@RFirst_Corp Follow us on LinkedIn and Twitter Forward Together - PowerPoint PPT Presentation

@RFirst_Corp Follow us on LinkedIn and Twitter Forward Together • ReliabilityFirst

Enforcement Trends & Addressing Silos Patrick O’Connor, Counsel Kristen Senk, Senior Counsel

Agenda Topics  Update on enforcement trend data  Overview of CIP themes  Panel discussion on addressing organizational silos 3 Forward Together • ReliabilityFirst

Most Violated Standards 12 Month Rolling Count 132 Number of Violations 90 63 31 23 17 17 16 13 12 CIP-007 CIP-010 CIP-004 CIP-006 PRC-024 CIP-005 MOD-025PRC-005 PRC-019 CIP-011 4 Forward Together • ReliabilityFirst

Disposition Method 350 316 300 250 200 150 111 100 62 50 37 26 16 16 11 4 0 2016 2017 2018 Dismissal/CE FFT Settlement 5 Forward Together • ReliabilityFirst

Detective Controls 2018 310 2017 329 By Date Reported 2016 293 2015 671 2014 746 0 100 200 300 400 500 600 700 800 Average Days from Start Date to Report Date 6 Forward Together • ReliabilityFirst

2018 CIP Themes Report  Purpose • Identify themes in violations with the CIP Standards • Suggest potential resolutions  Collaboration • RF, WECC, and SERC worked with Registered Entities to identify the themes and resolutions.  Second Edition • First edition in 2015 7 Forward Together • ReliabilityFirst

CIP Themes 15% * The graph 11% 45% represents the violations that concern the 29% more significant CIP compliance deficiencies. Disassociation Organizational Silos Inadequate Tools Lack of Awareness 8 Forward Together • ReliabilityFirst

Theme - Organizational Silos  Lack of coordination between departments, business units, and different levels of management Vertical Silos (Between Business Units or Departments) Horizontal Silos Generation (Between Layers from the Top Down) 9 Forward Together • ReliabilityFirst

Organizational Silos Panel Discussion Thomas Breene Bill Edwards Kristina Pacovsky Assistant General Managing Senior Manager FERC/NERC Compliance Counsel Corporate Counsel Exelon Corporation Midcontinent WEC Energy Group Business Services Independent System Operator 10 Forward Together • ReliabilityFirst

Questions & Answers Forward Together ReliabilityFirst 11 Forward Together • ReliabilityFirst

GridEx IV Exercise Overview April 26, 2018 Columbus, OH

Slide 1 of 237 13 Forward Together • ReliabilityFirst

GridEx IV Exercise - 2017  NERC conducted its fourth biennial grid security and emergency response exercise, GridEx IV, on November 15–16, 2017  GridEx IV consisted of a two-day distributed play exercise and a separate executive tabletop on the second day  The exercise provided an opportunity for stakeholders in the electricity sector to respond to simulated cyber and physical attacks affecting the reliable operation of the grid 14 Forward Together • ReliabilityFirst

Cyber Attack Scenario  Cyber-attacks targeted corporate networks and industrial control systems (ICS) such as process control systems, energy management systems, distribution management systems, and supervisory control and data acquisition systems (SCADA) used to operate generating units, transmission substations, and control centers. The attacks disrupt the ability of power system operators to monitor and control the reliability of the bulk power system (BPS) 15 Forward Together • ReliabilityFirst

Physical Attack Scenario  Simultaneous physical attacks against certain generation, transmission, and control center facilities cause large-scale power outages, while avoiding immediate and deliberate degradation to the level that would move the exercise into black start restoration plan scenarios. Voice and data communications systems used by BPS operations and security personnel are also affected by physical attack, hindering their ability to respond to the situation 16 Forward Together • ReliabilityFirst

Communications Challenges  GridEx IV also provided participating organizations with the opportunity to exercise how they receive and share information with external stakeholders, including customers, local government officials, and the general public 17 Forward Together • ReliabilityFirst

GridEx IV Exercise - Objectives  Exercise incident response plans  Expand local and regional response  Engage critical interdependencies  Improve communication  Gather lessons learned  Engage senior leadership 18 Forward Together • ReliabilityFirst

GridEx IV Exercise - Participation 19 Forward Together • ReliabilityFirst

GridEx Exercise – Lessons Learned  Some exercise scenarios or “moves” require more integration into the master scenario  More active Lead Planners  Greater Cross-Sector Participation  E-ISAC Portal Improvements  EEI and the E-ISAC should work together to further operationalize the Cyber Mutual Assistance (CMA) Program 20 Forward Together • ReliabilityFirst

GridEx IV Exercise – RF Participation  Engaged the EASA, IT, and Corporate Communications Teams, and the CSO  EASA “played” in our normal roles following the master scenario events as played out by electric utilities in our footprint  IT “played” by responding to a custom scenario which was created and played out simulating an RF data breach event 21 Forward Together • ReliabilityFirst

GridEx IV Exercise – RF Participation (cont.)  Corporate Communications “played” following the exercise master scenario events as played out by electric utilities and also responding to the RF data breach event coordinating with IT, the CSO, and Executives  The CSO “played” by responding to and interacting with EASA, IT, Corporate Communications, and Executives for both the master scenario events and the custom RF data breach scenario  Support was provided by the Enforcement Team acting as RF users affected by the RF Data Breach event 22 Forward Together • ReliabilityFirst

GridEx IV Exercise – RF Lessons Learned  Procedure and Process updates  Tools updates and training  Communication protocol updates (internal & external)  Emergency response action updates  Increase RF IT involvement in future exercises to test our response capabilities more completely 23 Forward Together • ReliabilityFirst

GridEx IV Exercise – Follow on Activities  Review and comment on the GridEx IV After Action Report  Review and implement Lessons Learned  Planning for GridEx V in 2019  FERC Cyber Planning for Response and Recovery (CyPReS) Study 24 Forward Together • ReliabilityFirst

Why participate in GridEx Exercises?  It’s fun! Just ask your Lead Planner…  It’s customizable!  Industry participants take part from their regular work locations  Provides an opportunity for utilities to demonstrate how they would respond to and recover from simulated coordinated cyber and physical security threats and incidents  Strengthen your crisis communications relationships 25 Forward Together • ReliabilityFirst

Slide 237 of 237 26 Forward Together • ReliabilityFirst

Questions & Answers Forward Together ReliabilityFirst Forward Together • ReliabilityFirst

Project 2016-02 CI P Modifications Standard Drafting Team Outreach Slides

Agenda • Project 2016-02 Scope • CIP-002  Modifications  Planned and Unplanned Changes • CIP-012  Modifications • Control Center Definition • V5TAG Transition Document  Definitions  Virtualization 29 RELI ABI LI TY | ACCOUNTABI LI TY

SAR – FERC Directives • Per paragraph 53, “…the Commission concludes that modifications to CIP-006-6 to provide controls to protect, at a minimum, communication links and data communicated between bulk electric system Control Centers are necessary in light of the critical role Control Center communications play in maintaining bulk electric system reliability. Therefore, we adopt the NOPR proposal and direct that NERC, pursuant to section 215(d)(5) of the FPA, develop modifications to the CIP Reliability Standards to require responsible entities to implement controls to protect, at a minimum, communication links and sensitive bulk electric system data communicated between bulk electric system Control Centers in a manner that is appropriately tailored to address the risks posed to the bulk electric system by the assets being protected (i.e., high, medium, or low impact).” 30 RELI ABI LI TY | ACCOUNTABI LI TY

SAR – V5TAG I tems • Cyber Asset and BES Cyber Asset (BCA) Definitions  Clarify the intent of “programmable” in Cyber Asset.  Clarify and focus the definition of “BES Cyber Asset” • Network and Externally Accessible Devices  improving clarity within the concepts and requirements • Transmission Owner (TO) Control Centers Performing Transmission Operator (TOP) Obligations  Clarify: o the applicability of requirements on a TO Control Center that performs the functional obligations of a TOP, particularly if the TO has the ability to operate switches, breakers and relays in the BES. o The definition of Control Center. o The language scope of “perform the functional obligations of” throughout the Attachment 1 criteria. 31 RELI ABI LI TY | ACCOUNTABI LI TY