New NERC Directive Emphasizes Cyber Planning And Reporting For Electrical Energy Sector

The North American Electric Reliability Corp. (NERC) recently adopted the Cyber Security – Incident Reporting and Response Planning CIP-008-6 directive (Directive), which creates new cybersecurity incident reporting obligations for bulk electric systems (BES) categorized as high or medium impact in North America. The Directive also emphasizes the importance of cyber planning and preparedness and is set to be implemented in December 2020.

Given that NERC standards are mandatory in several Canadian provinces, the new Directive will have implications for organizations on both sides of the Canada-U.S. border. Organizations governed by NERC standards are advised to review these requirements carefully and update their cybersecurity incident response plans and frameworks accordingly.