What it asks for. CIP-005 is a NERC Critical Infrastructure Protection standard for the North American bulk electric system. It requires responsible entities to place applicable BES Cyber Systems within a defined electronic security perimeter, control and justify inbound and outbound access through electronic access points, detect known or suspected malicious communications and secure interactive remote access, including through an intermediate system and multi-factor authentication.
In practice. Entities document each perimeter and access point, keep rule sets with a stated reason for each permitted connection, route remote access through an intermediate system and monitor and can disable active vendor remote sessions. Evidence includes network diagrams, firewall rule reviews, remote access logs and procedures for vendor access.
Common gaps. Firewall rules without documented justification are a common finding. Vendor remote access paths are also frequently less controlled than the main perimeter.