NERC NERC Critical Infrastructure Protection (CIP)

Question 1

Which NERC CIP standard addresses security management controls for bulk electric system cyber systems?

Accepted Answer

CIP-003

Answer

CIP-006

Answer

CIP-009

Answer

CIP-013

Question 2

What is the primary purpose of NERC CIP-010?

Accepted Answer

Configuration change management and vulnerability management

Answer

Physical security of BES assets

Answer

Incident reporting and response planning

Answer

Supply chain risk management

Question 3

Under NERC CIP, what does the term 'BES Cyber Asset' refer to?

Accepted Answer

A cyber asset that, if rendered unavailable, could adversely impact BES reliability within 15 minutes

Answer

Any computer used by utility employees

Answer

All servers within a utility's corporate network

Answer

Any asset connected to the internet

Question 4

Which CIP standard requires responsible entities to have a physical security plan for high and medium impact BES Cyber Systems?

Accepted Answer

CIP-006

Answer

CIP-005

Answer

CIP-007

Answer

CIP-008

Question 5

What must a responsible entity do within 35 days under CIP-008 after a reportable Cyber Security Incident?

Accepted Answer

Submit an after-action review report

Answer

File a complaint with FERC

Answer

Notify all interconnected utilities

Answer

Implement new firewall rules

Question 6

NERC CIP-013 addresses which of the following risks?

Accepted Answer

Supply chain risk management for industrial control systems

Answer

Wildfire risk to transmission lines

Answer

Market manipulation by generators

Answer

Cybersecurity of corporate IT networks