NERC Compliance CIP & 693 Solution

NERC CIP Version 5 Compliance | Simpli�ed.

Meeting NERC CIP v5 Head OnThe CIP version 5 standards represent a shift in the compliance landscape for electric utilities. The expansion of CIP coverage under v5 will significantly increase the scope of utility infrastructure under CIP, and the shift from after-the-fact evidentiary reporting to actively-managed controls that identify and implement corrective actions is also a notable change from past compliance expectations.

The integration between the Tripwire NERC Solution Suite and SigmaFlow’s NERC CIP Compliance Manager provides an automated solution that drastically reduces time and resources required to manage NERC CIP v5 compliance and collect comprehensive audit evidence. The integration gives electric utilities the ability to manage and validate configuration changes, access rights, and baselines as part of the normal work they do.

Con�guration Change Management

SigmaFlow manages the change process, ensuring that changesare performed in a compliant manner. Tripwire collects securitycontrols testing (High Impact) and baseline validation data toprovide utilities with an efficient and reliable automationsolution for NERC CIP v5 Change Management.

Access Rights Management

SigmaFlow simplifies Access Rights Management with aprofile model that ‘rolls’access rights together for specificfunction/role processes and maintains the Approved List ofAccess Rights. Tripwire provides the actual Access RightsScan that is validated to ensure a state of Audit Readiness.

CIP-010 Evidence In-Depth

Change Request Procedure

Change Request Tickets

Workflow Report

Test Asset Security Controls

Baseline Scan Report

Validation Against Baseline Reports

CIP-007 Evidence In-Depth

Change Request Procedure

Change Request Tickets

Workflow Report

Local Accounts Scan

Domain Accounts Scan

Validation Against Baseline Reports

Baseline Con�guration Management

SigmaFlow organizes approved baselines into groups for commonitems like specific hardware, operating systems, and software. Baseline Groups are applied to Cyber Assets (all that apply) tobuild composite Cyber Asset Baselines. Tripwire uses thebaselines (whitelists) to detect issues. Scheduled Tripwire scansfeed “as is” data to SigmaFlow where actual baselines areassessed against approved baselines. This ensures baselineconformance and produces required supporting evidence.

CIP-007 Evidence In-Depth to Ensure

Approved Baselines

Baseline Approval

Baseline Whitelists

Baseline Scans

Baseline Validation

&

Combined Solution | Key Features

Compliance Driven by Preconfigured ProcessesExtensive Automation Reduces Work

Automated Compliance PerformanceAutomatic Generation of Evidence

Con�guration ChangeManagement Process

Access RightsManagement Process

Baseline Con�gurationManagement Process

The Bottom Line | A Complete NERC CIP v5 Solution

The SigmaFlow and Tripwire solution enables electrical utilities to manage all NERC CIP compliance activities and evidence. Building from Change Management, Access Rights, and Baselines, the solution provides the functionality needed to:

• Produce, collect and manage all evidence for every Requirement in NERC CIP v5• Manage and generate RSAWs for all CIP Standards • Retain awareness and oversight for the entire CIP Compliance practice

SigmaFlow is the industry-leading solution for orchestrating NERC CIP compliance in order to achieve an ongoing state of Audit Readiness. SigmaFlow uses process-driven compliance and closed-loop controls to enforce compliance, streamline work, and build the “stack” of evidence to meet all aspects of each NERC CIP Version 5 Requirement.

Learn more at SigmaFlow.com

Tripwire is the industry-leading solution for managing, producing and collecting required NERC CIP Version 5 evidence from BES Cyber Systems (BCS) and their related Cyber Assets (BCA, PCA, EACMS, PACS). Tripwire simplifies the complex challenge of collecting infrastructure data with an automated solution that saves time, improves compliance, and reduces risk.

Learn more at Tripwire.com

NERC Compliance CIP & 693 Solution

© 2014. The SigmaFlow and Tripwire logos are registered trademarks of SigmaFlow LLC, and Tripwire, Inc. All rights reserved.