A recent post described – at a very high level – my “methodology”[i] for complying with CIP-002-5.1 R1 (which I usually refer to simply as “R1”). When I wrote that post, I didn’t think there would need to be many changes to the methodology. However, I have already made one change in the methodology and now have two more to make – one substantial, one less so.
Besides describing these changes in this post, I will make them in the original post as well (as I did for the first change). In fact, since I know there will be more changes in the future, I will do this from now on: put out a post describing the change, then edit the original post so it reflects it. This makes the original post a “living” document that will hopefully always describe my most recent thinking on R1 methodology.
I. BCS Identification
If you haven’t read the original post (but if so, why are you reading this one?), I’ll point out that my “methodology” is heavily laden with a series of decisions the entity must make in order to comply with R1. Perhaps the most important of those decisions is exactly how BES Cyber Systems will be identified in the first place (i.e. before they’re classified High, Medium or Low impact).
In that post as well as a previous one, I described two primary methods for identifying BCS: “top-down” and “bottom-up”. My post stated that the best practice is to combine the two methods, since I believed that, in all cases, some BCS could be missed if only one of the two methods were used. However, since that post I have heard from two different sources - one a CIP auditor - that the top-down approach doesn’t really buy much in substations, although it does in control centers and generating stations.
The reasoning for this makes a lot of sense: in control centers and generating stations, there are certain well-understood functions that are performed by the asset as a whole; these functions each have systems associated with them. For example, BA control centers almost always have systems including production SCADA/EMS, Outage Management System, ICCP, Historical Data Retention, Operations Engineering Support System, etc. Generating stations have a digital control system, soot blow down system, control air management system, etc.[ii]
The entity only needs to confirm that the loss, misoperation, etc. of any of these systems has a BES impact within 15 minutes; if it does, the system is a BCS. So for these two asset types, starting with the top-down approach is best. Of course, the entity still needs to perform the bottom-up analysis, in which it considers each of the Cyber Assets at or associated with the asset[iii] - that haven’t already been identified as components of BES Cyber Systems through the top-down analysis - to determine whether or not they meet the definition of BES Cyber Asset, including having a 15-minute impact on the BES. Every BCA so identified should then be included in a BES Cyber System.[iv]
Substations are different. Substations don’t inherently perform particular functions – they can be all over the map, and can include some mix of Transmission (in scope for CIP) and Distribution (not in scope) functions[v]. There is no inherent set of functions that most or all substations perform. You really have to look at each individual Cyber Asset and consider whether it has a 15-minute impact on the BES, then perform the rest of the bottom-up analysis. But the top-down analysis isn’t likely to identify BCS that aren’t identified in the bottom-up approach, and therefore doing both analyses doesn’t buy you anything.
However, you may say, “What about the BES Reliability Operating Services (BROS), which are an integral part of the top-down approach? Do we just forget about them for substations?” No. Just because the entity doesn’t use the top-down approach for substations doesn’t mean the BROS don’t come into play in the BCS identification process. Since the heart of the BES Cyber Asset definition is that the loss of the Cyber Asset would “adversely impact” the BES within 15 minutes, a good way to identify BCAs is to consider whether a Cyber Asset has a 15-minute impact on one or more BROS. If so, the Cyber Asset is most likely a BCA.[vi]
So I will revise my R1 methodology post to reflect what I’ve just said. However, I’ve just identified another post that needs to be modified. This is a post I wrote on the meaning of “affect the BES” in the BCA definition. In that post, I stated that there was no point, when doing the bottom-up analysis, to consider the BROS. I said this because I was assuming that all entities would start their BCS identification with the top-down analysis, so they would have already identified all Cyber Assets that fulfilled a BROS - they are components of BCS. Since I’m now saying the top-down approach doesn’t help for substations, this means the BROS should be considered (again, not exclusively), as substation owners/operators identify their BCAs through the bottom-up analysis. I will modify this other post as well.
II. “Transmission Facilities”
In my R1 methodology post (item 3 under Task 2), I indicated that one of the definitions each entity needs to develop is one for “Transmission Facilities”. This term is used in several of the Medium impact criteria, yet even though both “Transmission” and “Facility” are NERC-defined terms, I had heard that trying to combine these two definitions didn’t yield anything very helpful. And I heard this was causing problems for Transmission entities as they tried to sort out Transmission from Distribution cyber assets in their substations. In addition, I heard the new BES definition (which essentially defines Transmission) wasn’t too helpful in sorting things out. I had discussed this issue in a previous post.
However, I have since heard from a couple knowledgeable persons that it really isn’t all that hard to separate Transmission from Distribution cyber assets (and Facilities) in substations, using the new BES definition. Since I haven’t heard any further comments to the contrary, I am officially declaring this a non-issue (leaving only 4,368 known issues with R1 and Attachment 1, by my latest count), and will remove it from the R1 methodology post.
The views and opinions expressed here are my own and don’t necessarily represent the views or opinions of Honeywell.
[i] I use quotes here because, as explained in the original post, it is impossible to write down – in a document with fewer words than the Bible – a single methodology for complying with R1; there are far too many branches and options required. But this doesn’t mean NERC entities, with High or Medium impact assets under CIP v5, don’t have to follow any particular methodology when they comply with R1. They have to follow some methodology, and it has to be documented. My post should be seen as more or less a “template” for developing the methodology, although a large part of the contents – various definitions and interpretations – need to be determined and inserted by the entity; there is no way they can be dictated in advance, given the ambiguities and contradictions in the wording of R1 and Attachment 1.
[ii] All of these examples of systems were suggested by the auditor.
[iii] If the asset is a High impact Control Center, the applicable wording is “used by and located at”. If it is a Medium impact Control Center or a Medium impact generating station, the wording is “associated with”.
[iv] The exception to this rule is for large plants (usually coal) that are in scope with v5 because of criterion 2.1. In these, it is usually impossible to apply the true “bottom-up” approach, because of the huge number of devices (sometimes in the tens of thousands) that may meet the definition of Cyber Asset. Since my post on R1 methodology in theory just applied to substations (although I think it also works for generating plants that don’t meet 2.1), I still haven’t addressed the “2.1 plant” methodology. I hope to in a future post.
[v] It occurred to me that this is why CIP Versions 1-3 fit so badly in substations. A Critical Cyber Asset was defined as a Cyber Asset “essential to the operation” of a Critical Asset. Since, strictly speaking, a substation considered as a whole doesn’t perform any particular operations, there really aren’t any Cyber Assets that meet that definition. Version 5 tried to address this issue by writing all the criteria that apply to substations (2.4 – 2.8) with the word “Facilities” in the subject – meaning the lines, transformers, busses, etc. that are located at the Transmission substation. These are what becomes Medium impact, not the substation itself. Of course, many Transmission entities and even Regional Entities seem to be interpreting the word Facilities to mean the substation itself, even though that is almost certainly not what was intended (although as I said in my methodology post, there’s nothing wrong with doing this – as long as you accept that you’ll probably identify more Medium BCS than if you used the pure “Facilities” approach). I have discussed this issue in several posts, including this one.
[vi] Of course, the converse isn’t true: If the Cyber Asset doesn’t have a 15-minute impact on a BROS, it doesn’t mean it isn’t a BCA, since its impact could be in another area than reliability. For example, the fire suppression system in a substation doesn’t fulfill any particular BROS, but were it to fail to operate when needed (in the event of a fire), its failure to operate would presumably have a 15-minute impact (e.g. one or more lines might be tripped because their associated relays burned up).