The Federal Energy Regulatory Commission has released a final rule approving three new Critical Infrastructure Protection standards which address supply chain risk management for Bulk Electric Systems operations. The rule will take effect sixty days after it is published in the Federal Register, and must be implemented in eighteen months.
The three new CIP standards require responsible entities (such as distribution providers, generator owners and operators, and transmission owners and operators) to develop and implement security controls for industrial control system hardware, software, and services associated with BES operations. They respond to supply chain risks, including the insertion of counterfeit or malicious software, unauthorized production, tampering, and theft.