As the Chief Technology Officer of Engineered Intelligence, a leading SaaS vendor in the utility industry, I know that keeping up with the North American Electric Reliability Corporation (NERC) standards is a top priority. Our ISO 27001 certification underscores our commitment to robust information security practices, laying a strong foundation for addressing NERC compliance requirements.
Synergies Between ISO 27001 and NERC CIP
ISO 27001 and NERC CIP standards have the same goal: protecting the confidentiality, integrity, and availability of information assets. By aligning our Information Security Management System (ISMS) with ISO 27001, we can efficiently meet many NERC CIP requirements. For example, ISO 27001's controls for access management, incident management, and risk assessment directly map to NERC CIP-004 (Personnel & Training), CIP-008 (Incident Reporting and Response Planning), and CIP-010 (Configuration Change Management and Vulnerability Assessments). This alignment streamlines compliance and ensures we have a consistent security approach throughout our organization.
Leveraging ISO 27001 for NERC Compliance
While ISO 27001 certification isn’t a replacement for NERC compliance, it does provide a solid foundation and several advantages:
Robust Security Controls: Our ISMS, built on the ISO 27001 framework, includes thorough security controls that address many NERC CIP requirements. This includes access controls, encryption, secure software development practices, and incident response procedures.
Continuous Improvement: ISO 27001 emphasizes continuous improvement, ensuring our security controls remain effective and up-to-date. This aligns with the NERC CIP’s need for regular vulnerability assessments, patch management, and security control monitoring.
Third-Party Audits: Our ISO 27001 certification involves regular third-party audits, proving that our security controls work well. This helps us show compliance with NERC CIP requirements related to third-party vendor risk management (CIP-013).
Vendor Risk Management: Being ISO 27001 certified means we can give our utility customers the vendor security documentation they need, such as Security Risk Assessments and Software Bill of Materials (SBOMs), supporting their NERC CIP-013 compliance efforts.
Addressing NERC-Specific Requirements
While ISO 27001 provides a strong foundation, certain NERC CIP requirements unique to the utility industry require additional measures:
Establish a NERC CIP Compliance Program: Develop a dedicated NERC CIP compliance program with policies, procedures, and controls specific to the NERC CIP standards. This includes access management for Bulk Electric System (BES) Cyber System Information (BCSI), electronic security perimeters, and incident response planning tailored to the utility sector.
Implement Robust Cloud Security for BCSI: As a SaaS provider, implement robust security controls and processes to ensure the protection of BCSI hosted in the cloud, in line with NERC CIP-011 and the NERC guidance on cloud solutions.
Enhance Secure Software Development Lifecycle (SSDLC): Integrate NERC CIP requirements from the design phase through deployment, including secure coding practices, threat modeling, and security testing specific to utility software applications.
Provide Specialized Employee Training and Awareness: Beyond ISO 27001-mandated security awareness programs, provide specialized training to employees on NERC CIP standards, utility sector threats, and best practices for securing critical infrastructure.
Establish Incident Response and Recovery Plans: Develop and maintain incident response and recovery plans specific to BES Cyber Systems, in line with NERC CIP-008 and CIP-009. These plans should outline procedures for detecting, responding to, and recovering from cybersecurity incidents and system failures.
By putting these measures in place, you can show your commitment to NERC CIP compliance and ensure the secure and reliable operation of your systems supporting the client. This proactive approach of obtaining ISO 27001 certification and aligning it with NERC requirements not only mitigates risks but also builds trust with utility customers, providing them with secure, reliable, and compliant software solutions.
__________________________________________________________________________________________________________________________________________________________________________________
Alex Kachar is a Solutions Architect with over 20 years of experience in developing and delivering Business Intelligence and Analytics solutions, executing Data Governance programs and managing high-performance development teams.
As the Chief Technology Officer, Alex is responsible for the design and architecture of secure, reliable and scalable business solutions. Alex’s wide range of consulting experience brings a unique perspective on analytics, accurate and reliable decision-making and innovation across industries.