NERC NERC Critical Infrastructure Protection (CIP) 3

Question 1

Under NERC CIP-011, what must be protected as 'BES Cyber System Information'?

Accepted Answer

Information that, if disclosed, could be used to gain unauthorized access or pose a threat to BES Cyber Systems

Answer

CIP-011 requires protection of BES Cyber System Information that could be exploited to compromise BES reliability if disclosed.

Question 2

CIP-014 was created in response to what type of threat to the bulk electric system?

Accepted Answer

Physical attacks on critical transmission substations

Answer

CIP-014 was developed following the 2013 Metcalf sniper attack and requires physical security assessments for critical transmission substations.

Question 3

What is the minimum frequency for NERC CIP security awareness training?

Accepted Answer

Every 15 calendar months

Answer

CIP-004 requires security awareness training at least once every 15 calendar months for personnel with access to BES Cyber Systems.

Question 4

Which entity is responsible for approving or modifying NERC CIP reliability standards before they take effect in the US?

Accepted Answer

FERC (Federal Energy Regulatory Commission)

Answer

FERC must approve NERC reliability standards, including CIP standards, before they become mandatory in the United States.

Question 5

Under NERC CIP, a 'Protected Cyber Asset' (PCA) is:

Accepted Answer

Any device inside the ESP that is not a BES Cyber Asset but communicates with one

Answer

A Protected Cyber Asset is a device within the ESP that is not itself a BES Cyber Asset but communicates with a BES Cyber Asset.

NERC - North American Electric Reliability Corporation Practice Test