Critical Infrastructure Protection Committee Public Release Standards and Guidelines Working Group Status Updates 2005 Jun 09 Washington DC

Update Items As of 2005 Jun 09 Subject Area: Min: 1 SGWG Objectives for 2005/2006 - Confirmation 5 2 SGWG Process Flow and Decision Making 3 Review of CIPC Document Types 10 4 SAC Standard Documents and CIPC Document Types Guideline Template & Usage Guide 6 Accumulation and Handling of Comments for the Next Round of Guideline Updates 7 Status of Guideline Reviews and Updates

SGWG Objectives for 2005/2006 Secure endorsement for the standard document shell for CIPC guidelines Identify CIPC document types and define as to purpose, application rules, relationships with other documents Review existing guidelines and recommend for updating or discontinuance Recommend streamlining of reviewing and approving CIPC guidelines On-going reviews of guidelines and other documents

SGWG Document Review Process Flow

SGWG Main Function: Provide standard format for CIPC documents. Review DRAFTS for: Standard Components Consistency References Tone of language Will stay away from value judgment on the content. That will be left with the drafting teams.

Potential CIPC Document Types for SGWG Reviews Example: SGWG Review: 1 Policies Spare Equipmt Database (SED) ?? 2 Standards CIP 001 to CIP 009 No. 3 Guidelines Risk Assessment Guidelines Format only 4 FAQs FAQ Cyber Security DRAFT #3 No? 5 Glossary of Terms BES (Bulk Electric System) Scan existing when shifted 6 Procedure SED Usage Procedure Format only? 7 Reference (or White Paper) Risk Assessment Methodologies

SGWG Review of White/Reference Papers RAWG has produced a White Paper on Risk Assessment Methodologies Discussion Points: Does SGWG need to review White Papers and reference documents, or do SGWG members join the general CIPC members in providing comments? If SGWG did, what value can SGWG add? SGWG Consensus: SGWG will not get involved in the reviews of White papers. However, it may act as an unofficial proof reader.

SAC Document Types and CIPC Guidelines SAC announced a list of supporting documents that support “Standards”: Standard Reference Standard Supplement Procedure Practice Training Reference Technical Reference White Paper Discussion Points: There is no such document as ‘guidelines’ CIPC has guidelines without supporting standards. Does NERC recognize “guidelines”?

The Guideline Template Refer to the two Word documents: “Guideline Template” “Usage Guide” Discussion Points: Document ID for Guidelines Preamble (See next foil) Guideline Statement and Guideline Details Definitions (treat Global and Local differently) Certified Products (eliminated) Exceptions (eliminated)

Review of the Guideline Template Preamble: “ This Guideline addresses potential risks that can apply to some Electricity Sector Organizations and provides practices that can help mitigate the risks. Each organization decides the risk it can accept and the practices it deems appropriate to manage its risk.” Why the capitalization?

The Guideline Template Usage Guide Usage Guide provides a description of: What information to provide in which section of a CIPC guideline What tone of language to use Decision Requested: CIPC approve the: Guideline Template Template Usage Guide

Status of Document Reviews SGWG members reviewing existing guidelines: Reviewed 10 guidelines in March 2005 5 more being reviewed Discussion Points: Most of the reviewed guidelines need updating and are being assigned to the originating team or individuals.

Accumulation of Guideline Comments: A CIPC member asked what to do with the comments he or she might come up in between document update cycles. SGWG Consensus: SGWG recommends these comments be sent to the SGWG Chair who will identify the working/task team/individual responsible for the document, pass on the comment, and let the comment originator know.

Reviews of the Recent Document DRAFTS: SGWG Review comments passed to the drafters of: Threat Alert System and Physical Response Guidelines for the Electric Sector - V 3.0 Vulnerability and Risk Assessment V2 - Guideline Spare Equipment Database Usage Guide - Procedure