CIP-005-6 requires high and medium impact cyber systems to sit inside an electronic security perimeter with identified access points, to permit only traffic that has a documented reason and to deny everything else. For interactive remote access it requires an intermediate system, encryption that terminates on it and multi-factor authentication, and for vendors, the ability to see which sessions are active and to cut them.
The problem CIP-005 solves
A control system can be well configured and still be exposed by the network around it. CIP-005 defines where the edge of the control network is and how it is crossed. It does so in two requirements: the perimeter (R1) and remote access (R2). This guide covers version CIP-005-6. The general framework is in NERC CIP requirements and what to adopt elsewhere.
R1: the electronic security perimeter
It applies to high impact and medium impact systems, as classified under CIP-002, and to their associated protected cyber assets. The baseline configuration and the change and vulnerability management that CIP-010 requires are covered in NERC CIP-010: Change and Vulnerability Management.
| Part | What it requires |
|---|---|
| 1.1 | Every asset connected to a network through a routable protocol sits inside a defined perimeter (ESP) |
| 1.2 | Every routable connection to the outside goes through an identified Electronic Access Point (EAP) |
| 1.3 | Inbound and outbound permissions with the reason documented, and deny all other access by default |
| 1.4 | If there is dial-up access, authenticate when the connection is made, where technically feasible |
| 1.5 | Methods to detect known or suspected malicious communications, inbound and outbound |
Two notes on scope. Part 1.2 refers to systems with external routable connectivity. Part 1.5 applies to the access points of high impact systems and, for medium impact, those at control centers.
What evidence is expected
The standard gives examples of evidence. For 1.1, a list of the perimeters with each asset identified. For 1.2, network diagrams showing all routable paths to the outside and their access points. For 1.3, the list of firewall rules or access control lists, with a written reason for each rule. For 1.5, documentation that the detection method, such as an intrusion detection system or an application layer firewall, is implemented.
In practical terms: a firewall with «allow all» rules, or with rules that have no owner and no reason, does not meet 1.3 even if it filters.
R2: remote access management
It applies to high impact and to medium impact with external routable connectivity. Interactive remote access is access by a person from outside the perimeter using a keyboard and screen.
| Part | What it requires |
|---|---|
| 2.1 | Use an intermediate system: the device the person connects from does not reach the asset directly |
| 2.2 | Encrypt the session, and terminate the encryption on the intermediate system |
| 2.3 | Require multi-factor authentication |
| 2.4 | Have methods to determine active vendor remote sessions, both person-driven and system-to-system |
| 2.5 | Have methods to disable those active vendor sessions |
The intermediate system acts as a proxy for the remote person. Toward the perimeter only the protocol that controls that server has to be allowed, not every protocol the user would need to reach each asset. That is why firewall rules can be far more restrictive, and why the asset is protected from vulnerabilities on the remote computer.
The standard gives examples of factors: something the person knows (a password or PIN, not the user ID), something the person has (a token, digital certificate or smart card) or something the person is (a fingerprint or iris scan).
Vendor access: see it and cut it
Parts 2.4 and 2.5 exist because vendors often have access to equipment in service. The standard gives examples of how to comply:
- See active sessions: review logs, connection tables or firewall rule counters, open ports or user activity; or control that the vendor cannot start a session alone, for example by calling in to request the second factor.
- Cut sessions: disable vendor access at the Electronic Access Point, for system-to-system connections, or at the intermediate system, for sessions by a person.
How this looks in a substation
A typical substation with a link to the control center has a firewall at the edge of the substation network, which is the EAP. Inside are the switches, RTUs, gateways and IEDs. Remote maintenance enters through a jump server that acts as the intermediate system. Design details are in OT network segmentation: zones and conduits, industrial router and firewall and secure remote access to substations.
What usually fails
- Rules inherited from earlier commissioning, with no recorded reason.
- Vendor maintenance services that come in through a modem or a mobile link outside the firewall.
- Shared accounts that make it impossible to know who opened the session.
- Network diagrams that do not match what is installed.
We review your substation perimeter
At Tiza Group we configure firewalls, switches and gateways for substations and industry with minimal documented rules, and organize remote access with an intermediate system and multi-factor authentication, within our substation and plant cybersecurity service. We also configure relays remotely under controlled access: remote relay configuration.
Related guides
- NERC CIP-002: BES Cyber System categorization
- NERC CIP requirements and what to adopt elsewhere
- OT network segmentation: zones and conduits
- Industrial router and firewall
- Secure remote access to substations
- Intrusion detection (IDS) in substation networks
- NERC CIP-010: Change and Vulnerability Management
References
- NERC, CIP-005-6, Cyber Security – Electronic Security Perimeter(s): requirements R1 and R2.
Frequently asked questions
What is an electronic security perimeter (ESP)?
It is the logical boundary of the network that protects the cyber systems covered by CIP. Every asset connected through a routable protocol must sit inside a defined ESP, and every routable communication to the outside must pass through an identified Electronic Access Point, normally a firewall.
Why is a VPN not enough for remote access?
CIP-005-6 requires that the person connecting does not reach the asset directly: the session must go through an intermediate system, encryption must terminate on that system and multi-factor authentication is required. A VPN that drops the user straight into the control network does not meet that design.
What must an entity be able to do about vendor remote access?
Two things: determine which vendor remote sessions are active and be able to disable them. This covers both sessions by a person and system-to-system connections. These are parts 2.4 and 2.5 of the standard.