{"id":90585,"date":"2020-02-12T09:00:21","date_gmt":"2020-02-12T17:00:21","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90585"},"modified":"2023-05-15T23:06:56","modified_gmt":"2023-05-16T06:06:56","slug":"nerc-cip-compliance-azure","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/02\/12\/nerc-cip-compliance-azure\/","title":{"rendered":"NERC CIP compliance in Azure"},"content":{"rendered":"

When I did my first North American Electric Reliability Corporation\u2014Critical Infrastructure Protection (NERC CIP) compliance project it was 2009. NERC CIP was at version 3. It was the first mandatory cybersecurity standard that the utility I was working for had to meet. As it does today, the Bulk Electric System (BES) had the responsibility to keep North America powered, productive, and safe with near 100 percent uptime. Critical infrastructure for us is not email and payroll systems, it\u2019s drinking water and hospitals. Leading the way to the cloud was not top of mind. The NERC CIP standards were written for on-premise systems.<\/p>\n

NERC CIP compliance was a reason many participants in the BES would not deploy workloads to the cloud. NERC CIP version 6 is now in force. NERC has recognized the change in the technology landscape including the security and operational benefits that well architected use of the cloud has to offer.<\/p>\n

Microsoft has made substantial investments in enabling our BES customers to comply with NERC CIP in Azure. Microsoft engaged with NERC to unblock NERC CIP workloads<\/a> from being deployed in Azure and Azure Government.<\/p>\n

All U.S. Azure regions are now approved for FedRAMP<\/a> High impact level. We use this to establish our compliance to NERC and the Regional Reliability Councils.<\/p>\n

In June 2019, NERC Electric Reliability Organization (ERO) conducted an audit of Azure in Redmond, Washington. NERC, NERC regional auditor organizations, and the NERC CIPC (Critical Infrastructure Protection Committee) were represented.<\/p>\n

We prepared a NERC CIP compliance guide for Azure<\/a>, and a Cloud Implementation Guide for NERC Audits<\/a>, which includes pre-filled Reliability Standard Audit Worksheet (Reliability Standard Audit Worksheet (RSAW)<\/a>) responses. This will help our customers save time and resources in responding to audits.<\/p>\n

NERC\u2019s BES Cyber Asset 15-minute rule is important to deploying appropriate NERC CIP workloads to Azure. This rule sets out requirements for BES Cyber Assets that perform real-time functions for monitoring or controlling the BES under the current set of CIP standards<\/a> and the NERC Glossary of Terms<\/a>. BES Cyber Assets, under the 15-minute rule, are those that would affect the reliable operation of the BES within 15 minutes of being impaired.<\/p>\n

Under the current rules, BES Cyber Assets\u2014like Supervisory Control and Data Acquisition Systems (SCADA) and Energy Management Systems (EMS)\u2014are not good candidates a for move to the cloud for this reason.<\/p>\n

Importantly, the NERC CIP standards also recognize that the needs of Bulk Electric System Cyber System Information (BCSI)<\/a> are different from BES Cyber Assets. BCSI is information that could be used to gain unauthorized access or pose a security threat to the Bulk Electric Cyber System. BCSI is not subject to the 15-minute rule.<\/p>\n

Many of the workloads that will benefit most from the operational, security, and cost savings benefits of the cloud are BCSI.<\/p>\n

Machine learning, multiple data replicas across fault domains, active failover, quick deployment, and pay for use benefits are now available for BCSI NERC CIP workloads when they\u2019re moved to or born in Azure.<\/p>\n

Examples include:<\/p>\n