Using cloud and SaaS services with NERC CIP: storing BCSI in the cloud under CIP-004-7 and CIP-011-3, encryption and key management, assessing providers, and disposing of cloud-held BCSI.
Whether and how BCSI can live in SaaS, PaaS or IaaS services since CIP-004-7 and CIP-011-3: identifying BCSI, protecting it, provisioned access, provider personnel access, and the evidence the ERO-endorsed guidance describes.
How encryption keys decide who has access to cloud-held BCSI: vendor versus customer-owned keys, keys held outside the cloud or in an HSM, tracking key holders, and revoking access when people leave.
What to ask a cloud or SaaS provider before BCSI goes into its service: provider staff access paths, multi-tenant protections, contracts and risk assessments, and how FedRAMP or SOC 2 Type 2 reports serve as administrative evidence.
Meeting CIP-011-3 reuse and disposal requirements when the storage belongs to a cloud provider: crypto shredding, key destruction, provider deletion commitments and the evidence a CIP auditor will expect.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.