Audit Evidence for Shared OT Accounts
Lakeshore Electric, a registered NERC CIP entity with medium-impact BES Cyber Systems, received a draft audit report. The auditor found: 17 shared local administrator accounts on HMIs across two substations; 14 accounts belonging to former contractors still enabled; no documented security patch evaluation for nine months on the EMS jump host; and vendor remote access through a shared VPN account with no session logging. The utility argues that unique accounts are impractical because shift operators need fast access during storms, and that patching the EMS host during the audit window would require a control-center outage. The auditor is asking for evidence of remediation, not just a plan. The next storm season begins in ten weeks. The utility has one OT security engineer and no 24x7 SOC.
1. Map the findings to the relevant NERC CIP requirement areas and describe the evidence the auditor should receive.
Read the worked answer
The shared and dormant accounts fall under account management requirements in CIP-007. The evidence should include a current account inventory for each HMI and the EMS jump host, with account owner, business justification, authorization, last logon, and disable date. For shared accounts, show why they are necessary, who is authorized to use them, and what compensating controls exist. For the 14 former-contractor accounts, provide disablement records and verification that sessions and credentials were revoked.
The missing patch evaluations fall under CIP-007 patch management. Provide the patch evaluation procedure, the release dates of applicable patches, the evaluation dates, the decision and rationale, and the approval for any delayed installation. A statement that the EMS host cannot be patched is not enough without documented evaluation and compensating controls.
The shared VPN and missing session logging fall under CIP-005 remote access. Provide the remote access authorization list, the actual account structure, VPN logs, jump-host logs, and evidence that vendor sessions are approved and recorded. The auditor wants artifacts tied to dates and assets, not a policy PDF.
2. Given one engineer, no 24x7 SOC, and storm season in ten weeks, what remediation sequence do you recommend?
Read the worked answer
Sequence by risk reduction and operational feasibility.
First, disable the 14 dormant contractor accounts and remove the shared VPN account. This is low-risk and high-value. Replace vendor access with named accounts through a jump host, require approval per session, and log the session. If a shared vendor account cannot be removed immediately, vault its credential, restrict its source, and log all use.
Second, reduce shared local administrator use on HMIs. Do not start with a disruptive identity overhaul during storm season. Create named operator accounts for daily use, keep a documented break-glass administrator credential in a vault, and log its checkout. Test the login path on one substation before wide rollout.
Third, complete the overdue patch evaluation on the EMS jump host. Evaluation is documentation and risk analysis; it does not require an immediate outage. Record why installation is deferred, what compensating controls are in place, and when it will be installed.
Fourth, schedule the remaining HMI account cleanup after storm season, with a pilot and rollback plan. Provide the auditor interim evidence for each step.
3. How would you answer the argument that unique accounts are impractical during storms?
Read the worked answer
The argument has an operational point but not a sufficient control justification. Fast access can be preserved without shared credentials: use named accounts with role-based access, a documented break-glass account for emergency use, and a password vault or badge-based checkout. The break-glass use should trigger an alert and a post-event review, not be invisible.
Explain that shared accounts destroy accountability. During a storm, an incident responder cannot tell which operator or vendor performed a change, and a former contractor may retain access. That is worse during an emergency, not better.
Offer a pilot: one substation, named accounts for normal shifts, and a sealed break-glass credential for emergency access. Measure login time and operator feedback. If the pilot shows a delay, adjust the authentication method rather than reverting to shared accounts. Provide the auditor with the pilot results, the break-glass procedure, and logs showing emergency use is reviewed. This answers the operational concern with evidence instead of simply asserting policy.