The CIP Standards

    June 5, 2008
    Here’s a brief look at the requirements of the Critical Infrastructure Protection (CIP) standards, taken from the January 2008 Federal Energy Regulatory Commission’s Order approving the standards.
    The -1 designation indicates that these are version one of the standards.CIP-002-1 – Cyber Security—Critical Cyber Asset Identification:Requires a responsible entity to identify its critical assets and critical cyber assets using a risk-based assessment methodology.CIP-003-1 – Cyber Security—Security Management Controls:Requires a responsible entity to develop and implement security management controls to protect critical cyber assets identified pursuant to CIP-002-1.CIP-004-1 – Cyber Security—Personnel & Training:Requires personnel with access to critical cyber assets to have identity verification and a criminal check. It also requires employee training.CIP-005-1 – Cyber Security—Electronic Security Perimeters:Requires the identification and protection of an electronic security perimeter and access points. The electronic security perimeter is to encompass the critical cyber assets identified pursuant to the methodology required by CIP-002-1.CIP-006-1 – Cyber Security—Physical Security of Critical Cyber Assets:Requires a responsible entity to create and maintain a physical security plan that ensures that all cyber assets within an electronic security perimeter are kept in an identified physical security perimeter.CIP-007-1 – Cyber Security—Systems Security Management:Requires a responsible entity to define methods, processes and procedures for securing the systems identified as critical cyber assets, as well as the non-critical cyber assets within an electronic security perimeter.CIP-008-1 – Cyber Security—Incident Reporting and Response Planning:Requires a responsible entity to identify, classify, respond to, and report cyber security incidents related to critical cyber assets.CIP-009-1 – Cyber Security—Recovery Plans for Critical Cyber Assets:Requires the establishment of recovery plans for critical cyber assets using established business continuity and disaster recovery techniques and practices.

    To view the accompanying article to this story,"Making Cyber Security Mandatory", visit www.automationworld.com/feature-4255

    Companies in this Article

    Continued Reading

    Sponsored Recommendations

    From robotic arms to high-speed conveyors, accuracy matters. Discover how encoders transform motor control by turning motion into real-time data?delivering tighter speed control...
    Safety in automation goes beyond fences and emergency stops. Learn how functional safety actively monitors and controls motion?delivering smarter protection, greater flexibility...
    Inductive Automation offers multiple editions of Ignition created for specific use cases. See what differentiates Ignition, Ignition Edge, Ignition Cloud Edition, and Ignition...
    Castle & Key brought new life to a historic Kentucky distillery by blending 140 years of heritage with cutting-edge automation. With help from Gray AES, they replaced outdated...