CIP-007 — System Security Management

Description

CIP-007 establishes system-security-management controls for applicable BES Cyber Systems. Typical areas include security patches, vulnerability mitigation, malicious-code prevention, ports and services, account management, system access, security-event monitoring, and logging.

Implications

• OT systems require controlled hardening, patching, malware protection, account administration, and logging without compromising availability or deterministic operation.
• Unsupported operating systems and legacy devices increase compensating-control needs and lifecycle risk.
• Security logs must be sufficient to detect and investigate unauthorized activity while accounting for storage, time synchronization, and bandwidth constraints.
• Emergency changes and vendor maintenance must remain traceable and governed.

Common Compensating Controls

• Application allowlisting, removable-media scanning, endpoint detection where validated for OT, and strict USB controls.
• Disablement of unnecessary ports and services, secure configuration baselines, host firewalls, and network segmentation.
• Virtual patching through isolation, firewall restrictions, IPS signatures, access limitation, and accelerated replacement when direct patching is unsafe.
• Centralized or locally buffered logging, protected time sources, SIEM monitoring, alert triage, and retention controls.
• Strong account lifecycle management, unique IDs, least privilege, privileged-access workstations, and emergency-account review.

Patching and scanning decisions must be risk-assessed, documented, tested, and coordinated with operations.