NERC CIP – Stronger, Easier

The NERC CIP standards specify cybersecurity measures required in the North American Bulk Electric System (BES) for grid control centers, large power plants and high-voltage substations. The standards are also used as guidance by many other stakeholders, even in other industries, around the world. A problem with the standards, however, is that they are written in abstract language that is difficult to interpret. For example, the standards effectively forbid OT systems to use IT Active Directory forests, and strongly encourage the use of Unidirectional Gateways – but neither the words “Active Directory” nor “Unidirectional Gateway” appear anywhere in the standards.

This is unfortunate, because Unidirectional Gateways really do strengthen and simplify NERC CIP security and compliance programs. Unidirectional Gateways are used routinely at the IT/OT interface in power plants – providing OT data to IT users and applications, with no risk at all of cyber attacks “leaking” through the gateways back into protected networks. Unidirectional Gateway technology is currently deployed to protect roughly 1/3 of the power produced in the North American grid. Unidirectional Gateways are also used to protect inter-utility ICCP connections in Balancing Authorities (BA’s) and Transmission System Operators (TSO’s). And the gateways are starting to be used to protect sub-networks of protective relays in power plants and high voltage substations.