Personnel Security SG.PS All Organizational Risk Management and Assessment SG.RA All Organizational Grid Information System and Services Acquisition Policy and SG.SA SG.SA-1 Procedures Organizational Security Policies for Contractors and SG.SA-2 Third Parties Organizational Life-Cycle Support SG.SA-3 Organizational Acquisitions SG.SA-4 Organizational Smart Grid Information System SG.SA-5 Documentation Organizational Software License Usage Restrictions SG.SA-6 Organizational Developer Configuration Management SG.SA-9 Organizational Supply Chain Protection SG.SA-11 Organizational Grid Information System and Communication Protection Policy and SG.SC SG.SC-1 Procedures Organizational Security Function Isolation Unclear how to implement SG.SC-3 for SA SG.SC-10 Trusted Path N/A Transmission of Security Parameters SG.SC-14 N/A Honeypots SG.SC-24 Inappropriate for SA Operating System-Independent SG.SC-25 Applications N/A Heterogeneity SG.SC-27 Inappropriate for SA Virtualization Techniques SG.SC-28 Inappropriate for SA Smart Grid Information System and Information Integrity Policy and SG.SI SG.SI-1 Procedures Organizational Flaw Remediation SG.SI-2 Organizational Security Alerts and Advisories SG.SI-5 Organizational Security Function Verification Unclear how this would be handled for SA. Supporting controls include AAM, CAR, SG.SI-6 CFSD, ID, HM, and IUA. Error Handling SG.SI-9 Not specific to SA
SG.PS All Personnel Security Organizational SG.RA All Risk Management and Assessment Organizational SG.SA SG.SA-1 Grid Information System and Services Acquisition Policy and Procedures Organizational SG.SA-2 Security Policies for Contractors and Third Parties Organizational SG.SA-3 Life-Cycle Support Organizational SG.SA-4 Acquisitions Organizational SG.SA-5 Smart Grid Information System Documentation Organizational SG.SA-6 Software License Usage Restrictions Organizational SG.SA-9 Developer Configuration Management Organizational SG.SA-11 Supply Chain Protection Organizational SG.SC SG.SC-1 Grid Information System and Communication Protection Policy and Procedures Organizational SG.SC-3 Security Function Isolation Unclear how to implement for SA SG.SC-10 Trusted Path N/A SG.SC-14 Transmission of Security Parameters N/A SG.SC-24 Honeypots Inappropriate for SA SG.SC-25 Operating System-Independent Applications N/A SG.SC-27 Heterogeneity Inappropriate for SA SG.SC-28 Virtualization Techniques Inappropriate for SA SG.SI SG.SI-1 Smart Grid Information System and Information Integrity Policy and Procedures Organizational SG.SI-2 Flaw Remediation Organizational SG.SI-5 Security Alerts and Advisories Organizational SG.SI-6 Security Function Verification Unclear how this would be handled for SA. Supporting controls include AAM, CAR, CFSD, ID, HM, and IUA. SG.SI-9 Error Handling Not specific to SA