NERC NERC Critical Infrastructure Protection (CIP) 3

Question 1

Under NERC CIP-011, what must be protected as 'BES Cyber System Information'?

Accepted Answer

Information that, if disclosed, could be used to gain unauthorized access or pose a threat to BES Cyber Systems

Answer

All utility customer billing data

Answer

Weather data used for load forecasting

Answer

Publicly available grid topology maps

Question 2

CIP-014 was created in response to what type of threat to the bulk electric system?

Accepted Answer

Physical attacks on critical transmission substations

Answer

Cyber intrusions into SCADA systems

Answer

Geomagnetic disturbances from solar events

Answer

Coordinated market manipulation

Question 3

What is the minimum frequency for NERC CIP security awareness training?

Accepted Answer

Every 15 calendar months

Answer

Every 6 months

Answer

Quarterly

Answer

Annually

Question 4

Which entity is responsible for approving or modifying NERC CIP reliability standards before they take effect in the US?

Accepted Answer

FERC (Federal Energy Regulatory Commission)

Answer

The Department of Energy

Answer

The National Institute of Standards and Technology (NIST)

Answer

The US Cybersecurity and Infrastructure Security Agency (CISA)

Question 5

Under NERC CIP, a 'Protected Cyber Asset' (PCA) is:

Accepted Answer

Any device inside the ESP that is not a BES Cyber Asset but communicates with one

Answer

A high-impact BES Cyber System located in a control center

Answer

A vendor-owned device used for remote access

Answer

An encrypted backup of BES Cyber System data

Question 6

NERC CIP-009 requires responsible entities to maintain which type of plans?

Accepted Answer

Recovery plans for BES Cyber Systems

Answer

Market participation plans

Answer

Wildfire mitigation plans

Answer

Load shedding plans