Switchyard Access Flashcards
What role does NERC play in relation to CIP Standards
NERC develops CIP Standards
What role does WECC play in relation to CIP Standards
WECC enforces CIP Standards
What role does FERC play in relation to CIP Standards
FERC regulates CIP Standards
What body has the legal authority to enforce compliance with NERC reliability standards?
WECC
NERC is the acronym for:
North American Electric Reliability Corporation
What CIP Standard addresses training requirements?
CIP-004
What CIP Standard addresses physical security
CIP-006
Network devices that make up the logical border surrounding the assets critical to the Bulk Electric System (BES) is known as
Electronic Security Perimeter (ESP)
What CIP Standard addresses the Electronic Security Perimeter?
CIP-005
What CIP Standard addresses Systems Security Management?
CIP-007
What action do you need to take if an ODN task is infeasible without the use of removable media?
File for an exemption and as a first step complete the correct form on the PG&E Intranet
Why is unapproved software regarded as a threat to security?
It may interfere with the proper operation of PG&E systems
A breach in cyber security could lead to
Loss of productivity
List two ways entrances and exits are controlled
- Automatic gates are controlled via phone, keycard, station key or remote control.
- Facilities are surrounded by a chain-link fence with gates that are to remain locked when authorized personnel are not present.
List 4 ways that automatic gates are controlled
phone, keycard, station key or remote control
What must be entered into the log book upon entering a facility
Name, affiliation, entry and exit times
Name 3 possible security problems at facilities
Unauthorized visitors or trespassers
Fences may be cut, washed away or otherwise breached
Buildings may be vandalized or broken into.
What CIP Standards specifically address access control?
CIP-003, CIP-004, CIP-005, CIP-006
How long can a door be held open before an alarm is received?
20 seconds
Name two methods used to protect information
Assigning a sensitivity level to information
Using good password practices
Name two ways to protect information
Don’t leave work orders in copy rooms
Only release or share information on a business “need to know” basis
Name three events that should be reported as cyber security incidents
Unexplained account lockouts
Unknown network connections
Outages impacting critical operations
Cyber security incidents must be reported to
Electric Sector Information Sharing and Analysis Center (ES-ISAC)
How often must the Cyber Security Incident Response Plan be updated?
Within 30 calendar days of any changes
What CIP Standard specifically addresses Recovery of Assets?
CIP-009
