Standards and Guidelines Working Group Status Updates 2005 Jun 09 Washington DC Critical Infrastructure Protection Committee Public Release

Update Items As of 2005 Jun 09 Subject Area:Min: 1SGWG Objectives for 2005/ Confirmation5 2SGWG Process Flow and Decision Making5 3Review of CIPC Document Types10 4SAC Standard Documents and CIPC Document Types5 5Guideline Template & Usage Guide5 6Accumulation and Handling of Comments for the Next Round of Guideline Updates 5 7Status of Guideline Reviews and Updates5

SGWG Objectives for 2005/ Secure endorsement for the standard document shell for CIPC guidelines 2.Identify CIPC document types and define as to purpose, application rules, relationships with other documents 3.Review existing guidelines and recommend for updating or discontinuance 4.Recommend streamlining of reviewing and approving CIPC guidelines 5.On-going reviews of guidelines and other documents

SGWG Document Review Process Flow

SGWG Main Function: 1.Provide standard format for CIPC documents. 2.Review DRAFTS for: Standard Components Consistency References Tone of language 3.Will stay away from value judgment on the content. That will be left with the drafting teams.

Potential CIPC Document Types for SGWG Reviews Type:Example:SGWG Review: 1PoliciesSpare Equipmt Database (SED)?? 2StandardsCIP 001 to CIP 009No. 3GuidelinesRisk Assessment GuidelinesFormat only 4FAQsFAQ Cyber Security DRAFT #3No? 5Glossary of Terms BES (Bulk Electric System)Scan existing when shifted 6ProcedureSED Usage ProcedureFormat only? 7Reference (or White Paper) Risk Assessment Methodologies No.

SGWG Review of White/Reference Papers RAWG has produced a White Paper on Risk Assessment Methodologies Discussion Points: 1.Does SGWG need to review White Papers and reference documents, or do SGWG members join the general CIPC members in providing comments? 2.If SGWG did, what value can SGWG add? SGWG Consensus: SGWG will not get involved in the reviews of White papers. However, it may act as an unofficial proof reader.

SAC Document Types and CIPC Guidelines SAC announced a list of supporting documents that support “Standards”: 1.Standard Reference 2.Standard Supplement 3.Procedure 4.Practice 5.Training Reference 6.Technical Reference 7.White Paper Discussion Points: 1.There is no such document as ‘guidelines’ 2.CIPC has guidelines without supporting standards. 3.Does NERC recognize “guidelines”?

The Guideline Template Refer to the two Word documents: “Guideline Template” “Usage Guide” Discussion Points: 1.Document ID for Guidelines 2.Preamble (See next foil) 3.Guideline Statement and Guideline Details 4.Definitions (treat Global and Local differently) 5.Certified Products (eliminated) 6.Exceptions (eliminated)

Review of the Guideline Template Preamble: “ This Guideline addresses potential risks that can apply to some Electricity Sector Organizations and provides practices that can help mitigate the risks. Each organization decides the risk it can accept and the practices it deems appropriate to manage its risk.” Why the capitalization?

The Guideline Template Usage Guide Usage Guide provides a description of: What information to provide in which section of a CIPC guideline What tone of language to use Decision Requested: CIPC approve the: 1.Guideline Template 2.Template Usage Guide

Status of Document Reviews SGWG members reviewing existing guidelines: 1.Reviewed 10 guidelines in March more being reviewed Discussion Points: Most of the reviewed guidelines need updating and are being assigned to the originating team or individuals.

Accumulation of Guideline Comments: A CIPC member asked what to do with the comments he or she might come up in between document update cycles. SGWG Consensus: 1.SGWG recommends these comments be sent to the SGWG Chair who will identify the working/task team/individual responsible for the document, pass on the comment, and let the comment originator know.

Reviews of the Recent Document DRAFTS: SGWG Review comments passed to the drafters of: 1.Threat Alert System and Physical Response Guidelines for the Electric Sector - V Vulnerability and Risk Assessment V2 - Guideline 3.Spare Equipment Database Usage Guide - Procedure