Which document family commonly prescribes incident reporting timelines for cyber security events?

• A. CIP (Critical Infrastructure Protection) standards
• B. NERC Reliability Standards
• C. North American Electric Reliability Grid
• D. Federal Energy Regulatory Commission Guidelines

Answer: (A)

Incident reporting timelines for cyber security events are defined by the CIP standards. These Critical Infrastructure Protection standards from NERC specifically address cyber security incident reporting and handling, setting the required timeframes for notifying the right entities and authorities. The broader NERC Reliability Standards cover many reliability topics but not the specific cyber incident reporting windows, while the North American Electric Reliability Grid and FERC Guidelines are not the document family that prescribes these timelines. Therefore, the CIP standards are the correct reference.