Consideration of Comments

Consideration of Comments

Cyber Security Order 706 Version 5 CIP Standards

Comment Form D

Definitions and Implementation Plans

The Cyber Security Order 706 Drafting Team thanks all commenters who submitted comments on the CIP Version 5 standards. These standards were posted for a 40-day public comment period from April 12, 2012 through May 21, 2012. Stakeholders were asked to provide feedback on the standards and associated documents through a special electronic comment form. There were 95 sets of comments, including comments from more than 75 different people from approximately 45 companies representing 8 of the 10 Industry Segments as shown in the table on the following pages.

All comments submitted may be reviewed in their original format on the standard’s project page:

If you feel that your comment has been overlooked, please let us know immediately. Our goal is to give every comment serious consideration in this process! If you feel there has been an error or omission, you can contact the Vice President of Standards and Training, Herb Schrayshuen, at 404-446-2560 or at . In addition, there is a NERC Reliability Standards Appeals Process.[1]

Index to Questions, Comments, and Responses

1.Do you agree with the proposed definitions of BES Cyber Asset, BES Cyber System, and Cyber Asset? …. X

2.Do you agree with the proposed definition of Control Center? …...... X

3.Do you agree with the proposed definitions of BES Cyber System Information, CIP Exceptional Circumstances, and CIP Senior Manager? …. X

4.Do you agree with the proposed definitions of Physical Access Control Systems and Physical Security Perimeter? …. X

5.Do you agree with the proposed definitions of Electronic Access Control or Monitoring Systems, Interactive Remote Access, and Intermediate Device?…. X

6.Do you agree with the proposed definitions of Electronic Access Point, Electronic Security Perimeter, External Routable Connectivity, and Protected Cyber Asset? …. X

7.Do you agree with the proposed definitions of Cyber Security Incident and Reportable Cyber Security Incident? …. X

8.Definitions: Do you have any comments on the changes to the proposed definitions of BES Cyber Asset, BES Cyber System, and Cyber Asset? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

9.Definitions: Do you have any comments on the changes to the proposed definition of Control Center? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

10.Definitions: Do you have any comments on the changes to the proposed definitions of BES Cyber System Information, CIP Exceptional Circumstances, and CIP Senior Manager? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

11.Definitions: Do you have any comments on the changes to the proposed definitions of Physical Access Control Systems and Physical Security Perimeter? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

12.Definitions: Do you have any comments on the changes to the proposed definitions of Electronic Access Control and Monitoring Systems, Interactive Remote Access, and Intermediate Device? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

13.Definitions: Do you have any comments on the changes to the proposed definitions of Electronic Access Point, Electronic Security Perimeter, External Routable Connectivity, and Protected Cyber Asset? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

14.Definitions: Do you have any comments on the changes to the proposed definitions of Cyber Security Incident and Reportable Cyber Security Incident? If you voted “negative” on any ballot because of a proposed definition or modification to a definition described in this question, please describe the specific suggested changes that would facilitate an “affirmative” vote. …. X

15.Do you agree with the changes made to the proposed implementation plan since the last formal comment period? …. X

16.Implementation Plan: If you disagree with the changes made to the Implementation Plan since the last formal comment period, what, specifically, do you disagree with? Please provide specific suggestions or proposals for any alternative language. …. X

17.If you have comments or specific suggestions that you have not been able to provide in response to the previous questions, please provide those comments here. Please provide specific suggestions or proposals for any alternative language. …. X

1

The Industry Segments are:

1 — Transmission Owners

2 — RTOs, ISOs

3 — Load-serving Entities

4 — Transmission-dependent Utilities

5 — Electric Generators

6 — Electricity Brokers, Aggregators, and Marketers

7 — Large Electricity End Users

8 — Small Electricity End Users

9 — Federal, State, Provincial Regulatory or other Government Entities

10 — Regional Reliability Organizations, Regional Entities

1. Do you agree with the proposed definitions of BES Cyber Asset, BES Cyber System, and Cyber Asset?

1. Do you agree with the proposed definition of Control Center?

3. Do you agree with the proposed definitions of BES Cyber System Information, CIP Exceptional Circumstances, and CIP Senior Manager?

4. Do you agree with the proposed definitions of BES Cyber System Information, CIP Exceptional Circumstances, and CIP Senior Manager?