Dispel Wicket ESIs allow administrators to whitelist not only IP addresses and ranges, but also specific ports and ranges thereof.
Please see Visual 6A for reference
| | 1.2 | “Protect against the use of unnecessary physical input/output ports used for network connectivity, console commands, or Removable Media.” | Wicket ESI | For customers who want to meet both the spirit and letter of CIP-007-6, Dispel recommends placing a Wicket ESI physically next to the PCI/HMI equipment, and placing all of said equipment into a locked, alarmed cage. | ### Requirement 2 > Each responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 - Security Patch Management. #### Table R2 - Security Patch Management | Part | Requirement | Product/Feature | Technical Supplement | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 2.1-4 |(2.1) “A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets.”
(2.2) “At least once every 35 calendar days, evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1”
(2.3) “For applicable patches identified in part 2.2, within 35 calendar days of the evaluation completion, take one of the following actions: Apply the applicable patches; or create a dated mitigation plan; or revise an existing mitigation plan. Mitigation plans shall include the Responsible Entity’s planned actions to mitigate vulnerabilities addressed by each security patch and a timeframe to complete these mitigations.
(2.4) “For each mitigation plan created or revised in Part 2.3, implement the plan within the timeframe specified in the plan, unless a revision to the plan or an extension to the timeframe specified in Part 2.3 is approved by the CIP Senior Manager or delegate.
| Cycling virtual components, automated network refreshes, automatic patching and updating | Dispel launches its virtual components with the latest patches each time the network is refreshed (often, at a minimum, daily). For customers that desire support in patching and tracking of underlying assets, Dispel is happy to provide upkeep as a managed service. | ### Requirement 3 > Each responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R3 - Malicious Code Prevention. #### Table R3 - Malicious Code Prevention | Part | Requirement | Product/Feature | Technical Supplement | | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 3.1 | “Deploy method(s) to deter, detect, or prevent malicious code. | Moving Target Defense networks, traffic logs |For deterrence and prevention, all Dispel networks are Moving Target Defense SD-WANs. For detection, all of our components speak syslog which can be tied back to a firewall or SEIM.
Please see Visual 6B for reference
| | 3.2 | “Mitigate the threat of detected malicious code.” | Disposable components, golden images | As a preventative measure, all Dispel components can be scheduled to self-destruct and rebuild periodically from golden images. If malicious code is detected between periodic refreshes, components can be manually destroyed and replaced from the Admin Console. | | 3.3 | “For those methods identified in Part 3.1 that use signatures or patterns, have a process for the update of the signatures or patterns. The process must address testing and installing the signatures or patterns. | Traffic log data | In reference to 3.1, if Dispel has embedded a Layer 7 firewall into its network, new patterns are passed to it according to the specifications of the firewall vendor. | ### Requirement 4 > Each responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R4 - Security Event Monitoring. #### Table R4 - Security Event Monitoring | Part | Requirement | Product/Feature | Technical Supplement | | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 4.1 | “Log events at the BES (Bulk Electric System) Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Asset capability) for identification of, and after-the-fact investigations of, Cyber Security Incidents that includes, as a minimum, each of the following types of events: 4.1.1. Detected successful login attempts; 4.1.2. Detected failed access attempts and failed login attempts; 4.1.3 Detected malicious code. | Log server, traffic logs, audit database | Dispel places a log server within each of their networks. The Customer is able to pull these logs to their SEIM. We also have an audit database of login attempts, including successful and unsuccessful logins at the engine level. | | 4.2 | “Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): 4.2.1. Detected malicious code from Part 4.1; and 4.2.2. Detected failure of Part 4.1 event logging. | Dispel Partner Network | Dispel is happy to provide this as a service through its partner network, should the customer not already have a working solution. | ### Requirement 5 > Each responsible Entity shall implement one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R5 - System Access Controls. #### Table R5 - System Access Controls | Part | Requirement | Product/Feature | Technical Supplement | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 5.1-3 |(5.1) “Have a method(s) to enforce authentication of interactive user access, where technically feasible.
(5.2) “Identify and inventory all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s).
(5.3) “Identify individuals who have authorized access to shared accounts.”
| Dispel console, multi-factor authentication, virtual desktops, disposable components |The Dispel Dashboard allows administrators to enforce access rights, segment what is visible to each user, and require multi-factor authentication. Additionally, the Dashboard can manage virtual desktops, provision virtual desktops to third parties, and remove desktop access by destroying the desktop once the work is completed.
Please see Visual 6C for reference
| | 5.4-7 |(5.4) “Change known default passwords, per Cyber Asset capability.”
(5.5) “For password-only authentication for interactive user access, either technically or procedurally enforce the following password parameters: 5.5.1. Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and 5.5.2. Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, non-alphanumeric) or the maximum complexity supported by the Cyber Asset.”
(5.6) “Where technically feasible, for password-only authentication for interactive user access, either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months.”
(5.7) “Where technically feasible, either: Limit the number of unsuccessful authentication attempts; or Generate alerts after a threshold of unsuccessful authentication attempts.”
| AD integration, Dispel password requirements | For those who are not using an AD integration, Dispel’s password strength requirements are: at least 8 characters, 1 number, 1 uppercase, and 1 special character. Dispel does not allow more than six unsuccessful login attempts. | ### Visual References #### 6A (Section 1.1)  #### 6B (Section 3.1)   #### 6C (Section 5.1-3)  --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/cip-007-6.md?ask=