draft conference call summary smart grid task force … grid task force sgtf dl/sgtf...sgtf...

116-390 Village Blvd. Princeton, NJ 08540

609.452.8060 | www.nerc.com

Draft Conference Call Summary Smart Grid Task Force (SGTF)

Smart Grid Task Force (SGTF) February 4, 2010 | 10:30 a.m. – 11:30 a.m. The fourth conference call of the North American Electric Reliability Corporation’s (NERC) Smart Grid Task Force (SGTF) was held on February 4, 2010. The conference call announcement and agenda are provided in Exhibit A and the attendance list is provided in Exhibit B. SGTF Chair Mr. McCurley presided over the call. Welcome NERC Staff Coordinator Mr. Bennett welcomed conference call participants. Participants introduced themselves when dialing into the call. (Exhibit B) Antitrust Guidelines Mr. Bennett reviewed the NERC Antitrust Compliance Guidelines. Chair Remarks Mr. McCurley introduced himself as the Chair and thanked everyone for participating in the call. Review Agenda Mr. Bennett reviewed the agenda presented in Exhibit A. Table of Contents Outline Discussion A table of contents outline (Exhibit C) for the SGTF report was discussed. Mr. McCurley reviewed the general layout of the document and Vice Chairs reviewed chapters associated with their subgroups. Mr. McCurley suggested adding a brief overview of the bulk power system in the Introduction section of the report to provide context and background for readers who are less familiar with the system. Mr. Kotting concurred with this addition and agreed that it would add value. Mr. Vartanian suggested adding material to provide a “baseline” perspective of the current state and operation of the gird that would set up the report to explain the benefits of smart grid and allow for an analysis of any gaps. Mr. Vartanian noted that he would provide a document from SCE and NETL on this topic for reference.

SGTF Conference Call February 4, 2010

2

Mr. Gupta noted that adding a glossary would be helpful and the group agreed. Mr. Wohnig, Mr. Thanos, and Ms. Zdenek agreed to contribute to this effort. Mr. Wohnig added that creating a hierarchy of terms would be a sensible approach to avoid conflicts of definitions. The hierarchy may start with the NERC (Reliability Standards) Glossary, followed by NIST framework glossary terms, followed by DOE defined terms, followed by other and developed terms. Mr. Resek and Mr. Kotting added that the report should include the definition and references to its source. Ms. Zdenek suggested that a team be formed to work on this section of the project. Ms. Whitaker reviewed the purpose of the Characteristics chapter of the report and noted that the Characteristics group plans to have a subgroup call in two weeks to continue work on the matrix that it has developed to catalog the devices and functions of the Smart Grid. Everyone was invited to participate. Mr. Myrda and Mr. Kotting reviewed the purpose of the Planning and Operations and Cyber Security chapters of the report outline. Mr. Wepman inquired about how cyber security would be addressed with relation to Operations and Planning. Mr. Kotting noted that it would be largely covered in the Planning and Operations chapter and that the Cyber Security chapter would provide a narrative overview of the situation. It was suggested that a subsection on security should be included to address any other matters not covered within the Planning and Operations chapter. Mr. Gupta noted that the metrics section was moved to Planning and Operations chapter but cyber security metrics may be important to add to the report. Mr. Myrda noted that the metrics section was added to the Planning and Operations chapter because it was difficult to consider the metrics in a vacuum and this seemed more workable. Members discussed the merits of creating a matix to catalog metrics and noted that the Characteristics matrix could provide a good start. Mr. Thanos noted that the R&D section should include material on cyber security and Mr. Bennett agreed this will be a valuable contribution to the report. Ms. Ilic was unable to join the call but Ms. Miu indicated she would contact her to share this information. Work Plan Discussion Due to time limitations, this discussion was curtailed to several minutes. Mr. Bennett expressed that the intent of the Work Plan was to identify the tasks necessary for each subgroup to complete its contribution to the report as identified in the table of contents outline previously discussed. Next Meeting NERC Staff and the SGTF Chairs will meet in Arlington, VA on February 26, 2010 to write more of the content of the report and follow-up on discussion items during this call. Mr. McCurly proposed a second in-person meeting and the group discussed viable options. The week of March 29 to April 2 was determined to be the most available near-term opportunity so

SGTF Conference Call February 4, 2010

3

Mr. Bennett agreed to create a poll to decide the best dates for maximum participation. Volunteers were requested for a venue. Adjournment Mr. McCurley thanked all callers for participating and the meeting adjourned at 11:30 a.m. Respectfully submitted, Aaron Bennett NERC Staff Coordinator

Exhibit A

Conference Call Announcement: From: Aaron Bennett [mailto:[email protected]] Sent: Tuesday, January 19, 2010 12:54 PM To: [email protected] Subject: NERC SGTF - 4th conf call - 2/4/10 NERC SGTF, Thank you for participating in the poll indicating your availability earlier this month. Based on 48 responses, the best time for the call was identified to be Friday 2/4/10 at 10:30am-11:30am Eastern. Call information is provided below with a tentative agenda.

Conference Call Smart Grid Task Force (SGTF) Thursday, February 4, 2010 | 10:30 – 11:30 a.m. Eastern Dial in: 866-740-1260 Access Code: 5247003 Tentative Agenda:

1. Introductions and Welcome 2. Antitrust Guidelines 3. Review report outline (to be distributed prior to the call) 4. Review work plan (to be distributed prior to the call) 5. Adjourn ______________________________________ Aaron A. Bennett Engineer of Reliability Assessments North American Electric Reliability Corporation

Exhibit B

116-390 Village Blvd. Princeton, NJ 08540

609.452.8060 | www.nerc.com

Smart Grid Task Force Conference Call Attendance List

February 4, 2010 | 10:30 a.m. – 11:30 a.m., Eastern

Name Organization Sandy Aivaliotis Nexans Sandy Bacik Sensus Joe Bucciero Bucciero Consulting, LLC

Jim Calore PSE&G Thomas Dagenais American Transmission Company Dave Dalva Cisco Systems Christopher Eisenbrey EEI Rich Foley APS - Arizona Public Service Co. Richard Gordus ComEd Neil Greenfield American Electric Power Vinit Gupta Entergy Services Rodney Hardiman Southern Company David Hardin Automation Federation (Invensys Global Development) Edward Hedges KCP&L Gavan Howe Howe Brand Communications Deepa Kundar Texas A&M University Chris Kotting NARUC (Public Utilities Commission of Ohio) Mike LaMarre Austin Energy Donald Lynd Consumers Energy Madhav Manjrekar Siemens Paul McCurley NRECA Douglas McGinnis Exelon Karen Miu Drexel University Nathan Mitchell American Public Power Association Nelson Muller Open Access Technology International, Inc. (OATI) Paul Myrda EPRI Avni Patel Duke Energy (primary)

Exhibit B

2

Farrokh Rahimi Open Access Technology International, Inc. (OATI) - Alternate

Bhasker Rao Fortech Software Inc. Jim Resek KEMA Nano Sierra FERC John Skliutas GE Energy Bill Souza GridWise Alliance (PJM) Daniel Thanos GE EntSol, Digital Energy

Eli Turk Canadian Electricity Association Charlie Vartanian A123 Systems Chris Villarreal CPUC Joshua Wepman SAIC Virginia Whitaker E.ON US Ernest Wohnig Booz Allen Hamilton Pamela Zdenek BP US Cogens

NERC STAFF Aaron Bennett NERC - RAPA

SGTF Report – TOC Outline

Page 1 of 2

Section objective comments in italic. EXEC SUMMARY

• Executive Summary REPORT MAIN BODY

• Chapter 1– Introduction o Overview of report. Emphasize far-reaching impacts (good/bad) of Smart Grid, a few

broad statements on general concepts, how it will involve more data and automation to integrate, and how it includes more than PMU, AMI, and PHEV. Review the scope of work for the SGTF. Introduce cyber security as cross-cutting pervasive issue and explain its treatment in this report. Discuss importance of interoperability.(3 pages)

• Chapter 2 – Characteristics of the Smart Grid

o Detailed review of Smart Grid that lays foundation for report and industry discussion. Relies upon established work. Broad in scope of material covered to be inclusive (IED, RTU, IVVC, SST, PLC, DFACTS, HSIL, DSI, etc.) but remains high-level. (20 pages)

o Definition of Smart Grid based on policy statements/etc. o Summary of devices and systems (+interoperability) with subgroup developed material

BPS Distribution-level

o Recommendations

• Chapter 3 –Planning and Operations: Maintaining and improving bulk power system reliability with Smart Grid.

o Recognizing that time frame separates planning from operations in BPS, and Smart Grid narrows/obscures this distinction; the issues are handled together here. Emphasis placed on nature of Smart grid to present both challenges to reliability and opportunities to improve reliability. Integrate references to applicable NERC Reliability Standards. (25 pages)

o Operations Impacts o Planning Impacts o Metrics o Recommendations

• Chapter 4 – Summary of Cyber Security and Critical Infrastructure Protection Concerns o Concise overview of material covered in chapters 1 and 2 with readable narrative of how

cyber impacts everything. Harmonize with NERC positions/statements on CIP/cyber. (3 to 5 pages)

o Recommendations on changes needed to plan, design, and operate the bulk power system from a cyber perspective.

• Chapter 5 – Conclusions and Recommendations

o Summarize overarching challenges to reliability and opportunities to improve reliability. Provide high-level recommendations to NERC and industry. (3 to 5 pages)

o Recommendations Req. coordination with external groups (e.g., NERC + NIST, NERC + IEEE) Req. coordination among external groups (e.g, FERC + NIST + FCC)

SGTF Report – TOC Outline

Page 2 of 2

SUPPORTING APPENDICES • Appendix I – Smart Grid Characteristics Tables

o Provide semi-detailed list of devices and systems that constitute Smart Grid (5 to 7 pages)

• Appendix II – Summary of Related NERC Reliability Standards o Summary of Reliability Standards that impact the Smart Grid as identified in Chapter 1.

(3 to 10 pages depending on if this section is just a list or a more detailed review) • Appendix III – Work Plan and Follow-on Work (if necessary)

o List next steps – TBD (3 to 5 pages) • Appendix IV – Research and Development Opportunities

o Highlight opportunities for R&D related to Smart Grid, drawing from material and issues addresses in Chapters 2 and 3. (5 to 7 pages)

• Appendix V – International Smart Grid Developments o Highlight existing and developing Smart Grid projects and systems outside North

America. (5 to 7 pages)

BACKGROUND • Abbreviations (3 to 4 pages) • Further Reading (1 to 2 pages) • SGTF Roster (5 pages)

SGTF Work Plan

Updated 1/21/10

February 2010

Smart Grid Task Force Work Plan

Smart Grid Task Force Work Plan December 2009 2

Committee Members

Paul McCurley Chair

Ginger Whitaker

Vice-Chair, Characteristics Subgroup

Paul Myrda Co-Vice-Chair, Operations and Planning Subgroup

Trevor Siegfried Co-Vice-Chair, Operations and Planning Subgroup

Sandy Bacik

Co-Vice-Chair, Cyber Security Subgroup Chris Kotting

Co-Vice-Chair, Cyber Security Subgroup

Marija Ilic Leader, Research and Development Task Group



TTaabbllee ooff CCoonntteennttss Purpos e ......................................................................................................................................... 4

Objec tives to be addres s ed .................................................................................................... 4

Activities ....................................................................................................................................... 5

Charac te ris tics Subgroup ........................................................................................................ 6

Identified Issues ...................................................................................................................... 6 Activity C1 – Develop Smart Grid List .................................................................................. 6

Opera tions and Planning Subgroup ..................................................................................... 8

Identified Issues ...................................................................................................................... 8 Activity OP1 – Outline Operations and Planning Chapter ..................................................... 8 Activity OP2 – Compile draft of Operations and Planning Chapter ...................................... 8 Activity OP3 – Revise draft of Operations and Planning Chapter ......................................... 9 Activity OP4 – Finalize draft of Operations and Planning Chapter ....................................... 9

Cyber Security Subgroup ...................................................................................................... 10

Identified Issues .................................................................................................................... 10 Activity CY1 – Many cross cutting cyber security groups have and are being established. Many of these groups are not aware of or are working with each other and thus not working in a synergistic manner. ........................................................................................................ 11 Activity CY2 – Security requirements recommended for the AMI / AMR space need to be matched against the needs within the BPS. .......................................................................... 11 Activity CY3 – A baseline set of cyber security metrics for the BPS needs to be developed................................................................................................................................................ 12 Activity CY4 – Developing a risk assessment matrix for the BPS. ...................................... 12 Activity CY5 – Tools sets, equipment, and methodologies to perform cyber security tests within the BPS. ..................................................................................................................... 12

Res earch and Development Tas k Group ........................................................................... 14

Identified Issues .................................................................................................................... 14 Activity R1 – TBD ................................................................................................................ 14



PP uu rrpp oo ss ee This work plan is necessary for the NERC Smart Grid Task Force to achieve its objectives and complete its report. The purpose of the Task Force is to provide a high-level review of the reliability impacts of integrating Smart Grid1

technology on the bulk power system. It will consider system planning, design, and operations with respect to the bulk power system (BPS). The Task Force will prepare a report that reviews Smart Grid characteristics, identifies reliability concerns including cyber-security vulnerability, and provides recommendations to NERC and the industry.

OObb jjee cc tt iivvee ss ttoo bb ee aa dd dd rree ss ss ee dd A list of issues and proposed activities from the Planning Committee-approved Scope document dated July 29, 2009 is listed below:

SGTF Objectives

O1. Identify and explain any issues and/or concerns of the Smart Grid with respect to bulk power system reliability, including a definition of Smart Grid in the context of bulk power system reliability.

O2. Assess Smart Grid reliability characteristics, including those expected to be significant in the near-term and their potential impacts on bulk power system reliability. In particular, identify aspects that could become material to the reliability of the bulk power system,

O3. Determine the cyber-security and critical infrastructure protection implications of Smart Grid technologies and the potential impacts on bulk power system reliability,

O4. Identify how the integration of Smart Grid technologies affects bulk power system planning, design and operational processes and the tools that may be needed to maintain bulk power system reliability,

O5. Determine which existing NERC Reliability Standards2

O6. Present conclusions, recommendations, and a work plan for completing any recommended actions.

may apply to bulk power system Smart Grid elements, and provide recommendations for areas where technical foundations for standards development work may be needed, and,

1 “Smart Grid” is a term that broadly refers to electric systems and devices that integrate advanced sensing and communications

with real-time monitoring to enable the two-way flow of energy and new forms of supply, delivery, and consumption. The Energy Independence and Security Act of 2007 outlined several “Smart Grid Functions” in Section 1306(d) and for the terms of this scope, Section 1306(d) will serve as a baseline definition.

2 NERC’s Facility Connection Requirements (FAC), Critical Infrastructure Protection (CIP), and Communications (COM) Reliability Standards may be applicable.



AAcc tt iivviitt iiee ss The activities in the work plan serve to address the objectives identified above. The table below describes the activities at a high level. Detailed information on the work plan activities for each workgroup are located in the sections below.

Characteristics Subgroup (“Char”)

• Lead the task force in accomplishing Objectives O1 and O2.

Operations and Planning Subgroup (“OP”)

• Lead the task force in accomplishing Objectives O4 and O5.

Cyber Security Subgroup (“Cyber”)

• Lead the task force in accomplishing Objectives O3.

Metrics Task Group (“Metrics”)

• Compile and report on metrics related to Objectives O3 and O4.

Research and Development Task Group (“RD”)

• Compile and report on current and future research and development opportunities related to Objectives O3 and O4.

The following sections provide additional detail for each workgroup’s work plan.



CChh aa rraa cc ttee rr iiss tt iicc ss SS uu bb gg rroo uu pp This section of the report should define the Smart Grid. In effort to further describe the Smart Grid, the report should also identify the components that will comprise the Smart Grid and indicate which functions of the Smart Grid each component supports. The report should also include the impact each component has on the grid from an operational standpoint and should also describe the level of control the operator has over each component.

Identified Issues Issues to Be Addressed Recommended Activity

List of Issues, prioritized top to bottom. Activity(s) that will be used to address issue.

Identify Smart Grid devices and systems. C1. Develop and vet a list or matrix of Smart Grid Devices, covering both the BPS and distribution systems, to serve as a foundation for Task Force work.

Smart Grid definition in the context of BPS. C2. Develop a list of authoritative sources and drivers in Smart Grid development then derive a concise definition of Smart Grid for use in this report. Possibly use an existing definition if consensus is reached.

Activity C1 – Develop Smart Grid List Task: Develop and vet a list or matrix of Smart Grid Devices, covering both the BPS and distribution systems, to serve as a foundation for Task Force work. Assumptions: Technology related to Smart Grid and the power industry is constantly evolving, but the set of devices and systems that satisfy commonly held understandings of Smart Grid or fall within policy is not infinite. A thorough and fairly exhaustive list can be made at this time to help determine the parameters of Smart Grid and help the industry understand what technologies fit. Discussion:

• The NERC staff strawman on this Activity provides a starting point for discussion and refinement.

• The list or matrix should be user-friendly and not overly complicated. In final form, it may be a list or table in the report that readers will want to reference quickly without confusion.

Key Tasks Start Date Complete Date

This is a specific, measurable, task that supports the objective. Overall start Overall finish

NERC Staff to develop and distribute strawman document. 7/29/09 10/26/09

Char subgroup to review and discuss strawman document. 11/12/09 11/13/09

Vice-Chair to refine matrix and distribute to subgroup 11/13/09 TBD

Subgroup to review and discuss TBD TBD



Draft matrix shared to task force for continuing work TBD1/26/10 1/26/10

Continue refining matrix, assign work to begin writing on topics 2/4/10

Draft topic writing due to Vice-Chair for review with Chair and staff 3/15/10

Incorporate edits, redistribute to subgroup for review 4/1/10

Submit final report section to NERC staff for inclusion in draft report 5/1/10

Planned Collaboration with Others: Please explain who the collaboration would be with, and the specific activity that would be involved. List external groups and other NERC efforts here. Coordinate with OP and RD subgroups. Key Reference Documents: Please list the most important resources for this subgroup work..

• DOE / NETL - A COMPENDIUM OF SMART GRID TECHNOLOGIES - July 2009

http://www.netl.doe.gov/moderngrid/referenceshelf/whitepapers/Compendium_of_Technologies_APPROVED_2009_08_18.pdf�



OOpp ee rraa tt iioo nn ss aa nn dd PP llaa nn nn iinn gg SS uu bb gg rroo uu pp This section of the report should detail immediate operational and future planning issues involved with Smart Grid Deployment across the grid. The main focus of these impacts should focus on impacts to the bulk power system, both from a detrimental impacts standpoint as well as possible mitigating technologies through Smart Grid deployment.



Outline Operations and Planning Chapter OP1. Produce detailed outline of Operations and Planning chapter of report

Compile draft of Operations and Planning Chapter OP2. Compile Draft from individual contributions of outline

Revise draft of Operations and Planning Chapter OP3. Send out compiled draft to Operations and Planning Subgroup

Finalize draft of Operations and Planning Chapter OP4. Send out compiled draft to Smart Grid Task force

Activity OP1 – Outline Operations and Planning Chapter Task: Outline Operations and Planning Chapter Assumptions: Sufficient time and resource support of members to compile outline draft Discussion:


• Final format should support format detailed in TOC document



Outline of Operations and Planning Impacts should be detailed including Metrics and Recommendations 2/4/2010 2/28/2010

Send out 1st draft of outline to subgroup for additions and edits 3/1/2010 3/1/2010

Activity OP2 – Compile draft of Operations and Planning Chapter Task: Compile draft of Operations and Planning Chapter Assumptions: Sufficient time and resource support of members to compile individual sections Discussion:







Assign key team members sections of outline to provide wording and expand on ideas in outline 3/1/2010 3/1/2010

Combine and compile expanded sections of outline into overall draft document 4/1/2010 TBD

Activity OP3 – Revise draft of Operations and Planning Chapter Task: Revise draft of Operations and Planning Chapter Assumptions: Sufficient time and resource support of members to compile individual sections Discussion:





Sent out draft of Operations and Planning Chapter to subgroup members for review 4/7/2010 4/7/2010

Review and incorporate suggestions into revised draft 4/21/2010 TBD

Activity OP4 – Finalize draft of Operations and Planning Chapter Task: Finalize draft of Operations and Planning Chapter Assumptions: Sufficient time and resource support of members to compile individual sections Discussion:





Fianlize draft of Planning and Operations chapter for compilation into overall SGTF Report 5/1/2010

Planned Collaboration with Others: Please explain who the collaboration would be with, and the specific activity that would be involved. List external groups and other NERC efforts here. Coordinate with Characteristics and Cyber Security Subgroups Key Reference Documents: Please list the most important resources for this subgroup work.



CCyybb ee rr SS ee cc uu rriittyy SS uu bb gg rroo uu pp The cyber security subgroup will work with grid management to include the functional strategies of collection / discovery, control (SCADA or system), management (configuration / provisioning / access control), and diagnostics (e.g. forensics / analytics) / detection / monitoring and mapping it to interoperability / reliability and the security principles of confidentiality, integrity, and availability. Essentially, the cyber security subgroup will work with grid management to protect power integrity of the grid (generation and transmission and distribution to substation) and specifically BPS. The charter of our work is to build a framework of cyber security analysis, requirements, and guidance that can be used to at minimum preserve and/or enhance power system reliability within the context of Smart Grid systems and their capabilities and risks for BPS. The framework will be based on best practices and standards for technology, processes, operations, and people and their associated governance. Lastly and most importantly the framework will use elements in IT, communications, control, and power systems on an integrated basis to accomplish its goals.



Many cross cutting cyber security groups have and are being established. Many of these groups are not aware or working with each other to not re-invent the wheel for each domain.

CY1. Ensure that the cyber security subgroup has participation from and in various industry groups such as NIST, FERC, NEMA, NAESB, and SG Security.

Security requirements recommended for the AMI / AMR space need to be matched against the needs within the BPS.

CY2. Review the recommended cyber security standards from NIST, NEMA, FERC, NAESB, SG Security and other bodies assisting key SDOs to ensure the requirements fit the need for the BPS and do not impede the reliability and interoperability with the BPS.

A baseline set of cyber security metrics for BPS needs to be developed.

CY3. Based on defined cyber security assets, processes, standards, and requirements within the BPS define a set of cyber security metrics for baselining and tracking measurements.

Develop/Identify a risk assessment matrix for the BPS relative to Smart Grid technology implementation.

CY4. Using standard (existing) risk assessment methodology defined by other industry groups, adapt or modify the structure to fit the BPS.

Tools sets, equipment, and methodologies to perform cyber security tests within the BPS.

CY5. Based on the information from the NIST SGIP Conformity and the Open SG SG Conformity groups adapt or modify the tools sets, equipment, and methodologies to be used in the BPS.



Activity CY1 – Many cross cutting cyber security groups have and are being established. Many of these groups are not aware of or are working with each other and thus not working in a synergistic manner. Task: Ensure that the cyber security subgroup has participation from and in various industry groups such as NIST, FERC, NEMA, NAESB, and SG Security. Assumptions:

1. At least one member of the cyber security subgroup will be a participant in the following groups: NIST, FERC, NAME, NAESB, and SG Security.

2. When possible, the cyber security subgroup will normally not develop new requirements and/or guidance documents but use and appropriately adapt the existing industry knowledge base for the BPS.

3. If needed the group may identify new risks, requirements, solutions (or a need for ones that do not exist), and associated guidance.



Inventory all organizations devoted to Smart Grid issues – especially cyber security issues 1/15/10 2/1/10

Reach out to the identified organizations in the above action and bring representatives to this SGTF 2/2/10 2/15/10

Activity CY2 – Security requirements recommended for the AMI / AMR space need to be matched against the needs within the BPS. Task: Review the recommended cyber security standards from NIST, NEMA, FERC, NAESB, SG Security and other bodies assisting key SDOs to ensure the requirements fit the need for the BPS and do not impede the reliability and interoperability with the BPS. Assumptions:


2. When possible, the cyber security subgroup will not develop anything from scratch and will use currently developed documentation to assist the BPS.



Review the list of the 31 standards defined in the NISTIR 7628 draft document and see which apply and do not apply to the Bulk Power System

12/30/2009 01/31/2010

Create a fundamental list of high level security requirements for the BPS 12/30/2009 02/15/2010



Activity CY3 – A baseline set of cyber security metrics for the BPS needs to be developed. Task: Based on defined cyber security assets, processes, standards, and requirements within the BPS define a set of cyber security metrics for baselining and tracking measurements. Assumptions:

1. When possible, the cyber security subgroup will use the NIST CSCTG standards and high level requirements documents as a baseline.



TBD TBD TBD

Activity CY4 – Developing a risk assessment matrix for the BPS. Task: Using standard (existing) risk assessment methodology defined by other industry groups, adapt or modify the structure to fit the BPS. Assumptions:

1. The cyber security group will use the AMI-SEC risk assessment methodology as a baseline for these tasks.

2. The risk assessment methodology should be consistent with emerging NERC CIP-002-4 risk assessment methodology.


Develop guidance for how the CIP-002 risk assessment methodology may apply to various smart grid technologies/solutions

Overall start Overall finish

TBD TBD TBD

Activity CY5 – Tools sets, equipment, and methodologies to perform cyber security tests within the BPS. Task: Based on the information from the NIST SGIP Conformity and the Open SG SG Conformity groups adapt or modify the tools sets, equipment, and methodologies to be used in the BPS. Assumptions:




2. When possible, the cyber security subgroup will not develop anything from scratch and will use currently developed documentation to assist the BPS.



TBD TBD TBD

Planned Collaboration with Others: Please explain who the collaboration would be with, and the specific activity that would be involved. List external groups and other NERC efforts here.

• NIST CSCTG. Since NIST has been tasked to develop a set of Smart Grid cyber security standards, participation and sharing of information with the NERC effort will limit the amount of cyber security work that needs to be accomplished.

• SG Security and other task groups within the Open SG group. UCAIug and the SG Security work group have much input into the NIST CSCTG subgroups. By participating and soliciting participation of the SG Security group, the NERC task groups will have a previous of the information that NIST will be evaluating.

• NEMA. NEMA is requiring some smart endpoint security requirements that may affect interoperability and reliability of the requirements within the BPS.

Key Reference Documents: Please list the most important resources for this subgroup work.

• NISTIR 7628 (http://collaborate.nist.gov/twiki-sggrid/pub/SmartGrid/NISTIR7628Sep252009/NISTIR_7628_Draft1-final.pdf)

• Security Profile for AMI v1.0v0 (http://osgug.ucaiug.org/utilisec/amisec/Shared%20Documents/AMI%20Security%20http://collaborate.nist.gov/twiki-sggrid/pub/SmartGrid/NISTIR7628Sep252009/AMI_Security_Profile-v0_46-20090918.pdf

• Profile%20(ASAP-SG)/AMI%20Security%20Profile%20-%20v1_0.pdf)) • CSCTG potential list of cyber security standards (http://collaborate.nist.gov/twiki-

sggrid/bin/view/SmartGrid/CyberSecurityStandards) • National Association of State Energy Officials - State Energy Assurance Guidelines

(http://www.naseo.org/eaguidelines/State_Energy_Assurance_Guidelines_Version_3.1_2009-12.pdf)

http://collaborate.nist.gov/twiki-sggrid/pub/SmartGrid/NISTIR7628Sep252009/NISTIR_7628_Draft1-final.pdf�

http://collaborate.nist.gov/twiki-sggrid/pub/SmartGrid/NISTIR7628Sep252009/NISTIR_7628_Draft1-final.pdf�

http://osgug.ucaiug.org/utilisec/amisec/Shared%20Documents/AMI%20Security�




http://collaborate.nist.gov/twiki-sggrid/bin/view/SmartGrid/CyberSecurityStandards�

http://collaborate.nist.gov/twiki-sggrid/bin/view/SmartGrid/CyberSecurityStandards�



RRee ss ee aa rrcc hh aa nn dd DDee vvee lloo pp mm ee nn tt TTaa ss kk GGrroo uu pp TBD



TBD R1.

R2.

Activity R1 – TBD Task: TBD Assumptions: TBD



TBD TBD TBD

Planned Collaboration with Others: Please explain who the collaboration would be with, and the specific activity that would be involved. List external groups and other NERC efforts here. TBD Key Reference Documents: Please list the most important resources for this subgroup work.

• TBD