1. 1 Remote Access Update ReliabilityFirst CIP Webinar Thursday, September 30, 2010 Lew Folkerth, Senior Engineer - Compliance

2. Activity Since Previous Webinar CAN-0005 Posted 6/22; Revised 7/6 “Identifying Critical Cyber Assets” approved by SC for posting 8/12 CIP-002-3 R3 RFI Posted for Comment 9/8 CIP-005-4 Posted for Initial Ballot 9/17 CIP-002-4 Posted for Comment 9/20 Guidance Document: “Secure Remote Access” Posted 9/21 2

3. CAN-0005 Available at: http://www.nerc.com/files/CAN- 0005_6Jul2010_CIP-002-3%20R3.pdfhttp://www.nerc.com/files/CAN- 0005_6Jul2010_CIP-002-3%20R3.pdf “System operator laptops with the capability and purpose of controlling Bulk Electric System assets remotely (whether in normal operations or in emergencies) should be designated as CCAs under CIP-002-3 Requirement R3.” Does not change audit practice for RFC audit teams – this is what we’ve been doing 3

4. “Identifying Critical Cyber Assets” Available at: http://www.nerc.com/fileUploads/File/Standards/Critcal% 20Cyber%20Asset_approved%20by%20CIPCl%20and %20SC%20for%20Posting%20with%20CIP-002- 1,%20CIP-002-2,%20CIP-002-3.pdf http://www.nerc.com/fileUploads/File/Standards/Critcal% 20Cyber%20Asset_approved%20by%20CIPCl%20and %20SC%20for%20Posting%20with%20CIP-002- 1,%20CIP-002-2,%20CIP-002-3.pdf Guidance (not a standard) on how to identify CCAs Approved by NERC BoT Standards Committee for posting as a reference document 4

5. CIP-002-3 R3 RFI Available at: http://www.nerc.com/docs/standards/sar/Interpre tation_2010-INT-05_Duke_RFI_CIP- 002_R3.docx http://www.nerc.com/docs/standards/sar/Interpre tation_2010-INT-05_Duke_RFI_CIP- 002_R3.docx Examples list in R3 is not prescriptive “The phrase ‘essential to the operation of the Critical Asset’ means that the Critical Cyber Asset is used to perform a function essential to the operation of the Critical Asset.” 5

6. CIP-005-4 Available Through Project 2010-15 Page: http://www.nerc.com/filez/standards/SAR- Urgent_Action_Revisions%20to%20CIP-005-3.html http://www.nerc.com/filez/standards/SAR- Urgent_Action_Revisions%20to%20CIP-005-3.html Removes old R2.4; R2.5 -> R2.4; R2.6 -> R2.5 Adds R6, “Remote Access Controls,” with four sub-requirements: R6.1: Procedural controls to authorize remote access R6.2: Technical controls for authorized remote access R6.3: Restrict protocols permitted R6.4: Implement an intermediate device 6

7. CIP-002-4 Available Through 706 Phase II Page: http://www.nerc.com/filez/standards/Project_200 8-06_Cyber_Security_PhaseII_Standards.html http://www.nerc.com/filez/standards/Project_200 8-06_Cyber_Security_PhaseII_Standards.html Completely changes the way in which Critical Assets are identified: Does away with risk-based assessment methodology Attachment 1 adds 16 criteria for determining Critical Assets 7

8. “Secure Remote Access” Available at: http://www.nerc.com/docs/standards/sar/S ecure_Remote_Access_Reference_Docu ment.pdf http://www.nerc.com/docs/standards/sar/S ecure_Remote_Access_Reference_Docu ment.pdf Addresses access for “maintenance and support” Based on issues raised in CIP Awareness Bulletin on VPNs (3/31/2010, FOUO) 8

9. Questions Questions should be emailed to Karen Yoder (karen.yoder@rfirst.org) Subject: “CIP WEBINAR”karen.yoder@rfirst.org Questions will be considered in the order they are received Clarifying questions are welcome and we will do our best to answer during the question period Challenges to a position should be addressed to the presenter and will be taken offline