What it asks for. CIP-007 is a NERC Critical Infrastructure Protection standard for the North American bulk electric system. It requires responsible entities to manage the security of in-scope BES Cyber Systems through controls on ports and services, security patch management, malicious code prevention, security event monitoring and system access control, including password and authentication requirements.
In practice. Entities document enabled ports and services, evaluate security patches on a regular cycle and track mitigation plans, deploy methods to deter and detect malicious code, log and alert on security events and manage shared and default accounts. Evidence for audit includes configuration listings, patch evaluation records, log retention records and account management documentation.
Common gaps. Patch evaluation records and mitigation plans often lag behind the required cycle. Default and shared accounts on field devices are another frequent source of findings.