CIP-005 — Electronic Security Perimeters

Description

CIP-005 protects BES Cyber Systems through Electronic Security Perimeters, defined electronic access points, and controls for interactive remote access. It governs network boundaries, inbound and outbound communications, remote sessions, authentication, and monitoring of applicable access paths.

Implications

• Network architecture must identify all routable and externally reachable pathways to covered cyber systems.
• Remote access, vendor connectivity, wireless paths, dial-up, maintenance ports, and communications with external networks require strict control.
• Boundary devices and access rules must be maintained as systems evolve; undocumented paths are a major compliance and security weakness.
• Security controls must preserve real-time availability and not interfere with protection or control traffic.

Common Compensating Controls

• Segmented OT architecture with firewalls, jump servers, deny-by-default rules, and tightly controlled conduits.
• MFA, certificate-based authentication, privileged-access management, and approval-based remote sessions.
• Unidirectional gateways or data diodes where appropriate; disable unused ports, services, and remote paths.
• Centralized firewall-rule management, configuration backup, flow monitoring, IDS/IPS, and alert review.
• Temporary vendor access with time limits, session logging, explicit authorization, and post-session review.

Compensating measures must be technically feasible for the affected OT environment and validated for reliability impact.