What CIP-002-5.1a R1 asks for when categorizing BES Cyber Systems
Before any other CIP control can be sized, a registered entity must prove which of its systems drive CIP scope. CIP-002-5.1a R1 requires a documented process that considers six asset types: Control Centers and backup Control Centers, transmission stations and substations, generation resources, restoration systems (including Blackstart Resources and Cranking Paths), Special Protection Systems, and certain Distribution Provider Protection Systems. For each asset, the process must identify high impact BES Cyber Systems (Part 1.1), medium impact BES Cyber Systems (Part 1.2), and each asset that contains low impact BES Cyber Systems (Part 1.3). Under Part 1.3 the entity lists the assets, not every low impact system, so the inventory can stay at asset level. R1 carries a High Violation Risk Factor, which signals how much regulators weigh a wrong answer here.
The risk runs in both directions. If a system is under-rated, the entity may leave a high or medium impact system without the controls that CIP-005, CIP-007 or CIP-010 require, and an outage or intrusion could reach the grid unchecked. If a system is over-rated, the entity spends effort on controls that add cost without reducing risk, and its evidence trail becomes harder to defend. Neither outcome is easy to see from the outside until an audit or a self-report exposes it.
The work is hard for three reasons. The Attachment 1 bright-line criteria use specific thresholds, such as generation at a single plant, voltage levels and substation weighted values, and applying them requires reading network and plant data carefully. The Control Center definition determines which facilities count, so the boundary of a Control Center needs a documented, reasoned answer. Asset inventories also drift as plants are upgraded, substations are rebuilt and control rooms move, so a list that was right at the last review may be wrong now. Ask your Regional Entity and your compliance counsel which evidence they expect for the categorization decisions, and keep dated lists that show who approved each one.
Which assets and teams CIP-002-5.1a R1 puts in scope
R1 starts from physical and logical assets, not from a list of software. Each asset type below brings its own identification question, and the scoping decisions that follow determine which engineering, operations and compliance teams must contribute to the list.
Control Centers and backup Control Centers
R1 covers both primary and backup Control Centers, and the Attachment 1 criteria decide whether the systems there rate as high or medium impact. Confirm which facilities the entity operates or controls, which functions run at each one, and whether a backup site performs the same functions as the primary. A backup that can take over operations is a common place where scope is missed, so record it explicitly in the categorization.
Transmission stations and substations
Substations and stations are identified by their Transmission Facilities, voltage levels and aggregate weighted values under Attachment 1. Teams should confirm the voltage class of each facility, the Transmission Facilities it connects, and which protection and control systems sit inside the fence. Facility records from engineering often lag field changes, so reconcile one-line diagrams with the current asset register before classifying.
Generation resources
Generation resources are assessed at the plant level, so several units at one location can combine into a single rating. Engineering should identify each plant's aggregate capacity, reactive resources and the control systems that dispatch or protect them. Operations and asset management teams usually hold the capacity figures, so ask them to confirm the values used in the rating rather than relying on nameplate data.
Restoration systems and Cranking Paths
Restoration assets include Blackstart Resources and the Cranking Paths used to bring the system back after an outage. These are easy to overlook because they may run only during restoration drills. Operations planning should provide the current restoration plan, and engineering should confirm which cyber systems operate those paths. Any change to the restoration plan can change the categorization, so tie the review to plan updates.
Special Protection Systems and Distribution Provider Protection Systems
Special Protection Systems and certain Distribution Provider Protection Systems depend on grid design studies and protection engineering records. Ask protection engineers to list each scheme, the elements it trips or controls, and the cyber systems that implement it. Where a scheme spans several facilities, decide how the grouping will be documented so the categorization can be traced back to the design study.
Grouping systems and the compliance team
Grouping decides how BES Cyber Systems are named and rated, and it affects every later CIP requirement that refers to them. Compliance leads should own the rules for grouping, while engineering and operations confirm which cyber assets work together to perform a reliability function. Record who approved each grouping decision and why, so the list stays defensible at audit.
How the Attachment 1 criteria sort assets into impact levels
Attachment 1 of CIP-002-5.1a is applied in a fixed order, and the entity's record should show that each asset was tested against each tier. Section 1 sets the high impact criteria first. Reliability Coordinator Control Centers are rated high. Balancing Authority Control Centers are rated high when they control 3000 MW or more of generation in one Interconnection. Transmission Operator and Generator Operator Control Centers are rated high only when they meet specified medium impact criteria, so the entity has to run those Control Centers through Section 2 before it can settle their rating. Confirm the exact wording of each criterion against the standard PDF linked from this page, because the criteria are the only basis for the rating.
Section 2 then covers the medium impact criteria, of which there are 13. Examples include generation of 1500 MW or more at a single plant location, reactive resources of 1000 MVAR or more, Transmission Facilities at 500 kV or higher, and 200 to 499 kV substations whose aggregate weighted value is above 3000. Each asset type on the R1 list should be checked against every criterion that could apply to it, including Control Centers not already rated high. For an asset that meets none of these, the BES Cyber Systems at that asset fall to low impact under Part 1.3. The entity must identify the asset that contains them, but it does not need a discrete list of each low impact system.
The output of this process is a decision record, not a calculation the entity can skip or automate without review. Keep a dated list of the identified high and medium impact BES Cyber Systems and the assets containing low impact systems, with the criterion relied on for each rating and the person who approved it. A reviewer or auditor will ask why an asset was rated low, so the record should show the Section 2 criteria that were checked and found not to apply. Re-run this analysis whenever a generator, line, substation or Control Center changes, because that record drives every other CIP requirement that follows.
How auditors test CIP-002-5.1a R1 categorization
This table walks through the steps an auditor typically takes to test R1 categorization, the evidence requested at each step, and the findings that come up most often. Read it as a pre-audit checklist: each row is a point where the entity should be able to show its work without rebuilding the analysis under audit pressure.
| Test step | Evidence requested | Common findings |
|---|---|---|
| Confirm the written process covers all six asset types | The documented R1 process, showing how Control Centers, Transmission stations and substations, generation resources, restoration systems, Special Protection Systems and applicable Distribution Provider Protection Systems are considered | A process that omits one asset type, such as restoration systems or Special Protection Systems, or that addresses only the largest assets |
| Sample assets and recompute their ratings against Attachment 1 | Asset-level worksheets showing the Attachment 1 criteria applied, with the rating reached for each sampled asset | A rating that does not match the bright-line criteria, often because a threshold was misread or a criterion was applied to the wrong facility |
| Check Control Center and generation figures against source records | Source data such as operating records, planning models or registration data behind MW, MVAR and voltage values used in the analysis | Figures that differ from authoritative records, or outdated values that predate a plant upgrade or a new interconnection |
| Check Transmission figures against source records | Voltage levels, facility ownership and substation weighted values traced to one-line diagrams or equipment records | Substation values calculated from incomplete facility lists, or voltage classes recorded incorrectly |
| Verify the dated list of high and medium impact BES Cyber Systems | A dated electronic or physical list identifying each high and medium impact BES Cyber System and its asset | A list with no date, a list that does not match the categorization worksheets, or systems missing from the list |
| Verify the list of assets containing low impact BES Cyber Systems | A dated list of each asset that contains low impact BES Cyber Systems, which is not required to be a system-by-system inventory | A stale asset list that omits newly commissioned sites or still includes retired ones |
| Confirm the categorization was approved | Evidence that the CIP Senior Manager or delegate reviewed and approved the identifications, with a date | No approval record, or an approval that predates the most recent change to the asset list |
| Test whether changes flowed into the categorization | Change records for new, retired or modified assets, linked to updates in the categorization | Changes made in operations or engineering that were never reflected in the R1 lists |
How to build the R1 categorization process step by step
This sequence turns the CIP-002-5.1a R1 requirement into a documented, repeatable process that ends with a dated, approved identification list that an auditor can trace back to each asset and criterion.
Confirm registered functions and Control Centers
Start by confirming which NERC registered functions the entity holds, such as Balancing Authority, Transmission Operator, Generator Operator or Reliability Coordinator, because those registrations determine which Attachment 1 criteria can apply. List every Control Center and backup Control Center, with its owner, location and the functions it performs. The output is a Control Center register and a short written statement of registered functions. The step is done when a compliance lead and an operations lead have both signed off the list and the registration record matches it.
Inventory assets across the six asset types
Build an asset register covering the six asset types named in R1: Control Centers and backup Control Centers, Transmission stations and substations, generation resources, restoration systems including Blackstart Resources and Cranking Paths, Special Protection Systems, and certain Distribution Provider Protection Systems. For each asset, record its identifier, location, owner and the operational role it plays. Configuration management and asset inventory tools can help populate this register, though operations staff must confirm what they show. The output is the asset register. The step is done when operations staff have confirmed that no asset type is missing from the register.
Gather rating inputs for each asset
For each asset in the register, collect the technical values that Attachment 1 uses to rate it: megawatt output for generation, MVAR ratings for reactive resources, kV levels for Transmission Facilities, and the substation weighting inputs for 200 to 499 kV stations. Take these values from engineering records, nameplate data or operating studies, and note the source and date of each value. Ask for the document of record behind each figure, since an auditor will test it. The output is a ratings input sheet with a source reference for every value. The step is done when every asset has a complete set of inputs or a recorded reason why an input does not apply.
Apply Attachment 1 and record rationale per asset
Test each asset against the Attachment 1 bright-line criteria for high impact and medium impact, and note the criterion that matched or the reason none did. Record the outcome as high, medium or not rated under R1 for each asset, with a short rationale that cites the specific criterion and the input values used. Where a BES Cyber System at an asset is not high or medium, record that it falls under the low impact category. The output is a criteria worksheet with one row per asset. The step is done when a second reviewer has tested a sample of rows against the criteria and reached the same result.
Identify assets containing low impact systems
Identify each asset that contains low impact BES Cyber Systems under Part 1.3. A discrete list of individual low impact systems is not required, so the work is to identify the assets that hold them, not to enumerate each system. Confirm with engineering that the BES Cyber Systems at each such asset are correctly characterized as low impact before recording the asset. The output is a list of low impact asset identifiers with a note on the basis for each. The step is done when operations and engineering have confirmed that every asset on the list has been reviewed.
Obtain a dated, approved identification list
Assemble the final identification list of high impact BES Cyber Systems, medium impact BES Cyber Systems and assets containing low impact BES Cyber Systems, then have it dated and approved by the CIP Senior Manager or a delegate as your governance model requires. Store the approved list in a controlled repository with version history so that every change can be traced. Confirm with your Regional Entity or compliance advisor what format of evidence they expect. The output is the approved identification list and its approval record. The step is done when the list is dated, approved and retrievable for audit, and when the team knows that the R2 review cycle will start from this baseline.
Evidence that satisfies CIP-002-5.1a R1
CIP-002-5.1a R1 is tested by documents and records that show how the entity identified its BES Cyber Systems and what the result was. The cards below cover the artifacts auditors typically ask for and the open-source tools that can keep them current between audits, with the entity confirming license terms for its own use.
Dated lists of high and medium impact systems
The core artifact is a dated electronic or physical list of the high impact and medium impact BES Cyber Systems identified under Parts 1.1 and 1.2. Each entry should name the system, its Control Center or asset, and its rating, and the list should carry the date it was approved. Keep the list tied to the asset records so a new substation or relay added to the grid appears in the next version. Check that every entry traces back to a specific criterion in Attachment 1.
List of assets containing low impact systems
Part 1.3 does not require a discrete list of low impact BES Cyber Systems, but the entity must identify each asset that contains them. Keep this list dated and separate from the high and medium lists, and record the asset type and location for each entry. Review it whenever a station is commissioned, retired or re-rated, so the list matches what is physically in service. Auditors will compare it against site records, so the two must agree.
Written categorization process
The process document describes how the entity considers each of the six asset types named in R1, who performs the review, what inputs are used, and how disagreements are resolved. It should state how the process treats Control Centers, restoration assets and protection systems, and it should be approved under the entity's own change control. Keep the current version and every prior version so an auditor can see what process applied on a given date. Confirm that the document matches what staff actually do.
Criteria worksheets with MW, MVAR and kV inputs
Worksheets show how each asset was measured against the Attachment 1 bright-line criteria. They record generation in MW at a plant, reactive resources in MVAR, Transmission Facility voltages in kV, and weighted values for substations. Each worksheet should cite the data source, such as planning models or nameplate records, and the date of the measurement. Recalculate worksheets when ratings or topology change, since a single threshold crossing can move an asset into a different impact category.
Approval and revision records
Approval records show that the CIP Senior Manager or a delegate reviewed and approved the identifications, with dates and signatures or electronic approvals. Revision history shows what changed between versions and why. Keep these records together with the lists they approve so the approval date matches the list version in force. Confirm the delegation records that authorize each approver, because an approval by someone outside the delegation weakens the evidence.
What meeting CIP-002-5.1a R1 costs in money and effort
This table compares each cost component of building and maintaining the R1 impact categorization, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Use it to frame a quote request, since no price list exists and every figure depends on the size of your fleet and the state of your asset records.
| Cost component | One-time or recurring | Cost drivers | Ways to reduce it |
|---|---|---|---|
| Internal engineering time to build the asset inventory and criteria worksheets | One-time, then recurring upkeep | Number of Control Centers, substations, generation resources and protection systems; how current existing asset records are; how many people must agree on ratings | Start from existing asset and network records, apply Attachment 1 criteria in one worksheet, and assign a single owner per asset type |
| Tooling or licenses for inventory and documentation | Recurring if commercial; none for the named open-source tools beyond hosting | Commercial CMDB or GRC licenses priced by user or asset count; hosting and storage for self-hosted tools | GLPI for asset records and Wazuh Syscollector for endpoint inventory are GPL-licensed, but confirm license terms and any edition limits before deployment |
| Hosting, configuration and staff time for self-hosted open-source tools | Mostly one-time setup, then recurring operations | Server sizing, network segmentation of the tools themselves, agent rollout, integration with existing systems, patching of the tools | Use a documented build, keep the tools inside the Electronic Security Perimeter scope decisions made under CIP-002, and budget a named administrator |
| Time to maintain the lists as assets change | Recurring | Frequency of commissioning, retirements, reconfigurations and ownership changes; how quickly changes reach the list | Tie list updates to change management and commissioning checklists so new assets are categorized before they go live |
| Version control and dated approvals for the categorization record | Recurring | Number of revisions per cycle; approval routing; retention of prior versions | Use a wiki or document system with version history so each dated list and its approval are easy to produce |
| External review or third-party help | One-time for initial review, optional recurring for periodic checks | Scope and number of assets; whether the entity lacks in-house NERC CIP staff; depth of the criteria review | Request a fixed-scope written proposal with named deliverables, and ask whether the review covers the full Attachment 1 criteria |
| Auditor sampling effort during a Compliance Audit | Recurring, on each audit cycle | Number of lists and revisions the auditor selects; quality of the rationale behind each rating; gaps between records and reality | Keep a clear rationale for each rating and a complete change history so sampled evidence can be produced quickly |
Who does what: your team, an implementation partner and the auditor
Your organization owns the CIP-002-5.1a R1 categorization. Only your staff can establish the facts about each Control Center, substation, generation resource, restoration asset and protection system, and decide how the Attachment 1 bright-line criteria apply to them. The CIP Senior Manager, or a properly delegated person, approves the identifications. Those decisions are yours, and they carry your name into every later CIP requirement that depends on the impact rating.
- Categorization decision: Your team applies the Attachment 1 criteria to each asset and records which BES Cyber Systems are high impact, medium impact, or sit at a low impact asset.
- Asset facts: Your operations, engineering and planning staff confirm generation output, voltage levels, MVAR ratings, Control Center roles and substation configuration from authoritative records.
- Approval: The CIP Senior Manager or delegate signs off on the dated list of identified systems.
- Process ownership: Your team maintains the documented process that R1 requires and keeps it current as the fleet changes.
- Institutional knowledge: Staff who understand interconnections and operating roles are the people who explain why an asset was or was not rated.
Before you engage any outside party, confirm internally who holds the CIP Senior Manager role and who can act as delegate.
An implementation partner such as DeployOpen can prepare the tooling and documentation that help your team run the process consistently. Under a written, fixed scope, a partner can build the working parts. The partner does not decide whether an asset is high, medium or low impact, and does not issue any compliance determination. Those remain with your organization and, later, with the auditor.
- Inventory tooling: Configuring an asset inventory so hardware, software, network and location data for candidate assets can be reviewed against the criteria. Examples include the open-source inventory and CMDB options listed in the tools section of this pillar, each confirmed for your environment.
- Criteria worksheets: Building structured worksheets that list each Attachment 1 criterion, the data fields it needs and the reviewer's recorded answer.
- Document workflows: Setting up version-controlled documents for the process, the dated identification lists and the approval record.
- Evidence packages: Assembling dated lists, change history and approval records in a form your team can present to a Regional Entity.
- Limits of scope: The partner's output is preparation. Statements about impact ratings must still come from your team.
Ask any partner to put in writing which artifacts it will deliver and which decisions it will leave with you.
The Compliance Enforcement Authority, which is a Regional Entity or NERC, monitors compliance. It tests the process and the records through audits, spot checks, self-certifications and data submittals. It is not an implementer, and its findings come from examining what you produced. An auditor that helped design the process would then be testing its own work, which is why independence matters.
- Process testing: The auditor checks that the R1 process considers each required asset type and applies the criteria as written.
- Record testing: The auditor requests dated lists of identified BES Cyber Systems and checks that they match the asset facts and the approval record.
- Independence line: Your partner should not be the party that reviews the categorization for compliance purposes, and the auditor should not be asked to build it.
- Evidence requests: Expect requests to be answered from records that existed at the time, so retained versions matter.
- Findings: Gaps in the process or records are recorded by the auditor, and your team owns the response.
Confirm the audit schedule for your registration with your Regional Entity, since the timing depends on your registered function and risk profile.
Some work in R1 can be supported by outside help without moving the decision out of your organization. The common candidates are the mechanical parts: collecting inventory data, packaging evidence and maintaining document workflows. The decision itself and its approval are usually kept in-house, because they require operational knowledge and accountability that the CIP Senior Manager must hold.
- Usually outsourced: Inventory automation, evidence packaging, document workflow setup and recordkeeping templates.
- Usually kept in-house: The high, medium and low impact determinations, the asset fact review and the CIP Senior Manager approval.
- Shared work: Maintaining the inventory and worksheets, where your team confirms each change.
- One-time versus recurring: Tooling setup is largely one-time, while R2 review and ongoing data upkeep recur.
- What to ask for in a quote: A written list of deliverables, the owner of each artifact, and the handover of configuration and documentation.
Before signing, confirm that your team can explain every rating in the list without relying on the partner.
Where entities fall short on CIP-002-5.1a R1 and how to close each gap
Most CIP-002-5.1a R1 findings trace back to a few recurring gaps in scope, traceability and upkeep. Each card below names one gap, what an assessor typically sees, and the fix, which connects to the recurring review in the R2 topic.
Asset type left out of the process
The R1 process must consider six asset types, including Special Protection Systems and restoration assets such as Blackstart Resources and Cranking Paths. Teams often focus on Control Centers and substations and leave these out. Check the process document against each of the six types, and record a stated result for each, even when the result is that no qualifying asset exists.
Ratings that do not trace to inputs
A high or medium rating is only defensible when it links to a specific Attachment 1 criterion and its input data, such as plant megawatts, reactive resources, voltage level or weighted substation values. Ratings copied from prior years or entered as judgment calls fail review. Keep a worksheet per asset that shows each criterion, the source value and the date it was measured.
Low impact asset list out of date
Part 1.3 does not require a discrete list of low impact BES Cyber Systems, but it does require identifying each asset that contains them. Assets are added, retired or repurposed, and the list drifts. Reconcile the list against the asset register at each review and document the date of each change so the list reflects the current fleet.
Undated or unapproved lists
Acceptable evidence for R1 includes dated lists of the identified BES Cyber Systems. A list without a date, version or approval record gives an assessor nothing to test against. Store each version with its date, the reviewer and the CIP Senior Manager or delegate approval, and keep prior versions so the history of each change can be shown.
Inventory that does not match the asset register
Categorization results often disagree with the asset inventory used by operations or IT, which means a Cyber Asset may sit outside the categorized system. Compare the categorized BES Cyber Systems with the asset management and network records, and resolve every difference. An inventory tool such as GLPI or Wazuh can help show what is running on each system, but the categorization decision remains the entity's.
Changes that skip re-review
New generation, new substations, new Control Centers and changed ratings can move an asset across a bright-line threshold, yet the change often closes without a categorization check. Add a categorization trigger to the change and commissioning workflow so every new or modified asset is assessed before it enters service. Then run the full review on the recurring cycle set by R2.
Questions buyers ask about CIP-002-5.1a R1 categorization
How much effort does the first CIP-002-5.1a R1 categorization take?
The effort depends mainly on how many Control Centers, substations, generation resources, restoration assets and protection systems the entity owns, and how well its asset records already match the physical and logical reality of those sites. An entity with a small footprint and current single-line diagrams can finish the first pass quickly. An entity with many sites, legacy records, or several business units that each hold part of the picture will spend most of its effort reconciling data. Effort also rises when the entity has to apply the Attachment 1 criteria to borderline facilities, such as a plant near the 1500 MW threshold or a substation with an aggregate weighted value close to 3000. Ask any partner to estimate effort by asset type and to state which records it expects the entity to supply.
How long does categorization take before a CIP audit?
No fixed duration is set by the standard, so the realistic answer is that the timeline depends on the size of the asset base and the availability of the people who hold the data. Work the entity schedules backward from its audit notification window should start early enough to produce the dated list of BES Cyber Systems that CIP-002-5.1a R1 expects as evidence, and to allow time for the CIP Senior Manager approval that the sibling R2 obligation requires. Ask any partner to propose a timeline in its written scope with milestones for asset inventory, criteria review, draft categorization, and approval, and confirm the target date against the entity's own audit calendar.
What does the categorization need from the entity's own staff?
The entity must supply knowledge that no outside party can reconstruct on its own. That includes operations staff who know which systems actually control or monitor BES facilities, engineers who can confirm ratings such as generation capacity, voltage levels and reactive resources, and records owners who can produce network diagrams and asset lists. The CIP Senior Manager or delegate must review and approve the result, so that person needs time to examine the reasoning, not only the final table. Expect the most demand on operations and engineering during the criteria review, when each candidate asset is tested against the bright-line thresholds.
Can a registered entity do CIP-002-5.1a R1 categorization without outside help?
Yes. The standard places the obligation on the registered entity, and nothing in it requires an outside firm. An entity with experienced compliance and operations staff, accurate asset records and a clear reading of Attachment 1 can complete the process internally and document it well. Outside help becomes more useful when the entity has many sites, unclear records, few staff familiar with the criteria, or a need for a second set of eyes before an audit. Whichever route is chosen, the entity should be able to explain each rating and show the dated evidence behind it.
What is the difference between an implementation partner and the auditor?
The entity owns its categorization and its compliance. An implementation partner such as DeployOpen can help prepare systems, asset records, documentation and evidence, including inventory and documentation tooling that can hold the dated lists the standard expects. Only the Compliance Enforcement Authority, a Regional Entity or NERC, monitors and judges compliance through audits, spot checks and self-certifications. There is no CIP certificate, and no partner can issue an audit result or attestation. A partner's role ends at preparing the work for the auditor to test.
Does a low impact asset need a discrete list of each low impact BES Cyber System?
No. Under Part 1.3 of CIP-002-5.1a R1, the entity must identify each asset that contains low impact BES Cyber Systems, not produce a discrete list of every low impact system. The asset list is the required output, so the entity can keep its low impact records at the level of the site or asset. Engineers should still know what sits inside each asset, because the entity must apply the controls of CIP-003 to those assets. Confirm this approach with the Regional Entity if the asset footprint is complex, since the outcome depends on how the entity defines its assets.
What should a written scope for categorization include?
A written scope should name the asset types covered, which are Control Centers and backup Control Centers, transmission stations and substations, generation resources, restoration systems, Special Protection Systems and applicable Distribution Provider Protection Systems. It should list the Attachment 1 criteria it will apply, the records the entity must supply, the deliverables such as the dated list of high impact and medium impact BES Cyber Systems and the list of assets containing low impact systems, and the review and approval steps. Ask for the responsibilities of each party, the assumptions about existing records, the timeline with milestones, what happens if records are incomplete, and how changes after delivery will be handled. The scope should also state that the partner prepares evidence and that the entity's CIP Senior Manager approves the result.
How DeployOpen works on this
DeployOpen helps registered entities prepare the systems, documentation and evidence behind their CIP-002-5.1a R1 impact categorization. The organization keeps ownership of the categorization decision and its CIP Senior Manager approval, while DeployOpen assembles the inventory, rationale and dated lists that an auditor will ask to see.
How we scope
- Agree in writing which Control Centers, substations, generation resources, restoration assets and protection systems fall inside the categorization exercise.
- Confirm which Attachment 1 criteria apply to each asset type and record the sites and BES Cyber Systems that the written scope covers.
- Engagements are fixed-scope, so deliverables and timelines are set out before work starts. Ongoing support can follow as a retainer.
How we build
- Consolidate asset and Cyber Asset inventories from existing sources, using GLPI or Wazuh Syscollector where the organization already runs them or chooses to deploy them.
- Map each identified system to its high, medium or low impact rating, with the Attachment 1 criterion relied on written next to it.
- Set up versioned documentation for categorization rationale in XWiki or BookStack, with role-based access so changes stay traceable.
How we hand over
- Deliver dated electronic lists of the identified BES Cyber Systems, the assets containing low impact systems, and the supporting rationale.
- Provide a change record showing who changed each categorization decision, when, and what the previous value was.
- Walk the CIP Senior Manager or delegate through the package so they can review and approve it on the organization's own authority.
How we support
- Prepare the inputs for the recurring R2 review so that the next review starts from a current inventory rather than a rebuild.
- Update the categorization when assets are added, retired or change rating, and record each change in the same evidence set.
- Confirm with the organization's compliance lead and the Regional Entity which evidence formats they accept before the package is finalized.
