The NERC CIPv5 deadline is fast approaching, and it’s not too late to be prepared. Join Mark Prince, Manager Operational Technology Fossil, from Entergy, Karl Perman, VP Member Services from EnergySec and Tim Erlin, Director from Tripwire to discuss achieving and maintaining NERC CIPv5 compliance in a fossil generation plant. We’ll cover some of the challenges that Entergy has experienced in their NERC CIPv5 compliance journey. Specifically, we will discuss configuration change management and how to leverage technologies for these requirements and consider what life would be without them.

1. Lessons Learned For NERC CIPv5
Compliance & Configuration Change
Management
Mark Prince, Entergy
Tim Erlin, Tripwire
Karl Perman, EnergySec

2. Logistics
• Panelist discussion followed by questions and answers
• All lines other than panelists will be muted
• Questions via chat function
• Audio and slides will be posted within 72 hours

3. It’s Interactive
3
Please submit your
questions through the
control panel to get
answers LIVE from our
panelists.

4. Introductions
Mark Prince
Manager OT Fossil
Tim Erlin
Director, IT Security and
Risk Strategist
@terlin
Karl Perman
VP, Member Services
@EnergySec

5. NERC CIP V5 Pain Points
• Asset Identification and Categorization
• Change Approval Process
• Configuration Management
• Compliance Management
• Baseline Configuration
• Patching
• Malware Prevention and Detection
• Access Management
• Information Protection
• Evidence of Compliance
• Many manual processes

6. General Change
Management Process
• Develop baseline configurations
• Authorize and document changes to baselines
• Update baselines within 30 days
• Verify security controls
• Pre-change Testing
– High Impact BCS
• Configuration Monitoring
– High Impact BCS, EACMS, and PCA
© 2015 Energy Sector Security Consortium, Inc. 6

7. Configuration Change Management
Pain Points
• Number and variety of devices
• Every time, every change
– No exceptional circumstances exemption
• Identify security controls affected by the
change
– CIP-005 and CIP-007
• High Impact needs to have “Double Test”
– Once before change, once after change
• Automated system vs. manual process
© 2015 Energy Sector Security Consortium, Inc. 7

8. Evidence
• What needs to be maintained
• Maintain Documentation
• Storage
• Automated work flows or
manual processes
© 2015 Energy Sector Security Consortium, Inc. 8

19. Beyond Compliance to Cybersecurity

20. Q & A
Mark Prince
Manager OT Fossil
Tim Erlin
Director, IT Security and
Risk Strategist
@terlin
Karl Perman
VP, Member Services
@EnergySec