Computer Security and SCADA Requirements (Chapter 9)

Section 9.1 establishes why FERC regulates cyber and SCADA security for hydropower, what consequences drive the requirements, and which facilities are subject to them.

• Section 9.0 (Computer Security and SCADA) was thoroughly revised for Revision 3 and became effective January 1, 2016.
• FERC's focus for cyber security at hydropower is limited to two critical consequences: (1) the unintentional release of all or part of the reservoir, and (2) the non-operation of a licensed facility (loss of significant power generation).
• Because of this narrow scope, not all licensees are required to follow Section 9.0 — applicability depends on whether the facility uses remote or automated control of critical functions.
• A flowchart process (Figure 9.1 in the guidance) determines cyber asset criticality and whether Section 9.0 applies. Facilities whose cyber assets are determined to be "non-critical" do not need to adhere to Section 9.0, though voluntary conformance strengthens business continuity.
• All Security Group 1 and Group 2 dams must complete the FERC Hydro Cyber/SCADA Security Checklist (Form 3), Questions 1–4, to determine cyber asset designation, and discuss results with the FERC project engineer at the next Operation Inspection.
• Security Group 3 dams are subject to Section 9.0 only if they are interconnected to the operational or critical cyber assets of a Group 1 or Group 2 dam.
• Even if a facility is determined to be non-critical, FERC encourages voluntary compliance as a best practice for strengthening operational resilience.

The first step in determining whether Section 9.0 applies is answering four questions about the facility's use of remote or automated control systems. Any "Yes" answer requires proceeding to the Consequence Determination step.

• Every Group 1 and 2 dam must answer the four Remote Operation Determination questions on Form 3 (Questions 1–4) before the next Dam Safety Inspection.
• A "Yes" answer to any of these four questions means the licensee must proceed to the Cyber/SCADA Consequence Determination (Section 9.1.1.2) to assess whether the facility's consequences exceed the criticality thresholds.
• Question 4 includes a key note: if a virtual (system) interconnection exists to another facility already subject to Section 9.0, that interconnected facility is also automatically included in Section 9.0 requirements.
• If all four answers are "No," the facility's cyber assets are likely non-critical and Section 9.0 does not apply — though this must be re-evaluated annually as systems change.

If any Remote Operation question is answered "Yes," the licensee must evaluate the potential consequences of losing that capability. Consequence thresholds determine whether cyber assets are Critical, Operational, or Non-Critical — and therefore which security measures apply.

• The consequence evaluation considers both unintentional misoperation and intentional attack scenarios (insider and external).
• For gate-loss scenarios, the analysis must assume all gates are fully open with no remediation response for 48 hours.
• For dam failure potential, consider whether cascading operational losses could cause the dam to fail — referencing the 2009 Sayano-Shushenskaya accident as an example of cascading failure.
• Consequences should correlate with DAMSVR (or similar methodology) results to ensure consistency across the security program.
• Generating capacity thresholds determine criticality tier: ≥ 1,500 MW connected to one cyber asset = Critical; 100–1,499 MW = Operational; < 100 MW = Non-Critical. Black-start capable units are Operational regardless of capacity.
• Interconnected Group 3 dams must meet the same protection level (baseline or baseline + enhanced) as the Group 1 or 2 dam's cyber asset criticality.

Section 9.0 uses specific definitions for cyber assets and control systems. After classification, licensees must maintain a current inventory of all cyber assets organized by criticality tier.

• System — Interconnected hardware and software components (computers, databases, applications, monitoring devices) that together perform a related set of functions.
• Control Systems — Refers to Supervisory Control and Data Acquisition (SCADA) systems, Process Control Systems (PCS), and Distributed Control Systems (DCS). For FERC purposes, SCADA also includes remote operation of water retention features such as spillway gates and penstocks.
• SCADA System — A specialized computer system that gathers real-time data on hydroelectric generation and water management, transfers it to a central location, alerts operators to abnormal conditions, and executes necessary analysis and control actions.
• Cyber Asset — An individual computerized system that performs operational tasks at hydroelectric and water management facilities.
• Critical Cyber Asset — Essential to the safety and/or objectives of the project and exceeds the consequence thresholds in Table 9.1c.
• Operational Cyber Asset — Essential to the safety and/or objectives of the project but does not exceed the critical consequence thresholds.
• Non-Critical Cyber Asset — Isolated from remote monitoring and controls; does not meet the criteria for critical or operational classification.
• After classification, licensees must develop and maintain an accurate inventory of all cyber assets and cyber systems. When it is more convenient to classify assets as a group, they may be classified as a "cyber system."
• Legacy components with few or no security features must have compensating controls applied as part of an overall defense-in-depth approach.

Baseline measures apply to all cyber assets or cyber systems subject to Section 9.0, regardless of whether assets are classified as Operational or Critical. These measures are organized below by the categories used in Form 3 (Questions 18a–18g).

Critical cyber assets require enhanced measures beyond the baseline. This module also covers how Section 9.0 is reviewed during FERC Dam Safety Inspections and how NERC-CIP compliance relates to FERC's requirements.

Enhanced Cyber Security Measures — Table 9.3b (Critical Assets Only)

• Restrict physical and logical access to control systems and networks through a combination of locked facilities, passwords, secured communication gateways, access control lists, authenticators, separation of duties, and least-privilege practices. (NIST SP 800-82 §6.2.1, §6.2.16)
• Conduct a formal risk assessment to weigh the benefits of wireless networking against exploitation risks; evaluate the need for enhanced networking controls before any wireless implementation. (NIST SP 800-115 §6; 800-82 §3)
• Conduct periodic vulnerability assessments of control system security — including assessments in non-production environments — not to exceed 12 months between assessments. (NIST SP 800-40; 800-82 §6.2.14; 800-115)

FERC Dam Security Inspection — Cyber/SCADA Review (§9.4)

• Form 3 (FERC Hydro Cyber/SCADA Security Checklist) must be completed by the licensee before the Operation/Security Inspection and reviewed with the FERC Engineer during the inspection.
• FERC D2SI's scope is limited to ICS/SCADA assets involved in dam operation and remote project control. It does not extend into the corporate business network unless inadequate access controls allow the business network to influence operations.
• Inspection discussions are focused on remote operations that could impact water retention structures (dam, spillway gates, penstocks) and power generation — not on electric reliability or grid-level assets.
• Licensees must demonstrate that cyber security plans and measures are in place, and that proper coordination has been established with the FBI. The FBI maintains an incident database and coordinates technical protection for cyber-controlled systems.
• Cyber systems must be updated consistent with current security best practices and, where applicable, with NERC-CIP requirements.

NERC-CIP Coordination

• NERC-CIP standards (enforced by the FERC Office of Electric Reliability) focus on reliability of the Bulk Electric System — not on downstream population impacts from dam misoperation.
• A specific cyber asset may fall under both FERC D2SI and NERC-CIP jurisdiction. In this case, meeting NERC-CIP requirements satisfies D2SI's criteria for that asset.
• The CIP standards being met for any dual-jurisdiction asset must be referenced in the Security Plan and discussed with the FERC project engineer during the Dam Safety Inspection.
• If a NERC-CIP compliance inspection has been performed, the results, identified deficiencies, and corrective actions must be available for review during the Dam Safety Inspection to confirm Section 9.0 compliance and prevent duplication of effort.