Tom Alrich’s Blog: My (Final) Fantasy CIP-002-5

In the previous post, I reasoned there are two main areas that need substantial wording changes in CIP-002-5:  identification of “big iron” and of “little iron”. [i] Big iron refers to the facilities that are in scope for Version 5: generating stations, control centers, etc.  Little iron refers to the cyber assets that are in scope. The goal of CIP-002-5 (and note that CIP-002-5 without the “-taf” refers to the “real” version submitted to FERC by NERC in January) is for the entity to identify their cyber assets in scope for V5 (called BES Cyber Systems).  However, in order to do this, the entity first has to identify and classify their facilities (or assets) in scope, so that the BES Cyber Systems can inherit the facility classifications.

The first post provided a CIP-002-5-taf that I think is much more coherent than CIP-002-5, as far as identification of little iron is concerned.  However, I punted on the changes that are needed for big iron and just inserted the term “asset/Facility” as a placeholder wherever CIP-002-5 uses either “asset” or “Facility”.  I will now (note – without using a net!) remove that placeholder by fixing the big iron wording problem in CIP-002-5, resulting in my final version of CIP-002-5-taf.

However, this new post will be much shorter than the previous one, since I have already discussed the big iron problems in CIP-002-5 and provided an idea of what the cure could be.  I did this in an earlier post titled “My Comments to FERC on CIP Version 5, Part I”.[ii]  If you haven’t read that post, I recommend you do it now, since I don’t intend to repeat the arguments here, although I will summarize them.”