Frameworks, Standards, Guidelines, and Best Practices Dan Wagner, B.S., CISSP, CRISC, CISA, VCE-CIA Compliance Auditor, Cyber Security WECC Reliability & Security Workshop San Diego, CA – October 23–24, 2018 who wants to make more money, promote, improve your job/role group effectiveness Western Electricity Coordinating Council

What frameworks teach us √ Compliance to standards and best practices Defining, enhancing and managing enterprise identity and access management Definitions of threat and vulnerability management Identifying, defining, enhancing and managing application security controls How to Assess threats – vulnerabilities and associated tools Identify cyber and legal regulatory requirements to support compliance assessments How to build and deploy authorization processes Identify and address weaknesses in cloud strategies How to define and execute all stages of cybersecurity governance Identify the benefits and risks of virtualization How to distinguish technologies, e.g. Firewalls verses Network Security tools Perform cybersecurity, third & forth party risk assessments Defining and enhancing asset, configuration, change and patch management practices And more! Western Electricity Coordinating Council

Western Electricity Coordinating Council Early Stages Western Electricity Coordinating Council

NIST, DRII, BCI, CSA, ISO, COBIT, VRMMM, SCRM, DAMA, ITIL, SDLC Each of the above voluntary Frameworks present standards, guidelines, and best practices for managing cybersecurity-related risks. The NIST Cybersecurity Framework’s prioritized and flexible approach promotes the protection and resilience of critical infrastructure and other sectors important to the economy and national security. Western Electricity Coordinating Council

Western Electricity Coordinating Council

Western Electricity Coordinating Council

Western Electricity Coordinating Council Constantly learning? Western Electricity Coordinating Council

Industry Advice 8

NIST, DRII, BCI, CSA, ISO, COBIT, VRMMM, SCRM, DAMA, ITIL, SDLC Each of the above voluntary Frameworks integrate standards, guidelines, maturity models and best practices for managing cybersecurity-related risks. The NIST Cybersecurity Framework’s prioritized and flexible approach promotes the protection and resilience of critical infrastructure and other sectors important to the economy and national security. Western Electricity Coordinating Council

Frameworks, Standards, Guidelines, and Best Practice - Examples Disaster Recovery Institute International (DRII) https://drii.org/ The Business Continuity Institute (BCI) https://www.thebci.org/ The DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK) https://dama.org/content/body-knowledge VENDOR RISK MANAGEMENT MATURITY MODEL (VRMMM) https://sharedassessments.org/vrmmm/ Supply-Chain Risk Management (SCRM) http://www.scrlc.com/ Western Electricity Coordinating Council

Frameworks, Standards, Guidelines, and Best Practice - Examples Framework for Improving Critical Infrastructure Cybersecurity and related news, information: www.nist.gov/cyberframework Additional cybersecurity resources: http://csrc.nist.gov/ Questions, comments, ideas: cyberframework@nist.gov COBIT (Control Objectives for Information and Related Technologies) http://www.isaca.org/Knowledge-Center/COBIT/Pages/Overview.aspx Capability Maturity Model Integration (CMMI) https://cmmiinstitute.com/ Western Electricity Coordinating Council

Disaster Recovery Institute Intl (DRII) 12

The Business Continuity Institute (BCI) 13

The DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK) 14

Vendor Risk Management Maturity Model (VRMMM) 15

Supply Chain Risk Management (SRCM) Maturity Model 16

Framework for Analyzing the Pace of Technology Substitution ADD radio comment to this slide content… 17

Professional Advice Cannot Predict 18

What is significant to your role PLAY VIDEO - Los-Alamos NL-EMP-1MIN.mp4 Western Electricity Coordinating Council

The Business Continuity Institute (BCI) 20

The Business Continuity Institute (BCI) 21

BCI – PP1 22

BCI – PP1 (Policy and Program Management) 23

BCI – PP2 24

BCI – PP2 (Embedding Business Continuity) 25

BCI – PP3 26

BCI – PP3 (Analysis) Maximum tolerable period of disruption (MTPD), maximum acceptable outage (MAO), and recovery time objectives (RTOs) 27

BCI – PP4 28

BCI – PP4 (Design) 29

BCI – PP5 30

BCI – PP5 (Implementation) 31

BCI – PP6 32

BCI – PP6 (Validation) 33

Western Electricity Coordinating Council Questions? Dan Wagner B.S., CISSP, CRISC, CISA, VCE-CIA Compliance Auditor, Cyber Security Audits Western Electricity Coordinating Council 155 N 400 West Suite 200, Salt Lake City, UT 84103 dwagner@wecc.biz Western Electricity Coordinating Council