> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/additional-sections.md). # Additional Sections A quick summary of NERC CIP standards not previously discussed. ### CIP-002-5.1 Cyber Security — BES Cyber System Categorization CIP-002-5.1 provides criteria for applicable Responsible Entities to categorize their BES Cyber Systems based on the impact of their associated facilities, systems, and equipment, which, if impaired, would affect the Bulk Electric System's ability to operate. The scope of these standards is limited to BES Cyber Systems, which, "if rendered unavailable, degraded, or misused, would adversely impact the reliable operation of the BES within 15 minutes of the activation or exercise of the compromise." Notably, in Version 4, BES Cyber Systems were previously referred to as Critical Cyber Assets. ### CIP-003-7 Cyber Security — Security Management Controls CIP-003-7 aims to protect BES Cyber Systems by specifying consistent and sustainable security management controls that establish responsibility and accountability. Responsibile Entities are required to review and maintain CIP Senior Manager approval at least once every 15 calendar months for one or more documented cyber security policies obtained from a list of topics. Depending on the specific type of facilities, equipment or system, or subset of such, these requirements vary. ### CIP-004-6 Cyber Security – Personnel & Training CIP-004-6 serves to minimize risk against compromise in BES Cyber Systems. Misoperation or instability from individuals accessing BES Cyber Systems can be mitigated through requiring an appropriate amount of personnel risk assessment, training, and security awareness. Requirements for training content include topics such as cyber security policies, physical and electronic access controls, the visitor control program, handling and storage of BES Cyber System information, etc. ### CIP-008-5 Cyber Security — Incident Reporting and Response Planning CIP-008-5 specifies incident response requirements in order to mitigate the risk of a Cyber Security Incident on the reliable operation of the BES Cyber System. The Cyber Security Response Plan requirements discussed are listed with corresponding applicable systems and necessary measures to be taken. Response Plan requirements include identifying, classifying, and responding to Cyber Security Incidents and establishing the roles of response groups and individuals. ### CIP-008-6 Cyber Security — Incident Reporting and Response Planning (Future Enforcement) CIP-008-6 requires Responsible Entities to develop and implement Cyber Security Incident response plans to detect and protect against incidents that affect BES Cyber Systems. This standard specifies processes and procedures to be included in response plans, as well as actions related to implementation, testing, maintence, and reporting related to such response plans. CIP-008-6 differs from CIP 008-5 by broadening the mandatory reporting of Cyber Security Incidents to include compromises or attempts to compromise BES Cyber Systems or their associated ESPs or EACMS. ### CIP-009-6 Cyber Security — Recovery Plans for BES Cyber Systems CIP-009-6 aims to specify recovery plan requirements to recover reliability functions performed by BES Cyber Systems. The Recovery Plan Specifications list the applicable systems, along with measures to be taken. Examples of Recovery Plan Requirements include: conditions for activation of recovery plans, roles and responsibilities of responders, and processes for the backup and storage of information required to recover BES Cyber System functionality. ### CIP-010-2 Cyber Security — Configuration Change Management and Vulnerability Assessments CIP-010-2 specifies configuration change management and vulnerability assessment requirements in order to prevent and detect unauthorized changes to BES Cyber Systems. The Configuration Change Management Requirements list corresponding applicable systems, as well as necessary measures to be taken. Examples of Configuration Change Management Requirements provided in this standard include: developing a baseline configuration, authorizing/documenting changes that deviate from the baseline configuration, and updating the baseline configuring as necessary within 30 days of completing a change that deviates from the existing baseline configuration. ### CIP-010-3 Cyber Security — Configuration Change Management and Vulnerability Assessments (Future Enforcement) CIP-010-3 is similar to CIP-010-2 in that it aims to prevent and detect unauthorized changes to BES Cyber Systems by specifying configuration change management and vulnerability assessment requirements. The modification unique to CIP-010-3 lies in Requirement Part 1.6, which covers all changes that deviate from an existing baseline configuration associated with baseline items in operating systems, commercially available or open-source application software, and security patches applied. In order for baseline changes to occur, entities must verify the identity of the software source, and verify the integrity of the software obtained from the software source. ### --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/additional-sections.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.