C5_5_Appx__A_-_Supply_Chain_Risk_Management_Plan_for_BCS.pdf

U.S. Department of the Interior 11/17/2021

Supply Chain Risk Management Plan for Bulk Electric System Cyber Systems (BCSs)

CIP-013-1

Revision Block

Rev. No. Description Date Change Official, Organization

1.0 Initial Release 09/09/2020 Wendy S. Center, PRO

2.0 2021 Annual Review and Approval

11/17/2021 Wendy S. Kalidass, PRO

Contents Overview

Requirement R1

Part 1.1

Part 1.2

Requirement R2

Requirement R3

References

Overview This document describes Reclamation’s controls and processes to meet the CIP-013-1 requirements for supply chain cyber security risk management. CIP-013-1 applies to high and medium impact Bulk Electric System (BES) Cyber Systems (BCSs). It does not apply to associated systems such as Physical Access Control Systems (PACS), Electronic Access Control or Monitoring Systems (EACMS), or Protected Cyber Assets (PCA). It also does not apply to low impact BCS, non-NERC Facilities, or other Industrial Control Systems (ICS) that are not related to BES operation.

Requirement R1 CIP-013-1 Requirement R1 requires Reclamation to develop one or more documented supply chain cyber security risk management plan(s) for high and medium impact BCSs. This document satisfies that requirement.

Part 1.1 The Federal Acquisition Regulations, Department of the Interior (DOI) Acquisition Regulations, and Reclamation Acquisition Regulations (RAR) identify the cyber and physical security controls required for all purchases. These controls were determined through risk assessments conducted at the federal, department, and bureau levels.

In accordance with the RAR, Reclamation documents contractors’ past performance in the Past Performance Information Retrieval System (PPIRS), which is used to determine whether vendors may be selected. Past performance is based in part on whether the vendor adhered to contract clauses (including those associated with information technology (IT)). Additional details for this process can be found in WBR subpart 1442.1503 of the RAR.

When changing vendors, Reclamation must follow the processes in the RAR for a new contract.

WBR Part 1439 of the RAR describes controls for procuring IT hardware, including BCS components in accordance with the DOI Enterprise Information Technology Hardware Mandatory Acquisition Strategy. To secure facilities and IT resources during the performance of service and construction contracts, Reclamation implements the security risk mitigation controls described in WBR subpart 1437.81 of the RAR.

The Denver Power Resource Office (PRO), Reliability Compliance Team reviews purchase requests for ICS equipment and services as part of the ICS Purchase Request Process. This process is initiated using an online preliminary purchase request application for both ICS purchases and ICS micro-purchases. Emergency purchase requests, i.e., those where not purchasing immediately would result in a serious impact to the agency or mission, must be submitted as soon as practical after the purchase occurs through the micro-purchase process.

Part 1.2 Reclamation requires the following when procuring BCSs:

1.2.1 Notification by the vendor of vendor-identified incidents related to the products or services provided to Reclamation that pose cyber security risk to Reclamation.

1.2.2. Coordination of responses to vendor-identified incidents related to the products or services provided to Reclamation that pose cyber security risk to Reclamation.

1.2.4. Disclosure by vendors of known vulnerabilities related to the products or services provided to Reclamation.

To address contractor responsibilities with respect to incident and vulnerability notification in accordance with subparts 1.2.1, 1.2.2, and 1.2.4, Reclamation uses WBR 1452.237-80, paragraph (f)(3) of the RAR, which states, “the Contractor shall immediately notify the [Contracting Officer’s Representative (COR)], of all cyber-related incidents (including the compromise of Contractor- or Government-owned systems for which the Contractor bears operational or management responsibility), regardless of location.”

In addition to the RAR contract language, Reclamation coordinates with the Cybersecurity & Infrastructure Security Agency (CISA) and Department of the Interior to remediate identified vulnerabilities prior to public disclosure by vendors or through CISA’s advisories or bulletins.

1.2.3. Notification by vendors when remote or onsite access should no longer be granted to vendor representatives.

Reclamation does not allow vendor remote access to its BCSs. To address contractor responsibilities for onsite access in accordance with subpart 1.2.3, Reclamation uses WBR 1452.237-80, paragraph (a)(5) of the RAR, which states:

Any Contractor employee that will have access to a Federally-controlled facility or information system will be required to have a Government-issued identification card, consisting of a Personal Identity Verification (PIV) Card, a temporary identification card, or a visitor badge. (Note: within the Department of the Interior this card is known as a DOI Access Card.) During performance of the contract, the Contractor shall keep the COR apprised of any changes in personnel, or changes in personnel access or duration, to ensure that performance is not delayed by compliance with credentialing processes.

Additionally, issuance of government-issued identification cards requires a background check for Contractor employees. Temporary identification cards and visitor badges do not allow unescorted physical access to BES Cyber Systems.

1.2.5. Verification of software integrity and authenticity of all software and patches provided by the vendor for use in the BES Cyber System.

To address contractor IT security responsibilities in accordance with subpart 1.2.5, Reclamation uses WBR 1452.237-80 paragraph (f)(5), of the RAR, which states:

Contractor shall be responsible for the IT security of all contractor-owned systems connected to a Bureau of Reclamation network or Reclamation-owned systems operated or maintained by the Contractor for Reclamation, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services to which the Contractor must have physical or electronic access, and which may contain Reclamation's sensitive information on unclassified systems directly supporting the mission of Reclamation. This includes IT, hardware, software, databases, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

Examples of tasks that require these security provisions include:

(i) The acquisition, transmission or analysis of data owned by Reclamation; and

(ii) Access to Reclamation networks or computers at a level beyond that granted to the general public, such as access to control rooms, computer rooms, or controlled access through a firewall or other security control measure.

Each Reclamation region implements procedural controls to verify the identity of software source(s) and the integrity of the software obtained from the software source(s) in accordance with CIP-010-3 R1 Part 1.6. The contract language ensures that contractors are required to meet obligations with respect to software security.

1.2.6. Coordination of controls for (i) vendor-initiated Interactive Remote Access, and (ii) system-to-system remote access with a vendor(s).

Reclamation does not allow vendor remote access to its BCSs. For more information, see Reclamation Power Reliability Compliance Bulletin for CIP-005-6.

Requirement R2 CIP-013-1 Requirement R2 requires Reclamation to implement the supply chain cyber security risk management controls described within this document. Reclamation retains evidence of implementing each control with each applicable purchase request and/or contract. Evidence of implementation includes emails transmitting completed Information Management Team (IMT) ICS Purchase Checklists as part of the ICS purchase approval process and equipment or service contracts containing language for purchases made for CIP-013 applicable systems. Reclamation is not required to renegotiate or abrogate existing contracts (including amendments to master agreements and purchase orders) to implement these controls. Additionally, these controls do not govern (1) the actual terms and conditions of a procurement contract or (2) vendor performance and adherence to a contract.

Requirement R3 PRO Reliability Compliance staff annually reviews this plan for changes prior to briefing the CIP Senior Manager. The CIP Senior Manager reviews and approves this plan annually, not to exceed 15 calendar months.

References CIP-013-1 – Cyber Security - Supply Chain Risk Management

Department of the Interior Acquisition Regulation

Federal Acquisition Regulation

Reclamation Acquisition Regulation, WBR 1452.237-80 Security Requirements

Reclamation Acquisition Regulation