NERC Compliance CIP & 693 Solution NERC CIP Version 5 Compliance | Simplified. Meeting NERC CIP v5 Head On The CIP version 5 standards represent a shift in the compliance landscape for electric utilities. The expansion of CIP coverage under v5 will significantly increase the scope of utility infrastructure under CIP, and the shift from after-the-fact evidentiary reporting to actively- managed controls that identify and implement corrective actions is also a notable change from past compliance expectations. The integration between the Tripwire NERC Solution Suite and SigmaFlow’s NERC CIP Compliance Manager provides an automated solution that drastically reduces time and resources required to manage NERC CIP v5 compliance and collect comprehensive audit evidence. The integration gives electric utilities the ability to manage and validate configuration changes, access rights, and baselines as part of the normal work they do. Configuration Change Management SigmaFlow manages the change process, ensuring that changes are performed in a compliant manner. Tripwire collects security controls testing (High Impact) and baseline validation data to provide utilities with an efficient and reliable automation solution for NERC CIP v5 Change Management. Access Rights Management SigmaFlow simplifies Access Rights Management with a profile model that ‘rolls’access rights together for specific function/role processes and maintains the Approved List of Access Rights. Tripwire provides the actual Access Rights Scan that is validated to ensure a state of Audit Readiness. CIP-010 Evidence In-Depth Change Request Procedure Change Request Tickets Workflow Report Test Asset Security Controls Baseline Scan Report Validation Against Baseline Reports CIP-007 Evidence In-Depth Change Request Procedure Change Request Tickets Workflow Report Local Accounts Scan Domain Accounts Scan Validation Against Baseline Reports Baseline Configuration Management SigmaFlow organizes approved baselines into groups for common items like specific hardware, operating systems, and software. Baseline Groups are applied to Cyber Assets (all that apply) to build composite Cyber Asset Baselines. Tripwire uses the baselines (whitelists) to detect issues. Scheduled Tripwire scans feed “as is” data to SigmaFlow where actual baselines are assessed against approved baselines. This ensures baseline conformance and produces required supporting evidence. CIP-007 Evidence In-Depth to Ensure Approved Baselines Baseline Approval Baseline Whitelists Baseline Scans Baseline Validation &