NERC Critical Infrastructure Protection Advisory Group (CIP AG) Electric Industry Initiatives Reducing Vulnerability To Terrorism Add notes

September 11, 2001 Industry Implications Significant change to the Security Environment Increased Security focus and costs Threat of imposed Federal and State legislation Company over-reaction Company under-reaction

Post 9/11 Reactions

CIP AG Overview

Security Guidelines Guiding Principles Each company defines and identifies its own critical facilities and functions. Each company assesses the usefulness of the Guidelines individually and adapts them as needed. The Guidelines are living documents, expected to change. Implemented and supported by workshops for industry

Initiatives CIPAG Security Guidelines Threat Conditions and Response FERC Assist Spare Parts Database PKI

Security Guidelines Executive Summary The Guidelines describe general approaches considerations practices planning philosophies The Guidelines are NOT a “cookbook” for protection.

Security Guidelines Definitions Critical Facility Any facility or combination of facilities, if severely damaged or destroyed would: have a significant impact on the ability to serve large quantities of customers for an extended period of time, have a detrimental impact to the reliability or operability of the energy grid, or cause significant risk to National security, National economic security, or public health and safety.

Security Guidelines Guideline Topics Vulnerability and Risk Assessment Threat Response Emergency Management Continuity of Business Processes Communications Physical Security IT/Cyber Security Employment Screening Protecting Sensitive Information

Security Guidelines Guideline Topics Vulnerability and Risk Assessment Helps identify critical facilities, their vulnerabilities, and countermeasures. Threat Response Helps in developing plans for enhanced security.

Security Guidelines Guideline Topics Emergency Management Better prepares companies to respond to a spectrum of threats, both physical and cyber. Continuity of Business Practices Reduces the likelihood of prolonged interruptions and enhances prompt resumption of operations after interruptions occur.

Security Guidelines Guideline Topics Communications Enhances the effectiveness of threat response, emergency management, and business continuity plans. Physical /Cyber Security Mitigates the impact of threats through deterrence, prevention, detection, limitation, and corrective action.

Security Guidelines Guideline Topics Employment Screening Provides strategies to mitigate “insider” threats. Protecting Sensitive Information Production, storage, transmission, and disposal of both physical and electronic information

Security Guidelines Reference Documents An Approach to Action for the Electricity Sector (NERC, June 2001) Threat Alert Levels and Physical Response Guidelines (NERC, November 2001) Threat Alert Levels and Cyber Response Guidelines (NERC, March 2002)

ThreatCon and Response Guidelines The Guidelines Define Threat Alert Levels for Alerts issued by ES-ISAC NIPC Other government agencies (Excludes facilities regulated by the NRC) Ensure that electric Threat Alert Levels are consistent with information from other sources Provide examples of security measures Supported with workshops

ThreatCon and Response Guidelines Threat Alerts / Threat Conditions Can be issued for a specific geographic area for a specific facility by category - such as a specific type of facility

Threat Alert Level Definitions THREATCON-NORMAL Applies when no known threat exists. Is equivalent to normal daily conditions. Security measures should be maintainable indefinitely. THREATCON-LOW Applies when a general threat exists with no specific threat directed against the electric industry. Additional security measures are recommended. Added security should be maintainable for an indefinite period with minimum impact on the organization.

Threat Alert Level Definitions THREATCON-MEDIUM Applies with increased or more predictable threat to the electric industry. Implementation of additional security measures is expected. Increased measures are anticipated to last for a defined time. Significant increases in corporate resources will be required. THREATCON-HIGH Applies when an incident occurs or a credible threat is imminent. Maximum security measures are necessary and are expected to: cause hardships on personnel, seriously impact normal operations, and may be economically unsustainable for more than a short time.

FERC Request FERC requested NERC to develop security standards for inclusion to Standard Market Design NOPR CIPAG picked-up the Gauntlet NERC BoT approved CIPAG participation on June 14, 2002

FERC Request “Minimum Daily Requirements” Achievable Granular Cyber focused Inter-connection focused

FERC Request Final draft to FERC July 26 SMD NOPR released July 31 for general public review, comment Final SMD ruling late October or early November Effective date of compliance 2004 Annual signed self certification

FERC Request All future standards to be developed and maintained by NERC All future FERC rule making on standards will refer to NERC standards

Spare Equipment Database Expanding database created in 1989 Spare EHV transformers in case of national emergencies Web based on a secure server Other equipment to be included

PKI Needed because of the reliance on computer based systems and applications Evaluate potential Certificate Authorities Develop an integrated PKI architecture and deployment strategy Resolve technical issues Create web based training materials

ES ISAC PDD #63 Identified electricity as on e of the eight critical infrastructures NERC sector coordinator for electricity IAW Program Website CIPAG oversight body for ISAC Collect, Analyze and Disseminate information

Pulling Together

Available on the Web www.nerc.com Committees CIPAG Related Files

“Security is always excessive until it’s not enough” One Last Thought! “Security is always excessive until it’s not enough”