All opinions expressed herein are mine, not necessarily those of Honeywell International, Inc.
My post on the CIP Version 5 NOPR has had well over 600 page views in the month it has been available. So it was with a little dismay that I just noticed a mistake in one of the footnotes.
The footnote had to do with Distribution Providers. DPs are one of the NERC entity types listed as being subject to CIP Version 5 in Section 4.1 of CIP-002-5; however, they are only subject to V5 if they own one of four specific types of BES facilities listed in that section. Section 4.2 then indicates which BES Facilities owned (or operated) by each type of entity subject to Version 5 are actually in scope for V5 (as at least a Low impact facility).
I hadn’t read Section 4.2 carefully enough when I wrote the NOPR post, and I assumed that DP’s were like all of the other entities listed in 4.1: every BES Facility they own (operate) is subject to V5. However, in going back over CIP-002-5 much more carefully while writing subsequent posts, I have come to realize this is wrong. For DPs, the only facilities that are in scope are the four specific types listed in section 4.1 (and also in 4.2).
Of course, if an entity has multiple registrations including DP and one of those other registrations makes it subject to V5, then this doesn’t matter. Because of those other registrations, the entity will still have to comply for all of their BES Facilities. This only matters for pure DPs.
I apologize for this mistake. I hope it hasn’t caused unnecessary heartburn in DPs.