The Federal Energy Regulatory Commission (FERC) announced it has bolstered the cyber security of the nation's bulk electric system by expanding the reporting requirements for incidents involving attempts to compromise operation of the grid.

The action closes a gap in the prior Critical Infrastructure Protection Reliability Standards that required entities to report only when an incident has compromised or disrupted one or more reliability tasks, FERC stated in the press release.

FERC previously directed the North American Electric Reliability Corp. (NERC) to enhance the reporting of cyber security incidents out of concern that the existing standards may understate the true scope of threats by excluding from reporting incidents that could facilitate subsequent efforts to harm the reliable operation of the grid.

The approved new Critical Infrastructure Protection Reliability Standard CIP-008-6 (Cyber Security - Incident Reporting and Response Planning) now requires reporting of cyber security incidents that either compromise or attempt to compromise Electronic Security Perimeters, Electronic Access Control or Monitoring Systems, and Physical Security Perimeters associated cyber systems.

The new Reliability Standard also encompasses disruptions or attempts to disrupt the operation of a bulk electric system cyber system.

Each responsible entity will be required to develop criteria for identifying an attempt to compromise a cyber asset and then apply those criteria during its cyber security incident identification process.

Source: FERC