CIP-005-7

R1 · Electronic Security Perimeter

What it means. For medium impact BES Cyber Systems and their associated Protected Cyber Assets: every applicable Cyber Asset connected to a network by a routable protocol resides within a defined ESP (Part 1.1); all External Routable Connectivity goes through an identified Electronic Access Point (Part 1.2); each EAP requires inbound and outbound access permissions, including the reason for granting access, and denies all other access by default (Part 1.3); and, where technically feasible, Dial-up Connectivity is authenticated (Part 1.4). EAPs for medium impact BES Cyber Systems at Control Centers also need methods for detecting known or suspected malicious inbound and outbound communications (Part 1.5).

Evidence an auditor expects. Lists of ESPs with all uniquely identifiable Cyber Assets connected by a routable protocol; network diagrams showing all external routable paths and EAPs; firewall or access control list rules showing only permitted access, each with a documented reason; the dial-up authentication process; and, at Control Centers, documentation that malicious communications detection such as an intrusion detection system is implemented.

R2 · Remote access management

What it means. Where technically feasible, for medium impact BES Cyber Systems with External Routable Connectivity and their associated Protected Cyber Assets: all Interactive Remote Access passes through an Intermediate System so the initiating Cyber Asset does not directly access an applicable Cyber Asset (Part 2.1); IRA sessions use encryption that terminates at the Intermediate System (Part 2.2); all IRA sessions require multi-factor authentication (Part 2.3); and the entity has methods to determine active vendor remote access sessions, including IRA and system-to-system remote access (Part 2.4), and to disable them (Part 2.5).

Evidence an auditor expects. Network diagrams or architecture documents showing the Intermediate System, where encryption starts and ends, and the authentication factors used, plus documentation of the methods used to see and to disable active vendor remote access.

R3 · Vendor remote access to EACMS and PACS

What it means. For Electronic Access Control or Monitoring Systems and Physical Access Control Systems associated with medium impact BES Cyber Systems with External Routable Connectivity, have methods to determine authenticated vendor-initiated remote connections (Part 3.1) and to terminate them and control the ability to reconnect (Part 3.2).

Evidence an auditor expects. Documentation of the methods, such as logged or monitoring information for detecting vendor-initiated connections, and steps such as ending the session, dropping the firewall connection, or disabling the account, token or source addresses to prevent reconnection.

For inverter-based plants

An inverter-based plant whose BES Cyber Systems are all low impact under CIP-002 is exempt from CIP-005-7 under Section 4.2.3.5; its remote access controls come from CIP-003 Attachment 1 Sections 3 and 6.