generation owners, generation operators and load serving entities that
have a limited view of the Bulk-Power System, we believe that NERC's
development of guidance on the risk-based assessment methodology and
our direction above to provide assistance to small entities should
support the efforts of entities--both small and large--in performing a
proper assessment. We do not believe that the lack of a wide-area view
is sufficient reason to forego an assessment or taking responsibility.
---------------------------------------------------------------------------

    \98\ CIP NOPR at P 111.
---------------------------------------------------------------------------

    320. We will not allow a ``safe harbor'' for good faith compliance
as requested by AMP Ohio. We do not believe that blanket waivers from
an enforcement action are appropriate in this context and have
previously denied other requests for safe harbors from enforcement.\99\
Rather, we believe that demonstrable good faith compliance is a
legitimate mitigating factor in an enforcement action.
---------------------------------------------------------------------------

    \99\ See, e.g., North American Electric Reliability Council, 119
FERC ] 61,060 at P 133; order on reh'g, 120 FERC ] 61,260 at P 41
(2007).
---------------------------------------------------------------------------

    321. SPP and ReliabilityFirst suggest modifying CIP-002-1 to allow
an entity to rely upon the assessment of another entity with interest
in the matter. We believe that this is a worthwhile suggestion for the
ERO to pursue and the ERO should consider this proposal in the
Reliability Standards development process. We note that, even without
such a provision, an entity such as a small generator operator is not
foreclosed from consulting with a balancing authority or other
appropriate entity with a wide-area view of the transmission system.
(b) Need for External Review and Alternatives
    322. The Commission adopts its CIP NOPR proposal to direct that the
ERO develop through its Reliability Standards development process a
mechanism for external review and approval of critical asset lists. The
Commission finds that an external review of critical assets by an
appropriate organization is needed to assure that such lists are
considered from a wide-area view (i.e., from a regional perspective)
and to identify trends in critical asset identification. Further, while
we recognize that individual circumstances may likely vary, an external
review will provide an appropriate level of consistency.
    323. The Commission disagrees with the suggestion of Luminant and
others that external review should be voluntary. The identification of
critical assets pursuant to CIP-002-1 is crucial to cyber security
protection because this determination controls whether a responsible
entity must comply with the remaining CIP requirements in CIP-003-1
through CIP-009-1. External review will help ensure that responsible
entities have an accurate and complete list of critical assets, which
will in turn allow them to be appropriately protected to further the
security of the nation's Bulk-Power System. Allowing external review as
a voluntary measure is not adequate to ensure that responsible entities
are prepared to address cyber vulnerabilities and cyber threats. Based
on the same reasoning, we reject the suggestion of Northern Indiana and
others that the external review should only address the assessment
methodology, and not critical asset lists.
    324. The Commission also disagrees with commenters who insist that
the external review can be performed pursuant to the ERO's and Regional
Entity's current compliance and enforcement programs, and the audit
process in particular. While the Commission decided earlier in the
Final Rule to rely on the ERO and regional audit processes to examine
exceptions

to compliance based on ``technical feasibility,'' the Commission does
not believe that the audit process will provide timely feedback to a
responsible entity regarding critical asset determinations. Review of
critical asset lists through individual audits would span a significant
period of time, measured in years, during which time such lists would
not undergo review and possibly gaps in security could result. While
EEI's suggestion of spot checks prior to the ``auditably compliant''
stage would provide more timely feedback it would, by design, not be
comprehensive. The Commission concludes that a structured program for
the formal, timely review of critical assets lists is a reasonable
means to provide timely, comprehensive guidance to responsible entities
on the adequacy of their critical asset lists.
    325. The Commission agrees with Ontario IESO that in a dispute
between a responsible entity and the external reviewer over whether to
identify an additional asset as critical, the external reviewer should
prevail. (However, an external reviewer's role should be limited to
determining if additional assets should be added, and should not
include making recommendations to remove an asset from the list of
critical assets.) We recognize, however, that there may be a legitimate
reason for a responsible entity to dispute such a determination,
possibly through an appeal. We leave it to the ERO to determine the
need for such an appeal mechanism and, if appropriate, the development
of appropriate procedures (or reliance on appeal procedures currently
provided in the NERC Rules of Procedure). While the ERO may determine
that an appeals process is a necessary aspect of this program, we do
not believe that the burden of such appeals outweighs the benefits of
the external review of critical asset lists.
(c) Appropriate Organization To Conduct External Review
    326. The Commission in the CIP NOPR proposed that the Regional
Entities be responsible for the external review of critical asset
lists, and also expressed a willingness to consider a review process
that allows for the participation of other organizations such as
reliability coordinators and transmission planners. As indicated above,
a number of commenters question whether the Regional Entities have the
expertise or resources to conduct the reviews. Rather, there was
considerable support for reliability coordinators conducting the
external review because of their technical expertise, their wide-area
view and their role of coordinating among neighboring systems.
    327. The Commission believes that the Regional Entities must have a
role in the external review to assure that there is sufficient
accountability in the process. Further, a Regional Entity role is
necessary because the Regional Entities and ERO are ultimately
responsible for ensuring compliance with Reliability Standards. For
example, if the ERO determines that an appeals process is needed, this
process cannot rest with an active owner or operator of the Bulk-Power
System such as a reliability coordinator. Moreover, the ERO and the
Commission have oversight authority of the Regional Entities' programs
and procedures pursuant to section 215 of the FPA.
    328. Beyond the direction that the Regional Entities maintain a
role in the external review process to assure that there is sufficient
accountability, we leave to the ERO to determine whether the Regional
Entities have, or can timely develop, the resources to conduct the
external reviews.\100\ Alternatively, the ERO may determine that
another entity such as reliability coordinators may be best equipped to
conduct the reviews. While commenters have made what the Commission
believes to be a strong case that reliability coordinators are the
appropriate entity to perform the reviews, the ERO should decide the
best approach with its understanding of the capabilities and
limitations of the Regional Entities. Regardless of this determination,
however, the Commission notes that the Regional Entities have the
oversight responsibility.\101\
---------------------------------------------------------------------------

    \100\ The Commission does not believe that Regional Entity
review creates a conflict of interest as claimed by some commenters
because the Regional Entity has no pecuniary interest. The mere fact
that a Regional Entity performs a development and compliance role is
not a sufficient reason to find a conflict of interest.
    \101\ The Commission notes that general reliance on Regional
Entity oversight does not preclude the Commission, the ERO or a
Regional Entity from exercising its authority to review critical
asset lists, whether resulting from a complaint, an incident or on
its own initiative.
---------------------------------------------------------------------------

    329. Based on the above discussion, the Commission directs the ERO,
using its Reliability Standards development process, to develop a
process of external review and approval of critical asset lists based
on a regional perspective.
e. Confidentiality Concerns
    330. The Commission agrees with commenters that critical asset
lists contain sensitive information that needs to be protected from
public dissemination. The Commission, however, does not believe that
this concern is a persuasive rationale for not having an external
review mechanism. Rather, adequate safeguards need to be developed to
assure that the information contained in critical asset lists are not
released during the external review process. While Requirement R4 of
CIP-003-1 obligates a responsible entity to ``implement and document a
program to identify, classify, and protect information associated with
Critical Cyber Assets,'' the Commission does not view this as
inherently conflicting with an external review process that has
adequate safeguards to prevent the release of sensitive information.
    331. In developing an appropriate external review mechanism, the
ERO should include features for the controlled delivery of critical
assets to the entity performing the external review. Likewise, the ERO
should identify minimum safeguards that the external reviewer must
deploy to protect sensitive information from disclosure. We agree with
commenters' concern that the external reviewer should not become a
``central repository'' for critical asset lists, and this information
should be returned to the responsible entity once the review is
complete. The ERO should develop any other safeguards that it believes
to be appropriate to protect the disclosure of sensitive information
during the external review process.
    332. CEA and Manitoba Hydro comment that some Canadian utilities
are prohibited from sharing security information with U.S. authorities.
They also note that some Canadian utilities regard sharing sensitive
security information externally or with a foreign entity as a security
risk. In response, the Commission's Final Rule only addresses the
obligations of users, owners and operators of the Bulk-Power System in
the United States (excluding Hawaii and Alaska). Accordingly, the
Commission's directives regarding the development of an external review
mechanism applies only to entities subject to the Commission's
jurisdiction pursuant to section 215 of the FPA. Whether a similar
review process is appropriate or lawful in other jurisdictions is
beyond the scope of this Final Rule.
    333. Bonneville comments that external review could result in FOIA
concerns for Bonneville and other federal entities. It also cautions
that external reviewers of critical federal security information may
need federal security clearances before being allowed access to
classified information. In response to Bonneville, we agree that a
governmental entity subject to FOIA requirements should not be required
to share sensitive information about

critical assets lists that could be deemed a waiver of FOIA protection
that is otherwise available. Nonetheless, a governmental entity's
identification of critical assets should be subject to appropriate
oversight. Thus, we direct the ERO, in developing the accountability
structure for the technical feasibility exception, to include
appropriate provisions to assure that governmental entities can
safeguard sensitive information. The ERO should consult with
governmental entities that are subject to the CIP Reliability Standards
in developing such appropriate provisions and we, likewise, encourage
Bonneville and other governmental entities to participate in the
development of such provisions.
    334. Further, if a governmental entity has classified material
regarding its critical assets, this information may not be disclosed
except in accordance with controlling laws and regulations. The ERO's
external review process must explicitly recognize this limitation.
f. Interdependency
i. NOPR Proposal
    335. In the CIP NOPR, the Commission noted that, while CIP-002-1
pertains to the identification of assets critical to Bulk-Power System
reliability, broader interdependency issues with other infrastructures
cannot be ignored.\102\ The Commission stated its intention to revisit
this matter through future proceedings and in cooperation with other
agencies to help to inform the electric sector and itself about the
need for future CIP Reliability Standards, especially when the
interdependent infrastructures affect generating capabilities, such as
through fuel transportation.
---------------------------------------------------------------------------

    \102\ CIP NOPR at P 118.
---------------------------------------------------------------------------

ii. Comments
    336. APPA/LPPC and other commenters support the Commission's
proposed determination that the scope of reliability regulation is
properly limited to assets critical to the Bulk-Power System, and does
not extend to the management of assets that may be important to the
operation of other (even if presumably critical) non-electric assets.
MidAmerican comments that the expansion of CIP Reliability Standards
beyond Bulk-Power System reliability should be approached with caution
and only after the compliance effort is complete for the current CIP
Reliability Standards. Luminant agrees with the Commission that issues
pertaining to system interdependency are complicated and more
appropriately addressed in a separate proceeding after the Commission
completes its action approving the current NERC CIP Reliability
Standards.
    337. By contrast, Applied Control Solutions suggests that
interdependencies should be included in risk-based assessments, as they
can have direct (e.g., electronic connections between electric entities
and major customers) and indirect impacts (e.g., loss of major fuel
sources) on Bulk-Power System reliability.
    338. Likewise, the Congressional Representatives find fault in the
CIP Reliability Standards for failing to address interdependencies with
other critical infrastructures. The Congressional Representatives state
that the Bulk-Power System is an enormous, interconnected network that
is both redundant and resilient, making the sole focus on
``reliability'' and ``operability'' of the grid as a whole
inappropriate. They explain that every critical infrastructure in the
country is dependent on the Bulk-Power System, including chemical
plants, banks, refineries and military installations. Thus, according
to the Congressional Representatives, ``focusing on assets relative to
the functioning of the grid misses the importance of each individual
asset to the functions of our society.'' \103\ To address the
shortcoming, the Congressional Representatives suggest that every
electronically connected asset be considered ``critical.''
---------------------------------------------------------------------------

    \103\ Congressional Representatives comments at 7.
---------------------------------------------------------------------------

    339. Related, the Congressional Representatives are critical of
NERC's definition of critical assets as ``facilities, systems, and
equipment that would affect the reliability and operability'' of the
Bulk-Power System. The Congressional Representatives explain that this
definition fails to understand the importance of individual elements of
the Bulk-Power System that are essential to the delivery of power to
the nation's critical infrastructure. They state that generation units
serving individual communities, individual substations,
telecommunication equipment and distribution assets are critical to the
safety and security of the U.S., yet are excluded under CIP-002-1.
iii. Commission Determination
    340. The Commission is sensitive to the concerns raised by the
Congressional Representatives regarding the severe impact that a cyber
attack on assets not critical to the Bulk-Power System could still have
on the public. The Commission, however, believes that its authority
under section 215 of the FPA does not extend to other infrastructure.
Section 215 of the FPA authorizes the Commission to approve Reliability
Standards that ``provide for the reliable operation of the bulk-power
system,'' which the statute defines as the facilities and control
systems necessary for operation of an interconnected electric energy
transmission network and the electric energy needed to maintain
transmission system reliability. In addition, section 215(a)(1)
specifically excludes from the definition of Bulk-Power System
``facilities used in the local distribution of electric energy.''
Moreover, given the complexities surrounding this issue and the
aggressive timeline that will be necessary merely to meet the more
modest task of developing and implementing cyber security standards
capable of protecting the reliability of the Bulk-Power System, we will
follow the approach that we described in the CIP NOPR of approving CIP
Reliability Standards designed to safeguard the reliability of the
Bulk-Power System.
    341. Although the Commission will not direct modifications to the
scope of critical assets to be identified under CIP-002-1, for the
reasons discussed above, the Commission agrees with commenters
regarding the importance of considering interdependencies with other
critical infrastructures. The Commission believes that to meaningfully
address interdependencies with other critical infrastructures, it is
important to coordinate with the stakeholders of these other
infrastructures as well as with other government agencies and
organizations. Thus, we affirm our CIP NOPR approach that ``[w]hile
broader interdependency issues cannot be ignored, the Commission
intends to revisit this matter through future proceedings and with
other agencies. This work will help inform the electric sector and this
Commission about the need for future Reliability Standards, especially
when the interdependent infrastructures affect generating capabilities,
such as through fuel transportation.'' \104\
---------------------------------------------------------------------------

    \104\ CIP NOPR at P 118.
---------------------------------------------------------------------------

2. CIP-003-1--Security Management Controls
    342. Reliability Standard CIP-003-1 seeks to ensure that each
responsible entity has minimum security management controls in place to
protect the critical cyber assets identified pursuant to CIP-002-1. To
achieve this goal, a responsible entity must develop a cyber security
policy that represents management's commitment and ability

to secure its critical cyber assets. It also must designate a senior
manager to direct the cyber security program and to approve any
exception to the policy.
    343. CIP-003-1, in addition, requires a responsible entity to
implement an information protection program to identify, classify, and
protect sensitive information concerning critical cyber assets, as well
as an access control program to designate who may have access to such
information. Finally, a responsible entity must establish a ``change
control and configuration management'' program to oversee changes made
to the hardware or software of critical cyber assets.
    344. The Commission approves Reliability Standard CIP-003-1 as
mandatory and enforceable. In addition, we direct the ERO to develop
modifications to this Reliability Standard through its standards
development process and to take other actions. These actions pertain to
(1) the adequacy of policy guidance; (2) discretion to grant
exceptions; (3) leadership; (4) access authorization; (5) change
control and configuration management; and (6) interconnected networks.
a. Adequacy of Policy Guidance
    345. Requirement R1 of Reliability Standard CIP-003-1 directs a
responsible entity to ``document and implement a cyber security policy
that represents management's commitment and ability to secure its
critical cyber assets.'' The only guidance that is given with regard to
the nature and scope of the cyber security policy is that it should
address ``the Requirements in CIP-002-1 through CIP-009-1, including
the provisions for emergency situations.''
i. NOPR Proposal
    346. The Commission proposed in the NOPR that the ERO modify CIP-
003-1 to provide additional guidance for the topics and processes that
the required cyber security policy should address to ensure that a
responsible entity reasonably protects its critical cyber assets.\105\
We noted that Recommendation 34 of the Blackout Report called for grid-
related organizations to have a planned and documented security
strategy, governance model, and architecture for energy management
automation systems. The CIP NOPR provided examples of possible topics
for security policy guidance, such as communication networks related to
control systems; the appropriate use of defense in depth strategy; the
use of wireless communications for control systems; uninterruptible
power supplies; and heating, ventilation, and air-conditioning (HVAC)
equipment for critical cyber assets.
---------------------------------------------------------------------------

    \105\ See CIP NOPR at P 123-27.
---------------------------------------------------------------------------

ii. Comments
    347. NERC and other commenters contend that the Commission should
not direct the ERO to modify CIP-003-1 to provide additional guidance
for the topics and processes that the required cyber security policy
should address.\106\ The Commission should instead permit and encourage
the development of ``how'' guidelines and work papers. Ontario Power is
concerned that the expectation that security policies will address
issues that are not currently reflected in the CIP Reliability
Standards implies that an entity could be found non-compliant for not
following its own policies that are outside of the Reliability
Standards. Ontario Power maintains that this would be an unfounded
increase in the scope of the CIP Reliability Standards.
---------------------------------------------------------------------------

    \106\ E.g., Alliant Energy, Mr. Brown, First Energy, Idaho
Power, ISO/RTO Council and Ontario Power.
---------------------------------------------------------------------------

    348. ISO/RTO Council opposes the Commission proposal and expresses
concern that if a responsible entity's security policies go beyond the
specific Requirements of the Reliability Standards, it could be
penalized for failure to implement the policies fully. ISO/RTO Council
also objects to reporting any steps that exceed what the CIP
Reliability Standards require to any third party. It argues that it
would be wasteful to require development of one set of plans, policies
and standards to meet what is explicitly required by the Reliability
Standards and another that is applicable to other assets such as market
systems. ISO/RTO Council requests that the Commission clarify that
monitoring for non-compliance will pertain to the specific Requirement
of the Reliability Standards, not requirements expressed in corporate
policies relevant to security.
    349. In contrast, SoCal Edison believes that it is appropriate to
include guidance in CIP-003-1 on important systems that have not yet
been addressed such as data and communications networks, but that
guidance on topics such as power supplies, heating, and other equipment
is too detailed for a corporate level policy. APPA/LPPC agrees that
security policies will address issues that are not currently reflected
in the CIP Reliability Standards but that are important for control
system security. Further, APPA/LPPC state that the nature and scope of
a responsible entity's cyber security management policy generally
should be left to the entity's discretion.
    350. ReliabilityFirst and SPP comment that an entity's overall
organizational security policies should address protection of
supporting infrastructure and appropriately define a defense in depth
posture. However, they are concerned that, by including such
infrastructure in the scope of the CIP Reliability Standards, an audit
could determine that the devices supporting the network throughout the
entity should be considered either critical cyber assets or electronic
security perimeter access points and thus become subject to all of the
Requirements of the CIP Reliability Standards. Their concern is the
possibility of increasing the scope of the electronic security
perimeter to include the entity's entire communications network and all
assets connected thereto.
    351. Other commenters raise concerns whether specific issues should
be addressed in this guidance. Idaho Power disagrees with the
Commission's proposal to address the protection of support systems
(e.g., communication and HVAC) in the CIP Reliability Standards. It
states that other Commission-approved Reliability Standards are better
suited for addressing these issues. For example, according to Idaho
Power, communication concerns should be addressed in COM-001.
    352. Tampa Electric notes that cyber assets associated with
communications networks and data communication links between distinct
electric security perimeters are exempt under the CIP Reliability
Standards. It urges that this exemption be maintained and that further
consideration of the exemption's merit should be addressed only in the
Reliability Standards development process. Likewise, National Grid and
MidAmerican oppose expanding the CIP Reliability Standards to cover
communications and data networks beyond those directly involved in the
security of control systems.
    353. APPA/LPPC agree that it is reasonable for responsible entities
to be responsible for the communications systems they own and operate.
However, they cannot be expected to oversee the operations of
commercial communication carriers. APPA/LPPC state the Commission
should recognize that it has no authority to compel commercial
communication carriers to comply with the CIP Reliability Standards and
that responsible entities cannot compel them to comply.

    354. ReliabilityFirst and SPP are concerned that environmental
systems would become subject, at a minimum, to the requirements of CIP-
006-1 (Physical Security). Environmental systems are often not fully
enclosed within a physical security perimeter as defined by the
Reliability Standard and it is impractical in some instances to do so.
ReliabilityFirst states that, besides expanding the scope of the
Reliability Standards to encompass issues that either have no bearing
on Bulk-Power System reliability, or are specifically excluded from the
CIP Reliability Standards, the Commission's proposal improperly deals
with ``how'' a responsible entity is to address a Requirement.
iii. Commission Determination
    355. The Commission believes that responsible entities would
benefit from additional guidance regarding the topics and processes to
address in the cyber security policy required pursuant to CIP-003-1.
While commenters support the need for guidance, many are concerned
about providing such guidance through a modification of the Reliability
Standard. We are persuaded by these commenters. Accordingly, the
Commission directs the ERO to provide additional guidance for the
topics and processes that the required cyber security policy should
address. However, we will not dictate the form of such guidance. For
example, the ERO could develop a guidance document or white paper that
would be referenced in the Reliability Standard. On the other hand, if
it is determined in the course of the Reliability Standards development
process that specific guidance is important enough to be incorporated
directly into a Requirement, this option is not foreclosed. The
entities remain responsible, however, to comply with the cyber security
policy pursuant to CIP-003-1.
    356. In response to ISO/RTO Council, Ontario Power and other
commenters, the Commission's intent in the CIP NOPR--as well as the
Final Rule--is not to expand the scope of the CIP Reliability
Standards. Requirement R1 of CIP-003-1 requires a responsible entity to
document and implement a cyber security policy ``that represents
management's commitment and ability to secure its Critical Cyber
Assets.'' The Requirement then states that the policy, ``at a
minimum,'' must address the Requirements in CIP-002-1 through CIP-009-
1. The Commission believes that there are other topics, besides those
addressed in the Requirements of the CIP Reliability Standards, which
are relevant to securing critical cyber assets. The Commission
identified examples of such topics in the CIP NOPR. Thus, the
Commission, in directing the ERO to develop guidance on additional
topics relevant to securing critical cyber assets, is not expanding the
scope of the CIP Reliability Standards.
    357. Nor do we believe, as suggested by Idaho Power, that the
proposed topics for guidance are better addressed by revisions to other
Reliability Standards. Again, the guidance is in the context of
securing critical cyber assets and is best addressed in the CIP
Reliability Standards or a supporting guidance document.
    358. In response to SoCal Edison, we disagree that guidance on
topics such as power supplies, heating, and other equipment is too
detailed for a corporate level policy. These topics are potentially
relevant to securing critical cyber assets and, therefore, appropriate
topics for guidance.
    359. ISO/RTO Council, Ontario Power and other commenters raise
concerns regarding potential civil penalty liability if a responsible
entity addresses the additional guidance topics in its cyber security
policy. The Commission does not believe that the inclusion of
additional topics in the cyber security policy will increase a
responsible entity's penalty liability. We provide our views regarding
the enforcement of cyber security policies below in addressing
exceptions to such policies. In particular, we state there that our
concern is that a good policy exists and that it is implemented through
the exercise of sound reasoning. Consistent with the discussion in the
following section, we do not believe that an entity's decision to not
follow its cyber security policy in a particular situation should
trigger a penalty, as long as no Reliability Standard Requirement
(other than Requirement R1 in CIP-003-1) is violated as a result. We do
require that the reasoning be documented to ensure that the responsible
entity is indeed implementing the security policy as required by
Requirement R1 of CIP-003-1.
    360. We agree with APPA/LPPC that responsible entities cannot be
expected to oversee the operations of commercial communications
carriers. However, this is an example of precisely why more guidance
would be useful. Since responsible entities cannot oversee commercial
communications carriers, it is important that they consider what they
can do to guard against potential threats from that quarter.
b. Discretion to Grant Exceptions
    361. Requirement R3 of CIP-003-1 provides that a responsible entity
must document as an exception each instance where it cannot conform to
its security policy developed pursuant to Requirement R1. Exceptions
need senior manager approval. The documentation must include ``an
explanation as to why the exception is necessary and any compensating
measures, or a statement accepting risk.'' An exception to the cyber
security policy must be documented within 30 days of senior management
approval. An authorized exception must be reviewed and approved
annually to ensure that the exception is still required and valid.
i. NOPR Proposal
    362. The Commission expressed concern in the CIP NOPR that
Requirement R2 allows a responsible entity too much latitude in
excusing itself from compliance with its cyber security policy.\107\
The Commission, therefore, proposed to direct the ERO to develop
modifications to CIP-003-1 that require a responsible entity to submit
documentation of cyber security policy exceptions periodically to the
relevant Regional Entity to provide added assurance that exceptions are
adequately justified.
---------------------------------------------------------------------------

    \107\ See CIP NOPR at P 128-33.
---------------------------------------------------------------------------

    363. Further, the Commission distinguished between situations where
a responsible entity excepts itself from its cyber security policy and
where it excepts itself from specific Requirements of the CIP
Reliability Standards based on technical feasibility and stated that
exceptions from a policy provision do not also excuse compliance with a
Requirement. In that regard, the Commission proposed that the ERO
develop modifications to clarify that the exceptions mentioned in
Requirements R2.3 and R3 of CIP-003-1 do not except responsible
entities from the Requirements of the CIP Reliability Standards.
ii. Comments
    364. While NERC and ReliabilityFirst do not comment specifically on
Regional Entity review of exceptions to a responsible entity's cyber
security policy, their general comment is that the Commission should
rely on NERC's existing oversight structure is applicable here.
    365. EEI and other commenters oppose requiring responsible entities
to submit documentation of exceptions to the cyber security policy to
Regional Entities. EEI disagrees with the Commission's assertion that
CIP-003-1

gives a responsible entity too much latitude to excuse itself from
compliance with its cyber security policy. EEI adds that it is
sufficient that exceptions to a cyber security policy must be explained
in writing and approved by a designated manager. According to EEI,
external accountability for such decisions is a function of the audit
process, and the Commission should not suggest that the Regional Entity
step outside its role of enforcing the Reliability Standards and engage
in enforcing a responsible entity's internal cyber security policy.
PG&E submits that the proposal is burdensome.
    366. Entergy disagrees that responsible entities should be required
to submit documentation of exceptions periodically to their Regional
Entity. Entergy believes that a proper security policy will track what
the Reliability Standards require. The Commission, the ERO, and
Regional Entities should not be concerned with policy exceptions but
rather only with whether the Requirements of the CIP Reliability
Standards are being met. Entergy also argues that requiring
documentation of exceptions could cause internal policies to be written
less rigorously to avoid the burden of excessive documentation.
    367. CEA and Manitoba Hydro are concerned that periodic submission
of documents on cyber security policy exceptions to Regional Entities
may allow the release of highly sensitive information. Manitoba Hydro
states that such documentation would contain details about existing
critical cyber assets and their security weaknesses that would threaten
both security and reliability if it were released inadvertently into
the wrong hands. SoCal Edison suggests that it is more appropriate for
responsible entities to house all justifications for policy exceptions
internally and have them reviewed during an audit. Bonneville is
concerned that the practice could be deemed a waiver of FOIA
protections. Bonneville also is concerned that external reviewers may
be required first to obtain required federal security clearances before
accessing the information.
    368. MidAmerican believes that the reporting of exceptions will
indicate a weak spot in a responsible entity's cyber security policy
and a secure method of handling these exceptions would need to be
established.
    369. Several commenters address the Commission's proposal to
clarify that the exceptions mentioned in Requirements R2.3 and R3 of
CIP-003-1 do not except responsible entities from the Requirements of
the CIP Reliability Standards. EEI opposes the Commission's proposal
for the same reasons described above. MidAmerican comments that it has
not interpreted Requirements R2.3 and R3 as the ability to avoid
compliance.
    370. Related, SPP states that a responsible entity cannot exempt
itself from a Requirement of a CIP Reliability Standard. Once a policy
is in place to comply with these Requirements, the only recourse in
cases of technical infeasibility or other valid reason is to document
an exception to the security policy. SPP maintains that the
Commission's proposal for reporting and approval of technical
feasibility exceptions would, if adopted, extend to exceptions to the
required security policy if the exception would make the responsible
entity incapable of complying fully with a Requirement of the CIP
Reliability Standards.
    371. Northern Indiana requests clarification of the information
that would be required to justify an exception and suggests that it
match the level of information required in self-certifications. It
suggests that a responsible entity would benefit from consultation when
attempting to justify an exception and that monetary penalties should
be waived during this time as well as within the timeframe of any
remediation plan. Northern Indiana also contends that security policy
exceptions which do not affect compliance with the Reliability
Standards need not be documented. Some policies may be stricter than
the Reliability Standards, and responsible entities should not be
required to submit documentation of exceptions that are consistent with
the Reliability Standards Requirements.
iii. Commission Determination
    372. The Commission continues to believe that it is important that
there be ERO and Regional Entity oversight of exceptions from required
security policies, however, the Commission agrees with commenters such
as EEI and PG&E that this oversight is best accomplished through the
existing Regional Entity oversight and audit process.
    373. Requirement R1 of CIP-003-1 requires the development and
implementation of a security policy. Requirement R3 provides that a
responsible entity must document exceptions to its policy with
documentation and senior management approval. The Commission is
concerned that, if exceptions mount, there would come a point where the
exceptions rather than the rule prevail. In such a situation, it is
questionable whether the responsible entity is actually implementing a
security policy. We therefore believe that the Regional Entities should
perform an oversight role in providing accountability of a responsible
entity that excepts itself from compliance with the provisions of its
cyber security policy. Further, we believe that such oversight would
impose a limited additional burden on a responsible entity because
Requirement R3 currently requires documentation of exceptions.
    374. That being said, the Commission agrees with EEI and others
that Regional Entity review of exceptions to a responsible entity's
cyber security policy is best accomplished pursuant to the existing
Regional Entity audit process where all the relevant facts and
circumstances can be considered. Further, review of exceptions to a
cyber security policy in the audit process should effectively address
commenter concerns regarding disclosure of sensitive information by
keeping that data on site.\108\
---------------------------------------------------------------------------

    \108\ In the Final Rule, the Commission has directed the ERO to
develop somewhat different external review processes in different
contexts. As discussed immediately above, the Commission believes
that exceptions to a responsible entity's cyber security policy are
appropriately addressed in the course of the Regional Entity's audit
process. The Commission has also directed that Regional Entities
evaluate and approve a responsible entity's reliance on the
technical feasibility exception as part of the audit process. In
addition, to provide the Regional Entity with an ``upfront''
understanding regarding the extent of industry reliance on the
technical feasibility exception, as well as to allow the Regional
Entity to adequately prepare for an audit, the Commission also
required that a responsible entity submit a ``notice'' to the
Regional Entity when the exception is invoked. In contrast, due to
the importance of timely verifying that responsible entities have
developed accurate cyber asset lists pursuant to CIP-002-1, the
Commission has directed the development of an external review
separate from the audit process. Thus, the Commission has tailored
different review processes to different situations to minimize the
burden on industry yet satisfy the goal of assuring adequate
oversight.
---------------------------------------------------------------------------

    375. As we discuss elsewhere in the Final Rule, we agree with
Bonneville regarding the need to preserve a governmental entity's FOIA
protections and address security clearance concerns. The ERO should
address these concerns through consultation with relevant governmental
entities.
    376. Further, the Commission adopts its CIP NOPR proposal and
directs the ERO to clarify that the exceptions mentioned in
Requirements R2.3 and R3 of CIP-003-1 do not except responsible
entities from the Requirements of the CIP Reliability Standards. In
response to EEI, we believe that this clarification is needed because,
for example, it is important that a responsible entity understand that
exceptions that

individually may be acceptable must not lead cumulatively to results
that undermine compliance with the Requirements themselves.
    377. The Requirement to develop and implement a security policy
differs from many other Requirements in that it is a means to the end
of implementing those Requirements. Our concern that exceptions be
documented and justified is primarily a concern that there be reasoned
decision-making, consistency, and subsequent effectiveness in
implementing the policy. We thus disagree with Northern Indiana that
security policy exceptions which do not affect compliance with the
Reliability Standards need not be documented. Further, in response to
Entergy, as stated elsewhere in this Final Rule, our concern is that a
good policy exists and that it is implemented through the exercise of
sound reasoning. We do not believe that an entity's decision to not
follow its cyber security policy in a particular situation should
trigger a penalty, as long as no Reliability Standard Requirement
(other than Requirement R1 in CIP-003-1) is violated as a result. We do
require that the reasoning be documented to ensure that the responsible
entity is indeed implementing the security policy as required by
Requirement R1 of CIP-003-1.
    378. In response to Northern Indiana's request for clarification of
the information that would be required to justify an exception, we
leave it to the ERO to provide guidance on the level of information
that it considers appropriate, consistent with our discussion above.
c. Leadership
i. NOPR Proposal
    379. Requirement R2 of CIP-003-1 requires that a senior manager be
assigned overall responsibility for implementation of the CIP
Reliability Standards. In the CIP NOPR, the Commission interpreted this
Requirement to require the designation of a single manager who has
direct and comprehensive responsibility and accountability for
implementation and ongoing compliance with the CIP Reliability
Standards.\109\ The Commission noted that Recommendation 43 of the
Blackout Report called for clear lines of authority and ownership for
security matters, and it proposed to direct that the ERO modify CIP-
003-1 to make clear the senior manager's ultimate responsibility.
---------------------------------------------------------------------------

    \109\ See CIP NOPR at P 134-36.
---------------------------------------------------------------------------

ii. Comments
    380. Bonneville states that the Commission should clarify whether
its intent is to make the senior manager personally accountable for
violations of the CIP Reliability Standards, i.e., subject to civil
penalties for violations, so that necessary action can be taken to
protect the manager, such as acquiring additional personal insurance
coverage. Similarly, NRECA asks the Commission to confirm that the
senior manager responsible for CIP Reliability Standards compliance is
not, by virtue of his position, subject to civil penalties pursuant to
section 215 of FPA.
iii. Commission Determination
    381. The Commission adopts its CIP NOPR interpretation that
Requirement R2 of CIP-003-1 requires the designation of a single
manager who has direct and comprehensive responsibility and
accountability for implementation and ongoing compliance with the CIP
Reliability Standards. The Commission's intent is to ensure that there
is a clear line of authority and that cyber security functions are
given the prominence they deserve. The Commission agrees with
commenters that the senior manager, by virtue of his or her position,
is not a user, owner or operator of the Bulk-Power System that is
personally subject to civil penalties pursuant to section 215 of FPA.
d. Information Access Authorization
    382. Requirement R5 of CIP-003-1 directs the responsible entity to
implement a program for managing access to protected critical cyber
asset information and requires, among other things, that the list of
personnel responsible for authorizing access to protected information
be verified at least annually.
 i. NOPR Proposal
    383. The Commission explained in the CIP NOPR that CIP-007-1,
Requirement R5 (access implementation), CIP-004-1, Requirement R4
(access revocation), and CIP-003-1, Requirement R5 (access review and
approval) each contain provisions on access to information, and it took
the position that these various provisions are not interlinked as
clearly as they should be. The Commission noted that Recommendation 44
of the Blackout Report stresses the need to prevent inappropriate
disclosure of information. Thus, the CIP NOPR proposed to direct that
the ERO modify Reliability Standards CIP-003-1, CIP-004-1, and/or CIP-
007-1, to ensure that when access to protected information is revoked,
it is done so promptly.
ii. Comments
    384. CPUC agrees with the Commission's proposal on clarifying that
a revocation of access to protected information should be accomplished
promptly, but it maintains that that the term ``promptly'' is too
subjective. It would be more appropriate to specify a definite time
interval for revoking access. FirstEnergy agrees with the Commission's
proposal and states that in all cases of access authorization under the
CIP Reliability Standards, responsible entities should revoke an
employee's access to critical cyber assets within 24 hours in cases of
termination for cause and within seven days for other personnel no
longer needing such access. MidAmerican takes a similar position.
    385. Northern Indiana states that while a responsible entity may
remove an employee's or vendor's access to its critical cyber assets
and systems, it cannot eliminate all possible access to information. A
responsible entity cannot enter the employee's home to remove or
destroy information that the employee, particularly the vendor's
employee, may have maintained in his home because in the course of his
employment he wanted ready reference to such information. A responsible
entity may make a reasonable request that information be returned, but
immediate return may not occur.
iii. Commission Determination
    386. The Commission adopts its CIP NOPR proposal and directs the
ERO to develop modifications to Reliability Standards CIP-003-1, CIP-
004-1, and/or CIP-007-1, to ensure and make clear that, when access to
protected information is revoked, it is done so promptly. In general,
the Commission agrees with commenters and believes that access to
protected information should cease as soon as possible but not later
than 24 hours from the time of termination for cause.
    387. In response to Northern Indiana, while we acknowledge that
responsible entities are not authorized to enter private homes, we
believe that an appropriate cyber security policy will ensure that such
information is present in an employee's home only for legitimate
reasons specified in the policy and should require the return of all
information upon request.
e. Change Control and Configuration Management
    388. Requirement R6 of CIP-003-1 requires a responsible entity to
establish a process of ``change control and configuration management''
for adding,

modifying, replacing, or removing critical cyber asset hardware or
software.
i. NOPR Proposal
    389. The Commission noted in the CIP NOPR that Requirement R6 does
not address accidental consequences or malicious actions by individuals
where commercial vendors test and certify that the electronic security
patches they provide will not adversely affect other electronic systems
already in place.\110\ The Commission proposed to direct that the ERO
develop a modification to Requirement R6 to require that authorized
changes made to critical cyber assets only affect the processes they
are intended to affect (to address both accidental consequences and
malicious actions by individuals performing the changes). Also, the CIP
NOPR proposed that the ERO develop a new requirement for responsible
entities to take actions to detect unauthorized changes to critical
cyber assets, whether originating from inside or outside the
responsible entity.
---------------------------------------------------------------------------

    \110\ See id. P 140-44.
---------------------------------------------------------------------------

ii. Comments
    390. Entergy, ISO/RTO Council, Northern Indiana and PG&E oppose the
Commission's proposed modifications to Requirement R6 of CIP-003-1.
Entergy argues that the Commission's concern will be addressed by CIP-
007-1 when implemented by information security professionals and
changes to CIP-003-1 are unnecessary and burdensome. Entergy and BPA
also believe that the NIST Security Risk Management Framework offers
further comprehensive controls. Northern Indiana points out that assets
and systems targeted by the proposal include software as well as
hardware.
    391. MidAmerican believes that Requirement R6 is sufficient as
written and clearly outlines the process of review, testing and
approval, and is adequate for monitoring of change control and
configuration management. Idaho Power is concerned about the current
availability of technology to assist in detecting accidental and
malicious modifications. It asks whether the Commission is concerned
with unauthorized changes, unintended changes or both. Idaho Power
opposes additional changes and states that it can reduce the risk of
unauthorized changes significantly, but it cannot eliminate them
entirely. Idaho Power believes that there will be adequate protection
against unintended changes where there are appropriate test plans,
trained and qualified personnel, and a regimented change management
process.
    392. ISO/RTO Council states that it does not understand what the
Commission meant by ``detection and monitoring controls'' and suggests
that it consider the phrase ``verification that unintended changes have
not been made.'' ISO/RTO Council objects to testing the functionality
of changes made to live production systems. It agrees that verification
of manually initiated changes is appropriate, and responsible entities
should also be required to monitor and determine whether unintended
changes have been made to devices in the production environment and to
investigate and remediate any unintended changes. According to ISO/RTO
Council, it is not always possible to confirm definitively or safely
that applying a tested and approved change on a production device has
had the intended effect, especially where the modification is rarely
triggered or where testing could adversely affect reliability. ISO/RTO
Council prefers a requirement to verify that changes have been made on
the intended devices, to monitor for unintended or unplanned changes,
and to investigate and remediate any exceptions that are discovered.
    393. Further, ISO/RTO Council states some changes are intentionally
initiated automatically using pre-approved means, such as automated
virus signature updates. These changes can be unpredictable and can
occur multiple times per day. ISO/RTO Council agrees these changes need
to be verified, but states it is impractical and unnecessary to verify
each change as it happens and suggests periodic verification that the
necessary updates, or their cumulative equivalent, have been
effectuated.
    394. PG&E argues that technical problems could cause downtime of
critical assets if this requirement is imposed. Any requirements for
detection and monitoring controls for unintended changes must allow for
controls that do not require considerable downtime for the critical
cyber assets.
    395. Puget Sound argues that the CIP Reliability Standards should
expressly recognize that change control and configuration management
processes for critical cyber assets cannot ensure 100 percent integrity
for those assets when making changes. The CIP Reliability Standards
also should recognize that test environments can mimic portions of the
production environment but cannot capture all of the actual
interactions among critical cyber assets.
    396. ReliabilityFirst and SPP state that changes should be properly
tested prior to implementation, although it may not always be feasible
to test a change in an offline environment. They believe that a strict
interpretation of the Commission proposal would be impossible to
implement, as it would require a comprehensive regression test,
including failure testing, to be performed on the entire environment.
Even that might not detect an unintended consequence of the change and
could conceivably result in an expectation to report an issue of non-
compliance. Regression testing is appropriately reserved for
significant changes, such as version upgrades or new applications, but
not all changes. They state that appropriate mitigation measures exist
for reducing the risk of unintended consequences resulting from
changes.
iii. Commission Determination
    397. Based upon the comments received the Commission is altering
its position on how best to address the apparent deficiencies of
Requirement R6 in CIP-003-1. The Commission directs the ERO to develop
modifications to Requirement R6 of CIP-003-1 to provide an express
acknowledgment of the need for the change control and configuration
management process to consider accidental consequences and malicious
actions along with intentional changes. The Commission believes that
these considerations are significant aspects of change control and
configuration management that deserve express acknowledgement in the
Reliability Standard. While we agree with Entergy that the NIST
Security Risk Management Framework offers valuable guidance on how to
deal with these matters, our concern here is that the potential
problems alluded to be explicitly acknowledged. Our proposal does not
speak to how these problems should be addressed. We do not believe that
the changes will have burdensome consequences, but we also note that
addressing any unnecessary burdens can be dealt with in the Reliability
Standards development process.
    398. We agree with ISO/RTO Council that the phrase ``verification
that unintended changes have not been made'' captures the core issue.
Our concern is that some form of verification is performed to detect
when unauthorized changes have been made and to identify those changes,
as well as ensuring that the proper alerts are issued.
    399. Many of the comments address practical issues involved in
addressing accidental consequences and malicious actions, and we
recognize that such issues exist. We, thus, agree with Puget Sound that
change control and

configuration management processes for critical cyber assets cannot
ensure 100 percent integrity for those assets when making changes. We
do not seek absolute assurances but rather are concerned that there be
processes in place that permit a reasonably high level of confidence
modifications do not have unintended consequence. However, we reject
Puget Sound's proposal that the Reliability Standard should expressly
recognize that absolute assurances are not required. We also believe
that our revised directive to the ERO on Requirement R6 addresses Puget
Sound's concern about the limitations imposed by a test environment.
    400. In response to ReliablityFirst and SPP, we understand that
comprehensive regression testing is not necessary for every change
regardless of how insignificant. We also agree with ISO/RTO Council
that it can be impractical and unnecessary to verify every intentional
automatic change as it occurs. We believe that our revised directive to
the ERO addresses these concerns.
f. Interconnected Networks
i. NOPR Proposal
    401. The Commission proposed in the CIP NOPR to direct the ERO to
modify Reliability Standard CIP-003-1 to provide direction on the
issues and concerns that a mutual distrust posture must address to
protect a control system from the ``outside world.'' \111\ The
Commission noted that interconnected control system networks are
susceptible to infiltration by a cyber intruder and stated that
responsible entities should protect themselves from whatever is outside
their control systems.
---------------------------------------------------------------------------

    \111\ Id. at P 147. An architecture with a mutual distrust
posture could involve various hardware or software mechanisms or
manual procedures to restrict and verify access to the control
system from these outside sources. Examples include: firewalls; data
checking software(s); or procedures for manually implementing a
connection to allow a vendor to perform maintenance work.
---------------------------------------------------------------------------

ii. Comments
    402. FirstEnergy agrees with the intent of the Commission's
proposal that there be more direction on what constitutes a mutual
distrust posture, but it argues that the need for uniform processes
should be balanced against the need for flexibility in individual
cases. FirstEnergy argues that each entity may have a unique
architecture that requires a unique protection scheme. In addition, a
common security method could cause a vulnerability of its own, in that
one successful cyber attack could compromise all security systems if
there are similarities across all systems.
    403. ISO-NE agrees that the mutual distrust principle is a useful
consideration when determining when to protect cyber assets and in
designing a secure system architecture, but it disagrees that it should
be used as a measurable requirement. ISO-NE thus asks the Commission to
omit any direction to the ERO to address the concept of mutual
distrust.
    404. Northern Indiana comments that the Commission's proposal on
mutual distrust is unnecessary because the issue is addressed in
Reliability Standards CIP-005-1 and CIP-007-1. It argues that if the
Commission's proposal on mutual distrust were applied in unqualified
terms, it would have to sever the Midwest ISO's communication link to
the Northern Indiana control system. Northern Indiana states that it
trusts the Midwest ISO in its role as the reliability coordinator over
the Northern Indiana electric system and thus argues that the
Commission should exempt reliability coordinators. If the Commission
does not exempt reliability coordinators, Northern Indiana respectfully
requests that the Commission clarify and refine the definition of the
term mutual distrust.
    405. Entergy argues that the Commission needs to direct the ERO to
define the term mutual distrust in CIP-003-1 to foreclose ambiguities
in application and enforcement. Entergy notes that NIST has many
documents in its SP800 Series that provide excellent treatment of the
issues and variables involved in the concept of mutual distrust and
that complement the NIST Security Risk Management Framework. The
Commission could direct the ERO to consider this guidance. Entergy
argues that the broad wording of the Commission's proposal extends
beyond the scope of the Reliability Standards. It also argues that the
Commission's proposal would direct the ERO to specify what the end
result must be rather than permitting the Reliability Standards process
to establish the optimum solution.
    406. MidAmerican submits that the terms mutual distrust and outside
world require clarification to facilitate compliance. MidAmerican
recommends that the Commission ensure that the guidelines to be
developed have no impact on either performance or reliability. EMS/
SCADA systems are tuned for and certified by their vendor at specific
communication rates. The introduction of delays due to additional
security layers to communications and data exchange may impact
reliability.
iii. Commission Determination
    407. The Commission proposed in the CIP NOPR that the ERO provide
direction, i.e., guidance, regarding the issues and concerns that a
mutual distrust posture must address in order to protect a responsible
entity's control system from the outside world. The Commission noted
that a mutual distrust posture requires each responsible entity that
has identified critical cyber assets to protect itself and not trust
any communication crossing an electronic security perimeter, regardless
of where that communication originates.
    408. The Commission agrees with FirstEnergy on the importance of
flexibility in developing a mutual distrust posture, but does not see a
conflict between the need for flexibility and what it is proposing,
which is simply more guidance. More guidance will allow responsible
entities to implement measures adapted to their specific situations
more consistently and effectively. Additional guidance need not be
included in a specific Requirement, but could be in the form of
examples. We will leave it to the Reliability Standards development
process and the ERO to decide whether some or all of the guidance can
be contained in separate guidance documents referenced in the
Reliability Standard. In response to Entergy, the Commission is not
directing that the ERO establish a specific end result. Our concern is
simply that responsible entities have guidance on how to achieve an
appropriate result in individual cases, which can vary on a case-by-
case basis. We disagree that providing useful guidance affects the
scope of the Reliability Standards.
    409. We agree with Entergy that NIST provides much guidance, but we
disagree that it is necessary to define the term mutual distrust. Our
proposal is that there be guidance on certain issues and concerns, and
we therefore do not believe that a formal definition advances that
goal. In response to MidAmerican, we believe that clarification of the
terms mutual distrust and outside world, as well as ensuring that any
guidelines developed do not harm performance or reliability, are
matters that the ERO should consider in the Reliability Standards
development process.
    410. We disagree with Northern Indiana that Reliability Standards
CIP-005-1 and CIP-007-1 address the matters of concern to us. Northern
Indiana does not explain how these Reliability Standards provide
guidance of the type we have described. We also

disagree that the mutual distrust principle would require responsible
entities to sever their communication links with their ISO or RTO or
reliability coordinator. The principle could play a role in determining
what precautions would need to be taken to protect those
communications, but we do not see why it would lead to the specific
result that Northern Indiana identifies. Mutual distrust does not imply
refusal to communicate; it means the exercise of appropriate skepticism
when communicating. The Commission believes additional guidance on what
this means specifically in current practice would help responsible
entities to avoid these misunderstandings.
    411. We disagree with ISO-NE that guidance on mutual distrust is
unnecessary because responsible entities either are compliant or they
are not, mutual distrust not withstanding. We do not see how
responsible entities can fully understand the compliance issues they
face without some understanding of how mutual distrust is applied in a
modern security environment. Mutual distrust helps explain where an
entity's responsibilities begin and end and what assumptions it can
make about factors outside its control when it performs its risk-based
assessment.
    412. The Commission therefore directs the ERO to provide guidance,
regarding the issues and concerns that a mutual distrust posture must
address in order to protect a responsible entity's control system from
the outside world.
3. CIP-004-1--Personnel and Training
    413. Standard CIP-004-1 requires that personnel having authorized
cyber access or unescorted physical access to critical cyber assets
must have an appropriate level of personnel risk assessment, training
and security awareness. Responsible entities must develop and implement
a security awareness program that addresses concerns related to cyber
security; a cyber security training program for affected personnel that
addresses policies, access controls, procedures for the proper use of
critical cyber assets, physical and electronic access to critical cyber
assets, proper handling of asset information, and recovery methods
after a cyber security incident; and a personnel risk assessment
program for all personnel having access to critical cyber assets.
    414. As discussed further below, the Commission approves Standard
CIP-004-1 as mandatory and enforceable. In addition, we direct the ERO
to develop modifications to this CIP Reliability Standard. The
Commission also requires the ERO to clarify and provide guidance on
other matters. The required modifications are discussed below in the
following topic areas of concern regarding CIP-004-1: (1) Training; (2)
personnel risk assessments; (3) cyber and physical access; and (4)
jointly owned facilities.
a. Training
    415. The requirements for ongoing awareness reinforcement in sound
security practices specified in Requirement R1 and for training
specified in Requirement R2 apply to all personnel, contractors, and
service vendors who have authorized cyber access or unescorted physical
access to critical cyber assets. Requirement R2.1 allows such personnel
to have access to critical cyber assets for up to 90 days prior to
receiving any cyber security training.
 i. NOPR Proposal
    416. In the CIP NOPR,\112\ the Commission stated that training is
integral to the protection of critical cyber assets, and that allowing
personnel access to critical cyber assets prior to receiving training
increases the vulnerability of and risk to such assets. The Commission
proposed to direct the ERO to modify CIP-004-1 to require affected
personnel to receive the required training before obtaining access to
critical cyber assets (rather than within 90 days of access
authorization), but to limit exceptions to circumstances such as
emergencies, subject to documentation and mitigation. To facilitate
communications in emergency situations, the Commission proposed to
direct the ERO to require responsible entities to identify ``core
training'' elements to ensure that essential training elements will not
go unheeded in an emergency and in other contingency situations where
full training prior to access will not best serve the reliability of
the Bulk-Power System. We also proposed that the ERO consider what, if
any, modifications to CIP-004-1 should be made to assure that security
trainers are adequately trained themselves.
---------------------------------------------------------------------------

    \112\ See Id. at P 151-61.
---------------------------------------------------------------------------

    417. In addition, the Commission proposed to direct the ERO to
modify CIP-004-1 to clarify that the cyber security training programs
required by Requirement R2 are intended to encompass training on the
networking hardware and software and other issues of electronic
interconnectivity supporting the operation and control of the critical
cyber assets. The CIP NOPR stated that CIP-004-1 should clearly state
that cyber security training concerning a critical cyber asset should
encompass the electronic environment in which the asset is situated and
the attendant vulnerabilities. To clarify that point, we proposed that
the ERO consider adding a provision similar to that in Requirement R1.4
of CIP-005-1, which specifically subjects any non-critical cyber asset
within a defined electronic security perimeter to the CIP Reliability
Standard.
    418. Further, the Commission proposed to direct that the ERO
increase the guidance in the CIP Reliability Standard as to the scope
and quality of training, including examples of areas where the
inclusion of guidance can be considered, as follows: control of
electronic devices (such as laptop computers); the appropriate
audiences for the training; delivery methods; and updates of training
materials. The CIP NOPR stated that the awareness and training
programs, addressed separately by Requirements R1 and R2, complement
each other and work in tandem. The Commission also stated its
expectation that the ERO consider relevant aspects of certain NIST
Special Publications, as well as other relevant models, to improve CIP-
004-1 and prevent a lowest common denominator result.
ii. Comments
    419. Entergy recommends that the Commission modify its direction to
the ERO regarding access to critical cyber assets for newly-hired
personnel to provide access to critical cyber assets for newly-hired
personnel if they are accompanied by qualified escorts. Entergy insists
that individuals without training should be allowed to be escorted by a
trained individual to access a critical cyber asset and, if similar
required training has been received by an unescorted individual at
another industry facility, that training should be allowed to be
credited at the current facility. SDG&E recommends that new employees
be allowed escorted access to critical cyber assets, even in non-
emergency situations, since training is not always coincident with a
hiring date.
    420. Entergy disagrees with the proposal to direct the ERO to
require responsible entities to identify core training elements. On the
other hand, FirstEnergy and SoCal Edison agree with the Commission's
proposal that NERC should require the development of core training
elements. They state that additional guidance in this area would be
helpful preparation for responsible entities to operate in emergency
and other contingency

situations. FirstEnergy proposes that CIP-004-1 be revised to further
specify what situations should be considered emergency and contingency
for the purpose of granting access prior to completion of full
training. Northern Indiana agrees with the common sense approach in the
CIP NOPR on how responsible entities should be allowed to handle
emergency conditions, but would retain the 90-day transition period for
conducting training. Northern Indiana requests clarification of what is
intended by the term ``core training'' and requests additional guidance
in the Final Rule with respect to training.
    421. Entergy contends that specific discussion of the many forms of
training needed is beyond the current scope of the CIP Reliability
Standards. Entergy argues that, if specificity is needed, the
Commission should refer to materials issued by other federal agencies,
including the Defense Information Systems Agency. Mr. Brown argues that
the level of detail the Commission is proposing to be added to the
training portion of the CIP Reliability Standards would be more
appropriately and efficiently developed through some process other than
that of Reliability Standards development process.
    422. MidAmerican believes that CIP-004-1, Requirement R2 is
adequate as proposed and that specific job-related training
requirements are more properly managed by the entity performing or
contracting the work. MidAmerican submits that the entity performing
the work is best suited to determine the scope and delivery method of
job-specific training. MidAmerican believes additional clarification of
acceptable awareness and training programs is necessary for compliance
purposes, should the Commission's call for increased guidance be
adopted.
    423. In response to the Commission's proposal that training
encompass network and interconnectivity aspects, many commenters
suggest that training should be tailored to match up with the trainee's
duties, experience, or ``need to know.'' FirstEnergy suggests that CIP-
004-1 should include a provision that would direct a responsible entity
to establish access categories based on security roles because access
categories based on job responsibilities would ensure that the level or
frequency of exposure to critical cyber assets will be considered. For
example, a systems analyst would need access to certain critical cyber
assets on a frequent basis and at a level that allows file
manipulation, while a system user would need access to the data output
of the systems during working hours and not necessarily file
manipulation access. Those with access to critical cyber assets should
have training specific to the critical cyber asset and those without
such access should have general awareness training.
    424. Likewise, National Grid argues that, while a general
understanding of networking hardware and software and interconnectivity
is important, the focus of the training should be geared toward
understanding cyber security policies and each trainee's role in
response and recovery plans. National Grid believes that not every
employee requires IT training and that training should match an
employee's required skill set.
    425. FirstEnergy agrees that CIP-004-1 should address training
regarding access to the cyber assets themselves and the networking
hardware and software linking them, but it also asks the Commission to
clarify that only those personnel that have access to both the critical
cyber assets and the networking hardware and software should have
training on both. FirstEnergy argues that it would be overly burdensome
and serve no purpose to do otherwise and, conversely, it serves no
purpose to train personnel on the networking hardware and software
security methods, if those personnel have access only to the critical
cyber asset itself. Training personnel on security measures of
equipment for which they have no access can create a potential weakness
in the security measures for such equipment.
    426. ISO-NE argues that requirements for training relating to
networking hardware and software and other issues of electronic
interconnectivity supporting the operation and control of the critical
cyber assets are a business management decision and should be omitted
from the Final Rule. ISO-NE argues that the decision to determine the
level of skill training necessary for an individual, based on that
employee's functional task requirements and coordinated career goals,
is a business decision beyond the scope of security training for access
controls, monitoring, and incident response.
    427. Similarly, Northern Indiana contends that CIP-004-1 should not
specify who should be trained, what the training should include, or how
frequently training should occur. Northern Indiana argues that the
responsible entity must be given flexibility to differentiate between
those aspects of networked systems potentially affecting critical
control systems and those that should be included in critical cyber
asset training. Northern Indiana argues that the focus should be on the
applications, policies and procedures that relate to the critical
control systems and other critical cyber assets.
    428. ISO/RTO Council and ISO-NE argue that training that addresses
vulnerabilities is not appropriate for all individuals with access to
critical cyber assets and, therefore, they disagree with the statement
in the CIP NOPR that ``CIP-004-1 should leave no doubt that cyber
security training concerning a critical cyber asset should encompass
the electronic environment in which the asset is situated and the
attendant vulnerabilities.'' Information about vulnerabilities
associated with critical cyber assets and/or their security perimeters
is highly sensitive. Such information should be known only to those
with direct responsibility to administer the secure operation of the
critical cyber assets and their security perimeters.
    429. ReliabilityFirst is concerned that the ERO not lose sight of
the fact that Requirement R2.2 requires specific training ``appropriate
to personnel roles and responsibilities'' as it develops the additional
guidance proposed by the Commission. ReliabilityFirst argues that it is
inappropriate, for example, to train an operator in the dispatch
operations center on firewalls and networking devices. Training for
personnel with electronic or unescorted physical access to systems
within the electronic security perimeter should be appropriate to the
trainee's scope of access. The goal of the training is not to make
operational personnel into network specialists, but to train them on
the policies and procedures implemented by the responsible entity to
protect their critical cyber assets.
    430. In response to the Commission's question regarding what, if
any, modifications to CIP-004-1 should be made to address the concern
that security trainers be adequately trained themselves, SoCal Edison
believes that the Commission should require the ERO to have a program
to have qualified trainers in order to determine the adequacy of
training. To ensure quality and consistency, this implies that all
trainers would have to be qualified by the ERO prior to training. Any
vendor training tools (e.g., online training courses) would similarly
need to be approved by the ERO.
iii. Commission Determination
    431. The Commission adopts the CIP NOPR's proposal and directs the
ERO to develop a modification to CIP-004-1 that would require affected
personnel to receive required training before obtaining access to
critical cyber assets (rather than within 90 days of access

authorization), but allowing limited exceptions, such as during
emergencies, subject to documentation and mitigation.
    432. The Commission notes that commenters did not provide specific
reasons why employees should be granted access prior to training, but
focused on the nature and scope of our proposed exceptions. Entergy and
SDG&E recommend that newly-hired employees be allowed access to
critical cyber assets if they are accompanied by qualified escorts. We
note that a qualified escort would have to possess enough expertise
regarding the critical cyber asset to ensure that the actions of the
newly-hired employee or vendor did not harm the integrity of the
critical cyber asset or the reliability of the Bulk-Power System.
However, if the escort is sufficiently qualified, we believe such
escorted access could be permitted before a newly-hired employee is
trained.
    433. Based on the concerns of commenters, the Commission modifies
its CIP NOPR proposal that the ERO identify core training elements to
ensure that essential training elements will not go unheeded in
emergencies and in other compelling situations. While the Commission
continues to believe that the identification of core training elements
is useful, this issue would benefit from further vetting within the
Reliability Standards development process. Thus, we direct the ERO to
consider, in developing modifications to CIP-004-1, whether
identification of core training elements would be beneficial and, if
so, develop an appropriate modification to the Reliability Standard. If
the Reliability Standard development process determines not to identify
core requirements, the ERO should provide an explanation of this
decision. In reply to commenters, we clarify that by using the term
core training our concern is for a responsible entity to pre-plan what
information and training is necessary for personnel temporarily called
in to help in an emergency--not that the actual scope of such training
needs to be articulated in the Reliability Standard and applicable to
all responsible entities in all circumstances. It is important that
responsible entities have plans for introducing the personnel called in
to assist in such situations. We expect that core training would be
different for different responsible entities.
    434. The Commission adopts the CIP NOPR's proposal to direct the
ERO to modify Requirement R2 of CIP-004-1 to clarify that cyber
security training programs are intended to encompass training on the
networking hardware and software and other issues of electronic
interconnectivity supporting the operation and control of critical
cyber assets. CIP-004-1 should leave no doubt that cyber security
training concerning a critical cyber asset should encompass the
electronic environment in which the asset is situated and the attendant
vulnerabilities. We note that, according to Requirement R1.4 of CIP-
005-1, all cyber assets within an electronic security perimeter are to
be protected, not just the critical cyber assets. In reply to
commenters, we clarify that our proposal discussion on this topic was
not intended to suggest that personnel have training that is not
appropriate for an employee's duties, functions, experience, or access
level. We agree with commenters that information concerning
vulnerabilities should be revealed on a need to know basis and not
universally. However, any employee with access to an area where his or
her actions, or carelessness, could put critical assets at risk, should
receive the necessary training to assure that the employee understands
how his or her actions or inactions could, even inadvertently, affect
cyber security.
    435. Consistent with the CIP NOPR, the Commission directs the ERO
to determine what, if any, modifications to CIP-004-1 should be made to
assure that security trainers are adequately trained themselves.
Commenters provided minimal input on this proposal and, consistent with
the CIP NOPR, we believe that whether a modification is appropriate to
address this issue is better determined in the first instance through
the ERO's Reliability Standards development process. The ERO should
consider the comments of SoCal Edison with regard to what role and
steps should be taken by the ERO to ensure quality and consistency of
trainers.
 b. Personnel Risk Assessment
    436. Requirement R3 of CIP-004-1 requires each responsible entity
to have a documented personnel risk assessment program. It also
requires that a personnel risk assessment, including a criminal
background check, be conducted within 30 days after a person receives
cyber access or unescorted physical access to critical cyber assets.
The wording of Requirement R3 would allow access to critical cyber
assets while an investigation is still underway, and even before an
investigation has started.
i. NOPR Proposal
    437. In the CIP NOPR, the Commission stated that allowing
applicable personnel, including vendors, to access critical cyber
assets prior to the completion of their personnel risk assessment
increases the vulnerability of, and risk to, these assets.\113\ We also
observed that Recommendation 41 of the Blackout Report emphasizes the
need for guidance on implementing background checks.\114\ At the same
time, the Commission indicated that commenters had raised a valid
concern regarding the disruptions that would result if current
employees and vendors with established involvement were denied access
to critical cyber assets for a 30-day period. Accordingly, the
Commission proposed to direct the ERO to develop modifications to
Requirement R2 to provide that newly-hired personnel and vendors should
not have access to critical cyber assets, except in specified
circumstances, such as an emergency. To avoid transition disruptions,
the Commission proposed that the 30-day window allowing access before
completion of the personnel risk assessment remain in effect for
current employees and vendors with existing contractual relationships
with the responsible entity as of the effective date of the Reliability
Standard. The Commission proposed that the ERO include, in developing
modifications to CIP-004-1, criteria that address circumstances in
which current personnel can continue access to critical cyber assets
during the 30-day investigative period during initial compliance with
CIP-004-1.
---------------------------------------------------------------------------

    \113\ See id. P 162-66.
    \114\ See Blackout Report at 167-68, Recommendation 41
(recommending that NERC provide guidance on background checks to be
completed on contractor and sub-contractor employees in advance of
allowing access to secure facilities).
---------------------------------------------------------------------------

ii. Comments
    438. California Commission and MidAmerican support the Commission's
proposal to require that a personnel risk assessment be performed
before access is granted except in emergency situations for the reasons
articulated in the CIP NOPR. California Commission stresses that the
personal risk assessment must be conducted before a person obtains
access to critical cyber assets, because, if access is granted before a
person clears a risk assessment, Requirement R3 is rendered useless.
California Commission states that the point is to keep unwanted persons
away from critical cyber assets, not to grant them access for a brief
period of time and then bar them from access if they do not pass the
risk assessment.
    439. ReliabilityFirst and SPP do not believe that the CIP
Reliability

Standards should attempt to define an all encompassing set of emergency
contingencies for which unescorted access could be granted in the
absence of a background check, because there is a risk that a valid
emergency exists for which the guidance is unsuited. They suggest that
a more appropriate way to handle the emergency access is to allow a
short-term exception to the security policy, appropriately justified
and approved as any other exception to the policies implementing the
provisions of the CIP Reliability Standards.
    440. FirstEnergy agrees with the Commission that newly hired
employees or vendors with no previous relationship to the responsible
entity should not have access to critical equipment while undergoing
the personnel risk assessment. The 30-day window may be appropriate for
employees and vendors with which the responsible entity has had a
working relationship, such as employees transferring to another
position or contractors that are returning from a reassignment. In
contrast, SoCal Edison maintains that 30 days is not adequate time to
update personnel risk assessments during initial implementation on all
current personnel that would require an updated personnel risk
assessment. It believes that the 30 days would be adequate if such a
timeframe begins when personnel risk assessment certification paperwork
is provided for each individual.
    441. APPA/LPPC note that they do not object to the requirement in
CIP-004-1 R3.1 that ``[t]he responsible entity shall ensure that each
assessment conducted include, at least, [a] seven-year criminal check''
on employees with access to critical cyber assets. However, they seek
clarification that responsible entities have discretion in reviewing
the results of criminal background checks to determine, on a case-by-
case basis, whether any crime identified in the background check would
disqualify an individual from obtaining access to critical cyber
assets.
    442. SDG&E comments that Requirement R3 may require refinement on
various issues regarding the personnel risk assessment requirements,
including whether state and local law should be pre-empted to permit
industry-wide protocols for periodic background and criminal checks on
existing employees. SDG&E asks the Commission to clarify that an entity
may comply with Requirement R3 by using its existing pre-employment
background check procedures for current employees, at seven year
intervals, provided that such procedures encompass the required social
security verification and criminal background checks. SDG&E argues
that, otherwise, applicable state and local laws could prohibit an
entity from conducting such periodic checks.
iii. Commission Determination
    443. The Commission adopts with modifications the proposal to
direct the ERO to modify Requirement R3 of CIP-004-1 to provide that
newly-hired personnel and vendors should not have access to critical
cyber assets prior to the satisfactory completion of a personnel risk
assessment, except in specified circumstances such as an emergency. We
also direct the ERO to identify the parameters of such exceptional
circumstances through the Reliability Standards development process.
FirstEnergy and California Commission agree with the Commission's
proposals.
    444. ReliabilityFirst and SPP believe that it would be appropriate
to handle emergency access via a short-term exception to the security
policy. We note that such access would not be only an exception to the
security policy, but an exception to a CIP Reliability Standard
Requirement. Therefore, such exceptions would have to comply with the
conditions of a technical feasibility exception that we have specified
elsewhere in this Final Rule. The Commission believes that a workable
solution is for the Reliability Standards development process to
identify emergency circumstances that would warrant allowing access to
critical cyber assets. However, if a responsible entity experienced a
situation outside of those circumstances that it believed warranted
access to critical cyber assets, the responsible entity could treat the
situation as a technical feasibility exception and follow the
conditions set out by the Commission. With this approach, we believe
that in most cases it will be unnecessary to go through the
administrative burden of a technical feasibility exception.
    445. SoCal Edison expresses concern that the 30 days allowed in
CIP-004-1 for completion of the personnel risk assessment may not be
enough time to process all existing employees with access. We note that
there is no reason why such assessments cannot be completed well before
responsible entities are to be auditably compliant with this provision.
The ERO should consider SoCal Edison's issue in the Reliability
Standards development process.
    446. APPA/LPPC seek clarification regarding discretion in reviewing
results of personnel risk assessments and in coming to conclusions
regarding the subject employees. SDG&E seeks refinements on various
issues, including an industry-wide protocol for periodic background and
criminal checks, and the use of pre-employment background check
procedures for current employees. The ERO should consider these issues
when developing modifications to CIP-004-1 pursuant to the Reliability
Standards development process.
c. Cyber and Physical Access
    447. Requirement R4 of CIP-004-1 directs the responsible entity to
maintain list(s) of personnel with authorized cyber or authorized
unescorted physical access to critical cyber assets. The lists do not
serve to deny personnel access from critical cyber assets prior to
completion of a personnel risk assessment, although Requirement R4.2
requires that both cyber and physical access to critical cyber assets
be revoked within 24 hours for personnel terminated for cause and
within seven calendar days for personnel who no longer require such
access.
i. NOPR Proposal
    448. The Commission stated in the CIP NOPR that timely system
updates to access rights are important because access to critical cyber
assets by employees, contractors, or vendors represents a gap in
security when such access is no longer needed. We proposed to direct
the ERO to develop modifications to CIP-004-1 to require immediate
revocation of access privileges when an employee, contractor, or vendor
no longer performs a function that requires authorized physical or
electronic access to a critical cyber asset for any reason (including
disciplinary action, transfer, retirement or termination). Further, we
proposed to direct the ERO to modify Requirement R4 to make clear that
unescorted physical access should be denied to individuals that are not
identified on the authorization list.\115\
---------------------------------------------------------------------------

    \115\ See CIP NOPR at P 167-69.
---------------------------------------------------------------------------

ii. Comments
    449. Numerous commenters responded to the CIP NOPR proposal to
require immediate revocation of access to critical cyber assets when an
employee, contractor or vendor no longer performs a function that
required authorized physical or electronic access to a critical cyber
asset for any reason. California Commission agrees with the
requirements of CIP-004-1, and states that access controls should be
updated upon termination or transfer of

personnel. However, as with its recommendation regarding CIP-003-1,
California Commission suggests that CIP-004-1 should provide a specific
time limit for revoking access, rather than requiring access to be
revoked promptly.
    450. MidAmerican supports the proposal, but believes that the
timelines provided in Requirement R4.2 are clearly defined and
appropriate for the risk associated with removal of access.
ReliabilityFirst and SPP agree with the Commission that access should
be revoked as quickly as possible upon termination or reassignment, but
believe the use of the term ``immediate'' is subjective and could lead
to conflicting interpretations. According to ReliabilityFirst, one
entity might interpret the requirement as allowing a reasonable amount
of time, perhaps an hour, to revoke access once the termination or
reassignment has occurred and notifications made, while another entity
might interpret it as needing to terminate access prior to the moment
of termination or reassignment, perhaps coincident with the employee
being notified of his or her termination.
    451. SoCal Edison and Entergy believe that it will be difficult to
comply with the immediate revocation of access requirement. For
example, SoCal Edison states that meeting the proposed change would be
dependent upon direct communication from a manager initiating the
termination actions, and SoCal Edison believes it is appropriate to
allow 24 hours to revoke access privileges. FirstEnergy similarly
argues that an organization will not be aware in advance of personnel
that are transferred in short order to address an immediate need or
personnel that are dismissed or fired on the spot for misconduct.
Entergy asserts that the systems and equipment currently in use across
the industry simply cannot operate in the type of networked computing
environment necessary to revoke all access immediately. For example, a
responsible entity may have a magnetic strip physical access control at
a substation perimeter, but if the controller is not networked back to
a central access control system, meeting the immediacy requirement
would not be possible. The industry will need time and adequate grounds
to justify modernization of capabilities for rate relief in order to
implement such a proposal.
    452. First Energy and Idaho Power suggest that the Commission
should soften its position on immediate revocation and propose that the
Commission require access to critical cyber assets to be revoked as
soon as practicable. They suggest allowing either 24 hours or one
business day for revocations. Ontario Power notes that some activities
can be performed quickly, but others will take time.
    453. ReliabilityFirst argues that, from a risk perspective, it is
more time-critical to terminate access when an employee is
involuntarily terminated or reassigned due to disciplinary action.
ReliabilityFirst argues that an employee who voluntarily terminates or
changes positions normally does so on good terms with the employer. In
addition, both ReliabilityFirst and SPP maintain that, while an entity
should be cognizant of planned terminations and reassignments within
the company, the entity has no such insight into a vendor or
contractor. The entity must rely upon a timely notification from the
vendor or contractor, especially when the services are provided
remotely as opposed to on-site. In addition, ReliabilityFirst reasons
that primary access needs to be terminated as quickly as possible, with
secondary access not as time-critical. Primary access would include the
physical access, VPN access, and domain account, and terminating that
access will effectively quarantine the terminated employee while
remaining access is disabled. ReliabilityFirst and SPP recommend that,
in lieu of the term ``immediate,'' a reasonable and measurable time
frame already exists and has been defined within the CIP Reliability
Standard itself.
    454. Similarly, ISO-NE argues that personnel transfers can at times
require a protracted, transitional process, where there is good
business reason for the individual to retain access privileges after
the formal transfer date. Most often this would be where continued
back-up support is appropriate while the individual's replacement is
being identified, or a personal risk assessment is conducted, and/or is
trained and becomes familiar with new job responsibilities.
    455. ISO-NE and Northern Indiana oppose requiring revocation of
access when an employee is facing disciplinary action. ISO-NE argues
that not all disciplinary action should arbitrarily warrant revocation
of access privileges. Northern Indiana argues that, notwithstanding the
disciplinary action, such an employee might still be responsible for
performing tasks that require access. Northern Indiana argues that
Requirement R4.2 should be left intact and the timeline for revocation
should remain 24 hours for personnel terminated for cause and within
seven calendar days for personnel who no longer require access to
critical control systems and other critical cyber assets. ISO-NE
requests management discretionary power in determining when revocation
is warranted.
    456. Various commenters raise concerns about the timelines
associated with the Commission's proposal to deny unescorted physical
access to individuals not identified on the authorization list. For
example, Northern Indiana is concerned that absolute compliance with
this requirement would be very difficult to achieve and record within
the time specified.
    457. EEI objects to the immediate revocation of access privileges
proposal if the Commission is proposing to require responsible entities
to perform immediate updating of their authorization lists. EEI argues
that these changes are not needed, because, at the time any individual
is terminated for any reason, the manager collects items such as
badges, keys, tokens used for electronic entrance and other methods of
access, thus denying the individual access to facilities where critical
cyber assets are kept. Access control systems are updated using an
efficient overnight batch process. EEI asserts that converting to
immediate updates for all situations (including low-risk situations
such as individuals transferring or retiring) would require significant
expense with minimal improvement in security.
    458. Duke and others \116\ argue that some flexibility in the
promptness of access revocation is warranted, but raise many of the
same points as EEI. Duke concedes that immediate updates of access
authorization control systems can be performed outside of a batch
process, but argues that this would involve additional cost and should
be reserved for situations involving a tangible threat, such as when an
employee is being terminated for cause.
---------------------------------------------------------------------------

    \116\ See also PG&E and Tampa Electric.
---------------------------------------------------------------------------

    459. PG&E argues that CIP-004-1 already provides sufficient
controls and need not be revised. PG&E argues that CIP-004-1 ensures
that individuals who are terminated or who no longer require such
access lose their access in a timely manner, but argues that there
should be no requirement for immediate updating of authorization lists.
In this regard, PG&E argues that, although having the means to identify
individuals with valid access rights is important, if the individual
has been disabled from access to relevant systems and physical areas, a
slight delay in updating the list would not significantly compromise
security and thus there is no need to require the impractical task of

immediately updating authorization lists.
iii. Commission Determination
    460. The Commission adopts the CIP NOPR proposal to direct the ERO
to develop modifications to CIP-004-1 to require immediate revocation
of access privileges when an employee, contractor or vendor no longer
performs a function that requires physical or electronic access to a
critical cyber asset for any reason (including disciplinary action,
transfer, retirement, or termination).
    461. As a general matter, the Commission believes that revoking
access when an employee no longer needs it, either because of a change
in job or the end of employment, must be immediate. As noted in the CIP
NOPR, most organizations will know in advance the timing of personnel
actions and can arrange ahead of time for access revocation to be
concurrent with any disciplinary action, transfer, retirement or
termination. Revocation of access is usually a matter of assuring that
a particular employee's credentials no longer permit physical or
electronic access. We understand that outlying elements may require
some brief lag before denial of access is effective, in which case, the
circumstances justifying such lag must be documented for audit
purposes.
    462. FirstEnergy comments that the term ``immediate'' should be
clarified and be interpreted as ``as soon as possible'' but not later
than 24 hours to take care of on-the-spot dismissals. Others also
comment about various circumstances where advance or coincident
preparations for revocation to access cannot be made. We continue to
believe that most dismissals can be anticipated in advance and believe
that revocation should be immediate upon the employee's notification of
any personnel action requiring revocation of access. However, the ERO
may define what circumstances justify an exception that is other than
immediate and determine what is the fastest revocation possible.
    463. We acknowledge that not all disciplinary actions warrant
revocation of access privileges. In addition, certain personnel
transfers can require a protracted transitional process that warrants
retention of access privileges after the formal transfer date. There
may be operational reasons that justify retention of access privileges
after an employee transfers, but the default procedure should be to
cancel access privileges at transfer and to document any exceptions to
that policy for audit purposes.
    464. We also adopt our proposal to direct the ERO to modify
Requirement R4 to make clear that unescorted physical access should be
denied to individuals that are not identified on the authorization
list, with clarification. Our concern, in calling for this adjustment,
is that the current language in the CIP Reliability Standard does not
describe the purpose of the required list of personnel with authorized
access; rather, it merely states that such a list must be made,
reviewed, and updated. Similar to our expectations expressed earlier
regarding implementation of required plans and policies, we believe
that the expectation that access not be granted to personnel not on the
authorized list should be made clear in the Reliability Standard.\117\
However, while a responsible entity should not allow access to any
personnel not included on the list, the Commission believes commenters
misunderstood the CIP NOPR and inappropriately linked the Commission's
proposal with respect to the immediate revocation of access with its
proposal with respect to denying access to personnel not on the list.
We clarify that we are not requiring the list to be updated
simultaneously with the revocation of an employee's access.
---------------------------------------------------------------------------

    \117\ As we stated in our discussion above, we are directing the
ERO to revise the CIP Reliability Standards to explicitly add a
requirement for responsible entities to implement any plans they are
required to develop as part of these Standards.
---------------------------------------------------------------------------

d. Jointly-Owned Facilities
    465. In the CIP NOPR, the Commission addressed concerns raised with
regard to the application of and compliance responsibility for the CIP
Reliability Standards, especially on access issues, when facilities
governed by existing joint use or joint ownership agreements are
involved.
i. NOPR Proposal
    466. In the CIP NOPR, the Commission stated that joint owners of
critical cyber assets are equally as subject to the CIP Reliability
Standards as are other responsible entities.\118\ We further stated
that, if an asset is designated as a critical cyber asset by one joint
owner, it must be treated likewise by the other owner(s) and,
therefore, each owner would be responsible to develop a list of its
authorized personnel and to respect each other joint owner's
corresponding list.
---------------------------------------------------------------------------

    \118\ See CIP NOPR at P 170-73.
---------------------------------------------------------------------------

    467. With regard to joint use arrangements, the Commission stated
the principle that the owner of a critical cyber asset is responsible
under the CIP Reliability Standards for ensuring that all persons
having access to the critical cyber asset meet the requirements of the
CIP Reliability Standards, much as the owner is responsible to ensure
that vendor personnel have the required levels of security training,
awareness and background checks.
    468. The Commission proposed to require the ERO to consider further
clarifying CIP-004-1 to address the ``joint use'' concerns expressed by
APPA/LPPC while developing any modifications to the CIP Reliability
Standards.
ii. Comments
    469. APPA/LPPC support the Commission's proposal to direct the ERO
to address the joint use concerns.
    470. Northern Indiana is concerned that the Commission's proposal
means that a responsible entity must perform risk assessments of the
other owner's personnel so that such personnel may access a facility
that the responsible entity has identified as a critical cyber asset.
Northern Indiana argues that such a broad application of the CIP
Reliability Standards was never intended and requests that the
Commission clarify this point. Northern Indiana sees a conflict with
respect to sharing information with other entities that jointly own or
jointly use transmission facilities if it is required to maintain a
mutual distrust posture. Northern Indiana urges the Commission to
provide for flexibility when applying the CIP Reliability Standards to
such jointly owned facilities.
    471. SPP believes that jointly operated assets may require
contractual agreements to assign responsibility and liability for
compliance with the CIP Reliability Standards, similar to the
Commission's concern with respect to out-sourced service providers in
the CIP NOPR. It is unclear to SPP whether the Commission's
recommendations adequately cover the situation where each party is
uniquely responsible for a subset of the requirements of the CIP
Reliability Standards. For example, one entity may place critical cyber
assets within a facility managed by a second entity. The second entity
would be fully responsible for the physical security requirements of
CIP-006-1, while the first entity would be fully responsible for the
system management requirements of CIP-007-1 only for their own assets.
A contractual agreement between the two entities should be in place to
codify the second entity's physical security responsibilities and, as
with out-sourced services, to absolve the first entity of any
responsibility for CIP-006-1

beyond ensuring that the cyber assets are within the second entity's
physical security perimeter. SPP recommends that the Commission direct
the ERO to include recognition of such contractual agreements in its
auditing and sanctioning processes.
    472. NRECA is concerned that the Commission's joint use proposal
would cause problems for small entities. NRECA also raises concerns
about how disputes regarding joint use facilities will be addressed.
iii. Commission Determination
    473. The Commission adopts its proposals in the CIP NOPR with a
clarification. As a general matter, all joint owners of a critical
cyber asset are responsible to protect that asset under the CIP
Reliability Standards. The owners of joint use facilities which have
been designated as critical cyber assets are responsible to see that
contractual obligations include provisions that allow the responsible
entity to comply with the CIP Reliability Standards. This is similar to
a responsible entity's obligations regarding vendors with access to
critical cyber assets.
    474. Regarding Northern Indiana's comments, we do not believe that
this Requirement obligates one joint owner of a critical cyber asset to
perform risk assessments of another owner's personnel. Each such owner
is responsible for performing assessments of its own personnel.
    475. The ERO should consider the suggestions raised by Northern
Indiana, SPP and NRECA in the Reliability Standards development
process.
    476. Therefore, we direct the ERO to modify CIP-004-1, and other
CIP Reliability Standards as appropriate, through the Reliability
Standards development process to address critical cyber assets that are
jointly owned or jointly used, consistent with the Commission's
determinations above.
4. CIP-005-1--Electronic Security Perimeter(s)
    477. NERC's proposed Standard CIP-005-1 requires identification and
protection of the electronic security perimeters inside which all
critical cyber assets are located, as well as all access points. The
electronic security perimeters are to encompass all the critical cyber
assets that are identified using the methodology required by Standard
CIP-002-1. Multiple electronic security perimeters may be required; for
example, one may be needed around a control room while another may be
established around a substation. For any electronic security perimeter
established, the responsible entity must develop mechanisms to control
and monitor electronic access to all electronic access points and,
further, it must assess the electronic security perimeter's cyber
vulnerability and test every electronic access point at least
annually.\119\
---------------------------------------------------------------------------

    \119\ CIP-005-1 only pertains to electronic security. Physical
security is addressed in CIP-006-1.
---------------------------------------------------------------------------

    478. The Commission approves Standard CIP-005-1 as mandatory and
enforceable. In addition, we direct the ERO to develop modifications to
this CIP Reliability Standard. The Commission also requires the ERO to
clarify and provide guidance on other matters. The required
modifications are discussed below in the following topic areas of
concern regarding CIP-005-1: (1) Adequacy of electronic security
perimeters; (2) protecting access points and controls; (3) monitoring
access logs; and (4) vulnerability assessments.
a. Adequacy of Electronic Security Perimeters
    479. Requirement R1 of CIP-005-1 requires each responsible entity
to identify electronic security perimeters and ensure that every
critical cyber asset resides within one.
i. NOPR Proposal
    480. In the CIP NOPR, the Commission stated that, while the
electronic security perimeter constitutes a first line of defense, the
effectiveness of any one defensive measure is often dependent on the
quality of active human maintenance, and that there is no one perfect
defensive measure that will guarantee the protection of the Bulk-Power
System. The Commission proposed to direct the ERO to develop a
requirement that a responsible entity implement a defensive security
approach including two or more defensive measures in a defense in depth
posture when constructing an electronic security perimeter.\120\
---------------------------------------------------------------------------

    \120\ See CIP NOPR at P 178-81.
---------------------------------------------------------------------------

ii. Comments
    481. Many commenters, including Manitoba, NERC, NRECA, Ontario
Power and ReliabilityFirst, maintain that CIP-005-1 is adequate as
drafted and they oppose the Commission's proposal to require a defense
in depth strategy.\121\ In contrast, Juniper and ISA99 Team support the
Commission's proposal. Although Idaho Power expresses support for the
defense in depth concept, it questions the Commission's proposal to
require two distinct security measures when developing an electronic
security perimeter. MidAmerican supports the proposal to require
implementation of a defensive security approach including two or more
defensive measures in a defense in depth posture, but submits that the
term ``defensive measure'' requires clarification to facilitate
compliance.
---------------------------------------------------------------------------

    \121\ See also Arkansas Electric, APPA/LPPC, Alliant, Arizona
Public Service, California Commission, Duke, Entergy, FPL Group and
Northern Indiana.
---------------------------------------------------------------------------

    482. NERC and ReliabilityFirst argue that the defense in depth
provisions recommended by the Commission make sense in a control center
environment, because additional layers of electronic security and
physical security can be readily implemented, and they are prudent due
to the centralized function performed at a control center. However,
they question the direct impact to the reliability of the Bulk-Power
System from implementing multiple defensive actions in a substation or
generating plant environment. NRECA believes that the CIP NOPR
contemplates imposing excessive defense in depth requirements,
particularly in environments where the additional depth will not yield
a significant benefit, but will impose costs. NRECA states that a
better course would be for the Commission to defer to the ERO's
technical expertise as to the application of defense in depth, rather
than dictate a specific outcome.
    483. NERC, Idaho Power and ReliabilityFirst further explain that
the use of multiple electronic security perimeter devices (i.e.,
firewalls) obtained from different vendors, creating rings of
protection using different methods, is an accepted mainstream
information technology approach. The expected result is that a failure
of one device only appears on one of the two perimeters, thereby
allowing the other perimeter to provide the desired protection. For
small numbers of zones, which protect relatively large numbers of
assets (e.g., a single zone containing all of the corporate servers),
this makes implementation and economic sense.
    484. However, NERC states that the use of multiple electronic
security perimeter devices comes at a cost to performance and
reliability. According to NERC, each ``hop'' through a perimeter device
introduces a delay in the transmission of the data. In a traditional
information technology environment, this may be tolerable, or may be
mitigated through the use of higher-speed networks. In a control system
environment, NERC states that neither option may be acceptable or
available. Additional equipment takes up space in equipment racks, and
uses additional power and cooling, which in

some cases, may be at a premium, or may introduce equipment reliability
problems. Certified equipment from different vendors may not be
available for all protocols and toolsets used in the control system
environment. Additionally, there would be more equipment which must be
functional in order to maintain reliable operations. Any time there is
an increase in the number of components that must be running in series,
the availability of the entire system decreases. In this case, this
results in an overall decrease in the reliability of the system. Last,
but not least, is the impact of having more equipment at a substation
or generating plant to install, service, maintain, and for which to
provide instruction and training.
    485. Ontario Power argues, similarly, that while the multiple
layers of security required by a defense in depth strategy may be
feasible in some situations, it is impractical or impossible in others
and should be excluded from the Final Rule.
    486. APPA/LPPC and Northern Indiana state that CIP-005-1 provides
the needed degree of flexibility to accommodate very diverse physical
and electronic situations.
    487. Arkansas Electric, Duke and Northern Indiana state that there
is a point at which having multiple defense layers would not be cost-
effective. Arkansas Electric and Duke maintain that the CIP Reliability
Standards as a whole prescribe a sufficient defense-in-depth strategy.
In addition to electronic security controls, Arkansas Electric notes
that the Reliability Standards also require physical security controls,
access-control, authentication, and intrusion detection at the
perimeter. The CIP Reliability Standard also requires a general
``hardening'' of the security of the critical cyber assets.
Furthermore, policy and procedural controls are required. Adding
security controls for the sake of redundancy adds unnecessary cost,
complexity and administrative burden to the system. Further, Duke
argues that responsible entities must establish sufficient electronic
and physical security perimeters, which in some situations could
require multiple layers that other situations do not warrant.
    488. Manitoba maintains that providing one monitored and alarmed
electronic security measure provides a sufficient and balanced security
measure when implemented in conjunction with required physical security
measures. The proposed additional security measure may require other
security installations within the proposed implementation timeframe for
CIP Reliability Standards that could delay implementation of the more
important requirement to establish an electronic perimeter for all
critical cyber assets.
    489. SDG&E and Entergy raise concerns with the Commission's
comments regarding the placement of security measures in front of
systems. SDG&E cautions against giving such ``in front'' measures a
high priority over those placed inside the system. SDG&E comments that
consideration of both measures is necessary to make informed defense in
depth decisions. Alternatively, it agrees with NERC that the Commission
should omit the requirements for a defense in depth approach in the
Final Rule. Entergy also disagrees with the Commission's proposal to
place measures ``in front of'' systems as opposed to ``inside''
systems. It argues that data/control centers and field sites are two
very different matters and that two-factor authentication is more
challenging in the field, where most equipment being remotely accessed
simply cannot be upgraded or retro-fitted to affect this technological
approach.
    490. APPA/LPPC argue that, if the Commission continues to direct
the ERO to require two or more defensive measures, then it should
clarify whether or not the second security measure must be on a par
with the first security measure. NERC and APPA/LPPC maintain that an
inflexible rule calling for redundant electronic security in all cases
poses some very practical problems in a variety of settings. APPA/LPPC
believe that, given sufficient flexibility by the Commission, these
issues can be worked out in the Reliability Standards development
process.
    491. In FPL Group's view, the NERC approach of allowing responsible
entities to develop strategies appropriate for their environment to
protect their critical cyber assets is preferable to the CIP NOPR
proposal. FPL Group characterizes the CIP NOPR proposal as a ``one size
fits all'' approach that could fail to take into account site-specific
realities. It is concerned that the CIP NOPR approach mandates form
over function and logic by placing too much emphasis on uniformity and
ignoring a site's specific environment.
    492. In contrast, Juniper and ISA99 Team argue that multiple layers
are essential for defense in depth and that the Reliability Standard
must provide guidance on devices that may be considered to be a layer
of defense. ISA99 Team argues that single peripheral layers of defense
are not adequate to protect control networks. More significantly, ISA99
Team argues, the very nature of the CIP Reliability Standards provides
defense in depth for many of the control system components. For
example, not only are perimeters identified and established, and
defended with access controls, but anti-virus and other defensive
measures are applied to components within the perimeters. ISA99 Team
argues that this defense in depth is consistent with guidance provided
in most references and standards today.\122\
---------------------------------------------------------------------------

    \122\ See ISA99 TEAM at 4, citing NERC Control Systems Security
Working Group's, Top 10 Vulnerabilities of Control Systems and Their
Associated Mitigations--2006. The inner layer device may disallow
certain protocols on port 520, or only allow read commands from
certain networks.
---------------------------------------------------------------------------

    493. In addition, ISA99 Team disagrees that legacy control systems
can be excused from defense in depth requirements. ISA99 Team argues
that it is unacceptable to leave critical control systems components,
like distributed control systems controllers, remote terminal units for
supervisory control and data acquisition systems, programmable logic
controllers and intelligent electronic devices, without additional
protection similar to that commonly used for basic personal computers
used in business system networks every day. And this protection can be
provided by various means, including further segmentation and isolation
of those components from the other parts of the control networks. It
does mean additional hardware and does require great caution, but it
can be done effectively and should be required for our critical power
infrastructure.
    494. Juniper comments that, unless wireless access can be limited
to a physical boundary, any wireless enabled device must be considered
as outside the perimeter and must authenticate to gain access and
encrypt its communications. Jamming of RF signals even with spread-
spectrum is a real concern. An attack does not have to jam all
transmission. It can cause disruption by corrupting data. If this can
cause loss of data for even a short duration, that might be enough to
perpetrate other incursions without raising alarms.
    495. Northern Indiana and Xcel ask the Commission to clarify or
direct the ERO to clarify the phrase ``single access point at the dial
up device'' in CIP-005-1, Requirement R1.2. Xcel asks whether this
refers to the initiating device, the device at the point of
termination, or both. Northern Indiana would not modify CIP-005-1, but
urges that any modifications to Requirement R2 should

allow continued reliance on legacy systems.
iii. Commission Determination
    496. The Commission adopts the CIP NOPR's proposal to direct the
ERO to develop a requirement that each responsible entity must
implement a defensive security approach including two or more defensive
measures in a defense in depth posture when constructing an electronic
security perimeter. However, in light of the comments received, the
Commission understands that there may be instances in which certain
facilities cannot implement defense in depth or where such an approach
would harm reliability rather than enhance it. For that reason, the
Commission believes that it is appropriate to allow the ERO and the
Regional Entities to grant exceptions based on the technical
feasibility of implementing defense in depth, consistent with the
Commission's determination on technical feasibility above. However, the
responsible entity should implement electronic defense in depth
measures or justify why it is not doing so pursuant to our discussion
of technical feasibility exceptions.
    497. As stated in the CIP NOPR, the Commission recognizes that
there is a point at which having multiple defense layers would not be
cost effective. However, we continue to believe that the effectiveness