A Dispel Wicket ESI acts as both the ESP and EAP (Electronic Access Point) for cyber assets. To be accessible, a cyber asset must be deliberately assigned to a whitelist by an Administrator.
Please see Visual 5A for reference
| | 1.2 | “All External Routable Connectivity must be through an identified Electronic Access Point (EAP).” | Wicket ESI | Dispel’s Wicket ESIs act as network EAPs. As part of the installation process, Dispel and the customer conduct a network audit to confirm that all outbound traffic must pass through the Wicket ESI. | | 1.3 | “Require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default.” | Dispel console, proactive access management portal, LDAP Integration, Wicket |Inbound access permissions can be toggled by administrators through the Dispel Dashboard. Assigning users to Regions and Facilities for access is a proactive process, and can be made contingent upon a prior manual approval step. Outbound access is rarely needed, in practice, but can be activated by an administrator on a case by case basis on the Wicket ESI.
Depending upon the situation at the customer site, Dispel will either tie to a pre-existing LDAP system reflecting the appropriate access permissioning process or provide the customer with a custom form approval process embedded in the Dispel web portal.
| | 1.4 | “Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.” | Identity controller, multi-factor authentication, Enclave, Wicket | Dispel Wickets, the network EAPs for connected cyber assets, perform authentication while connecting through any backhaul, including dial-up. | | 1.5 | “Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications.” | Traffic logging, hyper-quiet network segmentation | All of the components in a Dispel network speak syslog and can be tied back to a SEIM. As an observation, Dispel remote access networks are both single-tenant and, in ICS settings, single-purpose which makes them hyper-quiet. While most customers choose to place Dispel’s Wickets ahead of their pre-existing security stack, Dispel can also embed Layer 7 firewalls in the virtual networks provided by any of the major commercial cloud providers. | ### Requirement 2 > Each Responsible Entity allowing Interactive Remote Access to BES Cyber Systems shall implement one or more document processes that collectively include the applicable requirement parts, where technically feasible, in CIP-005-5 Table R2 - Interactive Remote Access Management. #### Table R2 - Interactive Remote Access Management | Part | Requirement | Product/Feature | Technical Supplement | | ---- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 2.1 | “Utilize an Intermediate System such that the Cyber Asset initiating Interactive Remote Access does not directly access an applicable Cyber Asset.” | Virtual desktops, automatic updating and patching |Dispel’s Virtual Desktops, which are spun up in Regions and assigned by Administrators, act as the Intermediate System. Virtual Desktops ensure that all computers accessing cyber assets are in the Administrator’s control.
Please see Visual 5B for reference
| | 2.2 | “For all Interactive Remote Access sessions, utilize encryption that terminates at an Intermediate System.” | End-to-end encryption, Enclave | All traffic drops out of an encrypted state at the Virtual Desktop used as the Intermediate System. | | 2.3 | “Require multi-factor authentication for all Interactive Remote Access sessions.” | Multi-factor authentication, temporary one time passwords, hardware tokens, AD integration |Dispel’s networks come with user access controls which support and enforce multi-factor authentication through either Temporary One Time Password or Hardware Tokens.
Please see Visual 5C for reference
| ### Visual References #### 5A (Section 1.1)  #### 5B (Section 2.1)  #### 5C (Section 2.3)  --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/cip-005-05.md?ask=