1 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

Electric utilities have become increasingly aware of

cybersecurity threats and the operational impacts they pose to

their assets, operations, and grid reliability. Any cyber scenario

that can adversely affect reliability of the Bulk Electric System

(BES) threatens the integrity of the grid, health and human

safety, and critical services that sustain our daily lives.

The Federal Energy Regulatory Commission (FERC) continues

to increase the security and resilience of the U.S. power grid,

encouraging registered entities to enhance their awareness

and defensive capabilities to the cyber threat landscape.

Its regulators and utility members work in coordination

to stay proactive in the face of increased technological

dependence, digital interdependence, and increasing risks

and vulnerabilities.

The North American Reliability Corporation (NERC) is a

FERC-certified body tasked with establishing and enforcing

reliability standards, as well as soliciting feedback to

continually update mandated and enforced security controls

to improve overall cyber and physical security. The Critical

Infrastructure Protection (CIP) standards are a subset of

NERC standards that specify the minimum cybersecurity

requirements to support the reliability of the electrical system

applied to BES operators in the U.S., Canada, and Mexico.

The Nozomi Networks platform supports mandated NERC-CIP

cybersecurity standards for operational technology (OT) and

industrial control systems (ICS). The solution offers custom

queries and assertions for monitoring and analyzing network

traffic, and reporting capabilities to demonstrate compliance.

The system also provides anomaly detection for early

attack identification and prevention, as well as workbooks

to strategically prioritize remediation efforts to identified

vulnerabilities for more efficient risk management.

1. Introduction

The electricity sector is undergoing

significant changes that are unprecedented

in both transformational nature and rapid

pace. Such extraordinary evolution presents

new challenges and opportunities for

reliability, resilience, and security. Advances

in technology, customer preferences,

policies, and market forces are altering the

generation resource mix and challenging the

conventional understanding of the reliability

role of baseload power that was traditionally

provided by large, centralized generating

units. While efforts are underway to address

these risks, the management of reliability,

resilience, and security will require increased

focus by all.

NERC Long-Term Reliability Assessment, 2020

2 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

2. Additional Standards to Come

To reduce cybersecurity risks and exposure, NERC is in the

process of developing a new standard requiring internal

network security monitoring within a trusted Critical

Infrastructure Protection networked environment for all

high impact BES Cyber Systems with and without external

routable connectivity and medium impact BES Cyber Systems

with external routable connectivity. The standard could also

include medium and low impact BES Cyber Systems in the

future. Given the increasingly sophisticated methods by which

attackers gain access to critical systems, it is critical that

entities move beyond protection of the electronic security

perimeter and implement dynamic, persistent monitoring

measures.

FERC has also issued a recent order approving CIP-003-9

requiring remote access security controls for low impact

BES Cyber Systems. According to NERC, “the incredible

scale and diversity of low impact BES Cyber Assets across

Control Centers, substations, and generation resources of

all types, the idea of having a base cyber security plan with

required sections to mitigate high level risk areas rather than

prescriptive device-level requirements is a manageable way

for all entities to document how they meet the cyber security

objectives for the assets containing low impact BES Cyber

Systems.” The extended CIP-003 standard tasks utilities

with demonstrating security management controls for low

impact BES Cyber Systems, tackling cybersecurity awareness,

physical security controls, electronic access controls,

cybersecurity incident response, and transient cyber assets

and removable media.

Lastly, NERC continues to grapple with the addition of

distributed energy resources as outlined in the Department of

Energy’s October 2022 report, “Cybersecurity Considerations

for Distributed Energy Resources on the U.S. Electric Grid.”

Distributed Energy Resources (DER) are small-scale power

generation, flexible load, or storage technologies (typically

from 1 kilowatt to 10,000 kilowatts) that can provide an

alternative to, or an enhancement of, the traditional electric

power system.

Per the report, “existing cybersecurity standards and best

practices, such as multifactor authentication, endpoint

detection and response (EDR), encryption, and a skilled and

empowered security team, may need to be refined for specific

DER deployment use cases … Broad industry involvement is

key to the development, approval, and implementation of

robust DER cybersecurity standards. The U.S. Department of

Energy (DOE) will continue to engage DER operators; vendors;

developers; owners; aggregators; utilities; and other Federal,

state, and local partners to ensure the wide adoption of the

standards and best practices.”

3 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

3. Nozomi Networks Solution Support for NERC CIP Standards

Standard Requirement Security Objectives Nozomi Networks Support for OT/ICS Networks

CIP-002-5.1a: BES Cyber System Categorization

Identify and categorize BES Cyber Systems and their associated BES Cyber Assets for the application of cyber security requirements

Categorize inventory, prioritizing critical systems, understand and analyze assets and risk indicators, severity scoring, and recommendations

COMPLETE

CIP-003-8: Security Management Controls

Specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems

Centralize network visibility, provide security access management, analyze communications and protocols, set and review security management for BES across locations

COMPLETE

CIP-004-6: Personnel & Training

Minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric System

Create custom CIP reports, dashboards, and queries for training materials with nodes categorized as most at risk with clear visual markers and detailed alerts

PARTIAL

CIP-005-7: Electronic Security Perimeter(s)

Manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security Perimeter

Detect unauthorized network access, use of cleartext passwords and unencrypted remote access, and manage assets based on uniquely assigned electronic security perimeters

COMPLETE

CIP-007-6: System Security Management

Manage system security by specifying select technical, operational, and procedural requirements in support of protecting Bulk Electric System

Monitor traffic specific to ports, switches and control networks. Track BES assets by MAC, vendor, product lifecycle, IP, role, OS, firmware version, patch level, and more

PARTIAL

CIP-008-6: Incident Reporting and Response Planning

Mitigate the risk to the reliable operation of the BES as the result of a Cyber Security Incident

Monitor events and centrally manage network monitoring, consolidate and correlate events and alerts, report events and incidents and remediate with leading incident response partnerships and integrations

COMPLETE

4 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

3. Nozomi Networks Solution Support for NERC CIP Standards

Standard Requirement Security Objectives Nozomi Networks Support for OT/ICS Networks

CIP-010-4: Configuration Change Management and Vulnerability Assessments

Prevent and detect unauthorized changes to BES Cyber Systems by specifying configuration change management and vulnerability assessment requirements

Monitor baseline configurations with change notifications and alerts for change and version control, reviewing relevant vulnerabilities and appropriate patches and updates with available workbooks

COMPLETE

CIP-012-1: Communications between Control Centers

Protect the confidentiality and integrity of Real-time Assessment and Real-time monitoring data

Streamline security management of OT/ICS data from one network to range of operations and locations with real time monitoring of communications between control centers

PARTIAL

CIP-013-2: Supply Chain Risk Management

Mitigate cyber security risks to the reliable operation of the Bulk Electric System (BES) by implementing security controls for supply chain risk management

Utilize deep packet inspection of industrial protocols to perform configuration management on assets and devices, monitoring and reporting vulnerabilities, security events, and incidents

PARTIAL

CIP-007-6: System Security Management is the most often

violated standard as its complexity across OT networks is

difficult to master. The standard requires responsible entities

to define and document methods, processes, and procedures

for securing those systems determined to be Critical Cyber

Assets, as well as the Non-critical Cyber Assets within the

Electronic Security Perimeter(s). It is impossible to manually

log granular details about each asset, its activity and traffic

patterns, amounts of transferred data, protocols and function

codes, source and destination ports, connection attempts,

software and firmware versions and updates in real time.

Asset owners must consistently exhibit compliance,

highlighting the necessity for an automated and ongoing

security monitoring solution. NERC-CIP regulations carry legal

obligations, mandating utility companies to conduct thorough

risk assessments, conform to a foundational cybersecurity

framework, and implement specialized security measures

and industry best practices. Furthermore, these entities

are obligated to confirm their compliance and establish

comprehensive contingency strategies.

Failure to comply could result in monetary fines, sanctions, or

other penalties. Forthcoming standards will include internal

network security monitoring, extending risk management

practices to low-impact cyber systems, and incorporating

distributed energy resources.

5 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

Nozomi Networks provides real-time network intelligence,

monitoring and AI-powered threat detection. This enables

a proactive approach to risk management and ultimate

reduction. It also provides real-time alerts to threats and

anomalies within an industrial control network. Our solution

includes a flexible and intuitive interface for reporting and

operational oversight.

Develop a higher level of cybersecurity maturity

demonstrating NERC CIP compliance with:

• Virtual Nozomi Networks sensors that collect network data,

analyze it and generate a highly accurate report packed

with actionable insights and recommendations resulting in

a reduced mean-time-to-respond (MTTR).

• An Asset Inventory that delivers a detailed inventory of

assets on the network, along with actionable insights into

communications patterns, helping mitigate security risks

and increase SOC productivity.

• Asset Intelligence that delivers accurate device profiles that

enhance anomaly and threat detection capabilities.

• Vulnerability monitoring that groups alerts into incidents,

providing security and operations staff with a simple, clear,

and consolidated view of what’s happening on you’re the

network.

• Threat Intelligence updated regularly with data and analysis

to continuously detect and respond to emerging threats.

• Rapid detection of anomalies, including cyberattacks, cyber

events and critical process variable irregularities.

The example substation and SOC architecture below shows

the deployment of Nozomi Networks’ OT/IoT anomaly

detection and monitoring solution. A wide variety of

appliances, a flexible architecture, and integrations with other

systems allow us to provide a solution tailored to meet the

needs of your organization.

4. The Nozomi Networks Platform

PrinterOperator Stations Engineering

Station

Redundant SwitchesRedundant

Station Computers

Redundant Communication Gateways

GPS Time Server

Redundant Switches

Redundant Switches

Bay Control

Unit

Bay Control

Unit

Bay Control

Unit

Remote I/O

Bay Control & Protection Unit

Bay Control & Protection Unit

Bay Control & Protection Unit

Substation WAN

Security Management LAN

Ethernet Ring

Ethernet Ring

Mirror /SPANMirror/SPAN

Mirror / SPAN

IEC 61850-8-1

WAN

Emergency Control Center

System Control Center

Remote I/O Remote I/O

VANTAGE VANTAGE IQSOC

LOCAL MANAGEMENT

CONSOLE

GUARDIAN SMART POLLING

GUARDIAN SMART POLLING

GUARDIAN SMART POLLING

Sample Deployment Architecture for Substations SOC

6 MAPPING GUIDE

NERC CIP Compliance with Nozomi Networks’ Solution

NERC-CIP requires utilities and their responsible stakeholders

to develop baseline practices for cybersecurity visibility and

threat detection, adopt defense in depth security practices,

and protect sensitive information. The standards also

encourage strong perimeter and remote access controls,

real-time monitoring, business continuity planning, adequate

change management policies, and robust cybersecurity

training for staff and employees.

The NERC-CIP regulations encompass a wide range

of extensive and intricate directives, spanning diverse

skillsets of personnel for the secure implementation of

the specified controls. Maintaining compliance with all of

these requirements cannot be achieved by a single product,

technology, or team. Instead, it requires a collaborative

ecosystem of partners and technologies, seamlessly

operating across the various business units to ensure ongoing

compliance.

Nozomi Networks stands as your ally in navigating the

complexities of NERC-CIP compliance. We look forward to

enabling your organization to be successful in your NERC-CIP

journey.

5. Conclusion

Nozomi Networks accelerates digital transformation by protecting the world’s critical infrastructure,

industrial and government organizations from cyber threats. Our solution delivers exceptional network

and asset visibility, threat detection, and insights for OT and IoT environments. Customers rely on us to

minimize risk and complexity while maximizing operational resilience.

© 2023 Nozomi Networks, Inc. | All Rights Reserved.

NN-NERC-CIP-8.5x11-001

nozominetworks.com

nozominetworks.com/contact

Let's get started Schedule a demo with our experts to understand how

Nozomi Networks can help streamline your NERC CIP

compliance program.

Book a Demo

https://www.nozominetworks.com/demo/