CIP-002 BES Cyber System categorization
CIP-002-5.1a, the scoping standard: how entities identify BES Cyber Systems and rate them high, medium or low impact, which decides which other CIP requirements apply.
NERC CIP
The NERC Critical Infrastructure Protection (CIP) Reliability Standards, mandatory cyber and physical security requirements for owners and operators of the North American bulk electric system. The pillar covers each currently effective US standard, CIP-002 through CIP-014, plus the future-dated CIP-015 internal network security monitoring standard, requirement by requirement.
CIP-003 Security management controls
CIP-003-9: cyber security policies, the CIP Senior Manager and delegations, and the cyber security plan that is the main control set for low impact BES Cyber Systems.
CIP-004 Personnel and training
CIP-004-7: security awareness, role-based training, personnel risk assessments, access authorization and review, access revocation, and access to BES Cyber System Information.
CIP-005 Electronic security perimeters
CIP-005-7: Electronic Security Perimeters and Electronic Access Points, Interactive Remote Access through Intermediate Systems with encryption and MFA, and vendor remote access controls.
CIP-006 Physical security of BES Cyber Systems
CIP-006-6: physical security plans and Physical Security Perimeters, visitor control, and maintenance and testing of Physical Access Control Systems.
CIP-007 Systems security management
CIP-007-6: ports and services, security patch management on a 35-day cycle, malicious code prevention, security event logging and review, and system access control including passwords.
CIP-008 Incident reporting and response planning
CIP-008-6: Cyber Security Incident response plans, testing every 15 months, plan maintenance after lessons learned, and mandatory reporting to the E-ISAC and the federal cyber incident center.
CIP-009 Recovery plans for BES Cyber Systems
CIP-009-6: recovery plan contents, backup and verification, testing every 15 months (and operational exercises every 36 months for high impact), and plan maintenance.
CIP-010 Configuration change management and vulnerability assessments
CIP-010-4: baseline configurations and change control, software source and integrity verification, 35-day configuration monitoring, vulnerability assessments, and Transient Cyber Assets and Removable Media.
CIP-011 Information protection
CIP-011-3: identifying and protecting BES Cyber System Information (BCSI), including stored off-premise, and preventing unauthorized retrieval when Cyber Assets are reused or disposed of.
CIP-012 Communications between Control Centers
CIP-012-2: protecting Real-time Assessment and Real-time monitoring data sent between Control Centers against disclosure, modification and, since version 2, loss of availability.
CIP-013 Supply chain risk management
CIP-013-2: the supply chain cyber security risk management plan for procuring high and medium impact BES Cyber Systems and their EACMS and PACS, its implementation, and its 15-month review.
CIP-014 Physical security
CIP-014-3: identifying critical Transmission stations and substations, third-party verification, threat and vulnerability evaluations, physical security plans, and third-party review of those plans.
CIP-015 Internal network security monitoring
CIP-015-1 (subject to future enforcement): internal network security monitoring (INSM) inside Electronic Security Perimeters of high impact and medium impact (with External Routable Connectivity) BES Cyber Systems, and the CIP-015-2 extension to EACMS and PACS.
NERC CIP audit preparation
Getting ready for a Regional Entity CIP audit or other monitoring engagement: the notification timeline, the Evidence Request Tool, the audit period and evidence retention, Spot Checks and Self-Certifications, and how internal controls shape scope.
NERC CIP violations and enforcement
What happens when a CIP requirement is missed: penalties under the Sanction Guidelines, Self-Reports and self-logging, Compliance Exceptions and FFT, Mitigation Plans, and Technical Feasibility Exceptions for requirements that cannot be met as written.
NERC CIP for low impact assets
Guides for entities whose assets contain only low impact BES Cyber Systems: the CIP-003 low impact plan, the 2026 vendor remote access requirement, the 2029 CIP-003-11 changes, and running a lean program when most of CIP-004 to CIP-011 does not apply.
NERC CIP changes 2026 to 2029
Planning for the CIP standards approved for future enforcement: the 2028 virtualization set, CIP-015 internal network security monitoring, 'per system capability' in place of TFEs, and the supply chain revisions FERC ordered in 2025.
NERC CIP for vendors and suppliers
Guides for vendors, integrators and contractors selling into NERC CIP environments: what CIP-013 procurement asks of them, vendor remote access, software integrity, incident and vulnerability notification, and personnel risk assessments for contractor staff.
NERC CIP and cloud services
Using cloud and SaaS services with NERC CIP: storing BCSI in the cloud under CIP-004-7 and CIP-011-3, encryption and key management, assessing providers, and disposing of cloud-held BCSI.
NERC CIP tools and evidence automation
Tools that run CIP controls and produce audit evidence: open-source options for configuration monitoring, vulnerability assessments, Intermediate Systems for remote access, patch tracking and backup testing, with their license and edition limits.
NERC CIP guides
Buyer guides for registered entities and their suppliers: how CIP-002 categorization sets scope, how CIP audits work, what CIP-013 asks of vendors, how to run a CIP compliance program, and which CIP changes take effect through 2029.
