CIP Transition Guidance

How is NERC providing flexibility with the transition from CIP Version 3 to CIP Version 4, while CIP Version 5 is pending at the Federal Regulatory Commission?

While the effective date for CIP Version 4 compliance is April 1, 2014, the new Cyber Transition Guidance will provide guidance and clarification of which assets will be the primary focus of NERC and Regional Entity audits.

The Critical Infrastructure Protection (CIP) Version 3 Standards are currently mandatory and enforceable for Responsible Entities.  In each of the CIP Versions 3 through 5, CIP-002 includes a requirement that an entity identify those assets that are subject to compliance with the remainder of CIP Reliability Standards.

• CIP-002-3 Requires an entity to have a risk-based assessment methodology (RBAM) to determine its Critical Assets
• CIP-002-4 Requires an entity to use bright-line criteria methodology (Attachment 1) to define Critical Assets.
• CIP-002-5 Requires and entity to use impact rating criteria (Attachment 1) to classify the level of impact of a BES Cyber System and to determine the corresponding compliance obligations.

If CIP Version 5 and the corresponding implementation plan are approved by FERC prior to CIP Version 4 becoming enforceable, language in the implementation plan would go into effect.  This would allow an entity to continue compliance with CIP Version 3 until CIP Version 5 becomes mandatory and enforceable.  Under this scenario, CIP Version 4 would never be mandatory and enforceable.  Watch for future posts if CIP Version 5 is not approved!

Are you thoroughly confused?  Do you know if you are compliant?   360Factors will manage all your compliance confusion and will provide an easier way to manage all your NERC Standards, Compliance to these standards, practices, and procedures, Gap Analysis, RSAW, NERC Audits, and Job Task Analysis.