The extension of the NERC CIPv5 deadline to July 2016 means that registered entities have gained a small window of time for their compliance projects, but they now face a combined compliance deadline for CIPv5 and CIPv6 in July. Nick Santora, CEO of Curricula, and Tim Erlin, Director of IT Risk & Security Strategist at Tripwire, discuss the potential impact of CIPv6 on your organization and how to balance these requirements with your CIPv5 compliance efforts. Nick brings his seven years of experience working with NERC on over 100 NERC CIP compliance programs to the table to analyze CIPv6, and the extended CIPv5 deadline. You will learn: • What the CIPv6 changes mean for your organization. • How CIPv6 impacts your personnel • 3 critical steps you should take before the July deadline.

2. nick@getcurricula.com
terlin@tripwire.com

5. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2

6. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2

7. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2

8. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2
If you use transient cyber assets and removable media ….

9. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2
If you use transient cyber assets and removable media ….

10. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2
If you can’t implement the required physical controls, you can implement compensating
logical controls:
- Encryption
- Monitoring
- “an equally effective logical control”
“The entity is under no obligation to justify or explain why it chose logical
protections over physical protections identified in the requirement.”

11. • CIP 003-6 • CIP-004-6
• CIP-010-2
• CIP-006-6 • CIP-004-6
• CIP-007-6
• CIP-009-6
• CIP-011-2
FERC Order 791:
“[T]he Commission is concerned that the proposed language is overly-vague, lacking
basic definition and guidance that is needed, for example, to distinguish a successful
internal control program from one that is inadequate.”

12. CIP-003-6 1.2 4/1/2017
CIP-003-6 R2 4/1/2017
CIP-003-6 A1-1 4/1/2017
CIP-003-6 A1-2 9/1/2018
CIP-003-6 A1-3 9/1/2018
CIP-003-6 A1-4 4/1/2017
CIP-006-6 1.10 7/1/2016 or 4/1/2017
CIP-007-6 1.2 7/1/2016 or 4/1/2017
CIP-010-2 R4 4/1/2017
Conditional Deadlines

13. •
•
•
•

18. WECC Presentation

33. tripwire.com | @TripwireInc