NERC's Cyber Security Standards : Fulfilling Its Reliability Day Job and Moonlighting as a Cyber Security Model

The electric industry is experiencing notable changes with the implementation of communication and automation technology, many of which are part of the smart grid movement. Similar to other critical infrastructure industries such as banking, transportation and the cross sector critical information infrastructure industry, the electric industry must protect itself from intentional and unintentional security breaches and incidents to ensure uninterrupted operations of essential services. Of the critical infrastructure industries, the electric industry is the only private-sector industry subject to government enforced mandatory cyber security standards. This article gives an overview of the eight mandatory cyber security standards by the North American Electric Reliability Corporation. As an example of how standards are evolving it discusses CIP-002 – Critical Cyber Asset Identification in depth because it establishes whether the remaining seven standards apply. This article then compares the North American Electric Reliability Corporation regulatory regime against critical information infrastructure goals. The comparison finds that, at least on a basic level, the electric industry’s mandatory cyber security standards meet the critical information infrastructure goals and work to secure information networks, resources, and systems from cyber and physical threats. The mandatory cyber security standards promote an increase in technological products, better security management, personnel and public education and trust in the industry. Even though the electric industry’s mandatory standards are imperfect, the fact it satisfies the goals of the cross sector critical information infrastructure indicates that the framework is sound. The electric industry’s experience with mandatory cyber security standards is a valuable source of information and the regulatory regime itself can be a helpful model for other industries looking to develop their own security protection systems