2027 Event Agenda

Lower Colorado River Authority (LCRA) is focused on expanding their patching of all devices beyond those that are required to be updated under CIP-007 R2.  With the expanded population of equipment requiring security patches, the need to identify vulnerabilities in our system was further increased as we worked to ensure that the equipment is patched in a timely fashion.  To confirm impacted devices, the vulnerability assessments required manual database queries, cross-referencing of firmware versions and vendor disclosures, and generating compliance documentation for all regulated devices.   This consumed significant personnel time and had high risk of human error. Additionally, incomplete vendor disclosures and limitations in existing tools introduced delays and uncertainty in identifying device-level risks.

To address these issues and improve support for CIP-010 vulnerability assessments, LCRA defined requirements for a more automated approach that would reduce manual effort, enable more frequent assessments, and improve visibility into device vulnerabilities. Key objectives included correlating asset inventory with authoritative sources such as the National Vulnerability Database (NVD), and providing structured workflows for analysis, tracking, and reporting.

LCRA initiated a project to implement a solution to automate vulnerability identification by linking device firmware, software, and patches with external vulnerability information. LCRA actively supported development and testing by contributing operational input and validating the solution against real-world requirements.

This paper presents the implementation and resulting benefits, including reduced manual effort, improved assessment frequency, and enhanced risk visibility across field devices.