable requirement in the CIP version 4 
Standards.\74\ Reliability Standard CIP-006-4, Requirement R8 is 
assigned a VRF of Medium.
---------------------------------------------------------------------------

    \74\ Mapping Document Showing Translation of CIP-002-4 to CIP-
009-4 into CIP-002-5 to CIP-009-5, CIP-010-1, and CIP-011-1. Page 
20-21. Accessible from: https://www.nerc.com/docs/standards/sar/Mapping_Document_012913.pdf.
---------------------------------------------------------------------------

    93. Our Violation Risk Factor guidelines require, among other 
things, consistency within a Reliability Standard (guideline 2) and 
consistency between requirements that have similar reliability 
objectives (guideline 3).\75\ The petition does not explain the change 
from a Medium VRF to a Lower VRF for a comparable requirement. We 
propose to modify the VRF assigned to CIP-006-5, Requirement R3 from 
Lower to Medium. However, NERC and other commenters are free to provide 
additional explanation than provided thus far to demonstrate CIP-006-5, 
Requirement R3 is properly assigned a Lower VRF.
---------------------------------------------------------------------------

    \75\ See N. Amer. Elec. Reliability Corp., 119 FERC ] 61,145, 
order on reh'g and compliance filing, 120 FERC ] 61,145, at PP 8-13 
(2007) (VRF Order). The guidelines are: (1) Consistency with the 
conclusions of the Blackout Report; (2) Consistency within a 
Reliability Standard; (3) Consistency among Reliability Standards; 
(4) Consistency with NERC's Definition of the Violation Risk Factor 
Level; and (5) Treatment of Requirements that Co-mingle More Than 
One Obligation.
---------------------------------------------------------------------------

    94. On this basis, we seek comment on our proposal to direct NERC 
to modify the VRF assignment for CIP-006-5, Requirement R3 from Lower 
to Medium, consistent with the treatment of the comparable requirement 
in the CIP version 4 Standards, within 90 days of the effective date of 
a final rule in this proceeding.
Lower VRF for Access Authorizations
    95. NERC assigns a Lower VRF to proposed CIP-004-5, Requirement R4, 
which relates to access management programs addressing electronic 
access, unescorted physical access, and access to BES Cyber System 
Information. Requirement R4 obligates a responsible entity to have a 
process for authorizing access to BES Cyber System Information, 
including periodic verification that users and accounts are authorized 
and necessary.
    96. Recommendation 40 of the U.S.--Canada Power System Blackout 
Task Force, Final Report on the August 14, 2003 Blackout in the United 
States and Canada: Causes and Recommendations (Blackout Report) states 
that access to operationally sensitive computer

[[Page 24119]]

equipment should be ``strictly limited to employees or contractors who 
utilize said equipment as part of their job responsibilities.'' \76\ In 
addition, Recommendation 44 of the Blackout Report states that entities 
should ``develop procedures to prevent or mitigate inappropriate 
disclosure of information.'' \77\ These two Blackout Report 
recommendations relate to the protection of critical bulk electric 
system equipment and information, and we believe these recommendations 
support assigning access management programs, such as those required 
under CIP-004-5, Requirement R4, a Medium VRF. Our Violation Risk 
Factor guidelines require, among other things, consistency with the 
conclusions of the Blackout Report (guideline 1).
---------------------------------------------------------------------------

    \76\ See U.S.--Canada Power System Blackout Task Force, Final 
Report on the August 14, 2003 Blackout in the United States and 
Canada: Causes and Recommendations (April 2004) (Blackout Report) at 
167. The Blackout Report is available at https://reports.energy.gov/BlackoutFinal-Web.pdf.
    \77\ See Id. p 169.
---------------------------------------------------------------------------

    97. In addition, NERC proposes to assign a Medium VRF to CIP-004-5, 
Requirement R5, which addresses access revocation. This proposed 
assignment results in a potential inconsistency between VRFs within 
CIP-004-5. As noted above, Guideline 2 of our Violation Risk Factor 
guidelines requires consistency within a Reliability Standard. Access 
authorization, addressed in CIP-004-5, Requirement R4, is the companion 
to access revocation, addressed in CIP-004-5, Requirement R5. This 
relationship is demonstrated by the history of the CIP Reliability 
Standards; in the CIP version 1 through 4 Standards, access 
authorization and access revocation are two sub-requirements of a main 
requirement addressing the maintenance of a list of persons with 
authorized cyber or authorized unescorted physical access.\78\ The 
petition does not explain the potential inconsistency between VRFs in 
CIP-004-5.
---------------------------------------------------------------------------

    \78\ E.g., Reliability Standard CIP-004-4a, Requirement R4 
states:
    R4. Access--The Responsible Entity shall maintain list(s) of 
personnel with authorized cyber or authorized unescorted physical 
access to Critical Cyber Assets, including their specific electronic 
and physical access rights to Critical Cyber Assets.
    R4.1. The Responsible Entity shall review the list(s) of its 
personnel who have such access to Critical Cyber Assets quarterly, 
and update the list(s) within seven calendar days of any change of 
personnel with such access to Critical Cyber Assets, or any change 
in the access rights of such personnel. The Responsible Entity shall 
ensure access list(s) for contractors and service vendors are 
properly maintained.
    R4.2. The Responsible Entity shall revoke such access to 
Critical Cyber Assets within 24 hours for personnel terminated for 
cause and within seven calendar days for personnel who no longer 
require such access to Critical Cyber Assets.
---------------------------------------------------------------------------

    98. We propose to modify the VRF assigned to CIP-004-5, Requirement 
R4 from Lower to Medium. However, NERC and other commenters are free to 
provide additional explanation than provided thus far to demonstrate 
CIP-004-5, Requirement R4 is properly assigned a Lower VRF.
    99. We seek comment on our proposal to direct NERC to change the 
VRF assignment for CIP-004-5, Requirement R4 from Lower to Medium, 
consistent with the Blackout Report and to ensure consistency between 
VRFs within CIP-004-5, within 90 days of the effective date of a final 
rule in this proceeding.
Violation Severity Levels
    100. NERC requests approval for 32 sets of VSLs--one set for each 
requirement in the CIP version 5 Standards.\79\ Due to inconsistencies 
with previous Commission orders and various typographical errors in the 
content of the VSLs, we propose to direct NERC to file a modified 
version as discussed below.
---------------------------------------------------------------------------

    \79\ Petition at 2.
---------------------------------------------------------------------------

    101. Certain VSLs for the CIP version 5 Standards are inconsistent 
with previous Commission guidance.\80\ For example, proposed CIP-007-5, 
Requirement R4.4 requires entities to ``review a summation or sampling 
of logged events * * * at no greater than 15 days.'' The High VSL 
gradation for Requirement R4.4 states that an entity must miss ``two or 
more intervals'' for the violation to reach High severity over the 
specified time period. In addition, CIP-003-5, Requirement R4 provides 
the framework for a CIP Senior Manager to delegate authorities. The 
proposed VSL is based upon the number of incorrect delegations. The 
Commission has previously stated that VSL assignments are to be based 
on ``a single violation of a Reliability Standard, and not based on a 
cumulative number of occasions of the same requirements over a period 
of time.'' \81\ These are two examples of proposed VSL assignments that 
are inconsistent with the Commission's VSL guidelines.\82\
---------------------------------------------------------------------------

    \80\ N. Amer. Elec. Reliability Corp., 123 FERC ] 61,284 
(Violation Severity Level Order), order on reh'g, 125 FERC ] 61,212 
(2008).
    \81\ Violation Severity Level Order, 123 FERC ] 61,284 at PP 35-
36.
    \82\ Further examples of this concern include VSL assignments 
for the following: CIP-003-5, Requirement R3, CIP-004-5, Requirement 
R1, CIP-007-5, Requirement R4, CIP-009-5, Requirement R3.
---------------------------------------------------------------------------

    102. Also, certain VSLs are unclear or contain typographical 
errors. For instance, the proposed VSLs for CIP-004-5, Requirement 
R4.2's Moderate and High gradations are identical.\83\ Such 
typographical errors will create confusion and potentially hinder both 
compliance with and enforcement of the CIP Reliability Standards.\84\
---------------------------------------------------------------------------

    \83\ See NERC Petition, Exh. E (Table of VRFs and VSLs Proposed 
for Approval and Analysis of how VRFs and VSLs Were Determined Using 
Commission Guidelines), at 21.
    \84\ The Requirements that raise this concern include: CIP-003-
5, Requirements R1, R2, R3; CIP-007-5, Requirement R5; CIP-008-5, 
Requirements R2, R3; CIP-009-5, Requirements R2, R3.
---------------------------------------------------------------------------

    103. NERC also proposes VSLs that include the terms ``identify,'' 
``assess,'' ``correct,'' and ``deficiencies'' for the 16 CIP version 5 
``identify, assess and correct'' Requirements.\85\ As noted above, we 
seek comment on these terms and may direct modifications based on the 
comments received. If we do so, the VSLs may no longer be consistent 
with VSL Guideline 3, that VSLs use the same terminology as the 
associated requirement.\86\
---------------------------------------------------------------------------

    \85\ Although NERC has proposed 17 requirements with the 
``identify, assess, and correct'' language, the VSL assignment for 
CIP-003-5, Requirement R4 does not refer to the ``identify, assess, 
and correct'' language.
    \86\ See Automatic Underfrequency Load Shedding and Load 
Shedding Plans Reliability Standards, Order No. 763, 139 FERC ] 
61,098, at PP 91, 95 (2012) (citing VSL Guideline 3, the Commission 
directed NERC to change a VSL for Reliability Standard PRC-006-1, 
Requirement R8 to remove the phrase ``more than 5 calendar days, 
but'' because the requirement did not contain a five-day grace 
period for providing data to planning coordinators that was included 
in the VSL).
---------------------------------------------------------------------------

    104. Therefore, for the reasons outlined above, we seek comment on 
our proposal to direct NERC to file a modified version of the VSLs 
within 90 days of the effective date of a final rule in this 
proceeding.

F. Other Technical Issues

    105. While we propose to approve the CIP version 5 Standards based 
upon the improvements to the currently-approved CIP Reliability 
Standards discussed above, we believe that the cyber security 
protections proposed in the CIP version 5 Standards could be enhanced 
in certain areas. Therefore, we invite comment on the issues outlined 
below. After receiving comments, depending on the adequacy of the 
explanations provided in response to our questions, we may direct NERC 
to develop modifications to certain aspects of the CIP Reliability 
Standards to assure that BES Cyber Assets are adequately protected. 
Alternatively, we may conclude that while no changes are necessary at 
this time, NERC must consider these issues in preparing the next 
version of CIP Standards.

[[Page 24120]]

1. Communications Security
    106. Protecting communications systems is a critical concept in 
cyber security. Communications security involves securing the data 
being transmitted across a network.\87\ Secure data transmission is a 
basic layer to any defense-in-depth security strategy for typical 
industrial control systems.\88\ When addressing cyber security for 
electric power systems, communications security should protect and 
ensure the confidentiality, integrity, and availability of the data and 
functions used to support the reliable operation of the Bulk-Power 
System.
---------------------------------------------------------------------------

    \87\ See NIST Interagency Report 7298, Glossary of Key 
Information Security Terms, which defines communication security 
(COMSEC) as a ``component of Information Assurance that deals with 
measures and controls taken to deny unauthorized persons information 
derived from telecommunications and to ensure the authenticity of 
such telecommunications. COMSEC includes crypto security, 
transmission security, emissions security, and physical security of 
COMSEC material.''
    \88\ See NIST Special Publication 800-82, Guide to Industrial 
Control Systems Security, at page 3. According to NIST, ``in a 
typical ICS * * * a defense-in-depth strategy * * * includes * * * 
applying security techniques such as encryption and/or cryptographic 
hashes to ICS data storage and communications where determined 
appropriate.''
---------------------------------------------------------------------------

    107. We believe that the adoption of cryptography would improve the 
approach adopted in the CIP version 5 Standards.\89\ Cryptography is a 
branch of mathematics that provides communications protection.\90\ 
Cryptography is a useful technique to protect data that is utilized for 
both smart grid applications \91\ and in other industries,\92\ 
including the natural gas \93\ and nuclear power industries.\94\ 
Cryptography ensures the confidentiality of sensitive information, 
ensures the integrity of data and commands, determines if data has been 
modified, and authenticates the identity of the sender. A variety of 
cryptographic tools, such as encryption, integrity checks, and multi-
factor authentication, can enhance a responsible entity's defense-in-
depth security strategies.
---------------------------------------------------------------------------

    \89\ The CIP version 5 Standards address the use of cryptography 
in only one instance, regarding interactive remote access. See 
Reliability Standard CIP-005-5--Cyber Security--Electronic Security 
Perimeters, Requirement R2.2, at Page 16.
    \90\ See NIST Special Publication 800-21. According to NIST, 
cryptography can be used to provide confidentiality, data integrity, 
authentication, authorization and non-repudiation. Cryptography 
relies upon two basic components: an algorithm (or cryptographic 
methodology) and a key. The algorithm is a mathematical function, 
and the key is a parameter used in the transformation.
    \91\ See NISTIR 7628: Guidelines for Smart Grid Cyber Security 
and FIPS 140-2 for further guidance regarding smart grid systems and 
cryptography.
    \92\ See ISA/IEC-62443-2-1: Security for Industrial Automation 
and Control Systems--Industrial Automation and Control System 
Security Management System.
    \93\ See AGA 12: Cryptographic Protections for SCADA 
Communications.
    \94\ See NRC Regulatory Guide 5.71 for both data transmission 
integrity and confidentiality, as well as cryptographic key 
management.
---------------------------------------------------------------------------

    108. We are also concerned with NERC's proposal to exempt 
communication networks from protection based solely on specific types 
of technology. While proposed CIP-002-5 removes the prior blanket 
exemption for non-routable protocol, we seek comment regarding whether 
or not the resulting standards adequately protect non-routable 
communication systems.\95\ We maintain our prior position that limiting 
the CIP protections to only routable systems adds additional risk to 
the bulk electric system.\96\ Furthermore, by effectively locking the 
CIP Reliability Standards into a specific technology, we are concerned 
that any future technology which is non-routable in nature will not be 
addressed by the CIP Reliability Standards. Regardless of technology, 
the NIST Risk Management Framework addresses security for all 
communication systems.\97\
---------------------------------------------------------------------------

    \95\ See NERC Petition at pages 11-12. In particular, CIP 
Version 5 introduces qualifying language for many requirements 
through the use of the ``External Routable Connectivity'' 
definition. Furthermore, other definitions exempt non-routable 
systems.
    \96\ See Order No. 761, 139 FERC ] 61,058 at PP 85-86.
    \97\ See SP 800-53 Revision 3, security control family System 
and Communications Protection, page F-106-123.
---------------------------------------------------------------------------

    109. We invite comment on whether the adoption of communications 
security protections, such as cryptography and protections for non-
routable protocol, would improve the CIP Reliability Standards.
2. Remote Access
    110. Remote access refers to the ability to access a non-public 
computer network from external locations.\98\ Remote access provides 
greater flexibility in accessing remote computer networks; however, 
this flexibility creates new security risks by allowing a potentially 
unsecured device access into an entity's network.
---------------------------------------------------------------------------

    \98\ See SP 800-46 Revision 1, Guide to Enterprise Telework and 
Remote Access Security page 2-1.
---------------------------------------------------------------------------

    111. Improperly implementing remote access procedures can create 
security vulnerabilities.\99\ An entity must be able to verify that a 
party, whether it be an employee, vendor, or automated system, 
initiating remote access to the entity's internal networks has the 
appropriate access permissions. Since the communication network used 
for remote access is a pathway that can be used to spread malware, the 
secure implementation of remote access is another step in protecting 
the confidentiality, integrity, and availability of the data and 
functions used to support the reliable operation of the bulk electric 
system.
---------------------------------------------------------------------------

    \99\ See Remote Access VPN--Security Concerns and Policy 
Enforcement, SANS Reading Room, 2003, at page 3. Available at https://www.sans.org/reading_room/whitepapers/vpns/remote-access-vpn-security-concerns-policy-enforcement_881.
---------------------------------------------------------------------------

    112. Due to the increased risk associated with utilizing remote 
access and the complexities involved with secure implementation, many 
groups have created guidance documents to aid in the secure 
implementation of remote access. NIST, Department of Homeland Security 
(DHS), and NERC have developed guidance documents for securing remote 
access connections.\100\ The CIP version 5 Standards reflect certain 
aspects of these guidance documents. Specifically, proposed CIP-005-5, 
Requirement R2 requires responsible entities to utilize an Intermediate 
System, use encryption that terminates at an Intermediate System, and 
implement multi-factor authentication for all Interactive Remote Access 
sessions associated with high and medium impact BES Cyber Systems that 
allow Interactive Remote Access.\101\
---------------------------------------------------------------------------

    \100\ See SP 800-53 Revision 3, security control AC-17 page F-
14-15. See also SP 800-46 Revision 1, Guide to Enterprise Telework 
and Remote Access Security. See also DHS Configuring and Managing 
Remote Access for Industrial Control Systems. See also NERC's 
Guidance for Secure Interactive Remote Access.
    \101\ See Petition at 12.
---------------------------------------------------------------------------

    113. The controls in CIP-005-5, Requirement R2, however, are not as 
stringent as the guidance in the NERC advisory or controls required 
under the NIST Risk Management Framework.\102\ For example, both the 
NIST Risk Management Framework and NERC's remote access guidance 
document recommend authorization for each individual, person or system, 
granted remote access.\103\ We invite comment on whether the adoption 
of more stringent controls for remote access would improve the CIP 
Reliability Standards.
---------------------------------------------------------------------------

    \102\ See SP 800-53 Revision 3, security control AC-17, page F-
14-15.
    \103\ See SP 800-53 Revision 3, security control AC-17, page F-
14-15. See also Guidance for Interactive Remote Access, NERC, July 
2011, page 12.
---------------------------------------------------------------------------

3. Differences Between the CIP Version 5 Standards and NIST
    114. It appears that the CIP version 5 Standards do not address 
certain aspects of cyber security in as comprehensive a manner as the 
NIST Risk Management Framework addresses the same topics. For example, 
certain security controls contained in NIST Special Publication

[[Page 24121]]

800-53's Security Control Catalog and associated guidance documents are 
not reflected in the CIP version 5 Standards.
    115. The proposed CIP version 5 Standards do not address the proper 
upkeep and the protection of maintenance devices in as comprehensive a 
manner as the NIST Risk Management Framework.\104\ In addition, 
proposed CIP-004-5 does not require a comprehensive analysis of all 
individual's duties to determine where separation of duties can be 
utilized to improve security.\105\ The proposed CIP version 5 Standards 
also do not address the monitoring of information systems for new 
threats and vulnerabilities, as well as changes to how the asset should 
be categorized pursuant to CIP-002-5, in as comprehensive a manner as 
the NIST Risk Management Framework.\106\
---------------------------------------------------------------------------

    \104\ See SP 800-53 Revision 3, Maintenance and Media Protection 
control families, pages F-66 through F-75.
    \105\ See SP 800-53 Revision 3, control AC-5, pages F-8 and F-9.
    \106\ See SP 800-137, Information Security Continuous Monitoring 
(ISCM) for Federal Information Systems and Organizations. Page vi, 
``Information security continuous monitoring (ISCM) is defined as 
maintaining ongoing awareness of information security, 
vulnerabilities, and threats to support organizational risk 
management decisions.''
---------------------------------------------------------------------------

    116. In particular, the CIP version 5 Standards do not provide for 
re-categorizing BES Cyber Systems based on a change in an individual 
entity's risk determinations. The CIP version 5 Standards also do not 
require minimum terms for contractual agreements associated with the 
acquisition or integration of new systems.\107\ This is not an 
exhaustive list of the differences between the proposed CIP version 5 
Standards and the NIST Risk Management Framework, but is representative 
of the differences in the security posture required under each.
---------------------------------------------------------------------------

    \107\ See generally Department of Homeland Security: Cyber 
Security Procurement Language for Control Systems. See also SP 800-
53 Revision 3, System and Services Acquisition control family, pages 
F-96 through F-105.
---------------------------------------------------------------------------

    117. While we are not proposing to direct NERC to address these 
concepts in the CIP Reliability Standards at this time, we invite 
comment on whether, and in what way, adoption of certain aspects of the 
NIST Risk Management Framework could improve the security controls 
proposed in the CIP version 5 Standards.

IV. Information Collection Statement

    118. The FERC-725B information collection requirements contained in 
this Proposed Rule are subject to review by the Office of Management 
and Budget (OMB) under section 3507(d) of the Paperwork Reduction Act 
of 1995.\108\ OMB's regulations require approval of certain information 
collection requirements imposed by agency rules.\109\ Upon approval of 
a collection of information, OMB will assign an OMB control number and 
expiration date. Respondents subject to the filing requirements of this 
rule will not be penalized for failing to respond to these collections 
of information unless the collections of information display a valid 
OMB control number. The Commission solicits comments on the 
Commission's need for this information, whether the information will 
have practical utility, the accuracy of the burden estimates, ways to 
enhance the quality, utility, and clarity of the information to be 
collected or retained, and any suggested methods for minimizing 
respondents' burden, including the use of automated information 
techniques.
---------------------------------------------------------------------------

    \108\ 44 U.S.C. 3507(d) (2006).
    \109\ 5 CFR 1320.11 (2012).
---------------------------------------------------------------------------

    119. The Commission based its paperwork burden estimates on the 
difference between the latest Commission-approved version of the CIP 
Reliability Standards (CIP version 4) and the estimated paperwork 
burden resulting from CIP version 5. While the Commission is proposing 
to allow the CIP version 3 Standards to remain in effect until the CIP 
version 4 Standards become effective, the Commission has already 
imposed the burden of implementing the CIP version 4 Standards. Thus, 
from a regulatory perspective, any change in burden related to the 
proposed approval of the CIP version 5 Standards would be relative to 
the change from the burden related to that imposed by the 
implementation of the CIP version 4 Standards.
    120. The information collection burden under CIP version 5 is 
different than that imposed by CIP version 4. Under CIP version 4, all 
applicable entities must first identify, by applying criteria specified 
in CIP-002-4, which of the Cyber Assets they own are subject to the 
mandatory protections specified in the remaining CIP standards. Those 
identified Cyber Assets are termed Critical Cyber Assets (CCA) in CIP 
version 4. If, upon completion of the required process in CIP-002-4, 
the entity has identified at least one CCA, it must implement all 
mandatory protections specified in the remaining CIP Reliability 
Standards with respect to any identified CCA. If, on the other hand, 
the entity determines that it does not own any CCAs, it is not required 
to implement any of the protections specified in the remaining CIP 
version 4 Standards. By contrast, CIP version 5 does not use the term 
CCA. Under CIP version 5, a responsible entity identifies Cyber Assets 
for protection by applying the CIP-002-5 definitions and classification 
criteria. The responsible entity is required to comply with at least 
some mandatory protections in the remaining standards for all Cyber 
Assets identified as BES Cyber Systems (depending on their 
classification of Low, Medium, or High and other specifics specified in 
various individual requirements).
    121. Because the change in paperwork burden between CIP version 4 
and CIP version 5 differs depending upon the extent to which that 
entity had to comply with CIP version 4, we delineate the registered 
entities into three groupings, as follows:
    Group A: Entities that are not subject to the CIP version 4 
Standards, but are subject to the CIP version 5 Standards. The Group A 
entities consist of those Distribution Providers that are not also 
registered for another CIP function, such as the Load Serving Entity 
function (which is subject to CIP version 4).
    Group B: Entities that are registered for functions subject to CIP 
version 4, but that did not identify any CCAs under CIP-002-4. 
Therefore, Group B entities do not own facilities that require the 
implementation of mandatory protections specified by the remaining CIP 
version 4 Standards.
    Group C: Entities that are registered for functions subject to CIP 
version 4 and that identify, upon completion of the CIP-002-4 analysis, 
at least one asset as a CCA. Therefore, Group C entities own facilities 
that require the implementation of the mandatory protections specified 
in the remaining CIP version 4 Standards.
    122. The NERC Compliance Registry as of February 28, 2013 indicated 
that 1,927 entities were registered for NERC's compliance program. Of 
these, 1,911 were identified as being U.S. entities. Staff concluded 
that of the U.S. entities, approximately 1,475 were registered for at 
least one CIP-applicable function, and therefore must comply with the 
CIP Reliability Standards. Further, 1,414 are subject CIP version 4. 
Consistent with the Commission's approach in Order No. 761,\110\ we 
assume that 23 percent (325) of the 1,414 US entities subject to CIP 
version 4 identified CCAs (Group C). It follows that the remaining 77 
percent (1089) of the US entities did not identify any CCAs under CIP 
version 4 (Group B). This ratio factors into several of the

[[Page 24122]]

calculations needed to estimate the differences in effort among 
entities in Group B, as compared to Group C.
---------------------------------------------------------------------------

    \110\ See Order No. 761, 139 FERC ] 61,058 at P 122, n.162.
---------------------------------------------------------------------------

    123. To estimate the change in paperwork burden between CIP version 
4 and CIP version 5, we recognize that the entities in all groups will 
undertake the following paperwork tasks to at least some extent: (1) 
Create or modify documentation of processes used to identify and 
classify the cyber assets to be protected under the CIP Reliability 
Standards; (2) create or modify policy, process and compliance 
documentation; and (3) continuing documentation of compliance data 
collection. We estimate the level of burden for each Group as follows:
     All of Group B & C entities, but no more than 10 percent 
of the Group A entities, will own at least one subject asset classified 
as Low under the CIP version 5 Standards. We estimate 24 hours \111\ 
per entity to develop its evaluation process documentation for 
identifying the facilities subject to the standard, and 1,024 hours 
\112\ to develop the required documentation for covered assets. We 
divide the total burden hours between the second and third years of the 
compliance period allowed for the assets classified as Low.
---------------------------------------------------------------------------

    \111\ Based on assumption of 2 persons per entity, working 15 
percent of time for 2 weeks.
    \112\ Based on assumption of 2 persons per entity, creating 
required policy documentation per policy (4- low policies), working 
40 percent of time for 8 weeks.
---------------------------------------------------------------------------

     The burden hours for facilities classified as Medium and 
High are split between the first and second year, since Groups B and C 
are allowed a 24-month period to bring them into compliance. (The third 
year figure shown for these rows represents an ongoing effort level). 
Except for Group C Blackstart facilities, 32 hours \113\ per entity are 
assumed for development of its evaluation process documentation.
---------------------------------------------------------------------------

    \113\ Based on assumption of 2 persons per entity, working 20% 
of time for 2 weeks.
---------------------------------------------------------------------------

     We assume no more than 30 percent of Group B and Group C 
entities will own one or more of the newly covered transmission 
facilities classified as Medium. For those that do, we assume 3,200 
hours \114\ to develop the required policy, compliance and 
implementation documentation, and 832 hours \115\ per entity for 
ongoing compliance burden.
---------------------------------------------------------------------------

    \114\ Based on assumption of 1 person per entity, per standard 
(10) creating policy documentation, working 75 percent of time for 8 
weeks, and 1 person per entity, per standard (10) on creating 
compliance documentation, 25 percent of time for 8 weeks.
    \115\ Based on assumption of 2 persons per entity, working 20 
percent of time for 52 weeks.
---------------------------------------------------------------------------

     With respect to the Blackstart facilities owned by Group C 
entities, 160 hours\116\ per entity are assumed for each entity to 
modify its policy and evaluation process documentation. We also assume 
a reduction of 728 hours \117\ per entity for ongoing compliance 
documentation that is required under CIP version 4 but is no longer 
required under CIP version 5.
---------------------------------------------------------------------------

    \116\ Based on assumption of 1 person per entity, per standard 
(10) modifying policy documentation, working 10 percent of time for 
2 weeks, and 1 person per entity, per standard (10) modifying 
compliance documentation, 10 percent of time for 2 weeks.
    \117\ Based on assumption of a reduction of 2 persons per 
entity, collecting compliance data, working 20 percent of time for 
52 weeks, and an increase of 1 person per entity, collecting 
compliance data, working 5 percent of time for 52 weeks.
---------------------------------------------------------------------------

     For Group C's Medium and High facilities, we assume 1,600 
hours \118\ per entity to modify the required policy, compliance and 
implementation documentation, and 416 hours \119\ per entity for 
ongoing compliance.
---------------------------------------------------------------------------

    \118\ Based on assumption of 1 person per entity, per standard 
(10) modifying compliance documentation, working 50 percent of time 
for 8 weeks.
    \119\ Based on assumption of 2 persons collecting compliance 
data, working 10 percent of time for 52 weeks.
---------------------------------------------------------------------------

    124. The estimated paperwork burden changes for these entities, as 
contained in the proposed rule in RM13-5-000, are illustrated in the 
table below. The information collection burden also varies according to 
the types of facilities the entities own, as classified by the criteria 
in CIP-002-5, Attachment 1. To further refine our estimate, we indicate 
the classes of facilities each group of entities owns in the second 
column of the table below.
---------------------------------------------------------------------------

    \120\ Distribution Providers are the only functional entity type 
in Group A (see section 4, Applicability, of each CIP version 5 
Standard), and their facilities are captured only by the Low 
classification criteria listed in CIP-002-5. The number of entities 
in this group represent the number of Distribution Providers that 
are not registered for any additional CIP version 5 applicable 
functions, including the Load Serving Entity function (and are 
therefore subject to CIP versions 1-4).
    \121\ As with Groups A and C, Group B will own Low facilities 
which were not identified for protections under prior CIP versions. 
The number of Group B respondents is calculated as 77 percent of the 
total entities previously subject to the CIP Reliability Standards. 
(.77 * 1414 = 1,089).

 
----------------------------------------------------------------------------------------------------------------
                                   Classes of
                                    entity's                       Total burden    Total burden    Total burden
 Groups of registered entities     facilities        Number of    hours in  Year  hours in  Year  hours in  Year
                                  requiring V5       entities            1               2               3
                                   protections
----------------------------------------------------------------------------------------------------------------
Group A.......................  Low \120\.......              61               0           3,804           3,804
Group B.......................  Low \121\.......           1,089               0         570,636         570,636
Group B.......................  Medium \122\....             260         128,960         128,960          64,896
Group C.......................  Low \123\.......             325               0         170,300         170,300
Group C.......................  Medium \124\                  78           1,248           1,248          19,136
                                 (New).
Group C.......................  Low \125\                    283          22,640          22,640        -206,024
                                 (Blackstart).
Group C.......................  Medium or High               325         265,200         265,200         135,200
                                 \126\.
                               ---------------------------------------------------------------------------------
    Totals....................  ................  ..............         418,048       1,163,556         758,716
----------------------------------------------------------------------------------------------------------------

    125. The following shows the average annual cost burden for each 
group,

[[Page 24123]]

based on the burden hours in the table above: \127\
---------------------------------------------------------------------------

    \122\ In contrast to CIP version 4, Criterion 2.5 in CIP version 
5 identifies new facilities for protection--transmission facilities 
[gE] 200kV < 300kV--and classifies them as ``Medium.'' Some of these 
newly-applicable transmission facilities are owned by entities that 
had not previously identified any CCAs under previous versions, 
while some of the Criterion 2.5 facilities are owned by entities 
that previously identified CCAs. Assuming Group B entities 
constitute 77 percent of the entities to which this criterion 
potentially applies, 260 entities of the 338 total Transmission 
Owners (TO) captured by Criterion 2.5 are assigned to Group B, while 
the remaining 78 are allotted to Group C.
    \123\ As with Groups A and B, the entities that identified CCAs 
under CIP version 4 (Group C) will also own facilities newly 
addressed by CIP version 5 and classified as Low. The number of 
Group B respondents is calculated as 23 percent of the total 
entities previously subject to the CIP Reliability Standards. (.23 * 
1414 = 325)
    \124\ This row concerns only the newly subject transmission 
facilities that are addressed by CIP version 5, Criterion 2.5, as 
owned by Group C TO entities. See the note for Group B Medium above 
for further explanation. These Medium-rated facilities are broken 
out in this row, separate from other Medium facilities the entity 
may own in the High and Medium row below because the level of effort 
for these Group C TOs entities to protect these newly protected 
facilities is estimated differently than for the Group B entities, 
or for other Medium facilities the entity may own.
    \125\ Blackstart generation and transmission cranking paths are 
the only types of facilities identified first for more specified 
security controls under CIP version 4, Criteria 1.4 and 1.5, but 
then subject only to Low mandatory security controls under CIP 
version 5, Criterion 3.4. The number of entities in this row 
represents 23 percent of the sum of all registered Generation 
Operators to account for Blackstart Resources and all TOs to account 
for cranking paths.
    \126\ Except for the Blackstart facilities noted above, the 
facilities that Group C entities identify as CCAs under CIP version 
4 will be rated for Medium or High security controls under CIP 
version 5.
    \127\ The total cost figures are rounded to the nearest 
thousand. The ``hours per entity'' figures are averages over three 
years for the whole group. Some entities within a group may 
experience higher or lower hourly impact (as illustrated in the 
burden table) depending on entity type and assets owned.

     Group A: 61 unique entities * 41.5 hrs/entity * $72/hour = 
$182,000
     Group B: 1,089 unique entities * 448 hrs/entity * $72/hour 
= $35,127,000
     Group C: 325 unique entities * 889 hrs/entity * $72/hour = 
$20,803,000
Total average annual paperwork cost for the change in requirements 
contained in the NOPR in RM13-5 = $56,112,000. (i.e., $182,000 + 
$35,127,000 + $20,803,000).

    126. The estimated hourly rate of $72 is the average loaded cost 
(wage plus benefits) of legal services ($128.00 per hour), technical 
employees ($58.86 per hour) and administrative support ($30.18 per 
hour), based on hourly rates and average benefits data from the Bureau 
of Labor Statistics.\128\
---------------------------------------------------------------------------

    \128\ See https://bls.gov/oes/current/naics2_22.htm and https://www.bls.gov/news.release/ecec.nr0.htm.
---------------------------------------------------------------------------

    127. Title: Mandatory Reliability Standards, Version 5 Critical 
Infrastructure Protection Standards.
    Action: Proposed Collection FERC-725B.
    OMB Control No.: 1902-0248.
    Respondents: Businesses or other for-profit institutions; not-for-
profit institutions.
    Frequency of Responses: On Occasion.
    Necessity of the Information: This proposed rule proposes to 
approve the requested modifications to Reliability Standards pertaining 
to critical infrastructure protection. The proposed Reliability 
Standards help ensure the reliable operation of the Bulk-Power System 
by providing a cyber security framework for the identification and 
protection of Critical Assets and associated Critical Cyber Assets. As 
discussed above, the Commission proposes to approve NERC's proposed 
Version 5 CIP Standards pursuant to section 215(d)(2) of the FPA 
because they represent an improvement to the currently-effective CIP 
Reliability Standards.
    Internal Review: The Commission has reviewed the proposed 
Reliability Standards and made a determination that its action is 
necessary to implement section 215 of the FPA.
    128. Interested persons may obtain information on the reporting 
requirements by contacting the following: Federal Energy Regulatory 
Commission, 888 First Street NE., Washington, DC 20426 [Attention: 
Ellen Brown, Office of the Executive Director, email: 
DataClearance@ferc.gov, phone: (202) 502-8663, fax: (202) 273-0873].
    129. For submitting comments concerning the collection(s) of 
information and the associated burden estimate(s), please send your 
comments to the Commission, and to the Office of Management and Budget, 
Office of Information and Regulatory Affairs, Washington, DC 20503 
[Attention: Desk Officer for the Federal Energy Regulatory Commission, 
phone: (202) 395-4638, fax: (202) 395-7285]. For security reasons, 
comments to OMB should be submitted by email to: oira_submission@omb.eop.gov. Comments submitted to OMB should include Docket 
Number RM13-5-000 and OMB Control Number 1902-0248.

V. Regulatory Flexibility Act Certification

    130. The Regulatory Flexibility Act of 1980 (RFA) \129\ generally 
requires a description and analysis of proposed rules that will have 
significant economic impact on a substantial number of small entities. 
The RFA mandates consideration of regulatory alternatives that 
accomplish the stated objectives of a proposed rule and that minimize 
any significant economic impact on a substantial number of small 
entities. The Small Business Administration's Office of Size Standards 
develops the numerical definition of a small business.\130\ The Small 
Business Administration has established a size standard for electric 
utilities, stating that a firm is small if, including its affiliates, 
it is primarily engaged in the transmission, generation and/or 
distribution of electric energy for sale and its total electric output 
for the preceding twelve months did not exceed four million megawatt 
hours (MWh).\131\
---------------------------------------------------------------------------

    \129\ 5 U.S.C. 601-612 (2006).
    \130\ 13 CFR 121.101 (2012).
    \131\ 13 CFR 121.201, Sector 22, Utilities & n.1.
---------------------------------------------------------------------------

    131. The Commission seeks comment on the estimated impact of 
implementing and complying with the CIP version 5 Reliability 
Standards. Specifically, the Commission seeks detailed and supported 
information regarding the impacts in order to better estimate the cost 
on small businesses.
    132. The Commission estimates the NOPR will impact 536 small 
entities.\132\ Of this amount, the Commission estimates that only 14 
small entities \133\ (2.6 percent of the total number of small 
entities) may, on average, experience a significant economic impact of 
$116,000 per entity in the first year, $145,000 in the second year, and 
$88,000 in the third year.\134\ This cost is primarily due to 
implementation during the compliance period. After the initial 
implementation the Commission expects the average annual cost per each 
of the 14 entities to be less than $64,000. The Commission has 
determined that 2.6 percent of the effected small entities do not 
represent a ``substantial number'' in terms of the total number of 
regulated small entities applicable to the NOPR.
---------------------------------------------------------------------------

    \132\ Based on a comparison of the NERC Compliance Registry (as 
of February 28, 2013) and Energy Information Administration Form 861 
(available at https://www.eia.gov/electricity/data/eia861/).
    \133\ The 14 small entities in this class represent small 
Transmission Owners assumed to fall under the Medium classification 
and thus experience a greater impact than other small entities. 
These same entities also experience the impact associated with the 
Low classification.
    \134\ These costs are based on an estimated 4,600 hours of total 
work per entity over three years at $59/hour and $15,000 of non-
labor costs.
---------------------------------------------------------------------------

    133. The Commission estimates that 234 out of the 536 small 
entities \135\ will each experience an average economic impact of 
$29,000 per year during years two and three.\136\ Finally, the 
Commission estimates that the remaining 288 out of the 536 small 
entities \137\ will only experience a minimal economic impact.
---------------------------------------------------------------------------

    \135\ This figure represents the number of small entities that 
own assets covered by CIP version 5. This number does not include 
the 14 significantly impacted entities.
    \136\ This cost figure is based on an estimated 268 hours of 
total work per entity for each of years two and three combined at 
$72/hour, and $7,500 of non-labor costs for each of years two and 
three.
    \137\ The number of small Distribution Providers assumed to not 
own assets covered by CIP version 5.
---------------------------------------------------------------------------

    134. Based on the above, the Commission certifies that the proposed 
Reliability Standards will not have a significant impact on a 
substantial number of small entities. Accordingly, no initial 
regulatory flexibility analysis is required.

VI. Environmental Analysis

    135. The Commission is required to prepare an Environmental 
Assessment or an Environmental Impact Statement

[[Page 24124]]

for any action that may have a significant adverse effect on the human 
environment.\138\ The Commission has categorically excluded certain 
actions from this requirement as not having a significant effect on the 
human environment. Included in the exclusion are rules that are 
clarifying, corrective, or procedural or that do not substantially 
change the effect of the regulations being amended.\139\ The actions 
proposed here fall within this categorical exclusion in the 
Commission's regulations.
---------------------------------------------------------------------------

    \138\ Regulations Implementing the National Environmental Policy 
Act of 1969, Order No. 486, 52 FR 47897 (Dec. 17, 1987), FERC Stats. 
& Regs., Regulations Preambles 1986-1990 ] 30,783 (1987).
    \139\ 18 CFR 380.4(a)(2)(ii).
---------------------------------------------------------------------------

VII. Comment Procedures

    136. The Commission invites interested persons to submit comments 
on the matters and issues proposed in this notice to be adopted, 
including any related matters or alternative proposals that commenters 
may wish to discuss. Comments are due June 24, 2013. Comments must 
refer to Docket No. RM13-5-000, and must include the commenter's name, 
the organization they represent, if applicable, and their address in 
their comments.
    137. The Commission encourages comments to be filed electronically 
via the eFiling link on the Commission's Web site at https://www.ferc.gov. The Commission accepts most standard word processing 
formats. Documents created electronically using word processing 
software should be filed in native applications or print-to-PDF format 
and not in a scanned format. Commenters filing electronically do not 
need to make a paper filing.
    138. Commenters that are not able to file comments electronically 
must send an original of their comments to: Federal Energy Regulatory 
Commission, Secretary of the Commission, 888 First Street NE., 
Washington, DC 20426.
    139. All comments will be placed in the Commission's public files 
and may be viewed, printed, or downloaded remotely as described in the 
Document Availability section below. Commenters on this proposal are 
not required to serve copies of their comments on other commenters.

VIII. Document Availability

    140. In addition to publishing the full text of this document in 
the Federal Register, the Commission provides all interested persons an 
opportunity to view and/or print the contents of this document via the 
Internet through the Commission's Home Page (https://www.ferc.gov) and 
in the Commission's Public Reference Room during normal business hours 
(8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street NE., Room 2A, 
Washington, DC 20426.
    141. From the Commission's Home Page on the Internet, this 
information is available on eLibrary. The full text of this document is 
available on eLibrary in PDF and Microsoft Word format for viewing, 
printing, and/or downloading. To access this document in eLibrary, type 
the docket number excluding the last three digits of this document in 
the docket number field.
    142. User assistance is available for eLibrary and the Commission's 
Web site during normal business hours from the Commission's Online 
Support at (202) 502-6652 (toll free at 1-866-208-3676) or email at 
ferconlinesupport@ferc.gov, or the Public Reference Room at (202) 502-
8371, TTY (202) 502-8659. Email the Public Reference Room at 
public.referenceroom@ferc.gov.

    By direction of the Commission.
Nathaniel J. Davis, Sr.,
Deputy Secretary.
[FR Doc. 2013-09643 Filed 4-23-13; 8:45 am]
BILLING CODE 6717-01-P