> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/medium-impact-bcs.md).
# Medium Impact BCS
Dispel’s Zero Trust Engine mapped to NERC CIP Medium controls to support audit-ready compliance.
{% hint style="info" %}
This guide is for informational purposes only. Dispel does not intend the information or recommendations in this guide to constitute legal advice. Each customer is responsible for independently evaluating its own particular use of the services as appropriate to support its legal and security compliance obligations.
{% endhint %}
## Overview
At Medium Impact, Dispel usually shows up in your NERC CIP program as:
* An **Electronic Access Control and Monitoring System (EACMS)** for BES Cyber Systems
* Sometimes also a **Protected Cyber Asset (PCA)** / jump host component
* A major source of **access control + logging evidence** for auditors
These primarily reside within the CIP-004, -005, -007, and -010 control families. In this document, we'll cover the following for each:
1. What the standard wants at Medium.
2. How Dispel typically aligns.
3. What auditors actually expect to see.
***
## Control Family Background
### CIP-004-7 – Cyber Security: Personnel & Training
#### **What CIP-004 wants (Medium BCS)**
CIP-004 focuses on *who* has access to BES Cyber Systems and BCSI, and whether they’re vetted and trained. Requirements are structured as documented processes plus evidence in Tables R1–R4 (security awareness, training, personnel risk assessments, access management, plus BCSI access) for Medium/High impact and associated PACS/EACMS.
#### **How Dispel aligns**
Dispel does **not** own CIP-004 for you, but it’s a key data source and control point:
* **Role-based access control (RBAC):**
* Dispel Zero Trust Engine (ZTE) enforces least-privilege roles/groups tied to BES Cyber Systems and sites.
* This supports your documented “who is authorized for cyber access to what” under CIP-004 R4 (Access Management).
* **Strong identity + MFA:**
* Central identity, MFA, and per-user accounts help prove that only trained/authorized individuals can gain interactive remote access.
* **Access review support:**
* ZTE can export user/role/asset mappings and historical access logs to feed your periodic CIP-004 access reviews and recertifications.
* **BCSI access:**
* If you store configs or diagrams inside Dispel-hosted jump hosts or file shares, then Dispel’s auth controls/logging become part of BCSI access control (R6).
#### **What auditors typically expect**
For CIP-004, auditors will want to see **your governance artifacts first**, with Dispel used as technical evidence:
* **Documented processes**:
* Security awareness program, role-based training program, PRA process, and access management procedures explicitly including vendor/remote access. [NERCipedia+1](https://nercipedia.com/active-standards/cip-004-7-cyber-security-personnel-training/?utm_source=chatgpt.com)
* **Training & PRA evidence** (you, not Dispel):
* Training records (LMS exports), PRA completion logs, job role to training mapping.
* **Access management evidence** where Dispel helps:
* User list from Dispel (showing BES-relevant roles)
* Example access approval tickets granting access that matches Dispel roles
* Access recertification reports using Dispel exports
* Evidence of timely revocation (user removed in HR system → disabled in IdP → removed from Dispel group)
Think of Dispel as: *“the system we point to when we show auditors that the access we approved on paper is what actually exists in production.”*
***
### CIP-005-7/-6 – Cyber Security: Electronic Security Perimeter(s)
#### **What CIP-005 wants (Medium BCS)**
CIP-005 manages cyber access into the **Electronic Security Perimeter (ESP)** and increases controls for **interactive remote access and vendor remote access**. Requirements include:
* **R1 – ESP & access points:** Define ESP and all access points to BES Cyber Systems.
* **R2 – Remote access management:** Strong control for interactive remote access and (now) all remote access, with auth, encryption, jump hosts, and logging.
#### **How Dispel aligns**
This is where Dispel is front-and-center.
Dispel ZTE typically functions as an **EACMS that enforces CIP-005**:
* **Electronic access control / perimeter enforcement (R1):**
* ZTE sits at the boundary of your OT networks and enforces connectivity via **micro-segmented, policy-driven tunnels**.
* Per-asset or per-zone policies effectively define and enforce your ESP access points for remote users.
* **Interactive Remote Access (IRA) & vendor RA (R2):**
* **MFA** + unique accounts for each user (no shared “vendor” accounts).
* **Encrypted tunnels** end-to-end (TLS/VPN), satisfying requirement for strong encryption. [TDi+1](https://www.tditechnologies.com/wp-content/uploads/2017/03/TDi-CIP-005-CIP-007-CIP-010_2-1.pdf?utm_source=chatgpt.com)
* **Intermediate/jump systems**: Users connect into a Dispel jump host/session first, then to BES Cyber Systems, aligning with “intermediate system” expectations in IRA guidance. [TDi](https://www.tditechnologies.com/wp-content/uploads/2017/03/TDi-CIP-005-CIP-007-CIP-010_2-1.pdf?utm_source=chatgpt.com)
* **Granular policy**: Rules restricting which BES systems/protocols each user, vendor, or role can touch.
* **Session logging/recording**: Central logs (and often full session replays) for all remote access into ESP.
* **Monitoring and alerting on access:**
* Central logging of connection attempts, failures, and disconnects to feed your SIEM and satisfy CIP-005 monitoring expectations.
#### **What auditors typically expect**
For CIP-005 with Dispel in scope, expect auditors to ask for:
1. **ESP / EACMS diagrams**
* Network diagrams showing where Dispel sits relative to Medium BCS, firewalls, and PACS.
2. **Documented process referencing Dispel:**
* Formal “Electronic Access Control and Monitoring” / “Remote Access Management” procedure that:
* Names Dispel as the required path for IRA/vendor RA
* States MFA requirement
* Describes use of jump hosts / intermediate systems
* Describes logging and retention.
3. **Config & policy evidence from Dispel:**
* Screenshots or exports showing:
* MFA enforcement and identity source
* Role-to-asset mapping or access policies
* Example vendor access configuration and expiration controls.
4. **Log and session evidence:**
* Sample **remote access log entries** demonstrating:
* Who connected
* From where
* When
* To which asset
* If available, a session recording demonstrating oversight.
5. **Change control linkage:**
* A couple of example changes to Dispel rules tied to your change tickets (this is where CIP-005 and CIP-010 start to blur in practice).
***
### CIP-007-6/-7 – Cyber Security: System Security Management
#### **What CIP-007 wants (Medium BCS)**
CIP-007 specifies technical and operational security controls: system hardening, patching, malware protection, account management, logging, and so on, for BES Cyber Systems and applicable EACMS/PACS/PCAs.
Key buckets:
* **R1 – System hardening** (ports, services, default accounts)
* **R2 – Patch management**
* **R3 – Malicious code prevention**
* **R4 – Security event logging**
* **R5 – User account management**
#### **How Dispel aligns**
For CIP-007, Dispel is in scope **for the systems we operate** (ZTE infrastructure, jump hosts, gateways) as EACMS/PCAs; your BES Cyber Systems and other hosts remain your responsibility.
Typical alignment:
* **R1 – Hardening:**
* Dispel-managed gateways and jump hosts run with **minimal exposed services**, locked-down management access, and hardened OS images.
* Protocol allow-lists and micro-segmentation rules limit traffic paths into BCS.
* **R2 – Patch management:**
* Dispel maintains a documented patch process for ZTE components and underlying OS packages (security updates prioritized, tested, and deployed within defined windows).
* Customer view: you maintain patching for in-plant servers/BCS; Dispel provides attestation or reports for ZTE components.
* **R3 – Malicious code prevention:**
* Anti-malware and/or application control on Dispel jump hosts, plus restrictions on file transfer paths into BCS.
* Ability to route traffic through inspection systems you manage (e.g., your AV/EDR stack).
* **R4 – Logging:**
* Dispel generates detailed event logs on:
* Auth success/failure
* Connection establishment/teardown
* Policy violations
* These can be shipped to your SIEM to meet “detect, alert, retain” expectations.
* **R5 – User access:**
* Centralized account lifecycle through SSO and MFA, role-based authorization, and periodic account review supported by exports.
#### **What auditors typically expect**
When Dispel is in scope for CIP-007, auditors will ask:
* **System inventory & applicability:**
* Which Dispel components are considered EACMS/PCAs supporting Medium BES Cyber Systems?
* **Hardening documentation:**
* A standard build / hardening guide for Dispel-managed nodes (closed ports, disallowed services).
* Evidence that deployed systems match that standard (screenshots, configs).
* **Patch management proof:**
* A patching policy with SLAs for security updates.
* Example patch reports or tickets showing updates to Dispel gateways/jump hosts.
* **Malware protection evidence:**
* Config screenshots/logs from AV/EDR on jump hosts (or documented technical rationale if compensated controls are used).
* **Logging & retention proof:**
* Config showing what’s logged and where logs go (local, SIEM).
* Sample security events and how alerts are generated and triaged.
* **User account lifecycle:**
* Evidence that account creation/removal in Dispel follows your CIP-004 and corporate IAM processes (joiner/mover/leaver, periodic reviews).
***
### CIP-010-4 – Configuration Change Management & Vulnerability Assessments
#### **What CIP-010 wants (Medium BCS)**
CIP-010-4 aims to **prevent and detect unauthorized changes** by requiring: baseline configurations, change management, configuration monitoring, and vulnerability assessments for BES Cyber Systems and applicable EACMS/PACS/PCAs. [Western Electricity Coordinating Council+3NERC+3NERCipedia+3](https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-010-4.pdf?utm_source=chatgpt.com)
Main themes:
* **R1 – Baseline configuration & change management**
* **R2 – Configuration monitoring (detecting deviations)**
* **R3 – Vulnerability assessments** (periodic and triggered by major changes)
#### **How Dispel aligns**
For Dispel, think of CIP-010 as governing **ZTE configuration and infrastructure** that controls your remote access:
* **Baselines for Dispel components (R1):**
* Defined “golden” configuration for:
* Gateways / nodes
* Policy sets (who can connect where, over what protocol)
* Logging and auth settings
* Dispel can expose config exports and/or architecture docs that define this baseline.
* **Change management (R1):**
* Change workflows for:
* Adding/modifying access policies (e.g., new vendor access, new plant asset)
* Upgrading Dispel software
* These changes should be tied to your enterprise change system (ticket IDs, approvals).
* **Configuration monitoring (R2):**
* Audit trails showing **who changed what and when** inside Dispel (policy edits, role changes, device additions).
* Integration with your monitoring/alerting stack so unexpected config changes on ZTE are visible quickly. [spp.org+1](https://www.spp.org/documents/22759/cip-010_change_mgmt_video.pdf?utm_source=chatgpt.com)
* **Vulnerability management (R3):**
* Dispel’s own vuln scanning and remediation program for ZTE, and/or your independent scans of the deployed components.
* Treatment of vendor advisories and CVEs as “triggering events” that lead to assessments and updates.
#### **What auditors typically expect**
For CIP-010 with Dispel as EACMS:
* **Baseline documentation:**
* A configuration baseline that includes:
* Software/firmware versions
* Enabled services
* Auth and logging settings
* A defined set of security-relevant parameters for gateways/jump hosts. [spp.org+1](https://www.spp.org/documents/22759/cip-010_change_mgmt_video.pdf?utm_source=chatgpt.com)
* **Change records:**
* Examples where Dispel policies or components changed:
* Change ticket
* Risk assessment (if applicable)
* Approvals
* Implementation evidence (Dispel config diff, screenshots, or exports).
* **Monitoring evidence:**
* Logs or reports showing:
* Configuration change events detected by Dispel or your monitoring tools
* How unexpected/unauthorized changes would trigger an alert.
* **Vulnerability assessment proof:**
* Periodic vuln assessment / penetration test reports covering Dispel components in scope.
* Documented remediation or risk acceptance and timelines.
***
## **Dispel Control Alignment Roles & Responsibilities**
{% hint style="info" %}
#### **Legend**
* **Customer Responsibility:** You own the control.
* **Dispel Responsibility:** Dispel provides the technical control for its managed components.
* **Shared Responsibility:** Both parties participate (e.g., customer governance + Dispel technical enforcement).
{% endhint %}
#### **CIP-004 — Personnel & Training**
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| **CIP-004-R1 Security Awareness** | Maintain documented program and provide annual training to personnel. | N/A | N/A |
| **CIP-004-R2 Training for Personnel with Access** | Ensure all users (internal + vendor) are trained before access is granted. Maintain training records. | Provide materials describing Dispel’s system security features as needed for customer training. | Customer validates that only trained personnel are provisioned in Dispel. |
| **CIP-004-R3 Personnel Risk Assessment (PRA)** | Conduct PRA for personnel with cyber/BCSI access. Keep documentation. | N/A | N/A |
| **CIP-004-R4 Access Management** | Approve access, define roles, maintain access request records, ensure timely revocation. | Enforce role-based access control (RBAC), MFA, and identity requirements within the Dispel platform. Provide audit logs/evidence. | Access reviews performed using Dispel user/role reports. |
| **CIP-004-R6 BCSI Access Management** | Classify BCSI, maintain BCSI handling procedures. | Provide access control and logging for BCSI stored or transiting within Dispel-controlled jump hosts or file paths. | Customer ensures BCSI stored in Dispel follows their governance. |
#### **CIP-005 — Electronic Security Perimeter(s)**
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| --------------------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| **CIP-005-R1 ESP & Access Points** | Identify BES Cyber Systems and define the ESP. Document all Electronic Access Points (EAPs). | Provide ZTE (gateways, nodes, access controllers) as EACMS enforcing perimeter and controlling electronic access. | Customer integrates network diagrams showing Dispel as exclusive remote access path into ESP. |
| **CIP-005-R1.2 Access Control** | Ensure governance and procedures exist for EA control. | Enforce connection rules, protocol allow-lists, micro-segmentation, user-to-asset permissions. | Customer validates Dispel rules align with approved access rights. |
| **CIP-005-R2 Remote Access Management** | Document IRA and vendor RA procedures, including MFA and intermediate system requirements. | Provide MFA enforcement, encrypted tunnels, intermediate/jump systems, granular policy, full logging, session recording (when enabled). | Both parties ensure remote users follow approved RA processes; customer maintains RA approvals. |
| **CIP-005-R2.2 Logging & Monitoring** | Define log review, incident response, and retention governance. | Produce complete audit logs of connections, auth attempts, disconnections, and policy violations; export to SIEM. | Customer reviews, correlates, and stores logs per retention schedule. |
#### **CIP-007 — System Security Management**
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| ---------------------------------------- | ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **CIP-007-R1 System Hardening** | Maintain hardening standards for BES Cyber Systems and customer-operated EACMS/PCAs. | Maintain hardened configurations for Dispel-managed gateways, jump hosts, services, ports, logging, and OS security. | Customer validates placement of Dispel components and ensures compensating controls meet policy. |
| **CIP-007-R2 Security Patch Management** | Maintain patch process for BES Cyber Systems; review vendor patches. | Maintain patch program for Dispel components. Provide patching cadence documentation or attestation. | Customer tracks changes to Dispel components through change management. |
| **CIP-007-R3 Malicious Code Prevention** | Deploy and manage malware protection for BES Cyber Systems and internal jump hosts. | Maintain malware defenses and application control for Dispel-managed jump hosts and endpoints. | Where file transfer is used, both parties coordinate malware scanning. |
| **CIP-007-R4 Logging** | Define log review procedure, SIEM retention, and alerting workflow. | Generate logs for auth events, remote access sessions, security events, and retain as configured. Support log export. | Customer aggregates logs, correlates events, and maintains retention schedule. |
| **CIP-007-R5 Account Management** | Ensure user approvals, recertification, joiner/mover/leaver processes, and access removals. | Enforce MFA, unique accounts, RBAC, disablement, and logging of changes within Dispel. | Access reviews combine corporate IAM system with Dispel exports. |
#### **CIP-010 — Configuration Change Management & Vulnerability Assessments**
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| ---------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
| **CIP-010-R1 Baseline Configurations** | Maintain baseline configurations for BES Cyber Systems and customer-managed EACMS. | Maintain Dispel-specific baselines for ZTE gateways, jump hosts, authentication settings, and logging parameters. Provide baseline documentation on request. | Customer documents that Dispel components support the approved baseline and are tracked in asset inventory. |
| **CIP-010-R1 Change Management** | Maintain change documentation, approvals, risk assessments, and implementation evidence. | Maintain change documentation for Dispel software updates and infrastructure modifications. Provide change evidence on request. | Customer includes Dispel configuration policy changes within their enterprise change workflow (ticket linkage). |
| **CIP-010-R2 Configuration Monitoring** | Monitor configuration changes on BES Cyber Systems and customer EACMS. | Log administrative/user policy changes, access control changes, and configuration modifications within Dispel. Provide alerting outputs. | Customer reviews alerts and performs root cause analysis. |
| **CIP-010-R3 Vulnerability Assessments** | Conduct periodic and triggered VA on BES Cyber Systems and customer EACMS. | Perform vulnerability scanning and remediation for Dispel components; provide reports/attestations. | Customer includes Dispel infrastructure within their vendor-risk and CIP-013 processes. |
#### **CIP-011 — Information Protection** *(Common Auditor Tie-In)*
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| ------------------------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| **CIP-011-R1 BCSI Protection** | Classify, label, and manage BCSI according to documented process. | Provide access control and audit logging over BCSI stored or transferred inside Dispel jump hosts or remote access paths. | Customer ensures BCSI in Dispel follows corporate handling and storage policies. |
| **CIP-011-R2 Secure Disposal** | Securely destroy BCSI in accordance with policy. | Provide secure deletion options for Dispel-managed storage as applicable. | Customer validates disposal actions.
|
#### **CIP-013 — Supply Chain Cyber Security Risk Management** *(Always Asked for Vendor Controls)*
| CIP Requirement | Customer Responsibility | Dispel Responsibility | Shared Responsibility |
| ------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------- |
| **CIP-013-R1 Vendor Risk Management** | Maintain vendor-risk process, evaluate vendors, maintain contracts & SLAs. | Maintain secure development lifecycle, vulnerability management, SOC 2/ISO certifications, and provide security documentation. | Customer assures Dispel security posture meets procurement controls and risk acceptance thresholds. |
| **CIP-013-R2 Procurement Controls** | Include required language in contracts. | Provide required security and notification obligations (e.g., incident response, patching notifications). | Ensure bilateral responsibilities are contractually clear. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.dispel.com/regulatory-framework-mappings/nerc-cip/medium-impact-bcs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.