Lesson Learned CIP Version 5 Transition
Program
CIP-002-5: Programmable Electronic Device
Version: January 9, 2015
Purpose
The purpose of this Lesson Learned is to provide guidance on the identification of programmable electronic
devices. As discussed below, identifying “programmable electronic devices” is central to determining which
assets are in scope of the CIP Version 5 Reliability Standards. This document clarifies when the ERO will deem
a device to be “programmable” and subject to categorization as a Cyber Asset.
Guidance
The first step in determining whether a device is subject to the CIP Version 5 Reliability Standards as a BES
Cyber Asset or a Protected Cyber Asset (PCA) is to determine whether it is a “programmable electronic
device.” Specifically, for a device to be a BES Cyber Asset or a PCA, the device first must be a Cyber Asset. As
defined in the NERC Glossary of Terms Used in NERC Reliability Standards (NERC Glossary), Cyber Assets are
“programmable electronic devices, including the hardware, software, and data in those devices.”
In applying the definition of Cyber Asset and determining whether a device is programmable, the ERO will
look at whether the device has a microprocessor and field-updatable firmware or software. The ERO will not
focus on those devices that are merely configurable, as described below. The following highlights the differences
between a device the ERO will deem programmable and those it will deem to be configurable.
Programmable Electronic Device
As noted above, in determining whether a device is programmable, the ERO will look at whether the device has a
microprocessor and field-updateable firmware or software.
• “Field-Updatable” would include devices that have a management port, web interface, socketed chipset, or
any external interface that would allow the introduction of a firmware, software or logic update.
• If the device’s case is sealed in such a way that would require it to be damaged to gain access to the chipset
or internal ports then the device in to be considered to be not Field-Updatable.
Examples of such devices include, but are not limited to, the following:
• Digital Relays
• Phasor Measurement Units (PMUs)
• Phasor Data Concentrators (PDCs)
• Programmable Automation Controllers
3353 Peachtree Road NE
Suite 600, North Tower
Atlanta, GA 30326
404-446-2560 | www.nerc.com
•
Communications Processors
•
Routers, switches, firewalls
Configurable Device
A configurable device is a device that will not allow user changes to its internal programming, but otherwise allows
the user to change between pre-defined operational parameters or change hardware options.
• If a parameter allows for the entry of formulas, functions and/or any other series of logic steps then this
would constitute “programming” and would make the device a programmable electronic device.
Examples of configurable devices include the following types of devices:
• A solid state relay that allows the user to set when the relay will operate but not how the relay
operates.
• A HART compatible smart pressure transmitter
• A HART compatible smart actuator for a final control element, such as a control valve or damper
• A handheld HART configurator
• Output only/sealed devices
• A media converter (i.e., Copper to fiber converter)
Background Information
The following are definitions from the NERC Glossary relevant to this Lesson Learned.
BES Cyber Asset – A Cyber Asset that if rendered unavailable, degraded, or misused would, within 15 minutes of its
required operation, misoperation, or non-operation, adversely impact one or more Facilities, systems, or equipment,
which, if destroyed, degraded, or otherwise rendered unavailable when needed, would affect the reliable operation
of the Bulk Electric System. Redundancy of affected Facilities, systems, and equipment shall not be considered when
determining adverse impact. Each BES Cyber Asset is included in one or more BES Cyber Systems. (A Cyber Asset is
not a BES Cyber Asset if, for 30 consecutive calendar days or less, it is directly connected to a network within an ESP,
A Cyber Asset within an ESP, or to a BES Cyber Asset, and it is used for data transfer, vulnerability assessment,
maintenance, or troubleshooting purposes.)
BES Cyber System – One or more BES Cyber Assets logically grouped by a Responsible Entity to perform one or
more reliability tasks for a functional entity.
Cyber Assets – Programmable electronic devices, including the hardware, software, and data in those devices.
Protected Cyber Asset – One or more Cyber Assets connected using a routable protocol within or on an Electronic
Security Perimeter that is not part of the highest impact BES Cyber System within the same Electronic Security
Perimeter. The impact rating of Protected Cyber Assets is equal to the highest rated BES Cyber System in the same
ESP. A Cyber Asset is not a Protected Cyber Asset if, for 30 consecutive calendar days or less, it is connected either to
a Cyber Asset within the ESP or to the network within the ESP, and it is used for data transfer, vulnerability
assessment, maintenance, or troubleshooting purposes.