FERC Cybersecurity

Requirement

Provide physical security and access control to all cyber assets. This includes servers, workstations, network equipment, and control panels involved in SCADA or remote operation.

Suggested Solution

Lock and Key Program or Physical Access Control System.

Following the Lock and Key Program described in Key Control Procedures section in the Security Plan meets this requirement.

Requirement

Monitor and periodically review (not to exceed 18 months) network connections, including remote and third-party connections.

Suggested Solution

Use Interconnection Service Agreements (ISA) or Memorandums of Understanding/Agreement (MOU/A) to approve and document trusted connections. Review these agreements annually.

Requirement

Evaluate and reassess the role of wireless networking for risk before implementation.

Suggested Solution

Document authorized wireless access points and use strong encryption and authentication for wireless networks. Periodically scan for rogue wireless access points.

Requirement

Review and reassess all cyber security procedures annually. Update procedures as necessary.

Review and reassess cyber asset criticality periodically (not to exceed 12 months). In addition, criticality should be determined as all new cyber assets are added to the environment.

Suggested Solution

Establish a Governance and Risk Management program that periodically reviews and updates all cybersecurity policies, guidelines, and standards, and maintains asset inventories with annual reassessment of asset criticality.

Requirement

Develop a cross-functional cyber security team and an operational framework to ensure coordination, communication, and accountability for information security on and between the control systems and enterprise networks.

Suggested Solution

Hire personnel to guide the cybersecurity program and assign cybersecurity responsibilities to cyber asset owners.

Requirement

Define information and cyber security roles, responsibilities, and lines of communication among the operations, IT, and business groups, as well as with outsourcers, partners, and third-party contractors.

Suggested Solution

Establish a RACI matrix with cyber asset owners and cybersecurity personnel by cyber asset or by "system".

Requirement

Establish and document standards for cyber security controls for use in evaluating systems and services for acquisition. Encourage vendors to follow software development standards for trustworthy software throughout the development lifecycle.

Suggested Solution

Develop cyber asset assessment criteria based on your cybersecurity governance and/or risk management model. There are several models to choose from, such as NIST CSF, NIST RMF, ISO 27001, IEC/ISA-62443, or something else. Pick the one model that works for you. If you want advice, use the "Get Help" button on the sidebar.

Create a supply chain program to assess products and/or vendors prior to procurement.

Requirement

Incorporate security into cyber system design and operation, whether designing a new system or modifying an existing system. Secure design and operation of the SCADA control system architecture is critical for the creation of a sustainable and reliable system. Mitigate any security deficiencies found in control system hardware and software.

Suggested Solution

Train engineers and solution architects on the principles of Cyber Informed Engineering (CIE). CIE extends "secure-by-design" concepts beyond the digital realm to include the engineering of cyber-physical systems. CIE introduces cybersecurity considerations at the earliest stages of system design, long before the incorporation of software and security controls.

DOE OTSI's Cyber-Informed Engineering Implementation Guide

Requirement

Establish and document policies, standards, and procedures for assessing and maintaining system status and configuration information, for tracking changes made to control systems network, and for patching and upgrading operating systems and applications.

Suggested Solution

Establish a configuration management program that includes the creation of a configuration management board to review and approve changes prior to implementation.

Requirement

Establish and document policies, standards, and procedures for the secure disposal of equipment and associated media.

Suggested Solution

Create a secure disposal process that removes sensitive information from cyber assets before they are disposed of.

Requirement

Plan and prepare for the restoration and recovery of control systems in a timely manner as specified in the facility's recovery procedures.

Suggested Solution

Create a recovery plan to restore cyber assets to operational status and train personnel when and how to execute the plan.

Requirement

Review the restoration and recovery plan for control systems including annual testing of plan.

Suggested Solution

Conduct a tabletop exercise or after action review of a real-world event in which the recovery plan was used. Review the results of the exercise or event and update the plan as needed.

CISA's Cybersecurity TTX Scenarios

Requirement

Establish policies, standards, and procedures for cyber intrusion monitoring, detection, incident handling, and reporting.

Suggested Solution

Create a security monitoring program to collect and analyze network and cyber asset logs for unusual behavior.

A basic security monitoring program for OT systems has three (3) components:

1. Data Component:
   1. Network Logs
   2. System Logs (from cyber assets that can support remote log collection)
   3. Local Inventories and Network topologies
   4. Threat Intelligence
2. Security Incident and Event Monitor (SIEM) Component. Some free SIEM options are:
   1. AlienVault OSSIM
   2. Elasticsearch, Logstash, Kibana, known as the ELK stack.
3. Cyber Event/Incident response procedure — what do you do when you detect an anomaly.

Requirement

Provide training in information security awareness, on an annual basis or as necessitated by changes in the control system, for all users of control systems before permitting access to the control systems. Individuals with significant control systems security roles should have advanced training specific to their roles.

Suggested Solution

Establish a training program that provides initial and annual User Training and Privileged User Training to all employees and contractors. This website offers some rudimentary training to meet the basic requirement, but each utility should have their training program tailored to their needs.

Requirement

Segregate and protect the control systems network from the business network and the Internet through the use of firewalls and other protections. This applies both to wired and wireless networks.

Suggested Solution

At a minimum, separate the IT and OT networks and protect each network with a firewall.

Requirement

Use control systems servers and desktop computers only for approved control system activities.

Suggested Solution

Establish a training program and define what is and is not acceptable use of utility cyber assets.

The Cybersecurity User Training included in this website meets this requirement, but organizations with the resources to establish their own, tailored training program should do so.

Requirement

Establish and enforce access control policies for local and remote users, guests, and customers. Procedures and controls should be in place for approving and enforcing policy for remote and third-party connections to control networks.

Suggested Solution

Create an access control policy and process that verifies a new user has been trained and has a verified need-to-know or need-to-access a specific cyber asset(s) or services before given credentials.

Requirement

Restrict physical and logical access to control systems and control networks through the use of an appropriate combination of locked facilities, passwords, secured communication gateways, access control lists, authenticators, separation of duties practices, least privilege practices, and/or other secure access mechanisms and practices.

Suggested Solution

Create an access control program that addresses both physical security and cybersecurity to counter the threat of cyber-physical attacks. This requirement represents a more sophisticated, holistic approach to cybersecurity.

Requirement

Conduct a risk assessment to weigh the benefits of implementing wireless networking against the potential risks for exploitation. Evaluate the need for enhanced networking control technologies for wireless networks prior to implementation.

Suggested Solution

This requirement represents a more thorough risk assessment process for implementing wireless networking at the utility.

Requirement

Conduct periodic vulnerability assessments of the control system security, including as appropriate in a non-production environment, not to exceed 12 months.

Suggested Solution

Create a program to detect, identify, and when needed, mitigate vulnerabilities on cyber assets. This type of program can include vulnerability scanners, threat intelligence, and paper assessments.