United StatesNERC Reliability Standard CIP-013-2: Cyber Security Supply Chain Risk Management
NERC Reliability Standard CIP-013-2 (16 U.S.C. 824o)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Governance, Security
What it requires
- This standard reaches your organization only if it is a balancing authority, reliability coordinator, transmission operator or owner, generator operator or owner, or a distribution provider that owns specified protection or restoration facilities, and it has BES Cyber Systems categorized as high impact or medium impact. Declare operates_essential_service where that holds; no role names an operator of the bulk electric system more closely. A vendor that sells software or services to such an entity is not bound by the standard itself and meets it through the buyer's procurement process.
- Develop one or more documented supply chain cyber security risk management plans for your high and medium impact BES Cyber Systems and their associated Electronic Access Control or Monitoring Systems and Physical Access Control Systems, including processes to identify and assess the cyber security risk of vendor products and services you procure and install and of transitions from one vendor to another.
- Include in the processes you use to procure those systems the vendor's notification of vendor-identified incidents, coordination of responses to them, notification when remote or onsite access should no longer be granted, disclosure of known vulnerabilities, verification of the integrity and authenticity of software and patches, and coordination of vendor-initiated remote access, as applicable.
- Implement the plans, without renegotiating or abrogating existing contracts, and review them and obtain approval of the CIP Senior Manager or a delegate at least once every 15 calendar months.
These lines are LexLint's reading of the law's text.
What this law does
Requirement R1 of CIP-013-2 requires each Responsible Entity to develop one or more documented supply chain cyber security risk management plans for high and medium impact BES Cyber Systems and their associated Electronic Access Control or Monitoring Systems and Physical Access Control Systems.
The plans must include processes used in procuring those systems that address notification by the vendor of vendor-identified incidents related to the products or services provided to the Responsible Entity that pose cyber security risk to it. The plans must also address disclosure by vendors of known vulnerabilities related to the products or services provided to the Responsible Entity.
The plans must also address verification of software integrity and authenticity of all software and patches provided by the vendor for use in the BES Cyber System and its associated Electronic Access Control or Monitoring Systems and Physical Access Control Systems. Requirement R2 requires each Responsible Entity to implement its supply chain cyber security risk management plans. Implementation of the plan does not require the Responsible Entity to renegotiate or abrogate existing contracts.
The actual terms and conditions of a procurement contract, and vendor performance and adherence to a contract, are beyond the scope of Requirement R2. Requirement R3 requires each Responsible Entity to review and obtain CIP Senior Manager or delegate approval of its plans at least once every 15 calendar months. A Responsible Entity that has no BES Cyber Systems categorized as high impact or medium impact is exempt from the standard.
Section 824o of title 16 requires all users, owners and operators of the bulk-power system, including the entities described in section 824(f) of that title, to comply with reliability standards that take effect under that section. CIP-013-2 is a mandatory standard subject to enforcement. CIP-013-2 is effective . CIP-013-3 is subject to future enforcement from .
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .