NERC CIP-008: Incident Response and Reporting

Short answer

CIP-008-6 requires a written cyber incident response plan for high and medium impact systems, tested at least every 15 months, updated after each test or real incident, with Reportable Cyber Security Incidents notified to the E-ISAC within one hour and attempts to compromise by the end of the next calendar day. Later updates are sent within 7 calendar days.

What CIP-008 covers

CIP-008 deals with what happens after something goes wrong in a cyber system of the power grid: who does what, how it is decided whether an incident must be reported, and who is told. It applies to high and medium impact systems, as classified under CIP-002, and to their electronic access control or monitoring systems (EACMS). The version described is CIP-008-6.

It has four requirements: the plan (R1), its implementation and testing (R2), its maintenance (R3) and notifications (R4).

R1: what the plan must contain

A written plan that includes:

Processes to identify, classify and respond to incidents (part 1.1).
Processes to decide whether an incident is reportable or an attempt to compromise, with the entity’s own criteria for what an attempt is, and to notify under R4 (part 1.2).
The roles and responsibilities of the groups or individuals who respond (part 1.3).
Handling procedures for the incident: containment, eradication and recovery (part 1.4).

Part 1.2 is the hardest to write well. The standard does not fix what an attempt to compromise is: it obliges the entity to define it and to justify its criteria. A plan that only says «each case will be assessed» does not comply.

R2: implement and test the plan

Test every 15 calendar months (part 2.1). It can be met in three ways: responding to a real Reportable Cyber Security Incident, a tabletop exercise of a Reportable Cyber Security Incident, or an operational exercise.
Actually use the plan (part 2.2). When a reportable incident, an attempt to compromise or an exercise occurs, the plan is followed and deviations are documented.
Keep the records (part 2.3) of reportable incidents and attempts to compromise, as the plan specifies.

Typical evidence includes incident reports, logs and notes taken during the response, and a lessons-learned report with a summary of the test.

R3: keep the plan current

When	What must be done
Within 90 calendar days after a test or a real reportable incident	Document lessons learned, or document that there were none; update the plan with them; notify each person or group with a role in the plan of the changes
Within 60 calendar days after a change in roles, responsible people or technology that affects the ability to execute the plan	Update the plan and notify each person or group with a role

The second row is the one most often forgotten: if the operations team, the managed services provider or the central firewall changes, the plan is updated even if no incident has occurred.

R4: who is notified and when

Notification goes to the E-ISAC (Electricity Information Sharing and Analysis Center) and, if the entity is subject to United States jurisdiction, to that country’s national cybersecurity center (NCCIC or its successor), unless prohibited by law.

Situation	Deadline for the initial notification
Reportable Cyber Security Incident	One hour after the determination
Attempt to compromise a covered system	By the end of the calendar day following the determination
New or changed information	Update within 7 calendar days

Initial notifications and updates include, at a minimum and to the extent known, three attributes: functional impact, attack vector and intrusion achieved or attempted.

What this means in a substation

A useful plan answers concrete operating questions, not only IT ones:

Who decides to disconnect a link to the control center, and how local operation continues meanwhile.
How the configurations of relays, gateways and switches are restored from verified backups. See IED and SCD configuration management.
What records exist to reconstruct what happened: time synchronization, event logs and network captures. See time synchronization in substations and intrusion detection in substation networks.
Which vendor staff can be called and with what access, coordinated with secure remote access.

Use outside North America

NERC CIP is not mandatory everywhere, and the recipients it names are North American bodies. What carries over is the structure: classification criteria, roles, notification deadlines, periodic tests and lessons learned. Local rules and utility requirements set the actual recipients and deadlines. The baseline configuration and the change and vulnerability management that CIP-010 requires are covered in NERC CIP-010: Change and Vulnerability Management.

Need to prepare your plan and exercise?

At Tiza Group we prepare the technical part of the response plan for substations and industry: equipment inventory, configuration backups, logs and access, within our substation and plant cybersecurity service. We quote according to the scope of your installation. How to put the plan together, with roles, escalation and annual tests, is covered in OT Incident Response Plan for a Substation.

References

NERC, CIP-008-6, Cyber Security – Incident Reporting and Response Planning: requirements R1 to R4.

Frequently asked questions

How often must the response plan be tested?

At least once every 15 calendar months. The test can be the response to a real Reportable Cyber Security Incident, a tabletop exercise of a Reportable Cyber Security Incident or an operational exercise. After the test there are 90 calendar days to document lessons learned and update the plan.

How soon must an incident be notified?

One hour after determining that it is a Reportable Cyber Security Incident. If it was an attempt to compromise a covered system, by the end of the calendar day after that determination. Updates, if the notified information changes, go within 7 calendar days.

What must the first notification contain?

At a minimum, and to the extent known: the functional impact, the attack vector used and the level of intrusion achieved or attempted.