Audit of Federal Energy Regulatory Commission’s Monitoring of Power Grid Cyber Security Finds Missing “Essential Security Requirements and Effective Practices”

A new report by the Department of Energy’s inspector general finds that critical infrastructure protection cybersecurity standards promulgated by the Federal Energy Regulatory Commission do “not always include controls commonly recommended for protecting critical information systems.”  For example, the “standards did not include essential security requirements and effective practices such as defining what constituted critical assets and implementation of strong logical access controls,” and, “the Commission approved an implementation approach and schedule for the CIP standards that did not adequately consider risks to information systems.”