CIP 43 Reliability First Audit Observations

CIP 43ReliabilityFirst Audit Observations ReliabilityFirst CIP Webinar Thursday, September 30, 2010 Tony Purgar, Sr. Consultant - Compliance

Topics • Background • CIP 43 Audit Observations • CIP 43 Next Steps • Questions

Background • ReliabilityFirst has started conducting CIP 43 Audits in 2010 • A planned and coordinated approach is utilized to execute Pre-Audit, Onsite and Post-Audit activities • ReliabilityFirst continuously evaluates auditing practices for improvements to help streamline the audit process for the auditors and the registered entity

Background • Scope: • 2010: ReliabilityFirst is evaluating CIP compliance for the review period covering the previous full calendar year up through the end of audit date(based on Data Retention defined in the CIP Standards) • 2010 audits cover 1/1/09 through end of audit • 2011: ReliabilityFirst is evaluating CIP compliance for the review period of 10/1/10 through the end of audit date to coincide with the release of the CIP V3 standards. • 2011 CMEP Implementation Plan and Actively Monitored List will define the “minimum list” of CIP requirements within scope. • Compliance is assessed against: • CIP V1 standards from 1/1/09 to 3/31/10 • CIP V2 standards from 4/1/10 to 9/30/10 • CIP V3 standards from 10/1/10 and on………

Background • ReliabilityFirst is sharing the following observations for entity awareness in preparation for an upcoming CIP 43 Audit

CIP 43 Audit Observations • CIP 43 vs. CIP 13: • 2 teams of 3 vs. 1 team of 3, including the Audit Team Lead (ATL) • Each team focused on specific CIP Standards • CIP 43 Onsite review started ½ day earlier • (Monday @ 1:00 pm vs. Tuesday @ 8:30 am) • CIP 43 requires 2-3 wks of coordinated, web based pre-audit reviews by the two audit teams • CIP 13 usually required less with only one team • Greater focus on final findings during pre-audit reviews

CIP 43 Audit Observations • Audit - completed in 1 wk onsite • ½ days: Monday (pm) & Friday (am) • 8-10 hr days: Tuesday through Thursday • Based on onsite progress, additional time would have been scheduled to complete onsite objectives, if necessary • While onsite, managing the hrs spent auditing allowed for daily recap and a fresh start the next day

CIP 43 Audit Observations • Audit team and Entity’s Primary Compliance Contact worked closely to manage the agenda and SME coordination between both audit teams • Entity SMEs split their time, as needed • Effective and timely coordination within the team and with the entity allowed for meeting the schedule demands

CIP 43 Audit Observations • Onsite data requests had an assigned due date prior to the pre-established deadline • Due dates were agreed to by the entity and flexibility was granted where appropriate

CIP 43 Audit Observations • Evidence was voluminous but organized extremely well • Entity bookmarked all versions of policies, procedures, processes, programs and test results for entire audit review period • This resulted in efficient evidentiary reviews that supported the schedule demands

CIP 43 Audit Observations • Daily status reports were issued to keep the entity and audit team abreast of the overall audit status • The entity and audit team appreciated the value of the daily status report • At the end of each day, audit team met to discuss status, results, questionable interpretations, problem areas, expectations and plans for the next day

CIP 43 Audit Observations • The audit team used the following tools and techniques to supplement evidentiary reviews: • CIP-002: • Entity presented its process for determining Critical Assets and Critical Cyber Assets per its risk based assessment methodology • Examined the meaning of “essential to the operation” with regard to remote cyber access • Examined other systems that access Critical Assets and how the risks of those systems are addressed

CIP 43 Audit Observations • CIP-003: • Regionally developed “Cyber Security Policy” checklist was used to confirm the entity’s cyber security policy addressed all CIP-002 thru CIP-009 requirements • CIP-004: • Regionally developed ”CIP-004” checklist was used to evaluate training, PRA and physical / electronic access records for a designated sample size. • Supporting evidence for each date, activity, record was cross-checked against the checklist

CIP 43 Audit Observations • CIP-006: • Conducted thorough walk thru of main control center, backup control center and IT data centers • Checked drop ceilings, cages, raised floors, HVAC and maintenance penetrations • Evaluated unauthorized access attempts (i.e. held door). • Evaluated physical access controls (i.e. monitoring, logging, alarming, security personnel activities)

CIP 43 Audit Observations • CIP-005 & CIP-007: • Strategic (haphazard) sampling was utilized • The audit team selected four applications representing major processes and walked through entity procedures associated with each requirement • Evaluated firewall rule-sets and compared physical ESP device connections (i.e. ports) against diagrams and documentation

CIP 43 Audit Observations • CIP-008 & CIP-009: • Reviewed the meaning of “annual”; how it relates to applicable requirements; and the audit team’s evidentiary expectations • Reviewed “Bookending” expectations regarding exercising of Cyber Security Incident Response Plans and Recovery Plans for Critical Cyber Assets

CIP 43 Next Steps • ReliabilityFirst is preparing for the 2011 CIP Audit Schedule • CIP 43 and 693 audits will be conducted separately • Regional Entities are sharing audit observations to help develop effective practices and regional consistencies, where practical • ReliabilityFirst will implement audit process improvements, as necessary, based on audit observations • We welcome your support and preparedness in making your CIP 43 Audit a success!!!!!!

Questions • Questions should be emailed to Karen Yoder (karen.yoder@rfirst.org) Subject: “CIP WEBINAR” • Questions will be considered in the order they are received • Clarifying questions are welcome and we will do our best to answer during the question period • Challenges to a position should be addressed to the presenter and will be taken offline

CIP 43 Reliability First Audit Observations