1. Cybersecurity Special Public Meeting/Commission Workshop for Natural Gas Utilities September 27, 2018

2. Planning - Governance CIO / CSO Board of Directors
Enterprise Security Committee
Director of Infrastructure and Security
Guest Speakers
Regular Reporting
Conferences
Sr. Security Manager
An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.
Security Workgroups

3. Planning - Governance Enterprise Security Committee
Members
Dir. of Transmission Ops
Dir. of IT and Security
Dir. of Generation & Production
Mgr. of Reliability Compliance
Dir. of Corporate Communications
Dir. of Electrical Engineering
Sr. Legal Counsel
Dir. Human Resources
Dir. Environmental Affairs
Dir. of Planning & Asset Management
Dir of Natural Gas
Enterprise Security Committee
Work Groups
An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

4. Planning- Security Staff
Sr. Security Manager
Physical Security Engineer
Business Continuity / Emergency Management
Security Architect
Security Engineer
Security Engineer - SCADA
Security Engineer - Compliance
Security Team Lead
Access Administration
Security Analyst
An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

5. Planning – Policy
Introduction and Scope
400 Configuration Management Policy
Introduction
400 Policy Objective
Scope
400 Policy Statements
Exceptions to the Cyber Security Policy
400.1 Change Management
Security Risk Management
400.2 Patch Management
500 System Acquisition, Development & Maintenance Policy
Security Awareness
500 Policy Objective
Incident Response Management
500 Policy Statements
Information Management
500.1 System Assessments
100 - Physical Security Policy
500.2 System Acquisition
100 - Policy Objective
500.3 System Development
500.4 System Maintenance
100 - Policy Statements
600 - System and Information Protection Policy
100.1 Physical Security
600 - Policy Objective
200 - Exception Request Policy
600 - Policy Statements
200 - Policy Objective
600.1 Anti-Virus software
200 - Policy Statements
600.2 Network Protection
600.3 Encryption
200.1 Exception Request Policy
600.4 File Integrity Monitoring (FIM)
300 - Access Control Policy
600.5 Authorized and Unauthorized Devices
300 - Policy Objective
600.6 Secure Configurations for Avista Systems
300 - Policy Statements
600.7 Wireless Device Control
600.8 Secure Communications
300.1 Access Control
600.9 Audit Logs
300.2 Separation of Duties
Audit Log Storage
300.3 Account Management
Time Synchronization
300.4 Password Management
Logon Banner
Media Protection
300.5 Account Time-outs
An overview of your utility’s cybersecurity policy, strategy, or governing document, including how it incorporates both cyber and physical security components.
An explanation of how your utility’s cybersecurity policy is audited.

6. Standards - Cyber Security Framework
Describe how your utility prioritizes the implementation of new cybersecurity systems, components and functions.
An overview of your utility’s cybersecurity framework.

7. Standards – Effectiveness
An overview of your utility’s process to determine the effectiveness of the current cybersecurity policy and plan, including the frequency of the evaluation.
An overview of what needs to happen for improvement actions to take place with regard to your utility’s cybersecurity policy and plan, including any hindrances and what can be done to overcome them).
An explanation about the frequency in which your utility’s cybersecurity plan is updated.
An explanation about the frequency in which your utility’s cybersecurity plan is tested.

8. Reporting Cybersecurity reporting
An overview of how and when your utility reports cyberattacks, and the threshold for reporting cyberattacks.

9. Partnerships
An overview of your utility’s cybersecurity partnerships (i.e. Emergency management/law enforcement, Department of Homeland Security, fellow utilities, Fusion centers, etc.).
An explanation of how and when your utility interacts with the National Cyber Security Division of the U.S. Department of Homeland Security.

10. Procurement Vendor and device selection Background checks Employees
Vendors
An overview of your utility’s cybersecurity criteria used for vendor and device selection, and the guidance you follow to ensure that your procurement language is both specific and comprehensive enough to result in acquiring secure components and systems.
An overview describing personnel surety/background checks performed on those with access to key cyber components, including vendors and other third parties that have access to key cyber systems screened.
An overview of your utility’s cybersecurity personnel, detailing individuals that have specifically assigned cybersecurity responsibility, and other personnel that may assist in cybersecurity as only a percentage of their overall duties.

11. Risk Management Risk prioritization Vulnerability assessments Internal
External
Risk impacts
An overview of how your utility prioritizes risks, including the criteria used to prioritize risks, and how often the priority list is updated.
An overview explaining who your utility is using to perform vulnerability assessments (i.e. internal personnel or external personnel, such as a third party).
An overview of your utility’s process for looking at consequences of cyber incidents that informs your risk management process.

12. Response & Recovery: Response and recovery plans Responsibility
Exercises
Sharing & mutual defense
Communication plan to address customer perceptions
An overview of your utility’s cybersecurity response and recovery coordination plan, including but not limited to, who in your utility oversees response and recovery, any participation in sharing analysis, and mitigation measures with other companies as part of a mutual network of defense, and communication plan to address customer perceptions and expectations when their service has been impacted by a cyberattack event. 

13. Questions?