CIP–009–3: Recovery Plans for Critical Cyber Assets
Purpose
Standard CIP-009-3 ensures that recovery plan(s) are put in place for Critical Cyber Assets and that these plans follow established business continuity and disaster recovery techniques and practices. Standard CIP-009-3 should be read as part of a group of standards numbered Standards CIP-002-3 through CIP-009-3.
Applicability
Within the text of Standard CIP-009-3, “Responsible Entity” shall mean:
- Reliability Coordinator.
- Balancing Authority.
- Interchange Authority.
- Transmission Service Provider.
- Transmission Owner.
- Transmission Operator.
- Generator Owner.
- Generator Operator.
- Load Serving Entity.
- NERC.
- Regional Entity.
The following are exempt from Standard CIP-009-3:
- Facilities regulated by the U.S. Nuclear Regulatory Commission or the Canadian Nuclear Safety Commission.
- Cyber Assets associated with communication networks and data communication links between discrete Electronic Security Perimeters.
- Responsible Entities that, in compliance with Standard CIP-002-3, identify that they have no Critical Cyber Assets.
Effective Date
The first day of the third calendar quarter after applicable regulatory approvals have been received (or the Reliability Standard otherwise becomes effective the first day of the third calendar quarter after BOT adoption in those jurisdictions where regulatory approval is not required).
Requirements
R1. Recovery Plans — The Responsible Entity shall create and annually review recovery plan(s) for Critical Cyber Assets. The recovery plan(s) shall address at a minimum the following:
R1.1. Specify the required actions in response to events or conditions of varying duration and severity that would activate the recovery plan(s).
R1.2. Define the roles and responsibilities of responders.
R2. Exercises — The recovery plan(s) shall be exercised at least annually. An exercise of the recovery plan(s) can range from a paper drill, to a full operational exercise, to recovery from an actual incident.
R3. Change Control — Recovery plan(s) shall be updated to reflect any changes or lessons learned as a result of an exercise or the recovery from an actual incident. Updates shall be communicated to personnel responsible for the activation and implementation of the recovery plan(s) within thirty calendar days of the change being completed.
R4. Backup and Restore — The recovery plan(s) shall include processes and procedures for the backup and storage of information required to successfully restore Critical Cyber Assets. For example, backups may include spare electronic components or equipment, written documentation of configuration settings, tape backup, etc.
R5. Testing Backup Media — Information essential to recovery that is stored on backup media shall be tested at least annually to ensure that the information is available. Testing can be completed off site.
Measures
M1. The Responsible Entity shall make available its recovery plan(s) as specified in Requirement R1.
M2. The Responsible Entity shall make available its records documenting required exercises as specified in Requirement R2.
M3. The Responsible Entity shall make available its documentation of changes to the recovery plan(s), and documentation of all communications, as specified in Requirement R3.
M4. The Responsible Entity shall make available its documentation regarding backup and storage of information as specified in Requirement R4.
M5. The Responsible Entity shall make available its documentation of testing of backup media as specified in Requirement R5.