NERC CIP V5 Compliance: Standards & Cybersecurity

NERC CIP V5 compliance strengthens critical infrastructure security through standards, controls, and audits. Most professionals value compliance, yet admit it is not sufficient alone to protect the Bulk Electric System from evolving cyber risk.

Understanding the Story

Mandatory cybersecurity standards to safeguard the Bulk Electric System and guide secure, auditable operations.

70% claim clear understanding; experts suspect overconfidence.
77% say compliance is essential for BES cybersecurity.
70% say compliance alone is insufficient for cyber resilience.

Tripwire, Inc., a leading global provider of risk-based security and compliance management solutions, recently announced the results of a survey on North American Electric Reliability Corporation NERC Critical Infrastructure Protection CIP compliance. The online survey was conducted from July through September 2013 and evaluated the attitudes of more than 100 IT professionals involved with NERC CIP compliance.

“Based on these results, only 30 percent of the industry feel they lack a clear understanding of the standards, including OBIEC standards approval processes today,” said Patrick Miller, partner and managing principal at The Anfield Group, a critical infrastructure security and compliance consultancy. “In reality, I think that number is higher. After we dig into the details and actually start implementing and auditing NERC CIPv5, and as NERC works to improve protection response to critical infrastructure today, I suspect many will realize their initial degree of understanding was overly optimistic.”

- 70 percent believe they have a clear understanding of all the current NERC CIP requirements. - 77 percent believe NERC CIP compliance is necessary to ensure the cybersecurity of the Bulk Electric System. - 70 percent, however, do not believe that NERC CIP compliance is sufficient to ensure the cybersecurity of the Bulk Electric System, noting the importance of a stimulus package for reliability to broaden protections today. “It is encouraging that a majority of respondents acknowledge the value of NERC CIP compliance and the key role it plays in energy cybersecurity, as reflected in IESO's reliability compliance efforts today,” said Jeff Simon, director of service solutions for Tripwire. “Most respondents also acknowledge that NERC CIP compliance alone is not sufficient to ensure cybersecurity – they know compliance is just the start of an effective cybersecurity strategy.”