security reviews are conducted by a wide variety of vendors with different skill sets in order to ensure a thorough and comprehensive review. SMT and NIST IR 7628 The NIST IR 7628, is a three volume report developed Guidelines for Smart Grid Cyber Security using a consensus process by the Cyber Security Working Group of the Smart Grid Interoperability Panel (SGIP). The NIST IR 7628 provides an analytical framework to help utility industry organizations to develop or evaluate cyber security policies and strategies to assess risk and identify the appropriate cyber security requirements for their systems. SMT’s development began prior to the development of the NIST IR 7628 document, but AMIT was aware of the cyber security work being done by the SGIP and this industry guidance was helpful in the final evaluation of security requirements. SMT’s AMIT identified the set of security requirements for SMT listed in Table 11. The SMT security requirements also satisfy NIST IR 7628 security requirements as shown in the third column of the table. Additionally, other NIST IR 7628 requirements are satisfied by SMT system architecture and policy, but were not specifically identified in the original SMT business requirements and are outside the scope of this document. Table 11: SMT Security Requirements SMT Requirement Requirement NIST IR 7628 ID Ability to block access to a user and force a password reset, SG.AC-8 Unsuccessful via email, if they enter the incorrect password 4 times within Login Attempts BR- 017.010 5 minutes. Ability to require a user to respond to a confirmation email, SG.AC-2 Remote sent to the e-mail address they are registering with, to Access Policy and BR- 017.011 user’s validate the email address is correct before allowing them to Procedures move forward with the registration process (e.g. send and SG.AC-15 Remote receive a confirmation). Access
security reviews are conducted by a wide variety of vendors with different skill sets in order to ensure a thorough and comprehensive review. SMT and NIST IR 7628 The NIST IR 7628, Guidelines for Smart Grid Cyber Security is a three volume report developed using a consensus process by the Cyber Security Working Group of the Smart Grid Interoperability Panel (SGIP). The NIST IR 7628 provides an analytical framework to help utility industry organizations to develop or evaluate cyber security policies and strategies to assess risk and identify the appropriate cyber security requirements for their systems. SMT’s development began prior to the development of the NIST IR 7628 document, but AMIT was aware of the cyber security work being done by the SGIP and this industry guidance was helpful in the final evaluation of SMT’s security requirements. AMIT identified the set of security requirements for SMT listed in Table 11. The SMT security requirements also satisfy NIST IR 7628 security requirements as shown in the third column of the table. Additionally, other NIST IR 7628 requirements are satisfied by SMT system architecture and policy, but were not specifically identified in the original SMT business requirements and are outside the scope of this document. Table 11: SMT Security Requirements SMT Requirement ID Requirement NIST IR 7628 BR- 017.010 Ability to block access to a user and force a password reset, via email, if they enter the incorrect password 4 times within 5 minutes. SG.AC-8 Unsuccessful Login Attempts BR- 017.011 Ability to require a user to respond to a confirmation email, sent to the user’s e-mail address they are registering with, to validate the email address is correct before allowing them to move forward with the registration process (e.g. send and receive a confirmation). SG.AC-2 Remote Access Policy and Procedures SG.AC-15 Remote Access