> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/cip-011-2.md).
# CIP-011-2
Cyber Security - Information Protection
## Purpose
> To prevent unauthorized access to BES Cyber System Information by specifying information protection requirements in support of protecting BES Cyber Systems against compromise that could lead to misoperation or instability in the Bulk Electric System (BES).
## Sections and Standards
There are two requirements in CIP-011, with applicable requirement parts presented in tables. Below, the contents of each requirement are reproduced below under "Part" and "Requirement." "Product/Feature" indicates which Dispel product helps an organization comply to this requirement, and "Technical Supplement" details how this compliance is achieved.
### Requirement 1
> Each responsible Entity shall implement one or more documented information protection program(s) that collectively includes each of the applicable requirement parts in the CIP-011-2 Table R1 - Information Protection
#### Table R1 - Information Protection
| Part | Requirement | Product/Feature | Technical Supplement |
| ---- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| 1.1 | “Method(s) to identify information that meets the definition of BES Cyber System Information.” | Dispel documentation | Due to the compartmentalized nature of accounts at Dispel, this is met by simply documenting what a given network is protecting. Dispel is happy to provide customers with training to identify BES Cyber System Information when deploying Dispel networks. |
| 1.2 | “Procedure(s) for protecting and securely handling BES Cyber System Information, including storage, transit, and use.” | End-to-end encryption, Dispel documentation | Dispel’s products should be thought of as an enabler of 1.2. Standard-issue Dispel networks are single-tenant Moving Target Defense SD-WANs whose tunnels are encrypted with AES-256 using independent 4096-bit keys for the initial key exchange. |
| | | | |
### Requirement 2
> Each responsible Entity shall implement one or more documented processes that collectively include the applicable requirement parts in CIP-011-2 Table R2-BES Cyber Asset Reuse and Disposal
#### Table R2 - BES Cyber Asset Reuse and Disposal
| Part | Requirement | Product/Feature | Technical Supplement |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| 2.1-2 | (2.1) “Prior to the release for reuse of applicable Cyber Assets that contain BES Cyber System Information (except for reuse within other systems identified in the “Applicable Systems” column), the Responsible Entity shall take action to prevent the unauthorized retrieval of BES Cyber System Information from the Cyber Asset data storage media.”
(2.2) “Prior to the disposal of applicable Cyber Assets that contain BES Cyber System Information, the Responsible Entity shall take action to prevent the unauthorized retrieval of BES Cyber System Information from the Cyber Asset or destroy the data storage media.”
| Disposable components, automated network refreshes, virtual desktops | Dispel’s network infrastructure is made up of virtual machines. When destroying a virtual machine, the drives are zeroed before being released. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/cip-011-2.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.