The document details a panel discussion on the challenges and lessons learned regarding NERC CIP v5 compliance and configuration change management. Key pain points include asset identification, change approval processes, and compliance management, along with the need for thorough documentation and security controls. The discussion emphasizes transitioning from manual processes to automated systems for improved compliance and cybersecurity.

1. Lessons Learned For NERC CIPv5
Compliance & Configuration Change
Management
Mark Prince, Entergy
Tim Erlin, Tripwire
Karl Perman, EnergySec

2. Logistics
• Panelist discussion followed by questions and answers
• All lines other than panelists will be muted
• Questions via chat function
• Audio and slides will be posted within 72 hours

3. It’s Interactive
3
Please submit your
questions through the
control panel to get
answers LIVE from our
panelists.

4. Introductions
Mark Prince
Manager OT Fossil
Tim Erlin
Director, IT Security and
Risk Strategist
@terlin
Karl Perman
VP, Member Services
@EnergySec

5. NERC CIP V5 Pain Points
• Asset Identification and Categorization
• Change Approval Process
• Configuration Management
• Compliance Management
• Baseline Configuration
• Patching
• Malware Prevention and Detection
• Access Management
• Information Protection
• Evidence of Compliance
• Many manual processes

6. General Change
Management Process
• Develop baseline configurations
• Authorize and document changes to baselines
• Update baselines within 30 days
• Verify security controls
• Pre-change Testing
– High Impact BCS
• Configuration Monitoring
– High Impact BCS, EACMS, and PCA
© 2015 Energy Sector Security Consortium, Inc. 6

7. Configuration Change Management
Pain Points
• Number and variety of devices
• Every time, every change
– No exceptional circumstances exemption
• Identify security controls affected by the
change
– CIP-005 and CIP-007
• High Impact needs to have “Double Test”
– Once before change, once after change
• Automated system vs. manual process
© 2015 Energy Sector Security Consortium, Inc. 7

8. Evidence
• What needs to be maintained
• Maintain Documentation
• Storage
• Automated work flows or
manual processes
© 2015 Energy Sector Security Consortium, Inc. 8

19. Beyond Compliance to Cybersecurity

20. Q & A
Mark Prince
Manager OT Fossil
Tim Erlin
Director, IT Security and
Risk Strategist
@terlin
Karl Perman
VP, Member Services
@EnergySec