1. Critical Infrastructure Protection Committee
Public Release
Standards and Guidelines Working Group Status Updates Jun 09 Washington DC

2. Update Items As of 2005 Jun 09 Subject Area: Min: 1
SGWG Objectives for 2005/ Confirmation 5 2
SGWG Process Flow and Decision Making 3
Review of CIPC Document Types 10 4
SAC Standard Documents and CIPC Document Types
Guideline Template & Usage Guide 6
Accumulation and Handling of Comments for the Next Round of Guideline Updates 7
Status of Guideline Reviews and Updates

3. SGWG Objectives for 2005/2006
Secure endorsement for the standard document shell for CIPC guidelines
Identify CIPC document types and define as to purpose, application rules, relationships with other documents
Review existing guidelines and recommend for updating or discontinuance
Recommend streamlining of reviewing and approving CIPC guidelines
On-going reviews of guidelines and other documents

4. SGWG Document Review Process Flow

5. SGWG Main Function: Provide standard format for CIPC documents.
Review DRAFTS for:
Standard Components
Consistency
References
Tone of language
Will stay away from value judgment on the content. That will be left with the drafting teams.

6. Potential CIPC Document Types for SGWG Reviews
Example:
SGWG Review: 1
Policies
Spare Equipmt Database (SED) ?? 2
Standards
CIP 001 to CIP 009
No. 3
Guidelines
Risk Assessment Guidelines
Format only 4
FAQs
FAQ Cyber Security DRAFT #3
No? 5
Glossary of Terms
BES (Bulk Electric System)
Scan existing when shifted 6
Procedure
SED Usage Procedure
Format only? 7
Reference (or White Paper)
Risk Assessment Methodologies

7. SGWG Review of White/Reference Papers
RAWG has produced a White Paper on Risk Assessment Methodologies
Discussion Points:
Does SGWG need to review White Papers and reference documents, or do SGWG members join the general CIPC members in providing comments?
If SGWG did, what value can SGWG add?
SGWG Consensus:
SGWG will not get involved in the reviews of White papers. However, it may act as an unofficial proof reader.

8. SAC Document Types and CIPC Guidelines
SAC announced a list of supporting documents that support “Standards”:
Standard Reference
Standard Supplement
Procedure
Practice
Training Reference
Technical Reference
White Paper
Discussion Points:
There is no such document as ‘guidelines’
CIPC has guidelines without supporting standards.
Does NERC recognize “guidelines”?

9. The Guideline Template
Refer to the two Word documents:
“Guideline Template”
“Usage Guide”
Discussion Points:
Document ID for Guidelines
Preamble (See next foil)
Guideline Statement and Guideline Details
Definitions (treat Global and Local differently)
Certified Products (eliminated)
Exceptions (eliminated)

10. Review of the Guideline Template
Preamble:
“ This Guideline addresses potential risks that can apply to some Electricity Sector Organizations and provides practices that can help mitigate the risks. Each organization decides the risk it can accept and the practices it deems appropriate to manage its risk.”
Why the capitalization?

11. The Guideline Template Usage Guide
Usage Guide provides a description of:
What information to provide in which section of a CIPC guideline
What tone of language to use
Decision Requested:
CIPC approve the:
Guideline Template
Template Usage Guide

12. Status of Document Reviews
SGWG members reviewing existing guidelines:
Reviewed 10 guidelines in March 2005
5 more being reviewed
Discussion Points:
Most of the reviewed guidelines need updating and are being assigned to the originating team or individuals.

13. Accumulation of Guideline Comments:
A CIPC member asked what to do with the comments he or she might come up in between document update cycles.
SGWG Consensus:
SGWG recommends these comments be sent to the SGWG Chair who will identify the working/task team/individual responsible for the document, pass on the comment, and let the comment originator know.

14. Reviews of the Recent Document DRAFTS:
SGWG Review comments passed to the drafters of:
Threat Alert System and Physical Response Guidelines for the Electric Sector - V 3.0
Vulnerability and Risk Assessment V2 - Guideline
Spare Equipment Database Usage Guide - Procedure