3 Days left to get an iPad Pro with Smart Keyboard, Surface GO or $350 Off with Online Training

ICS & Energy-Houston 2017

Houston, TX | Mon, Jul 10 - Sat, Jul 15, 2017
This event is over,
but there are more training opportunities.

ICS456: Essentials for NERC Critical Infrastructure Protection

Mon, July 10 - Fri, July 14, 2017

This is best-in-class NERC CIP training. The courseware provides valuable compliance approaches and software tools for peer collaboration to build consent on implementation

Jeff Mantong, WAPA

The training equips you with the knowledge that places you a step above the adversary in ICS technology.

Mainza Mwiinga, Copperbelt Energy Corporation PLC

The Essentials for NERC Critical Infrastructure Protection 5-day course empowers students with knowledge of the "what" and the "how" of the version 5/6 standards. The course addresses the role of FERC, NERC and the Regional Entities, provides multiple approaches for identifying and categorizing BES Cyber Systems and helps asset owners determine the requirements applicable to specific implementations. Additionally, the course covers implementation strategies for the version 5/6 requirements with a balanced practitioner approach to both cybersecurity benefits, as well as regulatory compliance.

Our 25 hands-on labs range from securing workstations to digital forensics and lock picking.

Course Syllabus

Jason Christopher ,
Tim Conway
Mon Jul 10th, 2017
9:00 AM - 5:00 PM


A transition is underway from NERC CIP programs that are well defined and understood to a new CIP paradigm that expands its scope into additional environments and adds significantly more complexity. In day 1 students will develop an understanding of the electric sector regulatory structure and history as well as an appreciation for how the CIP Standards fit into the overall framework of the reliability standards. Key NERC terms and definitions related to NERC CIP are reviewed using realistic concepts and examples that prepare students to better understand their meaning. We will explore multiple approaches to BES Cyber Asset identification and learn the critical role of strong management and governance controls. The day will examine a series of architectures, strategies, and difficult compliance questions in a way that highlights the reliability and cybersecurity strengths of particular approaches. Unique labs will include a scenario based competition that helps bring the concepts to life and highlights the important role we play in defending 'the grid.'

CPE/CMU Credits: 6

  • Regulatory History and Overview
  • NERC Functional Model
  • NERC Reliability Standards
  • CIP History
  • Terms and Definitions
  • CIP-002: BES Cyber System Categorization
  • CIP-003: Security Management Controls

Jason Christopher ,
Tim Conway
Tue Jul 11th, 2017
9:00 AM - 5:00 PM


Strong physical and cyber access controls are at the heart of any good cybersecurity program. During day 2 we move beyond the "what" of CIP compliance to understanding the "why" and the "how." Firewalls, proxies, gateways, IDS and more - learn where and when they help and learn practical implementations to consider and designs to avoid. Physical protections include more than fences and you'll learn about the strengths and weaknesses of common physical controls and monitoring schemes. Labs will re-inforce the learnings throughout the day and will introduce architecture review and analysis, firewall rules, IDS rules, compliance evidence demonstration, and physical security control reviews.

CPE/CMU Credits: 6

  • CIP-005: Electronic Security Perimeter(s)
  • Interactive Remote Access
  • External Routable Communication and Electronic Access Points
  • CIP-006: Physical Security of BES Cyber Systems
  • Physical Security Plan
  • Visitor Control Programs
  • PACS Maintenance and Testing
  • CIP-014: Physical Security

Jason Christopher ,
Tim Conway
Wed Jul 12th, 2017
9:00 AM - 5:00 PM


CIP-007 has consistently been one of the most violated Standards going back to CIP version 1. With the CIP Standards moving to a systematic approach with varying requirement applicability based on system impact rating, the industry now has new ways to design and architect system management approaches. Throughout day 3, students will dive into CIP-007. We'll examine various Systems Security Management requirements with a focus on implementation examples and the associated compliance challenges. This day will also cover the CIP-010 requirements for configuration change management and vulnerability assessments that ensure systems are in a known state and under effective change control. We'll move through a series of labs that reinforce the topics covered from the perspective of the CIP practitioner responsible for implementation and testing.

CPE/CMU Credits: 6

  • CIP-007: System Management
  • Physical and Logical Ports
  • Patch Management
  • Malicious Code Prevention
  • Account Management
  • CIP-010: Configuration Change Management and Vulnerability Assessments
  • Change Management Program
  • Baseline configuration methodology
  • Change management alerting / prevention

Jason Christopher ,
Tim Conway
Thu Jul 13th, 2017
9:00 AM - 5:00 PM


Education is key to every organization's success with NERC CIP and the students in ICS 456 will be knowledgeable advocates for CIP when they return to their place of work. Regardless of their role, each student can be a valued resource to their organization's CIP-004 training program, the CIP-011 information protection program. Students will be ready with resources for building and running strong awareness programs that reinforce the need for information protection and cybersecurity training. In day 4 we'll examine CIP-008 and CIP-009 covering identification, classification communication of incidents as well as the various roles and responsibilities needed in an incident response or a disaster recovery event. Labs in day 4 will introduce tools for ensuring file integrity and sanitization of files to be distributed, how to best utilize and communicate with the E-ISAC, and how to preserve incident data for future analysis.

CPE/CMU Credits: 6

  • CIP-004: Personnel & Training
  • Security Awareness Program
  • CIP Training Program
  • PRA Evaluation Process
  • CIP-011: Information Protection
  • Information Protection Program
  • Data Sanitization
  • CIP-008: Incident Reporting and Response Planning
  • Incident Response Plan/Testing
  • Reporting Requirements
  • CIP-009: Recovery Plans for BES Cyber Systems
  • Recovery Plans
  • System Backup

Jason Christopher ,
Tim Conway
Fri Jul 14th, 2017
9:00 AM - 5:00 PM


On the final day students will learn the key components for running an effective CIP Compliance program. We will review the NERC processes for standards development, violation penalty determination, Requests For Interpretation, and recent changes stemming from the Reliability Assurance Initiative. Additionally we'll identify recurring and audit related processes that keep a CIP compliance program on track: culture of compliance, annual assessments, gap analysis, TFE's, and self-reporting. We'll also look at the challenge of preparing for NERC audits and provide tips to be prepare to demonstrate the awesome work your team is doing. Finally, we'll look at some real-life CIP violations and discuss what happened and the lessons we can take away. At the end of day 5 students will have a strong call to action to participate in the on-going development of CIP within their organization and in the industry overall as well as a sense that CIP is doable! Labs in day 5 will cover DOE C2M2, audit tools, and an audit focused take on 'blue team - red team' exercise.

CPE/CMU Credits: 6

  • CIP Processes for Maintaining Compliance
  • Preparing for an Audit
  • Audit Follow Up
  • CIP Industry Activities
  • Standards Process
  • CIP of the Future

Additional Information

"This is best-in-class NERC CIP training. The courseware provides valuable compliance approaches and software tools for peer collaboration to build consent on implementation." - Jeff Mantong, WAPA

"An excellent course that identifies CIP implementation through audit response." - Kevin Money, Iroquois Gas

"Best CIP training I've ever had in all my years of the CIP program." - Michael Veillon, Cleco

"Great class. I would like to send my entire staff." - Erik Weinmeister, Nebraska Public Power District

"Valuable information in a classroom setting you can't get anywhere else." - Tiffany Applegate, Western Area Power Administration (WAPA)

"Excellent information - very helpful to our program." - Melanie Thigpen, GE

"This is a course that has been needed for a long time." - Mike Weld, Burns & McDonnell

NOTE: It is critical that students have administrator access to the operating system and all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work.

  • 64-bit processor with 64-bit operating system
  • VT or other 64-bit virtualization settings enabled in your BIOS to run 64-bit VMs
  • At least eight (8) GB of RAM
  • At least fifty (50) GB of free hard drive space
  • At least one USB port
  • VMware Player 12, VMware Workstation 12, or VWware Fusion 8 installed BEFORE class. Other virtualization software such as Parallels or VirtualBox may work if the attendee is familiar with its functionality, however VMware should be pre-installed as a backup just in case
  • Access to an account with administrative permissions and the ability to disable all security software on their laptop such as Antivirus and/or firewalls if needed for the class
  • If you are using Linux for your host machine, you will need ExFAT drivers installed for the USB drive

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Individuals with CIP responsibilities in the following areas:

  • IT and OT (ICS) cybersecurity
  • Field support personnel
  • Security operations
  • Incident response
  • Compliance staff
  • Team leaders
  • Governance
  • Vendors / Integrators
  • Auditors

"The lecturers have an intimate knowledge of cybersecurity and the CIP standards and are able to answer the questions posed by students, including the highly technical and detail-oriented." - Aaron Clark-Ginsberg, U.S. Department of Homeland Security Cybersecurity Postdoctoral Scholar at Stanford. Read the full review at EnergyCentral.com.

Author Statement

The SANS ICS456: NERC Critical Infrastructure Protection Essentials course was developed by SANS ICS team members with extensive electric industry experience including former Registered Entity Primary Contacts, a former NERC officer, and a Co-Chair of the NERC CIP Interpretation Drafting Team. Together the authors bring real-world, practitioner experience gained from developing and maintaining NERC CIP and NERC 693 compliance programs and actively participating in the standards development process.