Appropriate security measures for smart grids

Guidelines to assess the sophistication of security measures implementation [2012-12-06]

Appropriate security measures for smart grids I DOCUMENT HISTORY Date Version Modification Author 21.09.2012 1.0 Preliminary draft structure Deloitte (Dan Cimpean, Pedro Cano, Fernando García) 01.10.2012 1.1 Comments on the preliminary ENISA (Konstantinos Moulinos, draft Thomas Haeberlen) 11.10.2012 1.2 Updated Version Deloitte (Dan Cimpean, Pedro Cano, Fernando García) 11.10.2012 1.3 Updated Version Deloitte (Dan Cimpean, Pedro Cano) 11.10.2012 1.4 Updated Version Deloitte (Dan Cimpean, Pedro Cano, Fernando García) 22.10.2012 1.5 Updated Version Deloitte (Dan Cimpean, Pedro Cano) 23.10.2012 1.5.1 Comments on the draft ENISA (Konstantinos Moulinos, Thomas Haeberlen) 22.11.2012 1.6 Updated Version Deloitte (Dan Cimpean, Pedro Cano; Fernando García) 06.12.2012 1.7 Final Version Deloitte (Dan Cimpean, Pedro Cano; Fernando García) II Appropriate security measures for smart grids Contributors to this report ENISA would like to recognise the contribution of the Deloitte team members that prepared this report in collaboration with and on behalf of ENISA:  Dan Cimpean;  Pedro Cano Bernaldo de Quirós;  Fernando García Gutiérrez. About ENISA The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at http://www.enisa.europa.eu. Contact details For contacting ENISA or for general enquiries on Critical Information Infrastructure Protection, please use the following details:  E-mail: resilience@enisa.europa.eu  Internet: http://www.enisa.europa.eu For questions related to Minimum Security Measures for Smart Grids, please use the following details:  Dr Konstantinos MOULINOS, Expert in Network & Information Security - Resilience and CIIP, European Network and Information Security Agency - ENISA  Address: Vassilika Vouton, GR-70013 Heraklion, Greece  Email: resilience@enisa.europa.eu Follow us on Facebook: http://www.facebook.com/ENISAEUAGENCY Twitter: https://twitter.com/enisa_eu LinkedIn: http://www.linkedin.com/company/european-network-and-informationsecurity-agency-enisa Youtube: https://www.youtube.com/user/ENISAvideos RSS feeds: http://www.enisa.europa.eu/front-page/RSS Appropriate security measures for smart grids III Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004 as lastly amended by Regulation (EU) No 580/2011. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012 6 Appropriate security measures for smart grids Preface The development of an efficient, reliable and sustainable environment for the production and distribution of energy in the future is linked to the use of smart grids. Various market drivers, regulatory or standardisation initiatives have appeared or gained importance as tools to help involved stakeholders to be prepared against smart grids security vulnerabilities and attacks. The perception and the approach taken on this topic differ among stakeholders. This underlines the importance of the stakeholder’s alignment on the key aspects related to the smart grid security. The European Network and Information Security Agency (ENISA) has decided to further investigate the challenges of ensuring an adequate smart grid protection in Europe, in order to help smart grid providers to improve the security and the resilience of their infrastructures and services. Defining a common approach to addressing smart grid cyber security measures will help achieve this. This technical document provides guidance to smart grid stakeholders by providing a set of minimum security measures which might help in improving the minimum level of their cyber security services. The proposed security measures are organised into three (3) sophistication levels and ten (10) domains, namely: 1. Security governance & risk management; 2. Management of third parties; 3. Secure lifecycle process for smart grid components/systems and operating procedures; 4. Personnel security, awareness and training; 5. Incident response & information knowledge sharing; 6. Audit and accountability; 7. Continuity of operations; 8. Physical security; 9. Information systems security; and 10. Network security. The adoption of a particular set of security measures needs the consensus and cooperation of various stakeholders in the smart grid community. A coordination initiative could allow a common and generally accepted approach to addressing smart grid security issues. Moreover, the development of a common approach to addressing smart grid cyber security measures will help not only regulators by harmonising the complex smart grid’s environment but also by providing incentives to other involved stakeholders to continuously strive for the improvement of their cyber security. Appropriate security measures for smart grids 7 1 Introduction This document describes a set of security measures which are considered to be appropriate for smart grids. ENISA issued this report in order to assist the Member States and smart grid stakeholders in providing a framework/measurement tool that could be used for:  Aligning the varying levels of security and resilience of the market operators with a consistent minimum framework;  Providing an indication of a minimum level of security and resilience in the Member States with regards to the smart grids, thereby avoiding the creation of the “weakest link”;  Ensuring a minimum level of harmonisation on security and resilience requirements for smart grids across Member States and thus reducing compliance and operational costs;  Setting the basis for a minimum auditable framework of controls across Europe;  Facilitating the establishment of common preparedness, recovery and response measures and pave the way for mutual aid assistance across operators during crisis;  Contributing to achieve an adequate level of transparency in the internal market. 1.1 Background European energy targets The European Union has established very ambitious objectives for 2020: 20% of renewable energy penetration, 20% of CO2 emissions reduction and an increase of 20% in energy efficiency. A key issue, in order to achieve these targets, is the effective integration of the distributed renewable energy generation into current and future electricity grids (smart grids): not only innovative technical solutions are required, but also new suitable regulatory and economic schemes at European scale. In order to achieve the defined objectives and the future vision of the energy market in Europe, an increase in the efficiency, reliability, quality and safety of the European electricity system is needed. In this context, the Strategic Energy Technology Plan (SET Plan) establishes the key goals focused on the overall energy research effort in Europe. Until recently, the installed capacity of distributed generation in Europe was too low to be a critical issue in the management of the electricity distribution network. The new advances imply an increasing use of the desirable renewable energy sources and, therefore, progressively lower costs per installed power capacity. Technical advances, environmental improvement and control wished by citizens and the European Union’s commitment to the Kyoto Protocol are drivers that have positioned smart grids as an alternative to manage the increasing distributed generation and the involved challenges. 8 Appropriate security measures for smart grids Smart grids security Smart grids have been defined by the European Smart Grid Task Force (set up by the European Commission at the end of 2009) as “electricity networks that can efficiently integrate the behaviour and actions of all users connected to it - generators, consumers and those that do both - in order to ensure an economically efficient, sustainable power system with low losses and high levels of quality and security of supply”. Smart grids have an essential role in the process concerning the integration of variable distributed resources in the electricity networks (key driver to get 2020 targets) and providing a user-oriented service, supporting the achievement of these targets. Current developments on the power networks, such as digital communication between supplier and consumer, intelligent metering and monitoring systems, will allow smart grids to improve the control over electricity consumption and distribution substantially to the benefit of consumers, electricity suppliers and grid operators. Moreover, not only advanced Information and Communication Technologies (ICT) are at the core of an effective smart grid implementation. Also industrial control systems (ICS) and related operational technology (OT) need to be taken into account. All processes across the whole value chain are heavily based on these infrastructures and technologies. Smart grids give clear advantages and benefits to the whole society, but the dependency on ICT components (e.g. computer networks, intelligent devices, etc.), ICS (e.g. supervisory control and data acquisition systems, distributed control system, etc.), OT (e.g. firmware, operating systems, etc.) and the internet makes our society more vulnerable to malicious attacks with potentially devastating results on smart grids. This can happen in particular because vulnerabilities in smart grid related communication networks and information systems may be exploited for financial or political motivation to shut off power to large areas or directing cyber-attacks against power generation plants. The Commission published the “Standardization Mandate to European Standardisation st Organisations (ESOs) to support European Smart Grid deployment” on March 1 of 2011, in which it defined a standardisation mandate to support European Smart Grid deployment. This document is a starting point for the normalisation of energy interoperability and will enable or facilitate the implementation in Europe of the different high level smart grid services and functionalities. Regarding security issues, the mandate states “A secure and robust energy network is essential for the continuous improvement and industrious operation of the European energy markets. This will only be possible if the associated information and communication networks are secure and robust. It is also essential to maintain data and system security and to respect the rights of end consumers as well as the fundamental rights and freedoms of natural persons.” Moreover, the “Commission Recommendation of 9 March 2012, on preparations for the rollout of smart metering systems , (2012/148/EU)” in its article 27 notes that “Member States should ensure that network operators identify security risks and the appropriate security Appropriate security measures for smart grids 9 measures to guarantee the adequate level of security and resilience of the smart metering systems. In this regard, network operators, in cooperation with national competent authorities and civil society organisations, should apply existing standards, guidelines and schemes and where not available develop a new one. Relevant guidelines published by the European Network Information and Security Agency (ENISA) should also be taken into account.” 1.2 Scope This technical guidance addresses smart grid networks and services which are critical and whose malfunctioning would have a significant impact on society. Data privacy issues, however, are considered out of scope of this document. 1.3 Target audience The present document is focused on the following actors:  Legislator(s) and the regulator(s) at various levels (EU, Member State);  Distribution system operators (DSO);  Transmission system operators (TSO);  Bulk generation and ‘bulk’ renewables (e.g., wind farm) operators;  Third party service and solutions providers;  Energy traders;  Third party financial services;  Smart Grid equipment manufacturers;  Prosumers . 1.4 Development approach The first phase of the project was based on a stock taking exercise of existing frameworks and standards related to smart grid security practices - completed with an extensive desk research activity. This stock taking involved the following categories of stakeholders:  Regulators and policy makers;  Smart Grid Operators;  Standardisation Bodies (e.g. ETSI, NIST, IEC, ISO, etc.);  Security solutions providers;  Smart Grid manufacturers;  Academia, R&D;  Public bodies in the Member States involved in Smart Grid cyber security. 10 Appropriate security measures for smart grids The information obtained during this phase was complemented with other sources and reports that have been considered relevant for the purpose of the study. The following key information sources have been identified:  Meeting minutes of the stock taking exercise that contains the relevant opinion from the experts;  Desktop research activity that identified the existing practices and standards related to cyber security that could be used to measure the security maturity level (including current European initiatives for securing smart grids);  Reports from governmental agencies providing information regarding operational capabilities for defence of control system environments against emerging cyber threats (e.g. EUROSCSIE, CPNI.UK and CPNI.NL);  Research documents about various aspects of information security from trusted and recognized entities (e.g. SANS);  Findings from the Expert Group on the security and resilience of communication networks and information systems for Smart Grids;  The U.S. Department of Energy (DOE) Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2). Using as a starting point the above mentioned sources, a draft conceptual approach to identifying minimum security measures for smart grids was defined. This approach will help policy makers and energy players to reach alignment on different level of security in smart grid related infrastructures and processes (fig 1). Then, the security measures identified and grouped in domains. The first draft document, containing both the approach and the measures, was shared for comments with different experts for a predefined consultation time. A new updated version of the document, containing most of the received comments, was presented to the stakeholders in a validation workshop held in Brussels. The final version of the document was published by ENISA at the end of December 2012. 1.5 Document overview In order to reach the objectives described above, the report has been structured in the following sections:  Chapter 1 – Introduction. This chapter contains an introduction to the smart grid context and the motivation for the study. Moreover, the terminology and methodology used during the study are also described;  Chapter 2 – Appropriate security measures. In this chapter the process used to derive the specific security measures for the smart grid security is described. Moreover, the chapter presents the different domains and the related appropriate security measures selected in the smart grid context; Appropriate security measures for smart grids 11  Chapter 3 – Sophistication levels. This chapter contains the identified lists of security measures and related evidence classified within the defined sophistication levels for each domain;  Chapter 4 – Catalogue of appropriate security measures. This chapter contains a table with the defined security measures;  Chapter 5 – Mapping with ISO/IEC-27002, NISTIR-7628 and ISO/IEC TR 27019. This chapter contains a table which represents the relationships between the defined security measures and the standards ISO/IEC-27002, NISTIR-7628 and ISO/IEC TR 27019;  Annex I – Glossary. A set of terms and definitions;  Annex II – References. List of relevant bibliography used in the study. 12 Appropriate security measures for smart grids 2 Approach to identifying appropriate security measures 2.1 Structure The set of smart grid security measures is organised into domains and sophistication levels. This is reflected in the following matrix where the columns are the domains and the rows are the sophistication levels: Figure 1 – Conceptual model of the approach

• .. • .. • .. Model Structure for the method tic 1 • .. • .. • .. applied to define p Security

So ty ty ty

ri ri ri Measures

re u d ation of licy tion secu tion secu tion secu po roc rity p ganiz Or orma forma forma In inf In D1 – Security D2 DN Governance

Domains - set of practices

The measures are grouped in domains in order (a) to allow the reader to better identify possible security deficiencies and (b) to provide data and high-level guidance that can be used to predict the effectiveness of the proposed domains. Appropriate security measures for smart grids 13 As example:  Security governance & risk management domain.

Sophistication level Description

The security measure is implemented in an early stage (not advanced). Security goals 1 are being achieved to some extent. The security measure is implemented according to industry standards across a large 2 part of the organization. Security goals are being achieved and their effectiveness sometimes (ad-hoc) reviewed. The security measure is implemented in an advanced way, and monitored and tested 3 continuously. The security measure is reviewed on a structural basis, and updated if necessary to support business goals in the best possible fashion. Exercises and tests are organized to check the effectiveness of the measure.

Sophistication levels are applied independently to each domain (Figure 2). As a result, a smart grid provider may receive different sophistication ratings for different domains. It is important to realise that the sophistication levels that are applicable to a given organisation depend on its specific characteristics such as its size or the services provided. For example, for a provider with only 5 employees it may be unnecessary to have a security policy that is fully aligned with best practice industry standards, or to have a documented formal procedure for hiring personnel. The practices that complete each sophistication level are selected from relevant standards, guidelines and frameworks which have been identified during the stock taking exercise. The practices have been selected from the following key documents:  NISTIR (National Institute of Standards and Technology Internal Report) 7628: Guidelines for Smart Grid Cyber Security;  ISO/IEC (International Organization for Standardization) 27002: Information technology —Security techniques — Code of practice for information security management; 14 Appropriate security measures for smart grids  ISO/IEC (International Organization for Standardization) DIS 27036-2, Information technology – Security techniques – Information security for supplier relationships - Part 2: Requirements;  ISO/IEC 27011: Information technology — Security techniques — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002;  NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection);  IEC (International Electrotechnical Commission) 62443: Technical Specification - Industrial Communication Networks - Network and System Security;  IEC (International Electrotechnical Commission) 62351: Power Systems Management and Associated Information Exchange – Data And Communications Security;  ISO/IEC TR (Technical Report) 27019: Information technology — Security techniques — Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy industry;  BDEW (BDEW Bundesverband der Energie- und Wasserwirtschaft) - White Paper Requirements for Secure Control and Telecommunication Systems. As example:  Information security policy security measures. Appropriate security measures for smart grids 15 Figure 2 - Overview of the common approach to addressing smart grid cyber security measures 2.2 The role of risk assessment Organisations wishing to establish, implement, operate, monitor and continuously maintain and improve an appropriate level of smart grid security, must also carefully and continuously consider and assess the actual level of preparedness and the related security risks they face. A risk assessment should be performed throughout the system life cycle: during requirements definition, procurement, control definition and configuration, system operations, and system close-out. A “Risk Assessment” (RA) would be, in this context, an important step to be performed before deciding the required sophistication levels needed by the smart grid organisation. The extent and granularity of the Risk Assessment should take into account several factors such as the size of the organisation, the implementation cost of the measures etc. The risk assessment allows the smart grid system designer to define a threshold for the minimum acceptance level before the establishment of a risk value and to perform the risk assessment for the assets in scope. Therefore, a risk assessment is a key preliminary step that should be conducted in order to understand what risk level is appropriate/acceptable for each 16 Appropriate security measures for smart grids organisation before deciding upon the required sophistication levels needed by the smart grid organisation (Figure 3): Figure 3 - The risk assessment is useful input for deciding on the sophistication levels needed The organisation should select specific controls, measures and sophistication levels by considering and effectively using the results of the risk assessment. This way, the proposed smart grid security measures could be considered as an appropriate benchmark enabling the security managers to determine which specific aspects of security require attention and priority within their respective organisations. Establishing a security benchmark within a context that has been defined by smart grid experts is considered to be a successful formula, because such a benchmark can be properly focused on smart grid specific security issues. Such benchmark can complement the outcome of the risk assessment and provide an additional input for defining and selecting the specific controls, measures and sophistication levels for smart grid security. The above-described proposed approach is aligned with general risk management good practices – and therefore will help create synergies between the risk management and the security efforts of the smart grid organisation. In contrast with a compliance based approach, this approach is considered to be more pragmatic and efficient. Moreover, the proposed approach is considered to be more powerful because it takes into consideration the specific characteristics of the smart grid organisation. Therefore, it can be applied to a wide range of smart grid organizations independently of their size or maturity. Appropriate security measures for smart grids 17 The use of sophistication levels allows the definition of different quality requirements each measure. This approach is different from a maturity level approach because, in practice, an organisation will probably not have all its measures developed to the same level of maturity. The identification of a suitable risk assessment methodology for smart grid establishments is beyond the scope of this report; therefore it has not been described in detail. Only the relevance and usefulness of performing a suitable risk assessment, before deciding the required sophistication levels, was highlighted. For the interested reader, a detailed description of different risk assessment methodologies for the energy sector can be found on the document “Common areas of Risk Assessment Methodologies” by EURACOM (European Risk Assessment and Contingency planning Methodologies for interconnected energy networks). 2.3 Lessons identified The following key conclusions have been drawn from the analysis of the above mentioned sources:  The reliability and resilience of the energy supply chain are critical factors because the smart grid is considered as a single interconnected system with a potential high impact in case of failure;  There is a considerable number of legacy systems present in almost all smart grid environments. One of the key security challenges with legacy systems is related to the deployment of security patches because in some cases it is not possible to install the patches or remove known vulnerabilities;  As required in every sound information security management system all key involved risks and their mitigating controls must be covered by a regular internal/external audit process intended to provide independent assurance on the adequacy of these controls;  Sharing relevant information between all smart grid organisations will make the awareness on vulnerabilities and on possible consequences transparent to all;  Manufactures are also responsible for contributing to the security of the smart grid (via the involved equipment /devices / components embedded). For instance, it is important to highlight the risks involved by the use of default configurations with weak passwords or with unnecessary services enabled;  An adequate risk assessment process is necessary in order to select the adequate security controls for the smart grid organisation while designing the overall architecture and the component specification; 18 Appropriate security measures for smart grids  The security of the smart grid should be taken into account at an early stage in order to allow set security requirements at planning or development stage at the latest;  One of the most important objectives of the security infrastructure protecting the smart grid is the prevention/detection as well as the response against cyber events and/or cyber incidents before there is significant power system impact;  Smart grid security is, in general, poorly integrated with the organisational security or the security management process; therefore the definition of specific smart grid security requirements might be not aligned with the overall business requirements;  Focus on cryptography, privacy, policies and performance criteria around application security and threat and vulnerability management requires significant attention because most smart grid stakeholders still have little experience in these areas;  As several smart grid activity domains can be identified, there are multiple actors that participate in the smart grid value chain (operational smart grid) – inherently this creates complexity in approaching the overall smart grid security challenges;  The smart grid includes the deployment of multiple interconnected systems and devices; therefore interoperability is critical;  Security metrics are a very active research field (when considering smart grids) but solid outcomes have not been achieved yet;  A skills gap exists between enterprise IT engineers and SCADA engineers with respect to the special information security requirements in the power domain. Therefore, it is necessary to implement specific training for people that will be involved on the power domain environment;  A very important consideration is designing a proper security of the smart grid network from the early stages; this way high costs of redesign will be avoided;  Physical security aspects should address the protection of smart grid devices located in the organisation’s premises as well as outside of the organisation’s own grounds or premises (for example smart grid devices physically located in areas that are the responsibility of other utility providers);  The necessity of an adequate identification and authentication process was acknowledged as one of the most relevant security control aspects in the view of the access to the smart grid;  Addressing cyber security of smart grids requires the proper identification of key dependencies between the ICT-infrastructures and electricity grids, and of all other relevant smart grid assets;  There is a need to establish a common procurement language and/or standard for a base level of security of the smart grid components and services in collaboration with private and public asset owners, vendors and regulators. Appropriate security measures for smart grids 19 These findings have been used as a basis for the definition of the domains. 2.4 Domains The identified domains cover all the relevant topics noted by the experts and by the additional information sources, namely: 1. Security governance & risk management: this domain covers the security measures that should been taken into consideration in order to facilitate a proper implementation and/or alignment with the security culture on smart grid stakeholders; 2. Management of third parties: this domain covers the security measures related to the interaction with third parties, so that the smart grid operator can reach a true and sustainable integration to the smart grid as a whole; 3. Secure lifecycle process for smart grid components/systems and operating procedures: this domain covers activities and procedures related to the secure operation, configuration, maintenance, and disposal of the smart grid components and systems. Therefore, the security measures included in this domain take into consideration among other things the proper configuration of the smart grid information systems and components or its change management procedures; 4. Personnel security, awareness and training: this domain ensures that employees of an organisation running a smart grid receive adequate training to perform reliable operations on the smart grid; 5. Incident response & information knowledge sharing: this domain covers the possible security threats, vulnerabilities, and incidents affecting smart grids in order to provide an effective response in case of a potential disruption or incident; 6. Audit and accountability: this domain covers the implementation of an audit and accountability policy and associated controls in order to verify compliance with energy and smart grid specific legal requirements and organisation policies; 7. Continuity of operations: this domain ensures the basic functions of the smart grid under a wide range of circumstances including hazards, threats and unexpected events; 8. Physical security: this domain covers the physical protection requirements for the smart grid assets; 9. Information systems security: this domain covers the definition of requirements to protect the information managed by the smart grid information systems using different technologies like firewalls, antivirus, intrusion detection and etc.; 10. Network security: this domain covers the design and implementation of requirements that protect the established communication channels among the smart grid information system and the segmentation between business and industrial networks. 20 Appropriate security measures for smart grids 3 Appropriate security measures 3.1 Domain 1: Security governance & risk management Control Objective: The provider has established and maintains a security governance program that directs and controls the smart grid information security. It provides strategic direction, ensures objectives are achieved, cyber security risk aspects regarding the smart grid systems and components have been fully addressed, uses organisational resources responsibly, and monitors the success or failure of the security programme. It should be noted that the programme should identify not only the internal risks but also risks coming from ICT and energy supply chain as appropriate. ID SM 1.1 Measure Information security policy. Definition The provider should establish and maintain an appropriate information security policy. Example [From ISO/IEC 27002 - 5.1.1 Information security policy document] An information security policy document should be approved by management, and published and communicated to all employees and relevant external parties. [From IEC 62443 - 4.3.2.6.1 Develop security policies] The organisation shall develop high-level cyber security policies for the industrial automation and control system environment which are approved by management. ID SM 1.2 Measure Organisation of information security. Definition The provider should establish and maintain an appropriate structure of security roles and responsibilities. Example [From IEC 62443 - 4.3.2.3.2 Establish the security organization(s)] There shall be an organisation, structure or network of stakeholders established (or chosen) under management leadership, with the responsibility to provide clear direction and oversight for the cyber aspects of the industrial automation and control system. [From NERC CIP-003-4 - Requirement 2 Leadership] The responsible entity shall assign a single senior manager with overall responsibility and authority for leading and managing the entity’s implementation of, and adherence to, Standards. Appropriate security measures for smart grids 21 ID SM 1.3 Measure Information security procedures. Definition The provider should establish and maintain an appropriate set of security procedures that supports the implementation of the security policy. Example [From IEC 62443 - 4.3.2.6.2 Develop security procedures] The organisation shall develop and approve cyber security procedures, based on the cyber security policies and provide guidance in how to meet the policies. [From NISTIR 7628 - SG.PM-1 Security Policy and Procedures -Requirement 1.b ] The organisation develops, implements, reviews, and updates on an organisation-defined frequency procedures to address the implementation of the security program security policy and associated security program protection requirements. ID SM 1.4 Measure Risk management framework. Definition The provider should establish and maintain an appropriate risk management framework for risk assessment and risk treatment activities across the organisation which will take into account the complex operational environment. Example [From NISTIR 7628 - SG.PM-5 Risk Management Strategy - Requirements 1 and 2] The organisation develops, a comprehensive strategy to manage risk to organisational operations and assets, individuals, and other organisations associated with the operation and use of information systems; and implements that strategy consistently across the organisation. [From IEC 62443 - 4.2.3.1 Select a risk assessment methodology] The organisation shall select a particular risk assessment and analysis approach and methodology that identifies and prioritizes risks based upon security threats, vulnerabilities and consequences related to their industrial automation and control system assets. ID SM 1.5 Measure Risk assessment. Definition The provider should establish and perform risk assessment activities to identify and evaluate the risk across the organisation at regular intervals. Example [From ISO/IEC 27002 - 4.1 Assessing security risks] Risk assessments should identify, quantify, and prioritize risks against criteria for risk acceptance and objectives relevant to the organisation. The results should guide and determine the appropriate management action and priorities for managing information security risks and for implementing 22 Appropriate security measures for smart grids controls selected to protect against these risks. [From ISO/IEC TR 27019 - 4.2.4.1.a Establishment of information security management] Through risk assessment, threats to the organisation’s own assets will be identified; vulnerabilities and likelihood of occurrence will be evaluated and potential impact assessed. ID SM 1.6 Measure Risk treatment plan. Definition The provider should establish and maintain an appropriate risk treatment plan in order to manage the risk across the organisation. Example [From NISTIR 7628 - SG.RA-2 Risk Management Plan - Supplemental Guidance ] Risk mitigation measures need to be implemented and the results monitored against planned metrics to ensure the effectiveness of the risk management plan. [From IEC 62443 - 4.3.4.2.2 Employ a common set of countermeasures] A common defined set of countermeasures (technical and administrative) to address both physical and cyber security risks should be defined and applied across the organisation wherever a specific risk is identified. 3.2 Domain 2: 2. Management of third parties Control Objective: The provider has established and maintained a third parties management program that involves agreements on security related issues with the smart grid's stakeholders that participate in the smart grid value chain. These agreements should also take account of the supply chain as appropriate. ID SM 2.1 Measure Third party agreements. Definition The provider should establish and maintains appropriate third party agreements to preserve the integrity, confidentiality and availability of the information at the same level as the internal services when dealing with customers and third parties. Example [From NISTIR 7628 - SG.SA-2 Security Policies for Contractors and Third Parties - Requirement 1] External suppliers and contractors that have an impact on the security of smart grid information systems must meet the organisation’s policy and procedures. [From ISO/IEC 27036 – Part 2 - 6.1.1 Acquisition process - Objective] The following objective shall be met by the acquirer for successfully managing information security Appropriate security measures for smart grids 23 within the acquisition process: Establish a supplier relationship strategy that:  Is based on the information security risk tolerance of the acquirer;  Defines the information security foundation to use when planning, preparing, managing and terminating the procurement of a product or service. [From ISO/IEC 27002 - 6.2.1 Identification of risks related to external parties] The risks to the organization’s information and information processing facilities from business processes involving external parties should be identified and appropriate controls implemented before granting access. ID SM 2.2 Measure Monitoring third parties services and validating solutions against predefined acceptance criteria. Definition The provider should establish and maintain mechanisms in order to monitor the compliance of contractual obligations of information and services and validate solutions against predefined acceptance criteria. Example [From ISO/IEC 27002 - 10.2 Third party service delivery management] The organisation should check the implementation of agreements, monitor compliance with the agreements and manage changes to ensure that the services delivered meet all requirements agreed with the third party. [From NISTIR 7628 - SG.AU-1 Audit and Accountability Policy and Procedures - Requirement 1.a.ii.] The scope of the audit and accountability security program as it applies to all of the organizational staff, contractors, and third parties. 3.3 Domain 3: Secure lifecycle process for smart grid components/systems and operating procedures Control Objective: The provider has established and maintained a secure lifecycle process that involves the planning, requirements definition, development, deployment, configuration, operation and disposal of the smart grid components/systems and procedures. Security measures applicable to smart grid components/systems are: ID SM 3.1 Measure Security requirements analysis and specification . Definition The provider should identify and define beforehand the necessary security requirements 24 Appropriate security measures for smart grids for smart grid components and systems during the design and procurement. Example [From ISO/IEC 27002 - 12.1.1 Security requirements analysis and specification] Statements of business requirements for new information systems, or enhancements to existing information systems should specify the requirements for security controls. [From NISTIR 7628 - SG.SA-8 Security Engineering Principles – General Requirement] The organization applies security engineering principles in the specification, design, development, and implementation of any Smart Grid information system. Security measures applicable to smart grids operating procedures are: ID SM 3.2 Measure Inventory of smart grid components/systems. Definition The provider should establish and maintain an inventory that represents the components and smart grid information systems. Example [From ISO/IEC 27002 - 7.1.1 Inventory of assets] All assets should be clearly identified and an inventory of all important assets drawn up and maintained. [From NISTIR 7628 - SG.CM-8 Component Inventory - Requirement 1] The organisation develops, documents, and maintains an inventory of the components of the smart grid information system that accurately reflects the current Smart Grid information system configuration. [From NERC CIP-002-4a Requirement 1 - Critical Asset Identification] The Responsible Entity shall develop a list of its identified critical assets determined through an annual application of the criteria contained in the NERC CIP Standard. ID SM 3.3 Measure Secure configuration management of smart grid components/systems. Definition The provider should ensure that the base security configuration of a smart grid’s components/systems is identified, set and maintained for every instance of that component/system. Example [From NISTIR 7628 - SG.CM-10 Factory Default Settings Management - Requirement 1] The organisation policy and procedures require the management of all factory default settings (e.g., authentication credentials, user names, configuration settings, and configuration parameters) on smart grid information system components and applications. [From ISO/IEC TR 27019 - B.1.1.1.9 Secure Standard Configuration, Installation and Start- Up] After initial installation and start-up the system should be configured in a fail-safe and secure manner. The defined secure base configuration should be documented. Appropriate security measures for smart grids 25 ID SM 3.4 Measure Maintenance of smart grid components/systems. Definition The provider should establish and maintain activities for performing routine and preventive/corrective maintenance on the components and smart grid information systems. Example [From NISTIR 7628 - SG.MA-3 Smart Grid Information System Maintenance - Requirement 1] The organisation schedules, performs, documents, and reviews records of maintenance and repairs on smart grid information system components in accordance with manufacturer or vendor specifications and/or organisational requirements. [From ISO/IEC 27002 - 9.2.4 Equipment maintenance] Equipment shall be correctly maintained to ensure its continued availability and integrity. ID SM 3.5 Measure Software/firmware upgrade of smart grid components/systems. Definition The provider should establish and maintain activities for software/firmware upgrade on the components and smart grid information systems. Example [From NISTIR 7628 - SG.SI-2 Flaw Remediation - Requirement 1 and 2] The organisation identifies, reports, and corrects Smart Grid information system flaws and tests software updates related to flaw remediation for effectiveness and potential side effects on organizational Smart Grid information systems before installation. [From ISO/IEC 27002 - 12.5.3 Restrictions on changes to software packages] A software update management process should be implemented to ensure the most up-to-date approved patches and application updates are installed for all authorized software. ID SM 3.6 Measure Disposal of smart grid components/systems. Definition The provider should establish and maintain activities for the secure disposal of smart grid components and smart grid information systems. Example [From NISTIR 7628 - SG.CM.9 - Addition, Removal, and Disposal of Equipment – Requirement 1] The organization implements policy and procedures to address the addition, removal, and disposal of all Smart Grid information system equipment. [NERC CIP-007-4 - Requirement 7. Disposal or Redeployment] The Responsible Entity shall establish and implement formal methods, processes, and procedures for disposal or redeployment of Cyber Assets within the Electronic Security Perimeter(s) as identified and documented in NERC CIP standard. 26 Appropriate security measures for smart grids Security measures applicable to smart grids components/systems and procedures are: ID SM 3.7 Measure Security testing of smart grid components/systems. Definition Security testing activities on the smart grid components/systems should be performed in order to verify its security. Example [From NISTIR 7628 - SG.SI-6 Security Functionality Verification - Requirement 1.a] The organisation verifies the correct operation of security functions within the smart grid information system Smart Grid information system start up and restart. [From IEC 62443 - 4.3.4.3.1 Define and test security functions and capabilities] The security functions and capabilities of each new component of the industrial automation and control system assets shall be defined up front, developed or achieved via procurement, and tested together with other components so that the entire system meets the desired security profile. 3.4 Domain 4: Personnel security, awareness and training Control Objective: The provider has established and maintained a personnel security, awareness and training program that supports a culture of cyber security for all relevant stakeholders and fosters the mutual exchange of security information between electric sector and information security professionals in the smart grid value chain. ID SM 4.1 Measure Personnel screening. Definition The provider should perform appropriate background checks on personnel (employees, contractors, and third-party users) if required for their duties and responsibilities. Example [From NERC CIP-004-3a - Requirement 3 Personnel Risk Assessment] The Responsible Entity shall have a documented personnel risk assessment program, in accordance with federal, state, provincial, and local laws, and subject to existing collective bargaining unit agreements, for personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets. A personnel risk assessment shall be conducted pursuant to that program prior to such personnel being granted such access except in specified circumstances such as an emergency. [From ISO/IEC TR 27019 - 8.1.2 Screening] A strict screening process for key personnel Appropriate security measures for smart grids 27 that have access to critical information assets or that are responsible for the operation and maintenance processes of critical systems should be considered. This is especially the case if the information assets or systems are part of the critical infrastructure or if they are required for the operation of critical infrastructure. ID SM 4.2 Measure Personnel changes. Definition The provider should establish and maintain an appropriate process for managing changes in personnel (employees, contractors, third-party users) or changes in their roles and responsibilities. Example [From NISTIR 7628 - SG.PS-5 Personnel Transfer - Requirement 1] The organization reviews logical and physical access permissions to smart grid information systems and facilities when individuals are reassigned or transferred to other positions within the organization and initiates appropriate actions. [From ISO/IEC 27002 - 8.3 Termination or change of employment] Responsibilities should be in place to ensure an employee’s, contractors or third-party user’s exit from the organisation is managed, and that the return of all equipment and the removal of all access rights are completed. ID SM 4.3 Measure Security and awareness program. Definition The provider should establish and maintain a security awareness program across the organisation. Example [From NISTIR 7628 - SG.AT-1 Awareness and Training Policy and Procedures - Requirement 1.a] The organization develops, implements, reviews, and updates on an organization-defined frequency a documented awareness and training security policy that addresses:  The objectives, roles, and responsibilities for the awareness and training security program as it relates to protecting the organization’s personnel and assets, and  The scope of the awareness and training security program as it applies to all of the organizational staff, contractors, and third parties. [From IEC 62443 - 4.3.2.4.1 Develop a training program] The organisation shall design and implement a cyber-security training program. [From ISO/IEC 27002 - 8.2.2 Information security awareness, education, and training] All employees of the organisation and, where relevant, contractors and third-party users should receive appropriate awareness training. [From NISTIR 7628 – SG.AT-2 Security Awareness - General Requirement] The organisation provides basic security awareness briefings to all smart grid information 28 Appropriate security measures for smart grids system users (including employees, contractors, and third parties) on an organisationdefined frequency. ID SM 4.4 Measure Security training and certification of personnel. Definition The provider should establish and maintain security training and personnel certification programmes, taking into account its needs based on their roles and responsibilities. Example [From NISTIR 7628 – SG.AT-3 Security Training - Requirement 1] The organisation provides security-related training before authorizing access to the smart grid information system or performing assigned duties. [From IEC 62443 - 4.3.2.4.3 Provide training for support personnel] All personnel that perform risk management, industrial automation and control system engineering, system administration/maintenance and other tasks that impact the cyber security management system should be trained on the security objectives and industrial operations for these tasks. 3.5 Domain 5: Incident response & information knowledge sharing Control Objective: The provider has established and maintained an incident response and information knowledge sharing process that prevents, resolves and recovers from cyber events, effectively containing the damage, and allows sharing cyber security information for internal and external entities. ID SM 5.1 Measure Incident response capabilities. Definition The provider should establish and maintain capabilities to respond against cyber security incidents. Example [From NISTIR 7628 - SG.IR-1 Incident Response Policy and Procedures - Requirement 1.a] The organization develops, implements, reviews, and updates on an organization-defined frequency a documented incident response security policy that address:  The objectives, roles, and responsibilities for incident response security program as it relates to protecting the organization’s personnel and assets, and;  The scope of the incident response security program as it applies to all of the organizational staff, contractors, and third parties. [From IEC 62443 - 4.3.4.5.1 Implement an incident response plan] The organisation shall implement an incident response plan that identifies responsible personnel and defines actions to be performed by designated individuals. Appropriate security measures for smart grids 29 ID SM 5.2 Measure Vulnerability assessment. Definition The provider should establish and maintain vulnerability assessment activities on the smart grid information systems. Example [From NISTIR 7628 - SG.RA-6 Vulnerability Assessment and Awareness - Requirement 1] The organisation monitors and evaluates the smart grid information system according to the risk management plan on an organisation-defined frequency to identify vulnerabilities that might affect the security of a smart grid information system. [From IEC 62443 - 4.2.3.7 Perform a detailed vulnerability assessment] The organization shall perform a detailed vulnerability assessment of its individual logical industrial automation and control system, which may be scoped based on the high-level risk assessment results and prioritization of industrial automation and control system subject to these risks. ID SM 5.3 Measure Vulnerability management. Definition The provider should establish and maintain an appropriate vulnerability management plan in order to manage vulnerabilities on smart grid information systems. Example [From ISO/IEC 27002 - 12.6.1 Control of technical vulnerabilities] Appropriate, timely action should be taken in response to the identification of potential technical vulnerabilities. [From IEC 62443 - 4.2.3.14 Maintain vulnerability assessment records] Up-to-date vulnerability assessment records should be maintained for all assets comprising the industrial automation and control system. ID SM 5.4 Measure Contact with authorities and security interest groups. Definition The provider should establish and maintain contacts with authorities and security interest groups to be aware of vulnerabilities and threats. Example [From ISO/IEC TR 27019 - 6.1.6 Contact with authorities] The applications and infrastructure of energy utility process control systems may be considered as part of the critical infrastructure and may be essential for the functioning of the local community and society and the economy as a whole. Operators of such systems should therefore maintain contact with all of the relevant authorities. [From ISO/IEC 27002 - 6.1.6 Contact with authorities] Appropriate contacts with relevant authorities should be maintained. 30 Appropriate security measures for smart grids 3.6 Domain 6: Audit and accountability Control Objective: The provider has established and maintained an audit and accountability process that enables sufficient logging capabilities in the smart grid systems and components and provides valuable log data for analysis. ID SM 6.1 Measure Auditing capabilities. Definition The provider should establish and maintain auditing capabilities on the smart grid Information systems and components. Example [From NISTIR 7628 - SG.AU-15 Audit Generation - Requirement 1] The smart grid information system provides audit record generation capability and generates audit records for the selected list of auditable events. [From ISO/IEC TR 27019 - 10.10.1 Audit logging] Relevant audit events may also include certain actions carried out by operating personnel, such as switching operations for instance. ID SM 6.2 Measure Monitoring of smart grid information systems. Definition The provider should establish and maintain monitoring activities on the smart grid Information systems and components. Example [From NERC CIP-005-4a - Requirement 3. Monitoring Electronic Access] The Responsible Entity should implement and document an electronic or manual process(es) for monitoring and logging access at access points to the Electronic Security Perimeter(s) twenty-four hours a day, seven days a week. [From ISO/IEC 27002 - 10.10 Monitoring] Systems should be monitored and information security events should be recorded. Operator logs and fault logging should be used to ensure information system problems are identified. ID SM 6.3 Measure Protection of audit information. Definition The provider should protect the audit information generated. Example [From ISO/IEC 27002 - 10.10.3 Protection of log information] Logging facilities and log information should be protected against tampering and unauthorized access. [From NISTIR 7628 - SG.AU-9 Protection of Audit Information - General Requirement] The smart grid information system protects audit information and audit tools from unauthorized access, modification, and deletion. Appropriate security measures for smart grids 31 3.7 Domain 7: Continuity of operations Control Objective: The provider has established and maintains a continuity of operations process that allows continuing or resuming operations of a smart grid information system in the event of disruption of normal system operation. ID SM 7.1 Measure Continuity of operations capabilities . Definition The provider should establish and maintain capabilities to ensure essential functions after disruption events on smart grid Information systems. Example [From NISTIR 7628 - SG.CP-2 Continuity of Operations Plan - Requirement 1] The organisation develops and implements a continuity of operations plan dealing with the overall issue of maintaining or re-establishing operations in case of an undesirable interruption for a smart grid information system. [From ISO/IEC TR 27019 - 14.1.1 Including information security in the business continuity management process ] Energy utility organisations should consider the continuity of the general energy supply as one of the key elements of business continuity management. ID SM 7.2 Measure Essential communication services. Definition The provider should establish, maintain and test essential/emergency communication services in case of major disasters. Example [From NISTIR 7628 - SG.CP-11 Fail-Safe Response - General Requirement] The smart grid information system has the ability to execute an appropriate fail-safe procedure upon the loss of communications with other Smart grid information systems or the loss of the smart grid information system itself. [From ISO/IEC TR 27019 - 14.2.1 Emergency communication] Energy utility organisations should ensure that essential communication links are maintained with their own emergency staff and/or the emergency staff of other utilities, with essential control systems and with external emergency organisations necessary for the protection and handling of, or recovery from such incidents. 32 Appropriate security measures for smart grids 3.8 Domain 8: Physical security Control Objective: The provider has established and maintained a physical security program that restricts the access to smart grid information systems and components only to authorized personnel. ID SM 8.1 Measure Physical security. Definition The provider should establish and maintain the appropriate physical security of the smart grid facilities/components/systems. Example [From ISO/IEC 27002 - 9.1 Secure areas] Critical or sensitive information processing facilities should be housed in secure areas, protected by defined security perimeters, with appropriate security barriers and entry controls. They should be physically protected from unauthorised access, damage, and interference. The protection provided should be commensurate with the identified risks. [From NISTIR 7628 - SG.PE-3 Physical Access - Requirement 1] The organisation enforces physical access authorizations for all physical access points to the facility where the smart grid information system resides. ID SM 8.2 Measure Logging and monitoring physical access. Definition The provider should establish and maintain capabilities for logging and monitoring the physical access to the smart grid facilities/components taking into account the criticality of the facility. Example [From NERC CIP-006 - Requirement 4. Physical Access Controls] The Responsible Entity should document and implement the technical and procedural controls for monitoring physical access at all access points to the Physical Security Perimeter(s) twenty-four hours a day, seven days a week. [From IEC 62443 - 4.3.3.3.8 Establish procedures for monitoring and alarming] Procedures should be established for monitoring and alarming when physical or environmental security is compromised. ID SM 8.3 Measure Physical security on third party premises. Definition The provider should protect equipment located outside of the organisations' own grounds or premises in areas that are the responsibility of other utilities against physical and environmental threats. Example [From ISO/IEC TR 27019 - 9.3.1 Equipment sited on the premises of other energy utility organizations] Where energy utility organisations install equipment outside of their own Appropriate security measures for smart grids 33 grounds or premises in areas that are the responsibility of other utilities, such as transfer stations for instance, the equipment should be sited in a protected area so that any risks arising from environmental threats or dangers are mitigated and the possibility of unauthorized access is reduced. [From ISO/IEC 27002 -9.2.5 Security of equipment off premises] Security shall be applied to off-site equipment taking into account the different risks of working outside the organisation’s premises. 3.9 Domain 9: Information systems security Control Objective: The provider has established and maintained information systems security controls that ensure that the smart grid information systems and components are logically accessed only by authorized entities and that its information is properly protected . ID SM 9.1 Measure Data security. Definition The provider should implement security requirements in order to protect the information on smart grid information system. Example [From ISO/IEC TR 27019 - B.1.1.1.6 Encryption of Sensitive Data during Storage and Transmission] Sensitive data should be stored or transmitted in encrypted form only. [From ISO/IEC 27002 - 10.7.3 Information handling procedures] Procedures for the handling and storage of information should be established to protect this information from unauthorized disclosure or misuse. ID SM 9.2 Measure Account management. Definition The provider should establish and maintain system/groups/user accounts on smart grid information systems. Example [From ISO/IEC 27002 - 11.2 User access management] The procedures should cover all stages in the life-cycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access to information systems and services. Special attention should be given, where appropriate, to the need to control the allocation of privileged access rights, which allow users to override system controls. [From NISTIR 7628 - SG.AC-3 Account Management - Requirement 1] The organisation 34 Appropriate security measures for smart grids manages smart grid information system accounts, including authorizing, establishing, activating, modifying, disabling, and removing accounts. ID SM 9.3 Measure Logical access control. Definition The provider should enforce logical access to authorized entities on smart grid information systems and security perimeters. Example [From NERC CIP-003-4 - Requirement 5. Access Control] The Responsible Entity shall document and implement a program for managing access to protected Critical Cyber Asset information. [From IEC 62443 - 4.3.3.7.2 Establish appropriate logical and physical permission methods to access IACS devices] The permission to access industrial automation and control system devices shall be logical (rules that grant or deny access to known users based on their roles). ID SM 9.4 Measure Secure remote access. Definition The provider should establish and maintain secure remote access where applicable to smart grid information systems. Example [From NISTIR 7628 - SG.AC-2 Remote Access Policy and Procedures - Requirement 1] The organisation documents allowed methods of remote access to the smart grid information system. [From IEC 62443 - 4.3.3.6.6 Develop a policy for remote login and connections] The organisation shall develop a policy addressing remote login by a user and/or remote connections (for example, task-to-task connections) to the control system which defines appropriate system responses to failed login attempts and periods of inactivity. ID SM 9.5 Measure Information security on information systems. Definition The provider should establish and maintain appropriate information security capabilities on information systems, to provide protection against malware, viruses and other common threats. Example [From IEC 62443 - 4.3.4.3.8 Establish and document antivirus/malware management procedure] A procedure for antivirus/malware management shall be established, documented, and followed. [From ISO/IEC TR 27019 - 10.4.1 Controls against malicious code ] The possible effects of malware incidents on equipment used for real-time process control and associated Appropriate security measures for smart grids 35 communications (e.g. through overload and disruption) should be taken into consideration and mitigated by implementing the appropriate controls. ID SM 9.6 Measure Media handling. Definition The provider should establish and maintain secure procedures for the access, storage, distribution, transport, sanitization, destruction and disposal of the media assets. Example [From NISTIR 7628 - SG.MP-1 Media Protection Policy and Procedures – Requirement 1a] The organization develops, implements, reviews, and updates on an organization-defined frequency a documented media protection security policy that addresses: i. The objectives, roles, and responsibilities for the media protection security program as it relates to protecting the organization’s personnel and assets, and; ii. The scope of the media protection security program as it applies to all of the organizational staff, contractors, and third parties. [From ISO/IEC 27002 - 10.7.1 Management of removable media] There should be procedures in place for the management of removable media. 3.10 Domain 10: Network security Control Objective: The provider has established and maintains a secure network engineering program that prevents security controls from being circumvented. ID SM 10.1 Measure Secure network segregation. Definition The provider should establish and maintain a segregated network for the smart grid information system. Example [From ISO/IEC 27002 - 11.4.5 Segregation in networks] Groups of information services, users, and information systems should be segregated on networks. [From ISO/IEC TR 27019 - 11.4.5 Segregation in networks ] Where applicable and technically feasible, the network infrastructure of process control systems should be divided into multiple zones with different functions and protection requirements. In particular, different technical and operational domains should be segregated from one another. 36 Appropriate security measures for smart grids ID SM 10.2 Measure Secure network communications. Definition The provider should establish and maintain secure communications across the segregated network. Example [From NISTIR 7628 - SG.SC-9 Communication Confidentiality - General Requirement] The smart grid information system protects the confidentiality of communicated information. [From ISO/IEC 27011 – A.10.6 Network security management] The secure management of networks, which may span organizational boundaries, requires careful consideration to data flow, legal implications, monitoring, and protection. [From ISO/IEC 27002 - 11.4.7 Network routing control] Routing controls should be implemented for networks to ensure that computer connections and information flows do not breach the access control policy of the business applications. Appropriate security measures for smart grids 37 4 Sophistication levels This section presents the sophistication levels that apply to the defined smart grids security measures for each of the 10 domains previously identified. 4.1 Domain 1: Security governance & risk management

Control Objective:

The provider has established and maintains a security governance program that directs and controls the smart grid information security. It provides strategic direction, ensures objectives are achieved, cyber security risk aspects regarding the smart grid systems and components have been fully addressed, uses organisational resources responsibly, and monitors the success or failure of the security programme. It should be noted that the programme should identify not only the internal risks but also risks coming from ICT and energy supply chain as appropriate.

SM 1.1 Information security policy.

The provider should establish and maintain an appropriate information security policy.

Level Practices Evidence

  Documented security procedures that address the minimum security Minimum security activities on the smart grid information system are

1

performed by the organisation. activities.   Approved information security policy covering most aspects of security An information security policy that addresses a secure and reliable energy containing at least: supply and legal and regulatory requirements is available and approved by o Scope of the information security policy; management.  o Applicable laws and regulations; Employees are aware of the existence and behave accordingly. 2 o Security objectives; o Management commitment with the security policy.  Proof of the information security policy communication among staff.  The information security policy is easy accessible for staff.

11  Last planned review has been done according with the review process. 3  The information security policy is regularly reviewed at planned intervals or

38 Appropriate security measures for smart grids

SM 1.1 Information security policy.

The provider should establish and maintain an appropriate information security policy.

Level Practices Evidence

if significant changes occur to ensure its continuing suitability, adequacy, and  Records of the management review. effectiveness.  Meeting minutes of review sessions.

SM 1.2 Organisation of information security.

The provider should establish and maintain an appropriate structure of security roles and responsibilities.

Level Practices Evidence

  Chart that reflects the organisation of information security. 1 Security roles and responsibilities are defined in the organisation.  The organisation of information security is adequately positioned within the  Security roles and responsibilities are established and documented separating functions as needed to eliminate conflicts of interest and to ensure organisation.  Formal description of the key security roles and responsibilities. independence in the responsibilities and functions of individuals/roles.

2

 Formal appointment of the key security roles and responsibilities.  Security roles and responsibilities are assigned to staff that is adequately positioned within the organisation, taking into account the specific, size, and necessities of the department and qualifications of the person.  Formal appointment of the backup person.  A backup person has been designated for key security roles and

3

responsibilities.

SM 1.3 Information security procedures.

The provider should establish and maintain an appropriate set of security procedures that supports the implementation of the security policy.

Level Practices Evidence

 Formal description of the key security procedures containing at least:  Security procedures to address the key security activities are developed, o Objectives, roles, and responsibilities; implemented and documented. 1 o Scope of the security procedure; o Security objectives.

 Formal description of the security procedures containing at least:  Security procedures to address the information security policy are developed,

2

o Objectives, roles, and responsibilities; implemented and documented.

Appropriate security measures for smart grids 39

SM 1.3 Information security procedures.

The provider should establish and maintain an appropriate set of security procedures that supports the implementation of the security policy.

Level Practices Evidence

o Scope of the security procedure; o Security objectives.

  The last planned review has been done according with the review process. Security procedures that address the information security policy are reviewed 3  Meeting minutes of review sessions. and updated on a regular basis.

SM 1.4 Risk management framework.

The provider should establish and maintain an appropriate risk management framework for risk assessment and risk treatment activities across the organisation which will take into account the complex operational environment.

Level Practices Evidence

  Documented risk management methodology that covers the risk on The risk management methodology has been developed based on best information and communication technology containing at least: practices and standards related to the information and communications o Objectives, roles, and responsibilities; technology context. o Scope of the risk management methodology; 1 o Procedures that supports the risk assessment.  Formal description of the risk tolerance level.  Organisation inventory assets that includes facilities, personnel, premises, etc.  Documented risk management methodology that covers the risk on smart  The risk management methodology has been developed based on best practices and standards related to the smart grid information system context. grids information system containing at least: o Objectives, roles, and responsibilities; o Scope of the risk management methodology; 2 o Procedures that supports the risk assessment; o Catastrophic but improbable events that could affect to the smart grids.  Formal description of the risk tolerance level.

3  The last planned review has been done according with the review process.  The risk management methodology is updated on a regular basis to ensure its

40 Appropriate security measures for smart grids

SM 1.4 Risk management framework.

The provider should establish and maintain an appropriate risk management framework for risk assessment and risk treatment activities across the organisation which will take into account the complex operational environment.

Level Practices Evidence

continuing suitability, adequacy, and effectiveness.  Meeting minutes of review sessions.

SM 1.5 Risk assessment.

The provider should establish and perform risk assessment activities to identify and evaluate the risk across the organisation at regular intervals.

Level Practices Evidence

  Documented risk assessment activities results containing at least: Risk assessment activities are executed following the defined methodology. o Critical assets identification; o Vulnerabilities; 1 o Threat sources; o Security impact level; o Organisation risk level.

  Documented risk assessment activities results containing at least: Risk assessment activities take into consideration the risk resulting from third o The risk on process control systems where system vendors and party access (e.g. vendors, system integrators or business partners) to sensitive systems, networks and information. integrators are involved in the maintenance and operation processes of these systems; o The risk on the use of remote access connections for maintenance by

2

external parties; o The risk on the access to security-controlled areas to perform on-site maintenance by external parties; o The risk on coupling of the control systems and communication networks of different organizations.

  The last planned review has been done according with the review process. Risk assessment activities are executed on a regular basis or whenever 3  Meeting minutes of review sessions. significant changes occur to the smart grid information system.

Appropriate security measures for smart grids 41

SM 1.6 Risk treatment plan.

The provider should establish and maintain an appropriate risk treatment plan in order to manage the risk across the organisation.

Level Practices Evidence

  Documented risk treatment plan containing at least: A risk treatment plan is developed based on the results of the risk assessment o Risk identified; activities. 1 o Risk treatment; o Security measure to implement.

 Records of the management review.  The risk treatment plan is reviewed and approved by the management. 2  Management commitment with the treatment plan.

  The last planned review has been done according with the review process. The effectiveness of the measures proposed on the risk treatment plan is 3  Meeting minutes of review sessions. reviewed on a regular basis.

4.2 Domain 2: Management of third parties

Control Objective:

The provider has established and maintains a third parties management program that involves agreements on security related issues with the smart grid's stakeholders that participate in the smart grid value chain. These agreements should also take account of the supply chain as appropriate.

SM 2.1 Third party agreements.

The provider should establish and maintain appropriate third party agreements to preserve the integrity, confidentiality and availability of the information at the same level as the internal services when dealing with customers and third parties.

Level Practices Evidence

 List of relevant third party relationships.  Contractual agreements when dealing with third parties and customers have  List of customer access request. been established. 1   Identify selection criteria. Security measures to protect the customer access to information have been  Documented contractual agreements containing at least: defined (see domain 9 Information systems security). o Service description;  Responsibilities regarding the maintenance, operation and ownership of

42 Appropriate security measures for smart grids

SM 2.1 Third party agreements.

The provider should establish and maintain appropriate third party agreements to preserve the integrity, confidentiality and availability of the information at the same level as the internal services when dealing with customers and third parties.

Level Practices Evidence

assets have been defined. o Security measures; o Non-disclosure agreements; o Roles and responsibilities; o Target service levels; o Contacts and reporting lines.  Documented third parties contractual agreements contains special  Special requirements relating to crisis and emergency communication where telecommunication services for the process control systems are supplied by requirements in case of: o Major blackouts; third parties have been identified.

2

o Natural catastrophes;  Preventive measures that may need to be taken in case of service overload o Accidents or other possible emergency situations; and to ensuring an acceptable degree of independence of the o Blackout resistance. telecommunication services of external energy utilities have been identified. 3 N/A N/A

SM 2.2 Monitoring third parties services and validating solutions against predefined acceptance criteria.

The provider should establish and maintain mechanisms in order to monitor the compliance of contractual obligations of information and services and validate solutions against predefined acceptance criteria.

Level Practices Evidence

  Documented service level agreement that contains requirement to protect Security controls, service definitions and delivery levels included in the third confidentiality, integrity and availability of information. 1 party service delivery agreement are implemented, operated, and maintained by the third party.  Services provided by the third party are monitored and reviewed on a regular  Documented results of monitoring activities. basis.  Documented results of auditing activities.  Regularly auditing activities are implemented on the third party.  Identify the process(es) applied to manage recent changes and confirm:

2

 Changes to the provision of services, are managed taking into account the o Adequate warning is provided; criticality of business systems and processes involved and re-assessment of o Involves relevant personnel; risk aspects. o Includes procedures for backing-out from failed changes.

Appropriate security measures for smart grids 43

SM 2.2 Monitoring third parties services and validating solutions against predefined acceptance criteria.

The provider should establish and maintain mechanisms in order to monitor the compliance of contractual obligations of information and services and validate solutions against predefined acceptance criteria.

Level Practices Evidence

3 N/A N/A

4.3 Domain 3: Secure lifecycle process for smart grid components/systems and operating procedures

Control Objective:

The provider has established and maintained a secure lifecycle process that involves the planning, requirements definition, development, deployment, configuration, operation and disposal of the smart grid components/systems and procedures.

SM 3.1 Security requirements analysis and specification.

The provider should identify and define beforehand the necessary security requirements for smart grid components and systems during the design and procurement.

Level Practices Evidence

 Documented security requirements.  Security requirements for security are specified early stages of information  Documented secured coding practices and guidelines. during the design and procurement of smart grid components and systems. 1  Security requirements take into account the electromagnetic emanations of the smart grid information systems and components.  Secure coding practices are used to reduce common security errors.   Documented threat model. A threat model is created for each smart grid information system and 2  Updated documented security requirements based on the threat plan output. component.  Security requirements are updated based on the results of the threat model.   Documented security response plan. A documented and tested security response plan is created in the event  Documented analysis of identified vulnerabilities. vulnerability is discovered.

3

 Root cause analysis is performed in order to understand the cause of identified vulnerabilities.

44 Appropriate security measures for smart grids

SM 3.2 Inventory of smart grid components/systems.

The provider should establish and maintain an inventory that represents the components and smart grid information systems.

Level Practices Evidence

  Documented inventory of assets containing at least: An inventory of assets of the smart grid components and information systems o Relevant process control systems; is available and maintained in the organisation. o Information assets;  The responsibilities in relation to smart grid components and information o Application; systems and the roles of the asset owner and asset operator in respect of o Physical assets; information security are exactly defined and documented. o Services; o Operating system/firmware;

1

o Legacy systems; o Location (logical and physical) of each component; o Owners; o Roles and responsibilities.  The last planned review has been done according with the review process.  Meeting minutes of review sessions.

 Documented acceptable use of smart grid components.  Rules for the acceptable use of smart grid components and information  Documented inventory of assets containing the defined zones and segments. systems are identified, documented and implemented.  The implemented multiple zones with different functions and protection requirements defined on the network infrastructure are included as a part of 2 the inventory.  The implemented independent horizontal segments defined on networks and distributed systems are included as a part of the inventory.  The implemented specific network for patch management functions defined on networks is included as a part of the inventory.  Documented classification schema covering at least the following smart grid  Smart grid components and information systems are classified in terms of value, legal requirements, sensitivity and criticality to the organisation. components and systems:  o Corporate assets, systems and information supporting the operation An appropriate set of procedures for information labelling and handling

3

of critical infrastructures and sensitive systems; should be developed and implemented in accordance with the classification o Corporate assets, systems and information needed for restoration of scheme adopted by the organisation. the energy supply system following a major supply disruption (grid

Appropriate security measures for smart grids 45

SM 3.2 Inventory of smart grid components/systems.

The provider should establish and maintain an inventory that represents the components and smart grid information systems.

Level Practices Evidence

restoration); o Corporate assets, systems and information necessary to ensure functional safety/plant security; o Corporate assets, systems and information necessary to ensure functional safety, to fulfil regulatory requirements such as unbundling requirements for instance, or that need to be implemented in order to fulfil other specific requirements.  Identify labelling/handling procedures for the classification schema defined.

SM 3.3 Secure configuration management of smart grid components/systems.

The provider should ensure that the base security configuration of a smart grid’s components/systems is identified, set and maintained for every instance of that component/system.

Level Practices Evidence

  Documented secure baseline configuration containing at least: A secure baseline configuration of smart grid components and information o Essential capabilities of operation; systems is developed, documented and maintained. o Restricted use of functions;  Configuration changes are tested, validated and documented before installing 1 o Ports, protocols and/or services allowed. on the operational smart grid information system.  Documented change management responsibilities and procedures.  Only authorized individuals are allowed to obtain access to smart grid  Documented and approved change control records. components and information systems for purposes of initiating changes, including upgrades, and modifications.   Documented results of the compliance activities. Periodical reviews of smart grid components and information systems in  Documented and approved exceptions to the configuration baseline order to ensure compliance with established secure configuration baseline 2 and applicable laws and regulations are performed. containing the alternative controls in place to ensure the confidentiality,  availability and integrity of the smart grid component. Exceptions to the configuration baseline are identified, documented and approved.  Documented secure baseline configuration for development and test  A secure baseline configuration for development and test environments is

3

environments. managed separately from the operational baseline configuration.

46 Appropriate security measures for smart grids

SM 3.3 Secure configuration management of smart grid components/systems.

The provider should ensure that the base security configuration of a smart grid’s components/systems is identified, set and maintained for every instance of that component/system.

Level Practices Evidence

 Automated mechanisms are implemented to centrally manage, apply, and  Documented results of the execution of the automated tools. verify configuration settings.  Automated mechanisms enforce access restrictions and support auditing of the enforcement actions.

SM 3.4 Maintenance of smart grid components/systems.

The provider should establish and maintain activities for performing routine and preventive/corrective maintenance on the components and smart grid information systems.

Level Practices Evidence

 Proof maintenance and reparation operations.  Maintenance on smart grid information components is done in accordance  List of personnel authorized to perform maintenance. with manufacturer or vendor specifications and/or organizational requirements.

1

 A list of qualified personnel authorized to perform maintenance on the smart grid information system is elaborated, documented and available.  Access to Information data is controlled during the maintenance activities.  List of planned maintenance actions.  Maintenance activities are formally scheduled.   Formal authorization for remote maintenance activities and maintenance Approved equipment is used on maintenance activities.  equipment. Records of the maintenance operations are maintained.  Approved documented security and evaluation plans containing at least:  Remote maintenance activities are notified, authorized, planned and audited. 2 o  Remote maintenance activities are performed by defined and trained Date and time; o Person who performs the activity; contractor personnel using systems physically or logically disconnected from o Description of the activities performed; other systems and networks during a remote access session. o List of equipment removed or replaced.

 Documented and approved exceptions to the maintenance process  Additional controls should be implemented when maintenance activities 3 cannot be performed normally on smart grid information systems. containing the alternative controls in place to ensure the availability and integrity of the smart grid information system and components.

Appropriate security measures for smart grids 47

SM 3.5 Software/firmware upgrade of smart grid components/systems.

The provider should establish and maintain activities for software/firmware upgrade on the components and smart grid information systems.

Level Practices Evidence

  Documented inventory of affected systems. Smart grid components affected by recently announced flaws are identified.  Documented test results.  Software/firmware updates are tested for effectiveness and potential side

1

effects on organisational smart grid information systems and components before installation.   Evidences of the software/firmware inclusion into the secure configuration Software/firmware updates are incorporated into the secure configuration management process (see measure SM 3.2 Secure configuration management process.  List of manufactures single point of contact. management of smart grid components). 2  A single point of contact and communication channels for smart grid components security related issues with manufacturers or vendors have been identified.

 Documented and approved exceptions to the configuration baseline  Additional controls should be implemented when update activities cannot be 3 performed normally on smart grid information systems. containing the alternative controls in place to ensure the confidentiality, availability and integrity of the smart grid component.

SM 3.6 Disposal of smart grid components/systems.

The provider should establish and maintain activities for the secure disposal of smart grid components and smart grid information systems.

Level Practices Evidence

 Documented inventory of assets.  Smart grid information system and components are documented, identified, 1  and tracked. Labelling of smart grid components.

 Formal authorization for disposal of Smart grid information system  Smart grid information system components and information are checked to components and information. ensure that any sensitive data has been removed or securely overwritten  Documented results of secure wiping process. prior to disposal or reuse.

2

 List of authorized personnel.  Smart grid information system components and information are taken-off with prior authorization.  Disposal operations are performed by authorized personal.

48 Appropriate security measures for smart grids

SM 3.6 Disposal of smart grid components/systems.

The provider should establish and maintain activities for the secure disposal of smart grid components and smart grid information systems.

Level Practices Evidence

  Documented alternative procedures like secured destruction of the Alternative procedures for the secure remove of sensitive data are identified 3 component. when normal procedures cannot be applied for technical reasons.

SM 3.7 Security testing of smart grid components/systems.

Security testing activities on the smart grid components/systems should be performed in order to verify its security.

Level Practices Evidence

  Detailed security and stress test on the individual system components and on Security functions and capabilities of new components are tested on nonthe entire system and its essential functions using a representative system operational environments individually and with other components in order to configuration. ensure the security of the entire system.

1

 Results of integrity checks or system fails.  Where applicable and technically feasible integrity checks of security-relevant

settings and data at start-up are performed on a regular basis by the system or the security modules, respectively.  Documented testing activities containing at least:  Approved and documented security test and evaluation plans are included as o Objectives, roles, and responsibilities; part of the lifecycle of the smart grid component. o Scope of the plan;  Static code and vulnerability analysis tools are used on a regular basis to test 12 o smart grid components . Detailed results of the execution of the plan; 2  o Frequency of the test. Smart grid, SCADA systems and field devices are tested periodically to keep  Results of automated tools. under control the risk level.  Results of end-to-end test.  End to end test are performed by the organisation in order to verify the

security of smart grid components and information systems interconnected.

 Results of the additional security testing activities.  Additional security testing activities to determine the level of difficulty in 3  circumventing the security requirements of the smart grid information Results of the smart grid component certification process.

Appropriate security measures for smart grids 49

SM 3.7 Security testing of smart grid components/systems.

Security testing activities on the smart grid components/systems should be performed in order to verify its security.

Level Practices Evidence

system have been defined.  Recognised certification schemas are applied to smart grid components .

4.4 Domain 4: Personnel security, awareness and training

Control Objective:

The provider has established and maintains a personnel security, awareness and training program that supports a culture of cyber security for all relevant stakeholders and fosters the mutual exchange of security information between electric sector and information security professionals in the smart grid value chain.

SM 4.1 Personnel screening.

The provider should perform appropriate background checks on personnel (employees, contractors, and third-party users) if required for their duties and responsibilities.

Level Practices Evidence

 Screening records containing at least:  Individuals screening criteria is established and reviewed for organisation’s o Employment history; position.  o Verification of the highest education degree received; 1 Individuals are screened before the access to the smart grid information o Residency; systems is authorized. o Law enforcement records.

 Documented screening requirements.  The screening process is in line with the defined policies and regulations. 2   Individuals are rescreened based on a defined list of conditions. Records of rescreening process.

 List of personnel who have access to critical information assets.  Specific security clearance provided by governmental organisations is 3  required before the access to critical information assets. List of personnel that hold a security clearance.

50 Appropriate security measures for smart grids

SM 4.2 Personnel changes.

The provider should establish and maintain an appropriate process for managing changes in personnel (employees, contractors, third-party users) or changes in their roles and

responsibilities.

Level Practices Evidence

 Formal description of the key security roles and responsibilities.  Responsibilities for performing employment termination or change of  Proof of employment’s changes communication. employment are clearly defined and assigned.   Proof of logical and physical access review. Changes on personnel and operating arrangements are communicated to  Proof of organisation assets return. employees, customers, contractors or third parties.

1

 Logical and physical access to smart grid information systems are

reconsidered based on the personnel changes.  Organisation assets are returned upon termination of their employment,

contract or agreement.   Proof of exit interviews. Exit interviews are performed in order to ensure that individuals understand

any security constraints imposed by being a former employee and that proper

2

accountability is achieved for all smart grid information system-related property.   Proof of automated process. Automated process review access permissions that are initiated by personnel

3

changes.

SM 4.3 Security and awareness program.

The provider should establish and maintain a security awareness program across the organisation.

Level Practices Evidence

 Documented awareness and training program containing at least:  A security awareness and training program is available and approved by o Objectives, roles, and responsibilities; management.  o Scope; Basic security awareness briefings are provided to smart grid system users on 1 o Procedures that supports the awareness and training program. a regular basis.  Proof of security awareness briefings activities.  Records of the awareness activities for each user are maintained by the  Records of individual awareness activities. organisation.

2   The last planned review has been done according with the review process. Changes on smart grid information systems and procedures are reviewed for

Appropriate security measures for smart grids 51

SM 4.3 Security and awareness program.

The provider should establish and maintain a security awareness program across the organisation.

Level Practices Evidence

inclusion in the organisation security awareness and training program.  Meeting minutes of review sessions.  The awareness and training program is regularly reviewed and revised, based  List of contacts with security groups and associations. on the review and new insights, new risk aspects, incidents that occurred.  Documented contents of security awareness briefings.  Contents of security awareness briefings are based on specific requirements of the organization and the smart grid information system to which personnel have authorized access.  List of contacts with security groups and associations.  Contacts and communication channels with security groups and associations  Documented communication channels. have been established in order to stay up to date with the latest 3  Records of simulated actual cyber-attacks. recommended security practices, techniques, and technologies.  Meeting minutes of review sessions.  Practical exercises that simulate actual cyber-attacks are included in security awareness briefings.

SM 4.4 Security training and certification of personnel.

The provider should establish and maintain security training and personnel certification programmes, taking into account its needs based on their roles and responsibilities.

Level Practices Evidence

 Proof of training activities.  Basic security training activities are provided to smart grid system users  Records of individual training activities. before authorizing access to the smart grid information system, when required by smart grid information system changes or on a defined

1

frequency.  Records of the training activities for each user are maintained by the organisation.  Documented contents of security training.  Contents of security training are based on assigned roles and responsibilities 2 and specific requirements of the organization and the smart grid information system to which personnel have authorized access.  Results of individual certification process. 3  Recognised security certifications are provided to organisation personnel.

52 Appropriate security measures for smart grids 4.5 Domain 5: Incident response & information knowledge sharing

Control Objective

The provider has established and maintains an incident response and information knowledge sharing process that prevents, resolves and recovers from cyber events, effectively containing the damage, and allows sharing cyber security information for internal and external entities.

SM 5.1 Incident response capabilities.

The provider should establish and maintain capabilities to respond against cyber security incidents.

Level Practices Evidence

 Documented security incidents.  Smart grid information system and network incidents are tracked and  Records of reported security incidents. documented by the organisation.

1

 Smart grid information system and network incidents security incidents are reported by the organisation.   Documented roles and responsibilities containing at least: An incident response program approved by management is developed and o Roles and responsibilities in relation to various types of incidents; maintained in the organisation. o Responsible personnel to lead the response effort if an incident  Personnel involved in the incident response program are trained in their incident response roles and responsibilities with respect to the smart grid occurs; o Response teams need to be formed. information system and receive refresher training on an organization-defined  Management commitment with the incident response program. frequency.  Records of individual training activities.  An incident handling capability for security incidents is implemented and  Description of the incident handling capability containing at least the 2 reviewed by the organisation. following procedures: o Preparation; o Detection; o Analysis; o Containment; o Mitigation; o Recovery.

3   Meeting minutes of review sessions. Corrective measures are reviewed to ensure their effectiveness and

Appropriate security measures for smart grids 53

SM 5.1 Incident response capabilities.

The provider should establish and maintain capabilities to respond against cyber security incidents.

Level Practices Evidence

adequately implementation.  Records of cyber exercises.  Lessons learned from incident handling activities are incorporated to incident response procedures.  Regular cyber exercises and related results to test the incident response effectiveness are scheduled and documented.

SM 5.2 Vulnerability assessment.

The provider should establish and maintain vulnerability assessment activities on the smart grid information systems.

Level Practices Evidence

 Documented vulnerability scans reports.  Smart grid information systems are monitored and evaluated on a regular 1 basis to identify vulnerabilities that might affect the security of a smart grid information system.  List of manufactures single point of contact.  A single point of contact and communication channels for information  Proof of vulnerability assessment activities in legacy systems. security related issues with manufacturers or vendors have been identified.

2

 Security vulnerabilities of the legacy systems and technologies related are part of the vulnerability assessment activities.   Records of vulnerabilities information sharing. Information obtained from the vulnerability scanning process is shared with 3 designated personnel throughout the organisation and authorities to help eliminate similar vulnerabilities in other smart grid information systems.

SM 5.3 Vulnerability management.

The provider should establish and maintain an appropriate vulnerability management plan in order to manage vulnerabilities on smart grid information systems.

Level Practices Evidence

 Documented vulnerability management plan.  A vulnerability management plan that manages the testing, installation and 1 documentation of security patches and system updates have been established and documented. 2  Approved documented actions on smart grid information systems.  The installation and de-installation of patches and updates is done manually

54 Appropriate security measures for smart grids

SM 5.3 Vulnerability management.

The provider should establish and maintain an appropriate vulnerability management plan in order to manage vulnerabilities on smart grid information systems.

Level Practices Evidence

by authorized and trained staff and authorized by the system owner.   Documented vulnerability management plan revisions. The installation or de-installation of patches is reviewed to ensure the  Documented and approved exceptions to the defined actions containing the adequately implementation of the defined actions. 3 alternative controls in place to ensure the confidentiality, availability and  Exceptions to defined actions and approved mitigating actions are identified and documented. integrity of the smart grid information systems.

SM 5.4 Contact with authorities and security interest groups.

The provider should establish and maintain contacts with authorities and security interest groups to be aware of vulnerabilities and threats.

Level Practices Evidence

  List of authorities contacts containing at least: Contacts and communication channels with relevant authorities have been o National and international agencies together with structures for coidentified and established. operation for the protection of critical infrastructures; 1 o National and international CERT organizations; o Disaster control organizations and disaster-relief teams.  Documented communication channels.

 List of contact persons for meteorological services.  Contacts and communication channels with corresponding local, regional and  List of meteorological information services subscribed. national meteorological services and corresponding information services have  List of contacts with security groups and associations. been identified and established.

2

 Documented communication channels.  Contacts and communication channels with security interest groups in order to be up-to-date regarding cyber security practices on smart grids have been identified and established.  Records of information exchange and cooperation activities.  Cross-industry incident information exchange and cooperation to learn from 3  the experiences of others in encouraged and promoted. Documented communication channels.

Appropriate security measures for smart grids 55 4.6 Domain 6: Audit and accountability

Control Objective:

The provider has established and maintained an audit and accountability process that enables sufficient logging capabilities in the smart grid systems and components and provides valuable log data for analysis.

SM 6.1 Auditing capabilities.

The provider should establish and maintain auditing capabilities on the smart grid Information systems and components.

Level Practices Evidence

 List of auditable events.  A list of smart grid information systems and components auditable events  Audit records containing at least: based on the risk assessment activities has been identified and established.  o Date and time of the event; Where applicable and technically feasible smart grid information systems and o Component of the smart grid information system where the event components are configured to produce audit records of the list of events

1

identified previously. concurred; o Type of event; o User/subject identity; o Outcome of the event.

 List of privileged auditable events.  The list of auditable events includes the execution of privileged functions in  Documented defined set of actions in case of audit processing failures. the smart grid information systems and components.

2

 A set of actions have been identified and defined in case of audit processing

failures.   The last planned review has been done according with the review process. The list of auditable events is revised based on current threat data,  Meeting minutes of review sessions. assessment of risk, and post-incident analysis.  Proof of centrally audit records management.  Audit records generated by smart grid information systems and components

3

 Documented alternative countermeasures for audit records. are centrally managed.  Alternative requirements or countermeasures are identified when audit

records cannot be deployed for technical reasons.

56 Appropriate security measures for smart grids

SM 6.2 Monitoring of smart grid information systems.

The provider should establish and maintain monitoring activities on the smart grid Information systems and components.

Level Practices Evidence

  Proof of reviewed action on smart grid information system and components Smart grid information systems and components audit records are reviewed 1 audit records. and analysed for indication of inappropriate or unusual activity on a regular basis.   Proof of audit findings communications. Findings on smart grid information system and components audit records are 2  Documented communication channels. communicated to the designed management authority.

  Documented defined automated mechanism. Automated mechanism to integrate audit review, analysis, and reporting have been identified and established.

3

 Audit information is correlated across different repositories to gain organisation-wide situational awareness.

SM 6.3 Protection of audit information.

The provider should protect the audit information generated.

Level Practices Evidence

  Documented defined audit storage capacity. An audit storage capacity is defined for each smart grid information system  Documented defined audit retention time period. and components.

1

 An audit retention time period is defined for audit records.

 Documented defined security measures to protect audit records for  Smart grid information system and components audit records are protected for unauthorized access, modification or deletion. unauthorized access, modification or deletion.

2

  Documented defined accurate time sources. Smart grid information systems and components audit records are timestamped using agreed accurate time sources.  Documented agreed time sources.  Directly or indirectly interconnected systems with external partners uses a  Documented defined NTP systems used. common and agreed time sources (e.g. Central European Time (CET) or 3 Coordinated Universal Time (UTC)).  Use of non-internet synchronized NTP server or digitally signed NTP time messages.

Appropriate security measures for smart grids 57 4.7 Domain 7: Continuity of operations

Control Objective:

The provider has established and maintains a continuity of operations process that allows continuing or resuming operations of a smart grid information system in the event of disruption of normal system operation.

SM 7.1 Continuity of operations capabilities.

The provider should establish and maintain capabilities to ensure essential functions after disruption events on smart grid Information systems.

Level Practices Evidence

 Documented continuity operations plan containing at least:  A continuity operations plan approved by management is developed in the o Roles and responsibilities; organisation.  o Scope of the plan; Disruptions root causes are analysed and reported to the management. o Capabilities to recover and reconstitute the smart grid information system to a known secure state after a disruption, compromise, or failure; o Compensating security controls for the organisation-defined circumstances that inhibit recovery to a known secure state; o Fail-safe procedure upon the loss of communications with other

1

smart grid information systems or the loss of the smart grid information system itself; o Backup procedures; o Agreements with third parties services or defined alternate supply services like alternate power supply resources.  Management commitment with the continuity operations plan.  Records of the management review.  Documented alternate power supply.

 Personnel involved in the continuity operations plan are trained in their roles  Records of individual training activities. and responsibilities with respect to the smart grid information system and  Documented results of the continuity of operations test activities.

2

receive refresher training on an organization-defined frequency.  Last planned review has been done according with the review process.  Operating safety functions are identified and protected in accordance with  Meeting minutes of review sessions.

58 Appropriate security measures for smart grids

SM 7.1 Continuity of operations capabilities.

The provider should establish and maintain capabilities to ensure essential functions after disruption events on smart grid Information systems.

Level Practices Evidence

sector-specific standards and legal requirements.  Documented alternate power supply.  The continuity of operations plan is tested and updated on a regular basis.  Documented protection measures for operating safety functions such as:  A long-term alternate power supply for the smart grid information system o Use of dedicated, isolated communication systems for the that is capable of maintaining minimally required operational capability in the transmission of safety related data communications; event of an extended loss of the primary power source is provided by the o Independency of operating safety functions. organisation.  Documented requirements for an alternate storage site containing at least:  Requirements for an alternate storage site are identified and evaluated by o Smart grid information system backups and the transfer rate of the organisation.  Requirements for an alternate control centre are identified and evaluated by backup information to the alternate storage; o Potential accessibility problems at the alternative storage site in the the organisation.  Requirements for less likely attacks but with a high impact (e.g. event of an area-wide disruption or disaster and explicit mitigation electromagnetic pulse) are identified and evaluated by the organisation. actions; o Geographically locations (e.g. city, close to the see, etc.); o Agreement with third parties.  Documented requirements for an alternate control centre containing at least: 3 o Equipment, telecommunications, and supplies required; o Potential accessibility problems at the alternative control centre in the event of an area-wide disruption or disaster and explicit mitigation actions; o Geographically locations; o Agreement with third parties.  Documented smart grid information system configuration in alternate systems.  Documented requirements for less likely attacks but with a high impact.

SM 7.2 Essential communication services.

The provider should establish, maintain and test essential/emergency communication services in case of major disasters.

Level Practices Evidence

Appropriate security measures for smart grids 59

SM 7.2 Essential communication services.

The provider should establish, maintain and test essential/emergency communication services in case of major disasters.

Level Practices Evidence

  Documented communication channels covering the following stakeholders: Essential communication links are identified and established with o Operating and emergency staff in central or decentralized locations; internal/external emergency teams and organisations. o Internal and external crisis management; o Power stations; o Distributed energy producers; o Transmission and distribution grid operators; o Meteorological organizations; o Flood prevention organizations;

1

o Fire service organizations; o Disaster relief organizations; o Safety authorities; o Telecommunication service providers; o Medical institutions; o Other national or local organizations that handle essential public services.   Documented communication channels. Essential data and communication links with emergency control systems and 2 related subcomponents and emergency alarm and monitoring systems and related subcomponents are identified and established.   Documented requirements for an alternate control centre containing at least: Requirements for an alternate communication services are identified and o Agreements to permit the resumption of operations for the safe evaluated by the organisation. operation of the smart grid information system within an organization-defined time period;

3

o Primary and alternate telecommunication service agreements containing priority-of-service provisions in accordance with the organisation’s availability requirements.

60 Appropriate security measures for smart grids 4.8 Domain 8: Physical security

Control Objective:

The provider has established and maintains a physical security program that restricts the access to smart grid information systems and components only to authorized personnel.

SM 8.1 Physical security.

The provider should establish and maintain the appropriate physical security of the smart grid facilities/components/systems.

Level Practices Evidence

 Documented diagram of security perimeters.  Security perimeters are used to protect areas that contain information and  Documented description of entry controls. information processing facilities.  Documented diagram with special security requirements.  Secure areas are protected by appropriate entry controls to ensure that only  Documented physical protection controls against natural or man-made authorized personnel are allowed access.  Physical security controls are designed and applied to offices, rooms and disaster. 1  Documented physical protection controls and guidelines on working areas. facilities.  Documented diagram of delivery and loading areas.  Physical protection and guidelines for working in secure areas are designed and applied.  Access points such as delivery and loading area and other points where unauthorized persons may enter the premises are controlled.

 Documented diagram and description of entry controls on peripheral sites.  Physical access controls is considered for peripheral sites where sensitive  Documented diagram on control centres. process control equipment is located.   Documented diagram on equipment rooms. Measures to ensure the physical security of control centres, where central control systems such as control servers, HMI and supporting systems are

2

housed, are designed, developed and applied.  Measures to ensure the physical security of equipment rooms where control system facilities used by providers are located, are designed, developed and implemented.   Documented diagram and description of entry controls on peripheral sites. Measures to ensure physical security of the peripheral sites where control 3  Documented mitigation measures on peripheral sites. system facilities used by providers are located, are designed, developed and applied.

Appropriate security measures for smart grids 61

SM 8.1 Physical security.

The provider should establish and maintain the appropriate physical security of the smart grid facilities/components/systems.

Level Practices Evidence

 Mitigation controls have been identified on equipment where is not possible to achieve a comprehensive level of physical protection for unmanned peripheral sites.

SM 8.2 Logging and monitoring physical access.

The provider should establish and maintain capabilities for logging and monitoring the physical access to the smart grid facilities/components taking into account the criticality of the facility.

Level Practices Evidence

 List of personnel with authorized access.  A list of personnel with authorized access to facilities containing smart grid  Formal appointed of the backup person. information systems and appropriate authorization credentials (e.g., badges,  List of authorized visitors. identification cards) is maintained by the organisation.  A designated official within the organisation to review and approve the list of

1

personnel with authorized access has been identified.  Visitors are authenticated before authorizing access to the facility.  Visitors are escorted as required according to security policies and procedures.   Records of visitors access to the facility. Visitor’s access records to the facility are maintained by the organisation.   Documented description of monitoring equipment. 2 The Physical access to the smart grid information system is monitored by the organisation.  Proof of record’s review.  Physical access records are reviewed on a regular basis. 3  Documented defined period of retention.  Physical access records are retained as dictated by applicable regulations or based on an organization-defined period by approved policy.

62 Appropriate security measures for smart grids

SM 8.3 Physical security on third party premises.

The provider should protect equipment located outside of the organisations' own grounds or premises in areas that are the responsibility of other utilities against physical and environmental threats.

Level Practices Evidence

 Documented security controls containing at least:  Equipment installed on the third party’s premises owned by other provider o Limits of the responsibility and interface with other providers is (e.g. transfer station) is sited in protected areas where physical and environmental security is addressed as described in previous security identified and specified; o Agreements with the other organization for the supply of supporting measures. 1  Equipment installed on the customer premises is protected against physical infrastructure services.  Documented security controls on customer premises containing at least: and environmental threats. o Limits of the responsibility and interface with customers is identified and specified. o Alarms and tamper protection measures.

 Documented diagram of equipment installed on third parties premises.  Equipment installed on the third party’s premises is isolated from other third 2  Records of interface monitoring activities. party equipment.  The status of the interconnected interfaces is monitored.  Documented results of auditing activities.  Auditing activities to ensure the implementation of necessary security  Documented agreements with third parties. requirements in the third party are performed by the organisation.

3

 Agreements are in place in order ensure the timely access to the equipment installed on the third party’s premises under special defined circumstances

4.9 Domain 9: Information systems security

Control Objective:

The provider has established and maintains information systems security controls that ensure that the smart grid information systems and components are logically accessed only by authorized entities and that its information is properly protected.

SM 9.1 Data security.

The provider should implement security requirements in order to protect the information on smart grid information system.

Appropriate security measures for smart grids 63

Level Practices Evidence

 Documented minimum security requirements for stored data.  Minimum security requirements are defined for stored data.

1

 Documented information classification levels.  Information is classified in terms of value, legal requirements, sensitivity and  Documented set of security requirements based on information classification criticality to the organisation.  levels. An appropriate set of procedures for information labelling and handling 2  should be developed and implemented in accordance with the classification Identify labelling/handling procedures for different categories of information scheme adopted by the organisation. defined.

  Documented procedures for the disposal or destruction of data. Detailed procedures for the disposal or destruction of smart grid information  The last planned review has been done according with the review process. system information are defined.

3

 Meeting minutes of review sessions.  Information that requires special control or handling is reviewed on a periodic

basis to validate that special handling is still required.

SM 9.2 Account management.

The provider should establish and maintain system/groups/user accounts on smart grid information systems.

Level Practices Evidence

  Documented access management procedure containing at least: Smart grid information system accounts have been identified and managed. o Account types;  Management approval is required prior to establishing accounts. o Access rights;  Smart grid information system accounts are reviewed on a regular basis.  o Privileges. 1 Account managers are notified when smart grid information system users are  Proof of management approval prior establishing accounts. terminated, transferred, or smart grid information system usage changes.  Proof of information system account review.

 Proof of accounts notification to account managers.

  Results of monitoring activities on guest/anonymous/group accounts. The use of guest/group accounts is monitored by the organisation.   Records of account actions. Smart grid information system automatically disables inactive accounts after 2 an organization-defined time period.  The account creation, modification, disabling, and termination actions is

recorded on smart grid information systems.

64 Appropriate security measures for smart grids

SM 9.2 Account management.

The provider should establish and maintain system/groups/user accounts on smart grid information systems.

Level Practices Evidence

  Documented description on automated mechanism used. Automated mechanism is employed to support the management of smart  Proof of terminated temporary and emergency accounts. grid information system accounts. 3  Smart grid information system automatically terminates temporary and emergency accounts after an organization-defined time period for each type of account.

SM 9.3 Logical access control.

The provider should enforce logical access to authorised entities on smart grid information systems and security perimeters.

Level Practices Evidence

  Documented methods of access control containing at least: Allowed methods of access control to the smart grid information system are o Authentication type; identified and documented. o Authorization schema.  Smart grid information system enforces assigned authorizations for  List of smart grid information system users and related access rights. controlling access to the smart grid information system in accordance with 1  Records of disabled accounts after a defined limit of consecutive invalid login organization-defined policy.  User accounts are granted with the most restrictive set of rights and attempts.

privileges or access needed for the performance of specified tasks.  Smart grid information system accounts are temporarily disabled after a defined limit of consecutive invalid login attempts.   List of authorized users who can access to security functions. Smart grid information system functions are separated through assigned access authorizations.

2

 Security functions are restricted to the least amount of users necessary to ensure the security of the smart grid information system.  Documented alternative countermeasures such as:  Alternative requirements or countermeasures are identified when allowed o Secure unique password; methods of access control cannot be implemented (e.g. legacy system that o Real-time logging and recording of unsuccessful login attempts; cannot support a strong password policy).

3

 o Real-time alerting of a management authority for the smart grid Restrictions in the number of concurrent sessions are defined and implemented by the organisation. information system when the number of defined consecutive invalid access attempts is exceeded.

Appropriate security measures for smart grids 65

SM 9.3 Logical access control.

The provider should enforce logical access to authorised entities on smart grid information systems and security perimeters.

Level Practices Evidence

 Documented defined number of concurrent sessions.

SM 9.4 Secure remote access.

The provider should establish and maintain secure remote access where applicable to smart grid information systems.

Level Practices Evidence

 Documented method of remote access.  Allowed methods of remote access to smart grid information system are  Documented restrictions in the use of wireless technologies. identified and documented.   Documented authentication and encryption methods. Restrictions in the use of wireless technologies are identified and

1

documented.  Wireless access to smart grid information system is protected using secure authentication methods and encryption controls.  Records of monitoring activities.  Remote access connections are approved and monitored.  The confidentiality and integrity of the remote access connections are 2 secured by secure cryptographic controls.  Remote sessions are terminated at the end of the session or after a defined period of inactivity.   Documented description of automated mechanism. Automated mechanisms are employed to monitor and control remote access

3

connections.

SM 9.5 Information security on information systems.

The provider should establish and maintain appropriate information security capabilities on information systems, to provide protection against malware, viruses and other common threats.

Level Practices Evidence

 Documented malicious code protection mechanisms.  Malicious code protection mechanisms are implemented by the organisation  Records of recent updates of malicious code protection mechanisms. on the smart grid information system.

1

  Records of periodical scans. The malicious code protection mechanisms are maintained up-to-date.  Malicious code protection mechanisms perform periodic scans on the smart

66 Appropriate security measures for smart grids

SM 9.5 Information security on information systems.

The provider should establish and maintain appropriate information security capabilities on information systems, to provide protection against malware, viruses and other common threats.

Level Practices Evidence

grid information systems.   Documented description of centrally management tools. The malicious code protection mechanisms are centrally managed.  Documented spam protection mechanism.  Smart grid information system prevents users from circumventing malicious 2  Use of whitelisting solutions, which restrict the execution of non-approved code protection capabilities.  software and code. Spam protection mechanisms are employed at system entry points and at workstations, servers, or mobile computing devices on the network.  Documented alternative countermeasures such as:  Alternative requirements or countermeasures are identified when malicious o Securing of all physical and logical data interfaces; code protection cannot be deployed for technical reasons. o Network isolation and implementation of segmented network

3

security zones that limit the impact of a malware incident; o Comprehensive system hardening measures to minimize the risk of malware incidents.

SM 9.6 Media handling.

The provider should establish and maintain secure procedures for the access, storage, distribution, transport, sanitization, destruction and disposal of the media assets.

Level Practices Evidence

  Approved media protection policy containing at least: A media protection policy that addressed the use and protection o Objectives, roles, and responsibilities for the media protection requirements for media assets is available and approved by management.  security program; The access, control, sharing, copying, transmittal and distribution of media o Scope of the media protection security program; assets is aligned with the information classification levels and protection o Management commitment with the media protection policy; required measures defined in the media protection policy. 1 o Information classification levels for media assets;  Media assets are marked in accordance with organisation-defined policy and o Protection required commensurate with the organisation procedures. information classification levels for media assets.  Use of external and internal marking labels on media assets.  Use of internal marking labels on smart grid information system output.

Appropriate security measures for smart grids 67

SM 9.6 Media handling.

The provider should establish and maintain secure procedures for the access, storage, distribution, transport, sanitization, destruction and disposal of the media assets.

Level Practices Evidence

 The media protection policy is regularly reviewed at planned intervals of  Last planned review has been done according with the review process. significant changes occur to ensure its continuing suitability, adequacy, and  Meeting minutes of review sessions. effectiveness.  Documented test results for sanitization equipment. 2  The organisation use secure procedures to sanitize the information from  Documented secure procedures in order to remove the information from media assets before the disposal or re-use. media assets.  Sanitization equipment is tested in order to verify its correct performance on a regular basis.  Use of protected areas for sensitive smart grid information system media.  The media protection policy is regularly reviewed at planned intervals of  Documented organisation-defined security measures for the transport of significant changes occur to ensure its continuing suitability, adequacy, and media assets covering the accountability of media assets during the transport effectiveness. 3  Smart Grid information system media is physically managed and stored in outside controlled areas and restricting the transport of media assets only for protected areas based on its information classification level. authorised personnel.  Media assets are protected during transport outside controlled areas using organisation-defined security measures.

4.10 Domain 10: Network security

Control Objective:

The provider has established and maintains a secure network engineering program that prevents security controls from being circumvented.

SM 10.1 Secure network segregation.

The provider should establish and maintain a segregated network for the smart grid information system.

Level Practices Evidence

  Proof of system management and user functionality partitioning. Smart grid information system management functionality is separated from

1

smart grid information system user functionality.

68 Appropriate security measures for smart grids

SM 10.1 Secure network segregation.

The provider should establish and maintain a segregated network for the smart grid information system.

Level Practices Evidence

  Documented network design and configuration containing at least: Where applicable and technically feasible the network infrastructure of o Physical, virtual and logical network connections; process control systems is divided into multiple zones with different functions o Network protocols and ports; and protection requirements. 2  o Network perimeter components; Where applicable and technically feasible the networks and distributed o Technical and operational domains. systems should be divided into independent horizontal segments.  Where applicable and technically feasible a specific network for patch management functions (e.g. testing) is defined.   Documented description of protection network devices. Network zones and network segments are separated by firewalls, filtering

3

routers or gateways.

SM 10.2 Secure network communications.

The provider should establish and maintain secure communications across the segregated network.

Level Practices Evidence

 Proof of communication partitioning.  The smart grid information system management communication path is 1 physically or logically separated from the telemetry/data acquisition services communication path.  List of implemented communication standards and protocols.  Where technically feasible, smart gird information systems (including SCADA  List of identified external connections. components) only use secure communication standards and protocols which provide integrity checks, authentication and, if applicable, encryption.  Secure communications are used for remote administration or transmission of user log-on information.

2

 Network connections to external networks are deployed only using communication protocols approved by the provider and in compliance with the security policies in effect.  External smart grid information system and communication connections are identified and protected from tampering or damage. 3  Documented list of authorized control system commands and messages.  Smart grid information system routes all remote accesses through a limited

Appropriate security measures for smart grids 69

SM 10.2 Secure network communications.

The provider should establish and maintain secure communications across the segregated network.

Level Practices Evidence

number of managed access control points.  Documented list of authorized information flows.  Only authorized communications and information flows are exchanged over  Documented description of protection network devices. the communication link.  Where technically feasible, intrusion detection systems and intrusion prevention systems (signatures based or behavioural) are implemented on smart gird information systems (including SCADA components) and/or network (especially in field devices networks).  Network connections to external networks are routed via especially hardened application proxies, which are located in a separate network zone (demilitarized zone) specifically for this purpose.

70 Appropriate security measures for smart grids 5 Catalogue of security measures This section contains a summary of the aboved described domains and cyber security measures.

Domain List of Security Measures

Appropriate security measures for smart grids 71 6 Mapping with ISO/IEC 27002, NISTIR 7628 and ISO/IEC TR 27019 This section contains a mapping between the between the defined security measures and the standards ISO/IEC-27002, NISTIR-7628 and ISO/IEC TR 27019.

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

72 Appropriate security measures for smart grids

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

Appropriate security measures for smart grids 73

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

74 Appropriate security measures for smart grids

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

Appropriate security measures for smart grids 75

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

76 Appropriate security measures for smart grids

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

Appropriate security measures for smart grids 77

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

78 Appropriate security measures for smart grids

Domain List of Security Measures ISO/IEC-27002 – ISO/IEC TR 27019 NISTIR-7628

Appropriate security measures for smart grids 79 Annex I - Glossary The appropriate security measures for smart grids have been selected using a generic terminology that is detailed below, as follows:  Smart grid: an upgraded electricity network to which two-way digital communication between supplier and consumer as well as between smart grid components, intelligent metering and monitoring systems have been added. In this domain, it is important to highlight the importance of the human factor as a key component of the smart grid;  Smart grid information system: reflects the following key elements: o Information and communications technology (ICT) components: like computer or telecommunication networks; o Industrial control systems: like supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as skid-mounted Programmable Logic Controllers (PLC); o Operational Technologies: like firmware or operating systems.  Smart grid components: elements or devices that represent part of the smart grid information system;  Media assets: this term includes compact discs, digital video discs, erasableprogrammable read-only memory and embedded assets, tapes, printed reports, and documents;  Provider: stakeholder which provides services to the smart grid value chain, such as: o Transmission System Operator (TSO): entity responsible for managing the security of the Transmission system in real time and co-ordinate the supply of and demand for electricity; o Distribution System Operator (DSO) : entity responsible for (a) operating, (b) ensuring the maintenance of, (c) if necessary, developing the distribution system in a given area and, where applicable, its interconnections with other systems; and (d) for ensuring the long term ability of the system to meet reasonable demands for the distribution of electricity; o Electricity generator: legal entity that produces electric energy and puts it into the system; o Customer: entity that purchases electricity for the purpose of use; 80 Appropriate security measures for smart grids o Electricity market: all operations related to the purchase and sale of power energy. In the electricity market, the commodity is the electrical energy which is purchased, sold or trade on short-term. o Prosumers: combination of the roles of consumer and producer. In the energy context is the combination of the roles generator and energy user.  Communication network: platform which interconnects exchange data among all devices within the smart grid infrastructure;  Supervisory Control and Data Acquisition (SCADA) : systems for the control of each substation, as well as for the management of the entire smart grid network;  Distributed control system (DCS): system used to monitor and control systems from the measuring instrument to the control console;  Cyber security: is the preservation of confidentiality, integrity and availability of information in cyberspace;  Cyberspace: is a complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form;  Domain: in the context of this study a domain is a set of measures which have a common purpose. A domain contains two key elements: o Control objective: the desired effect of the control; o Appropriate security measures to fulfil the control objective. Each security measure contains the following elements:  Examples of the security measure which highlight how the proposed security measure has been implemented in other security frameworks;  Practices: provides information in order to design a certain control on the organisation;  Sophistication level: indicates the implementation sophistication of the measure;  Evidence: provides information in order to verify that an organisation has implemented the practice. The above definitions were selected based on the taxonomy that was most used by the participants in the study, and based on observations collected during the extensive desk research performed. Appropriate security measures for smart grids 81 Annex II – References 82 Appropriate security measures for smart grids Appropriate security measures for smart grids 83 P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu