New Low Impact NERC CIP-003-9 Regulations: Vendor Supply Chain Security

By Patrick Miller

On March 16 2023, FERC issued a new Order approving NERC CIP-003-9 introducing new requirements for vendor electronic remote access security controls to low impact BES Cyber Systems. These new security controls are intended to allow detection and the ability to disable vendor remote access in the event of a known or suspected malicious communication.

Ampere hosed a webinar/webpanel featuring a former CIP regulator and three former asset owners, where they will discuss what is in scope, when it be applicable, how it will impact your utility, and what you should be doing.

Panelists

Show Links

FERC Order Approving Reliability Standard CIP-003-9 - Docket No. RD23-3-00

CIP-003-9 Reliability Standard, NERC

NERC Project 2020-03 Page for all documents related to the drafting and adoption process for CIP-003-09

  • All draft versions

  • Redlines to last posted/approved

  • Technical Rationale

  • VRF/VSL Justifications

  • Reliability Standard Audit Worksheet (RSAW)

  • Ballot results

Supply Chain Risk Assessment Report

Safety Sign Generator

Slides from this webinar/webpanel

Featured Posts

Featured
Exploring the Evolving Landscape of ICS/OT Cybersecurity at RSAC 2024
Exploring the Evolving Landscape of ICS/OT Cybersecurity at RSAC 2024

The RSA Conference 2024 spotlighted the critical importance of ICS/OT cybersecurity, reflecting a significant increase in attention compared to previous years. Ampyx Cyber CEO, Patrick Miller noted the strong presence of AI-driven security tools on the vendor floor and highlighted the conference's rich agenda featuring discussions on the convergence of IT and OT. As digital transformation continues, the industry's commitment to enhancing ICS/OT cybersecurity is more evident than ever.

Read More →
Reporting Cyber Incidents under DHS CIRCIA’s Proposed Rulemaking
Reporting Cyber Incidents under DHS CIRCIA’s Proposed Rulemaking

The US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) on April 4, 2024 published its proposed rules requiring critical infrastructure entities to report significant cyber incidents and ransom payments to CISA. The proposed regulations are intended to consolidate, fortify, and strengthen the United States’ cyber defenses in critical infrastructure (CI) sectors.

Read More →
Ampere Industrial Security Evolves into Ampyx Cyber
Ampere Industrial Security Evolves into Ampyx Cyber

Ampere Industrial Security, renowned for its expertise in industrial security, announces its rebranding to Ampyx Cyber, marking a new chapter in its global presence with offices in Portland, OR, USA, and a new European base in Tallinn, Estonia. This strategic change represents an expanded commitment to providing top-tier cybersecurity solutions across continents.

Read More →
Embracing AI for the Electric Grid: Insights from NERC
Embracing AI for the Electric Grid: Insights from NERC

In the rapidly evolving landscape of the electric sector, the integration of cutting-edge technologies is not just an option; it's a necessity. Among these, artificial intelligence (AI) stands out as a transformative force, offering unprecedented opportunities to enhance grid reliability, security, and efficiency. Recognizing this potential, the North American Electric Reliability Corporation (NERC) has provided insightful comments on how AI can be harnessed to address the challenges and opportunities within the electric grid.

Read More →
CIP-015: The Crucial Role of INSM in Strengthening Grid Security
INSM, Internal Network Security Monitoring, NERC CIP, FERC, FERC 887
CIP-015: The Crucial Role of INSM in Strengthening Grid Security
INSM, Internal Network Security Monitoring, NERC CIP, FERC, FERC 887

introduction of CIP-015, a new regulation aimed at enhancing grid security by mandating Internal Network Security Monitoring (INSM) for high and medium impact Bulk Electric System (BES) Cyber Systems. This development, initiated by FERC Order No. 887, responds to the need for robust monitoring within trusted network zones to detect and mitigate potential cyber threats. CIP-015 emerges as a standalone standard after industry feedback suggested that INSM requirements did not align well with existing frameworks, shifting towards an objective-based rather than prescriptive approach.

Read More →
INSM, Internal Network Security Monitoring, NERC CIP, FERC, FERC 887
NERC CIPPatrick MillerNERC CIP, CIP-003, Low Impact