Cyber Security Incidents
|
|
By Jason Georgoulis
|
As they relate to Reliability Standards, a Cyber Security Incident (CSI) is defined as a malicious act or suspicious event that:
- (For a high or medium impact BES Cyber System) compromises or attempts to compromise an Electronic Security Perimeter, a Physical Security Perimeter, or an Electronic Access Control or Monitoring System; or
- Disrupts or attempts to disrupt the operation of a Bulk Electric System (BES) Cyber System (BCS).
CSIs are a serious risk to the BES. Registered entities are required to report CSIs to the Electricity Information Sharing and Analysis Center (E-ISAC) and Critical Infrastructure Security Agency (CISA). How registered entities respond to and report these events can have a significant impact on the outcome.
One of the methods registered entities may use to submit reports online is through the DOE-OE-417 form. This form allows registered entities to specify the type of report and who will receive it. Due to time constraints for reporting certain types of CSIs, registered entities should be familiar with the different reporting methods and DOE-OE-417 form (instructions are available here).
