CIP-008 — Incident Reporting & Response Planning

Description

CIP-008 requires cybersecurity incident response planning, incident identification and classification, reporting of qualifying incidents, response actions, testing, and lessons learned for applicable BES Cyber Systems and responsible entities.

Implications

• Organizations need a repeatable process to detect, assess, contain, report, and recover from cyber incidents affecting BES reliability.
• Operations, cybersecurity, physical security, legal, communications, vendors, law enforcement, regulators, and regional entities may need coordinated roles.
• Response plans must work during loss of normal communications, degraded control systems, or simultaneous physical and cyber events.
• Exercises and lessons learned can expose gaps in contact lists, decision rights, evidence handling, and restoration procedures.

Common Compensating Controls

• OT-specific incident response playbooks for malware, unauthorized access, loss of view, loss of control, ransomware, and supply-chain compromise.
• 24/7 monitoring and escalation, out-of-band communications, offline contact lists, and predefined severity thresholds.
• Tabletop and functional exercises with operations, vendors, executives, and external stakeholders.
• Forensic readiness: protected logs, time synchronization, evidence-preservation procedures, and chain-of-custody forms.
• Post-incident reviews with corrective actions, ownership, due dates, and verification of closure.

Reporting thresholds and timelines must be taken from the current approved standard and applicable reporting guidance.