This session will provide an overview of the NERC CIP Reliability Standards. The electric grid in North America is at the top of the list of critical infrastructures maintained by Presidential Directive by the Department of Homeland Security and it is recognized that the remaining critical infrastructures will not function without a reliable supply of electricity.  As a result, cyber and physical security for electric utilities is at the forefront of the legislators and regulators agenda following recent cyber and physical attacks in the US and elsewhere in the world.

To address these risks, the North American Electric Reliability Corporation (NERC) has developed and maintained a set of Critical Infrastructure Protection (CIP) standards that are mandatory and enforceable.  These standards have undergone significant change since they were first adopted in FERC Order 706.  These standards have been extended to include all Bulk Electric System Assets and their related Cyber Assets each categorized as High, Medium, and Lower Risk assets thereby extending the program to all registered entities and all bulk electric system assets at some level.

This course will provide a deep fundamental understanding of the NERC CIP standards including a history of their development, an understanding of the present standards, and a view of what is coming in future standard development.  The course will also provide a detailed overview of each standard, its fundamental purpose, and the intent of each requirement.

Developing programs to meet the intent of the standard is challenging since compliance with the standards requires disciplines from several key corporate functions including electric system operations, information technology, corporate security, and human resources at a minimum.  This course will also review organizational structures for successful implementation and their experiences.  This course will also provide an overview of compliance and monitoring efforts that NERC will conduct for the CIP standards and is designed to give the necessary background for all staff to understand the concepts and complexities of NERC compliance in order to communicate and build a culture of compliance and reliability and prepare for upcoming CIP audits

Learning Outcomes

• Review the background for the NERC Critical Infrastructure Standards and discuss major recent revisions
• Review the scope and purpose of the NERC Critical Infrastructure Protection (CIP) standards
• Examine the NERC CIP requirements: Current version and upcoming revisions
• Assess the confidentiality provisions of the CIP standards
• Explain how violations are determined and identify which CIP standards are the most violated and why
• Discuss the challenges faced by utilities in defining a compliance program across the corporate functions necessary for CIP compliance (operations, information technology, corporate security, human resources, etc.)
• Define a culture of compliance and its importance in the compliance monitoring and enforcement process
• Examine strategies to build an internal CIP compliance program in such a diverse environment
• Analyze the audit process for CIP standards and demonstrate strategies for success before, during, and after an audit

Credits

EUCI has been accredited as an Authorized Provider by the International Association for Continuing Education and Training (IACET).  In obtaining this accreditation, EUCI has demonstrated that it  complies with the ANSI/IACET Standard which is recognized internationally as a standard of good practice. As a result of their Authorized Provider status, EUCI is authorized to offer IACET CEUs for its programs that qualify under the ANSI/IACET Standard.

EUCI is authorized by IACET to offer 1.0 CEUs for this event.

 

Requirements for Successful Completion of Program  

Participants must sign in/out each day and be in attendance for the entirety of the course to be eligible for continuing education credit.  

Instructional Methods  

PowerPoint presentations will be used in this course.  

Tuesday, March 9, 2021 : Central Time

12:30 – 1:00 p.m. :: Login and Welcome  

1:00  – 4:00 p.m. :: Course Timing

---

Short breaks will be taken throughout the sessions   

• History and background of NERC CIP
• Reliability standards
• CIP Version 5 – New definitions
  • Review of the intent and purpose of each standard
  • Understanding each of the requirements
  • Departments involved in meeting the intent
• Bulk electric system (BES) cyber system categorization
• Security management controls
• Personnel & training
• Electronic security perimeters

---

Wednesday, March 10, 2021 : Central Time

8:50 – 9:00 a.m. :: Login and Welcome

9:00 a.m. – 4:00 p.m. :: Course Timing

12:00 – 12:30 p.m. :: Lunch Break

---

Short breaks will be taken throughout the sessions   

• Physical security plan
• Audit process and preparation
• System security management
• Incident reporting/response planning
• Recovery plans for BES cyber systems
• Organizing for compliance
• Configuration change management and vulnerability assessments
• Information protection
• Managing documentation and evidence
• Tools and resources
  • “Tools” and NERC CIP compliance
  • Active vulnerability assessment tools
  • Danger: Active scanning of ICS environments is risky business!
  • Emerging issues and new standards

Andrew Gallo, Director of Corporate Compliance Programs, Austin Energy

Andrew Gallo is the Director of Corporate Compliance Programs for Austin Energy in Austin, Texas.  He is also the former Chairman of the NERC Standards Committee and has served on the Standards Committee for many years. He previously served as Chair of the Texas Reliability Entity’s Regional Standards Committee.

He served as the Chief Compliance Officer for Seattle City Light (SCL) from 2008 to 2010 and led SCL through its first on-site NERC Reliability Standards audit and Austin Energy through six Regional Entity (Texas RE) audits covering all of its registered functions (including CIP).  Before Seattle, he was Assistant General Counsel for Electric Reliability Council of Texas, Inc. (ERCOT), where he worked on protocols compliance and other matters.  Before becoming part of the electric industry, he worked in the oil and gas industry for approximately 17 years.  He received a Juris Doctor degree from the College of William and Mary in Virginia in 1985 and a Bachelor of Arts degree from Hofstra University in New York in 1982.

We will be using Microsoft Teams to facilitate your participation in the upcoming event. You do not need to have an existing Teams account in order to participate in the broadcast – the course will play in your browser and you will have the option of using a microphone to speak with the room and ask questions, or type any questions in via the chat window and our on-site representative will relay your question to the instructor.

• You will receive a meeting invitation will include a link to join the meeting.
• Separate meeting invitations will be sent for the morning and afternoon sessions of the course.
  • You will need to join the appropriate meeting at the appropriate time.
• If you are using a microphone, please ensure that it is muted until such time as you need to ask a question.
• The remote meeting connection will be open approximately 30 minutes before the start of the course. We encourage you to connect as early as possible in case you experience any unforeseen problems.