This practical cybersecurity guidance from NERC should be on every grid operators reading list. Inverter based resources (IBR) are the fastest growing supply resources in America with momentum coming largely from Solar installations, batteries (BESS) and Wind assets.
Many times these IBR devices are managed using an Internet connection, which can expose them to malicious activity. This guidance from NERC takes a "cradle to grave" approach to managing IBR cybersecurity starting with procurement, through the operational life of a product; "For products that perform or support critical IBR functions, procurement specifications should require software bills of materials (SBOM) and, where practicable, hardware bills of materials (HBOM); contracts should define update frequency, handling of sensitive BOM information, and rights to validate delivered components against approved BOMs or equivalent evidence. Entities should communicate these requirements to OEMs, EPC contractors, and integrators early enough to influence design, component selection, testing, commissioning, and system acceptance."
Here are a few key take-aways:
"This security guideline provides recommended practices intended to strengthen cyber security outcomes for utility-scale IBR facilities and supporting communications. The guideline is advisory and is intended to support the application of a practical baseline of cyber security controls that aligns with reliable operations across diverse IBR architectures, remote connectivity models, and third-party dependencies."
"Key recommended practice areas addressed in this guideline include the following:
• Supply chain and third-party dependency management, including procurement expectations, contractual controls, and ongoing oversight of vendor access and updates [SBOM]
• Identity and access management, including unique identities, strong authentication, least privilege, and monitoring of access activity
• Remote access and network connectivity governance, including secure-by-default remote access, differentiated handling of interactive and machine-to-machine communications, and explicit control of vendor remote access
• Network architecture and segmentation practices, including baseline and advanced segmentation approaches and the use of operational technology (OT)-designed internal network security monitoring to improve visibility without disrupting operations
• Asset management and configuration control, including asset inventory, baseline configurations, patching and update processes, and backup and restoration readiness
• Secure communication protocols and telemetry practices, including protection of operational data in transit and management of embedded communications modules"