NERC gets some teeth

For a long time now the electric utility industry has been trying to draw up a set of cybersecurity standards to have at least some minimum standard that power generators have to adhere to.  The requirements went into effect last month according to this article.  They are called CIP 002-009 for Critical Infrastructure Protection (CIP) specs.  There is supposedly financial penalties for non-compliance and I imagine between NERC and FERC, they have the power to enforce this.  The bad news is the first compliance deadlines are not until 2009.

Under the regulations power companies will have to have basics like anti-virus, patch management, IDS and yearly vulnerability assessments.  When you realize that some of the plants are nuclear power plants, you might think they should have to do more.  But at least this is a start.