Why should federal power agencies be held to a higher cyber security standard?

FISMA is the Federal Information Security Management Act. It is mandatory by federal law for all federal agencies. The controls document for implementing FISMA is NIST Special Publication (SP) 800-53. NIST SP800-53 was developed for IT systems. However, federal agencies including TVA, BPA, WAPA, the Bureau of Reclamation, and the Army Corps of Engineers utilize industrial control systems (ICSs). Consequently, NIST SP800-53 has been extended to address industrial control systems and is currently open for public comment (see the FISMA/ICS website: http://csrc.nist.gov/sec-cert/ics/draft-ics-interpretation_SP800-53.html).

A line-by-line comparison was made between NIST SP800-53 and the NERC CIPs with NIST SP800-53 identified as being more comprehensive. Consequently, federal agencies are being held to a higher standard than non-federal utilities that only have to meet the NERC CIPs. The electric industry is unique with the interconnections between utilities leading to the "weakest link in the chain" phenomena potentially being another utility. This means it is possible for a non-federal utility to compromise a federal utility because of the less restrictive NERC CIP standards. The FERC Staff Assessment of the NERC CIP Standards (RM06-22-000 issued December 11, 2006) already has pointed this out.

When the utility industry approved the NERC CIPs, NERC was an industry-sponsored organization. However, NERC is now the Electric Reliability Organization as established by the Federal Energy Policy Act of 2005. Consequently, one can ask why NERC is not making NIST SP800-53 mandatory for all utilities.  The federal power agencies are already in the process of implementing NIST SP800-53 and NIST SP800-53 has been shown to be more comprehensive than the NERC CIPs.

There will be a presentation on how NIST SP800-53 could have prevented an actual cyber event (one which the NERC CIPs could not) at the August Knoxville Control System Cyber Security Workshop and the subsequent NIST Workshop will focus on implementing NIST SP800-53.

Joe Weiss