A small utility´s perspective on CIP “version 4”

Summary form only given. The NERC Critical Infrastructure Protection (CIP) standards have made a large impact on all utilities that have Critical Cyber Assets. Like many utilities, Minnkota´s only Critical Asset to date has been its Energy Management System (EMS). Version 4 of the CIP standards will extend this application out to substations and power plants. Besides the large effort of bringing those assets´ “cyber systems” into compliance with the CIP standards, smaller utilities face other challenges related to a very limited work force - particularly, the skill set of substation engineers not lining up directly with the actions needed to achieve CIP compliance, and the geographical distance between CIP-affected cyber systems compared to the relatively close proximity of current CIP Critical Cyber Assets to the staff that supports them. The work load for the individuals involved in the configuration of the EMS and its associated network has increased dramatically over recent years in an effort to achieve compliance with CIP-002 through CIP-009. Early analysis of Version 4´s impact reveals that Minnkota will have approximately five “High Impact” facilities, seven “Medium Impact” facilities, and dozens of “Low Impact” facilities - as opposed to the current single Critical Asset. Complicating the issue for Minnkota is its relatively large geographic footprint (the eastern half of North Dakota, and most of northwestern Minnesota), a communications system that is still largely analog microwave, a very young engineering staff due to recent attrition, and other large projects that are heavily drawing on the workforce simultaneously including the construction of a backup control center and a new 250-mile long 345 kV line. Minnkota is approaching CIP Version 4 by creating a team that consists of a plant engineer with network skills - to be trained on current policies and procedures by the EMS staff which h- - as the most experience with the CIP standards and their application, substation engineers that possess the knowledge of the configuration of cyber systems at transmission facilities, and telecommunications engineers with knowledge of RTU configurations and substation networks. This team will be responsible for the categorization and documentation of all CIP cyber systems, as well as the implementation of technical and procedural changes needed to bring those cyber systems into compliance with CIP version 4.