Figure 25: Green Button PCI and NERC CIP Security Standards During the development of the SMT business requirements, AMIT created a task to evaluate both the Payment Card Industry Data Security Standard (PCI DSS) and the NERC Critical Infrastructure Protection (CIP) standards to determine which, if any, of these standards apply and what requirements applied to SMT. The NERC CIP standards have continued to evolve with the forthcoming version 5 being applicable to the bulk electric system which does not include SMT. The task group identified cyber security standards best practices and specific requirements for SMT from their review of these standards. At a high level, the requirements are: Build and maintain a secure network PCI Requirement Install and maintain a firewall configuration to protect critical – data PCI Requirement Do not use vendor supplied system defaults for system – passwords and other security parameters NERC CIP 005-1 Electronic Security Perimeter – Protect critical data PCI Requirement Protect stored critical data – PCI Requirement Encrypt transmission of critical data across open, public – networks Identify critical cyber assets NERC CIP 002-1 Critical Cyber Asset Identification – Maintain a vulnerability management program PCI Requirement Use and regularly update anti-virus software – PCI Requirement Develop and maintain secure systems and applications – NERC CIP 007-1 Systems Security Management – Implement strong access control measures PCI Requirement Restrict access to critical data by business need-to-know – PCI Requirement Assign a unique ID to each person with computer access –
Figure 25: Green Button PCI and NERC CIP Security Standards During the development of the SMT business requirements, AMIT created a task to evaluate both the Payment Card Industry Data Security Standard (PCI DSS) and the NERC Critical Infrastructure Protection (CIP) standards to determine which, if any, of these standards apply and what requirements applied to SMT. The NERC CIP standards have continued to evolve with the forthcoming version 5 being applicable to the bulk electric system which does not include SMT. The task group identified cyber security standards best practices and specific requirements for SMT from their review of these standards. At a high level, the requirements are: Build and maintain a secure network PCI Requirement – Install and maintain a firewall configuration to protect critical data PCI Requirement – Do not use vendor supplied system defaults for system passwords and other security parameters NERC CIP 005-1 – Electronic Security Perimeter Protect critical data PCI Requirement – Protect stored critical data PCI Requirement – Encrypt transmission of critical data across open, public networks Identify critical cyber assets NERC CIP 002-1 – Critical Cyber Asset Identification Maintain a vulnerability management program PCI Requirement – Use and regularly update anti-virus software PCI Requirement – Develop and maintain secure systems and applications NERC CIP 007-1 – Systems Security Management Implement strong access control measures PCI Requirement – Restrict access to critical data by business need-to-know PCI Requirement – Assign a unique ID to each person with computer access
FINAL_Understanding_Smart_Meter_Texas_with_Third_Party_Usability_2015.docx