NERC CIP Compliance

CIP-002: BES Cyber System Categorization

R1​: Identification and categorization of BES Cyber Systems and assets

• Passive monitoring and targeted active scanning features detect every asset connected to the OT network
• Detailed data on asset attributes and network traffic can aid in asset categorization

R2​: Identification of additions or changes to asset inventories and categorization

• Platform can identify any new asset communicating on the network
• Network maps and asset inventories can display network state at any given point in time
  

CIP-005: Electronic Security Perimeter(s)

R1​: Electronic security perimeters

• Create an ESP by enforcing OT access control rules for all connected assets within a High or Medium Impact system (1.1)
• Serve as the Electronic Access Point for High or Medium Impact systems with external routable connectivity by inspecting and applying policies to all inbound or outbound connections (1.2)
• Enforce policies to allow connections under permitted conditions and deny all other access by default (1.3)
• Detect known or suspected malicious communications by monitoring for abnormal, unexpected or unauthorized activity (1.5)

CIP-007: System Security Management

R1​: Ports and services

• Enforce access control rules limiting connections to only the necessary ports for each device (1.1)
  

R2​: Security event monitoring

• Log network traffic, asset configuration changes, and level 0 process changes, and correlate with login attempts (4.1)
• Generate alerts on failed login attempts and any other required network events (4.2)
• Provide evidence that event logs have been retained the required 90 days (4.3)
• Generate dashboards and summary reports for use in required event reviews (4.4)
  

CIP-010: Configuration Change Management and Vulnerability Assessments

R1​: Configuration change mangement

• Enable definition of baseline configurations by identifying and documenting the current configuration for each asset (1.1)
  

R2​: Configuration monitoring

• Use detection rules to identify any changes to asset configurations (2.1)

R3: Vulnerability assessments

• Support OT vulnerability assessments by maintaining real-time visibility into asset configurations, network activity, and known and emerging cyber threats