For awareness Medium Check exposure in your normal cycle
NERC CIP-003-9 vendor remote access rules create audit and recordkeeping burdens
Industrial Cyberenergy
What happened. Centrii says NERC CIP-003-9 requires owners of low-impact bulk electric system (BES) cyber systems to identify vendor remote access, disable it and detect malicious communications. It flags compliance and recordkeeping challenges. Penalties can reach $1,584,648 per violation, per day.
Who is affected. Owners and operators of renewable energy, storage and other facilities with low-impact BES cyber systems that permit vendor remote access, covering controllers, SCADA and communications.
What to do. Review whether your low-impact BES assets allow vendor remote access. Set up processes to identify it, disable it and detect malicious communications, and keep records.
When to act. For awareness: background reading, nothing to schedule
Editor's reading
Forasset ownerOT security leadleadership
- Purdue level
- L3.5
- L2
- L1
Why: Vendor remote access usually enters through remote-access gateways in the DMZ (L3.5) and reaches SCADA (L2) and controllers (L1), which the report names as in scope.
- Are you exposed?
List every low-impact BES asset where a vendor can connect remotely, and check whether each path is documented and can be disabled.
- If you cannot fix it yet
- Disable vendor remote access by default and enable it only for approved, time-limited sessions.
- Route all vendor access through a single monitored gateway in the industrial DMZ.
- Keep dated records of each vendor session and the checks made.
- Watch for
- Vendor remote sessions that start outside approved windows or bypass the central gateway.
- Known or suspected malicious communications tied to vendor access paths.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Industrial Cyber (opens industrialcyber.co)
More on Energy and power