Standards

Howard Gugel, Senior Director of Standards and EducationBoard of Trustees MeetingNovember 2, 2016

RELIABILITY | ACCOUNTABILITY2

• Status NERC Standards Committee endorsed on September 14, 2016 Presented to Standards Oversight and Technology Committee

• Action Approve 2017-2019 Reliability Standards Development Plan

2017-2019 Reliability Standards Development Plan

RELIABILITY | ACCOUNTABILITY3

• Background Improves and clarifies the FRCC standard development process Consistency in standard development with NERC and Regional Entities

• Action Approve FRCC Regional Reliability Standard Development Process Manual

FRCC Regional Reliability Standard Development Process Manual

RELIABILITY | ACCOUNTABILITY4

• Background FERC letter order approved IRO-018-1 and TOP-010-1 Order directed modifying Violation Risk Factors (VRFs) from “Medium” to

“High”

• Action Adopt the VRF revisions

Violation Risk Factor Revision IRO-018-1 and TOP-010-1

RELIABILITY | ACCOUNTABILITY5

• Interpretation Clarifies phrase “shared BES Cyber Systems” Clarifies evaluation parameters

• Action Adopt Interpretation of CIP-002-5.1

Interpretation of CIP-002-5.1

RELIABILITY | ACCOUNTABILITY6

• Interpretation Clarifies Operating Reserve – Spinning Consistent with FERC Order 789

• Action Adopt Interpretation of BAL-002-WECC-2a

Interpretation of BAL-002-WECC-2a

RELIABILITY | ACCOUNTABILITY7

• Background Final ballot December 2015 approved retiring BAL-004-0 Coordination with North American Energy Standards Board (NAESB) to

retire corresponding standard Operating Committee guideline

• Action Retire – BAL-004-0 Time Error Correction

Time Error Correction

RELIABILITY | ACCOUNTABILITY8

1

E-ISAC Update

Marcus Sachs, Senior VP & Chief Security OfficerBoard of Trustees MeetingNovember 2, 2016

2

• Sharing and reporting 198 E-ISAC staff posts to the portal 33 member responses to the portal items 17 additional posts to the portal from members 42 calls to the E-ISAC hotline 211 new portal accounts

• Engagement (monthly average during the quarter) 263 webinar attendees 414 downloads of the daily report

• Active portal membership on September 30, 2016 1201 NERC registered entities (86% of 1389 registered entities) 366 non-NERC registered entities (18% of estimated 2000 eligible) 114 partners (government, other ISACs, etc.)

Summary of Q3 2016

3

• Mid-year Report (July)• Engaging the E-ISAC (August) Second publication on how to use the E-ISAC’s products and services Produce with input from the Member Executive Committee

• Security Management in the North American Electricity Sub-Sector (September) Framework for comprehensive physical security of electricity assets

• Recommendations to Oblenergoes (September) Timeline of issues in 2015 that led to the December incident Assessment of the problem and detailed list of recommendations Checklist of actions that should be immediately implemented

Advisories and Reports

4

• Explosive growth of “smart devices” in the past two years Things that can communicate over the Internet Security cameras, digital video recorders, alarms, light switches, coffee

pots, refrigerators

• Most are not designed to be secure against unauthorized access Can be hijacked by malicious actors Are being used to attack other systems

• Three attacks on October 21, 2016 against an Internet service provider Caused hundreds of popular web sites to be unavailable

• E-ISAC issued TLP-AMBER, TLP-GREEN, and TLP-WHITE advisories at the end of October

Internet of Things Issue

5

• Staffing 17 employees plus three contractors in the Washington, DC office Physical security manager transferred internally Member services manager (ESCC recommendation) hired in August Active search for a new Watch Operations Team director

• Technology Web portal upgrade project initiated in June, will finish in November New platform project RFP issued in late October STIX/TAXII pilot in final stages of vendor procurement CRISP unclassified data center initiative started

E-ISAC Staffing and Support

6

• 2016 work plan execution is on track Publish a “How-To” Guide (“Understanding Your E-ISAC”) Develop E-ISAC Products and Services List Define E-ISAC Role in Classified Briefings Establish User Communities Develop Strawmen for E-ISAC Reports Pilot Automated Information Sharing (Platform) Initiate Improvements to the Portal Develop Plan to Evaluate 24/7 Watch and Notification Capability Conduct Site Pen Testing

• MEC face-to-face meeting in September Discussed Board’s request for a strategic plan

Member Executive Committee

7