NERC NERC Critical Infrastructure Protection (CIP)

Question 1

Which NERC CIP standard addresses security management controls for bulk electric system cyber systems?

Accepted Answer

CIP-003

Answer

CIP-003 establishes minimum security management controls to protect BES Cyber Systems.

Question 2

What is the primary purpose of NERC CIP-010?

Accepted Answer

Configuration change management and vulnerability management

Answer

CIP-010 covers configuration change management and vulnerability management for BES Cyber Systems.

Question 3

Under NERC CIP, what does the term 'BES Cyber Asset' refer to?

Accepted Answer

A cyber asset that, if rendered unavailable, could adversely impact BES reliability within 15 minutes

Answer

A BES Cyber Asset is one whose unavailability, degradation, or misuse could adversely impact BES reliability within 15 minutes of the action.

Question 4

Which CIP standard requires responsible entities to have a physical security plan for high and medium impact BES Cyber Systems?

Accepted Answer

CIP-006

Answer

CIP-006 requires physical security plans to protect high and medium impact BES Cyber Systems and their associated Physical Security Perimeters.

Question 5

What must a responsible entity do within 35 days under CIP-008 after a reportable Cyber Security Incident?

Accepted Answer

Submit an after-action review report

Answer

CIP-008 requires an after-action review and lessons-learned documentation submitted within 35 days of a reportable incident.

NERC - North American Electric Reliability Corporation Practice Test