Supply Chain Resources

ADDITIONAL INFORMATION WILL BE POSTED AS IT BECOMES AVAILABLE

SERC

• 2020 SERC Newsletter Article - Supply Chain - SGAS FAQs
  Concerns raised by registered entities during the 2019 Small Group Advisory Session hosted by NERC.
• 2019 SERC Newsletter Article - Supply Chain - Start with a Plan
  SERC Reliability and Security Advisor Chris Holmquest provides guidance on planning for CIP-013.
• 2017 CIP Seminar Presentation - Cyber Security Supply Chain Risk Management-Drafting Team Perspective
  Duke Energy's Managing Director, Enterprise Supply Chain James Chuber provides a summary of the Standard Development Process, CIP-013 R1-R3, and its Implementation Plan & Guidance.
• 2016 CIP Seminar Presentation by R Dunfee (FERC) - Supply Chain Risk Management
  The four objectives of FERC order No. 829 are outlined in this informative presentation.
• 2016 Spring Compliance Seminar Presentation - FERC Technical Conference-Supply Chain Risk Management    
  SERC Senior Reliability & Security Advisor Mike Hagee presented a summary of the January 28, 2016 FERC Technical Conference, which was conducted to facilitate a structured dialogue on supply chain risk management issues.

NERC
May 14, 2020 - Cyber Security Supply Chain Risks Webinar   

NERC's Supply Chain Risk Mitigation Program webpage offers a summary of resolutions and actions to assist in the implementation and evaluation of the Supply Chain Standards, and a list of resources covering background, Compliance, discussions, implementation guides and webinars.

NERC’s Supply Chain Working Group (SCWG) offers a list of guidelines and resources.

INDUSTRY  

• American Public Power Association and National Rural Electric Cooperative Association 
  APPA and NRECA offer a summary of best practices that are currently in use by one or more of their members that have only low-impact BES Cyber Systems.      

• Department of Energy   
  Department of Energy Office of the Chief Information Officer (OCIO) Supply Chain Risk Management (SCRM) Resource Center developed and assembled these documents to introduce DOE employees to the basic terms and concepts of the technology supply chain and associated threats.   

• Department of Homeland Security   
  DHS offers links to fact sheets and other resources regarding Supply Chain. 
    - Information & Communications Technology (ICT) Supply Chain Risk Management  
        - CISA Supply Chain Risk Management Essentials  
        - ICT Supply Chain Risk Management Fact Sheet   

• Edison Electric Institute    
  The model procurement contract language in this document provides registered entities a consistent set of provisions to address CIP-013-1 security controls within their own respective contractual forms.   

• Electric Power Research Institute
  This technical report describes the lessons learned and recommendations from a series of cyber security procurement pilot applications involving nuclear utilities and a controls vendor that were part of Phase 4 of a multi-phase project to develop an effective cyber security procurement methodology.

• Federal Emergency Management Agency   
  This FEMA document provides recommendations on how to analyze supply chains to enhance supply chain resilience, and identifies how the results of the supply chain resilience process can inform logistics planning.   

• National Institute of Standards and Technology   
  This document provides guidance on identifying, assessing, selecting, and implementing risk management processes and mitigating controls throughout organizations to help manage ICT supply chain risks.

• North American Generator Forum   
  This white paper identifies examples for generation entities to consider when developing and implementing a risk-based cyber security supply chain risk management plan. 

• North American Transmission Forum 
  Provides information on the collaborative work conducted by NATF subject-matter experts, industry organizations (including trade and forums), key suppliers, and third-party assessors on this important topic.