NERC CIP Low Impact Requirements — Electronic Access Controls, Proposed ModificationsAs noted in my previous post on the Electronic Access Control, I indicated that the Standard Drafting Team (SDT) charged with working on the FERC-ordered Low Impact External Routable Connectivity (LERC) modifications was in the process of completing its initial revisions to be submitted for industry comment and balloting. This update summarizes the most important proposed modifications that are expected to be presented for NERC Standards Committee approval and posting for industry comment and balloting.

Modification Main Points

  • The LERC definition will remain, but will be modified as explained below.
  • The definition for “Low Impact BES Cyber System Electronic Access Point (LEAP)” will be removed and replaced with text within the Attachment 1 requirements.

LERC Modification

To help understand the LERC modifications, let’s first look at the current definition:

Direct user-initiated interactive access or a direct device-to-device connection to a low impact BES Cyber Systems (BCS) from a Cyber Asset outside the asset containing those low impact BCS via a bi-directional routable protocol connection. Point-to-point communications between intelligent electronic devices that use routable communication protocols for time-sensitive protection or control functions between Transmission station or substation assets containing low impact BCS are excluded from this definition (examples of this communication include, but are not limited to, IEC 61850 GOOSE or vendor proprietary protocols)

The modified definition replaces “Connectivity” with “Communication” in the title, making it now read “Low Impact External Routable Communication,” and would include the proposed text:

Routable protocol communication that crosses the boundary of an asset containing one or more low impact BES Cyber System(s), excluding communications between intelligent electronic devices used for time-sensitive protection or control functions between non-Control Center BES assets containing low impact BES Cyber Systems including, but not limited to, IEC 61850 GOOSE or vendor proprietary protocols

It’s also worth highlighting that the original wording “direct user-initiated interactive access or direct device-to-device” was removed and replaced with “routable protocol communications”. By eliminating the use of ‘direct’, the SDT objective was to remove any uncertainty on what “direct” meant and that any communications coming into the BES asset using a routable protocol are to be considered, regardless of the communication’s intended purpose.

Along with these changes, modifications to the original wording regarding connection “from a Cyber Asset outside the asset containing those low impact BES Cyber System(s)” now reads “communication that crosses the boundary of an asset containing one or more low impact BES Cyber Systems(s).” This revision indicates that communications must pass from outside the BES asset boundary into the BES asset. I’ll dive into additional information for clarifying ‘boundary’ later in this posting.

One addition point to highlight from these modifications is the clarification made on the exclusion of time-sensitive communications only applies to the protection and control functions between non-Control Center BES assets that contain low impact BCS, which addresses the confusion on  whether the exclusion could be applied to Control Center to non-Control Center communication.

Removal of LEAP

In removing the LEAP definition, the requirement to provide access protections is handled in the CIP-003 Attachment 1, Section 3 where the text “electronic access control(s)” replaces LEAP: “Implement electronic access control(s) for LERC, if any, to permit only necessary electronic access to low impact BES Cyber Systems

What Does This Mean?

  • A ‘boundary’ where routable connections enter the BES asset must be defined by the Entity. Information will be provided in the Standards Guidelines and Technical Basis (GTB) section, which I’ll cover in future installments.
  • Routable communications will need to be identified coming into the BES asset, regardless if the communication is intended for BCS or business systems, bi-directional or uni-directional.
  • If communication enters a BCS, then controls must be implemented to allow only necessary inbound and/or outbound communications. There must also be technical and operational reasons justifying why these communications are necessary. Examples on possible controls types will be provided in the GTB section, which use a new set of reference models to demonstrate how controls can be applied to an Entity’s unique configurations.
  • If there is no communication to a BCS through LERC, it must still be identified, and noted in the plan that routable communications to the BCS does not occur.

Physical Security Controls & Next Steps 

For the physical security controls portion outlined in Attachment 1, Section 2, references to LEAP protection have been removed and replaced with protection of the “electronic access control devices”.

On July 21, 2016, the SDT officially submitted its proposed modification for a 45-day industry comment period, with the ballot conducted during the last 10 days of this period.

As I mentioned in this article’s introduction, this information is based on is the SDT’s current proposal, and it should be expected that there will be additional modifications based on industry comments and ballot outcome. With this ongoing process, I will continue to provide updates and potential impacts that could affect a Registered Entities current low impact implementation work.

Additional Information 

Upcoming articles will cover additional information electronic access controls and what is currently known about the audit approach, but in the meantime the following information may be of assistance in your Low Impact BCS research and implementation efforts:

Michael C. Johnson is a member of the Compliance & Information Protection Group at Burns & McDonnell. He provides cybersecurity and NERC CIP compliance consulting to generation, transmission and distribution entities.


The Next Generation Electric Utility 2.0The way we get power to our homes and businesses is changing. And while our dependence on local power utilities for our supply of electricity will not change, one thing that will is the level and type of services the utilities provide us. The steady flow of power supply we’ve come to expect will soon be just the starting basic service package, and will grow to a host of new value-added services.

For decades utilities have had the privilege of being exclusive service providers in their territories in exchange for providing a common good — one level of service offering to all customers while earning a modest rate of return to build, operate and maintain the power lines and substations. This simple model has served us well and provided an economic and reliable supply of abundant power to support our industries, grow our economies and afford us the modern amenities of life we enjoy today.

Maturing of newer technologies and consumer preference for living with low environmental impacts is enabling customers’ options to either go completely off the grid through self-generation or significantly reduce the amount of power they draw from the grid by augmenting their supply with partial self-generation options. The same shift that happened with the wireline telecom companies in the ’90s, and the shift that has taken the taxi industry by storm with entrance of new unregulated competition, is about to happen to the utility industry.

The cost reductions due to maturing of technologies and installation techniques in rooftop solar and wind turbines combined with battery storage or micro gas turbines will soon provide a cost effective, reliable and safe alternative, allowing individual residential or commercial customers to choose to either connect to their local utility’s traditional wires for power supply or install their own source of supply in their homes at a cost that over time can be cheaper than power from the grid. Similarly, land developers building new communities will have a choice between getting the traditional wire service from their local utilities or by installing their own community generation, also called distributed generation. This could be particularly appealing in areas like northeastern Canada and the United States where ice storm outages are becoming more frequent. Having access to a self-generation option could provide a reliable source of power when the utility power lines are down.

Until now, customers recognize the face of the utility as a power outlet that they’re able to plug into when they need some electricity or the phone number that they call if they have a connection request or billing inquiry. In the coming years utilities will provide a host of additional services, including:

    • Service Levels — Various levels could be provided, in terms of reliability and capacity. For example, a premium service could provide backup power when utility wires are down due to a storm, or perhaps a larger capacity outlet that would allow for fast charging of your electric vehicle.
    • Energy Management — A utility-installed energy management device in your home will track your power consumption behavior and individual appliance consumption and suggest energy-saving techniques such as automatically lowering house temperature when no one is home, or recommending changing old appliances that are not energy efficient.
    • Smart Home — Features would allow you to control your home appliances, door locks, alarm system or video surveillance from your phone and be able to turn lights on/off and control thermostat remotely.
    • Home Monitoring — Such capability would provide security alarms and video surveillance of your home.
    • Flat Rate — Such rates could be offered for electricity in jurisdictions that have time-of-use rates where electricity pricing is different at peak use hours vs. in nonpeak hours such as at mid-afternoon or at night.
    • Home Technician Service — If you have self-generation, a hybrid supply option utility could take care of all maintenance associated with your home microgrid. These services could also encompass maintenance and repair of your air conditioners, water heaters and furnace and perhaps even electrical wiring during home renovations.
    • Cable/Telephone Service — Some utilities may provide additional utility services such as cable television and telephone service through their power lines using a technology called broadband over powerline carrier (BPL).
    • Car Charging Stations — Car charging stations for electric cars will be needed throughout our cities and along the highways similar to today’s gas stations. Utilities are best suited to provide this service; they are a brand people trust for power supply at a reasonable cost.
    • IT Support Service – IT technical support and data backup and management by partnering with a data management and computer technical support company.
    • Home Energy Audits – Inspection and testing of home energy loss from windows, doors and wall insulation, and checking for efficiency of your home furnace.

The traditionally slow-changing world of utilities — often considered mundane compared to the fast paced and glamorous world of information technology and telecom companies — is about to get exciting. We’re entering the bold new world of smart, self-healing, technology-intensive and distributed microgrid, and there has never been such an exciting time to be in the utility sector.

To learn more about where the utility transformation is headed and what new technologies and service models utilities around North America are implementing to stay ahead of the changing world, subscribe to our monthly webinar presentation series by following this link:

The Next Generation Utility Webinar Series

With 16 years of service in the utility sector, Ahsan Upal is a regional manager with Burns & McDonnell responsible for Canadian business development and leading engineering, project management and regulatory teams for major electrical distribution and transmission projects across Canada and the United States.


Developing a Safety Culture Enhances Business Performance

by Jamie Butler July 18, 2016

It was 1985.  We were setting the steel for a deep caisson foundation for large transmission poles on the edge of a major — and dry — riverbank and the foreman was a wreck. The crane was undersized; the ground was unstable; the 60-foot rebar cage was being threaded into the cased excavation, displacing small […]

Read the full article →

NERC CIP Low Impact Requirements — Physical Security Controls

by Michael C. Johnson July 14, 2016

In this seventh blog installment on NERC CIP Low Impact BES Cyber Systems (BCS) requirements, I’ll cover the physical security controls necessary for successfully implementing these BCS requirements. What’s Covered CIP-003-6, Requirement R2, Attachment 1, Section 2 — indicates that physical security must be applied to the BCS requirements and any Low Impact BCS Electronic […]

Read the full article →

Erosion Presents Growing Risk to Pipeline Infrastructure

by Rick Besancon July 13, 2016

All around the United States, a hidden danger lies in channels and waterways — natural gas pipelines exposed by erosion and channel degradation. All it takes is a single heavy branch carried along by rushing water to cause a rupture, resulting in the potential loss of life and property in populated areas. With tens of […]

Read the full article →

Waterline Replacement: Trenchless Technologies Can Minimize Community Disruption

by Mike Lehrburger July 11, 2016

Trenchless technologies are emerging solutions for installing, replacing, repairing and restoring underground utilities. As the ever-present demand for reliable water resources continues to grow, and our existing infrastructure continues to age, communities are turning to trenchless technologies to improve their water infrastructure with minimal disruption to the community. Here’s a look at how our team […]

Read the full article →