NERC Critical Infrastructure Protection (CIP) Flashcards
6 cards from real NERC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 NERC Critical Infrastructure Protection (CIP) flashcards as text
Which NERC CIP standard addresses security management controls for bulk electric system cyber systems?
Answer: CIP-003
CIP-003 establishes minimum security management controls to protect BES Cyber Systems.
What is the primary purpose of NERC CIP-010?
Answer: Configuration change management and vulnerability management
CIP-010 covers configuration change management and vulnerability management for BES Cyber Systems.
Under NERC CIP, what does the term 'BES Cyber Asset' refer to?
Answer: A cyber asset that, if rendered unavailable, could adversely impact BES reliability within 15 minutes
A BES Cyber Asset is one whose unavailability, degradation, or misuse could adversely impact BES reliability within 15 minutes of the action.
Which CIP standard requires responsible entities to have a physical security plan for high and medium impact BES Cyber Systems?
Answer: CIP-006
CIP-006 requires physical security plans to protect high and medium impact BES Cyber Systems and their associated Physical Security Perimeters.
What must a responsible entity do within 35 days under CIP-008 after a reportable Cyber Security Incident?
Answer: Submit an after-action review report
CIP-008 requires an after-action review and lessons-learned documentation submitted within 35 days of a reportable incident.
NERC CIP-013 addresses which of the following risks?
Answer: Supply chain risk management for industrial control systems
CIP-013 establishes requirements for supply chain risk management plans for industrial control system hardware, software, and services.