• Home

• Industries
  • Financial Services
  • Government
  • Healthcare
  • Higher Education
  • Legal
  • Public Companies
  • Public Utilities
  • Retail

• Solutions
  • IT Audit Services
  • IT Risk Assessment Services
  • IT Security Planning
  • PCI Compliance Services
  • Application Code Review
  • Vulnerability Scanning
  • Penetration Testing

• News & Events
  • Events
  • Webinars
  • In The News
  • Press Releases

• About Us
  • Overview
  • Management
  • Partners

• Careers

• Contact Us

NERC CIP Compliance Solutions

The criteria for measuring effective control operation significantly raise the bar for internal audits previously established with the Sarbanes Oxley (SOX) regulations. It is anticipated that many organizations will identify gaps in compliance at the start of this process and remediation may require months, if not years, to close gaps. With "audibility" of compliance required by December 31, 2010, some electric utility organizations are already finding that they are operating on compressed schedules to complete compliance gap closure.

By providing proven processes, existing document templates and an online portal for information distribution and compliance management, Coalfire is helping a wide range of energy providers accelerate compliance program implementation and greatly reducing risk of control failure or compliance deficiency fines.

The CIP standards include eight (8) critical controls:

• Critical Cyber Assets: Requires a responsible entity to identify its critical assets and critical cyber assets using a risk-based assessment methodology.
• Security Management Controls: Requires a responsible entity to develop and implement security management controls to protect critical cyber assets.
• Personnel and Training: Requires personnel with access to critical cyber assets to have identity verification and a criminal background check. It also requires employee training.
• Electronic Security: Requires the identification and protection of an electronic security perimeter and access points. The electronic security perimeter is to encompass the critical cyber assets identified pursuant to the methodology.
• Physical Security: Requires a responsible entity to create and maintain a physical security plan that ensures that all cyber assets within an electronic security perimeter are kept in an identified physical security perimeter.
• Systems Security Management: Requires a responsible entity to define methods, processes and procedures for securing the systems identified as critical cyber assets, as well as the non-critical cyber assets within an electronic security perimeter.
• Incident Reporting and Response Planning: Requires a responsible entity to identify, classify, respond to, and report cyber security incidents related to critical cyber assets.
• Recovery Plans: Requires the establishment of recovery plans for critical cyber assets using established business continuity and disaster recovery techniques and practices.

Cyber Security Solutions

Coalfire and our partner Infrastructure Defense Partners (IDP) offer end-to-end controls that vary slightly between the water, waste water, and electric sectors. Structured processes for the following services, in addition to our compliance management solutions, for the utilities industry are:

• Asset Characterization
• Risk Assessment
• Policy Development
• Control Design and Selection
• Control Implementation
• Control Testing and Audit