United StatesNERC Reliability Standard CIP-008-6: Cyber Security Incident Reporting and Response Planning
NERC Reliability Standard CIP-008-6 (16 U.S.C. 824o)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Governance
What it requires
- This standard reaches your organization only if it is a balancing authority, reliability coordinator, transmission operator or owner, generator operator or owner, or a distribution provider that owns specified protection or restoration facilities, and it has BES Cyber Systems categorized as high impact or medium impact. Declare operates_essential_service where that holds; no role names an operator of the bulk electric system more closely.
- Document one or more Cyber Security Incident response plans that include a process to identify, classify and respond to Cyber Security Incidents, criteria to evaluate and define attempts to compromise, a process to determine whether an incident is a Reportable Cyber Security Incident or an attempt to compromise, and a process to give the notifications Requirement R4 requires.
- Notify the Electricity Information Sharing and Analysis Center and, if you are subject to the jurisdiction of the United States, the National Cybersecurity and Communications Integration Center or its successor, of a Reportable Cyber Security Incident and of a Cyber Security Incident that was an attempt to compromise a system in scope, unless prohibited by law.
- Give the initial notification within one hour after the determination of a Reportable Cyber Security Incident, and by the end of the next calendar day after the determination that a Cyber Security Incident was an attempt to compromise a system in scope.
- Include in each notification, to the extent known, the functional impact, the attack vector used and the level of intrusion that was achieved or attempted, and provide updates within 7 calendar days of determination of new or changed attribute information.
These lines are LexLint's reading of the law's text.
What this law does
Requirement R1 of CIP-008-6 requires each Responsible Entity to document one or more Cyber Security Incident response plans. The plans must include a process to determine whether an identified Cyber Security Incident is a Reportable Cyber Security Incident or an attempt to compromise a system in scope.
Requirement R4 requires each Responsible Entity to notify the Electricity Information Sharing and Analysis Center, and the National Cybersecurity and Communications Integration Center or its successor if subject to the jurisdiction of the United States, of a Reportable Cyber Security Incident and of a Cyber Security Incident that was an attempt to compromise a system in scope, unless prohibited by law.
The initial notification of a Reportable Cyber Security Incident is due one hour after the determination of the incident. The initial notification of an attempt to compromise a system in scope is due by the end of the next calendar day after the determination. Updates are due within 7 calendar days of determination of new or changed attribute information.
Initial notifications and updates must include the functional impact, the attack vector used and the level of intrusion that was achieved or attempted, to the extent known. A Responsible Entity that has no BES Cyber Systems categorized as high impact or medium impact is exempt from the standard.
Section 824o of title 16 requires all users, owners and operators of the bulk-power system, including the entities described in section 824(f) of that title, to comply with reliability standards that take effect under that section. CIP-008-6 is a mandatory standard subject to enforcement. CIP-008-6 is effective . CIP-008-7.1 is subject to future enforcement from .
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .