NERC Cyber Security 2006; an Overview Toward Implementation

Published By United Telecom Council

• Published August 2006
• 23 Page(s)

The framework of the updated NERC standards (CIP-002-1 to 009-1) includes a mix of general principles and detailed procedures for critical infrastructure entities to follow. It is critical that these standards are addressed, since some of the greatest vulnerabilities in electric utility networks lie in the systems that ensure their continuous operation and electric reliability.

To get critical infrastructure on the road to compliance, the report focuses on key questions to help critical infrastructure including:

• Who should lead the overall effort, and why it should be an individual who is familiar with the operations process;
• What the auditors consider compliance, and why it doesn't mean that utilities need all the solutions right away;
• When entities should get started on the process;
• Where they can draw the line between critical and non-critical cyber assets; and
• How the standards can be tailored to suit each utility's needs.

Although compliance deadlines are set with ample time for compliance, the report stresses the importance of the industry starting implementing changes now rather than waiting. Additionally, feature interviews and commentary from key industry players illustrating the drafting process and the reasoning behind the mandates are presented. As the ERO finds its place in the industry, it is important for companies to feel out the organization and actively participate in the process to ensure the necessary reliability.