Change and Configuration Management
Change and Configuration management is a major challenge under the NERC CIP standards. CWP comes with an enterprise grade business process workflow engine, designed specifically for NERC CIP. It comes pre-configured with the following process steps:
- Create change request
- Approvals based on customer process (at each step; multiple approval levels, escalations)
- Operations engineering analysis
- Impact analysis
- Emergency analysis
- NERC analysis
- Creation of the test plan
- Closed loop update of the baseline
- Ongoing monitoring for configuration changes
Users (reviewers, implementers, approvers) in the work flow have role-based inboxes that are set up for their personal work queue. As a user I can review the change detail along with the devices that are impacted as well as the CIP requirement that accompanies that change. Device details and CIP details are available directly on the screen for reference.
Assessment information can be added for by each reviewer, making the information available to all the users at each step of the process, as well as being logged for evidence.
CWP monitors things such as ports, services, patches, and user accounts for any change to the baseline. For example, if there is a change to a port, an alert is sent to the person responsible for evaluating that change. If it was an unapproved change a user might check to see if it was an emergency change and deal with it accordingly (e.g., approve). If it was an unapproved change then the user has the ability to restore to the original baseline.