CIP-002-5.1a R2 categorization review and approval

What the CIP-002-5.1a R2 categorization review requires every 15 months

Every registered entity must review its R1 identifications and have them approved at least once every 15 calendar months, even when nothing was identified. Part 2.1 of CIP-002-5.1a R2 requires the entity to review the R1 identifications of its BES Cyber Systems and update them where needed. Part 2.2 requires the CIP Senior Manager or a delegate to approve those identifications on the same 15-month cycle. An entity whose assets contain no high or medium impact BES Cyber Systems still has to complete both steps. Stale categorization is the root risk here: if a new substation, a changed Control Center or a reclassified generation resource is not reflected in the list, the entity may apply the wrong CIP requirements to the wrong systems, and an assessor will test the list as it stands on the audit date.

The obligation is hard to manage for three reasons. It runs on a calendar, not on change events, so a quiet year can still be a missed year. Teams tend to treat the review as a formality when no assets changed, which makes it easy to skip or to rush. And the Compliance Enforcement Authority judges compliance on dated records, so an approval that exists in someone's inbox but not in a retained, dated record does not show the obligation was met. CIP-002-5.1a R2 carries a Lower Violation Risk Factor, but its Violation Severity Levels step up when the review or approval slips to 16, 17 or 18 calendar months, so a late cycle is a violation with a rising severity, not a technicality.

Plan the cycle now. Put the next review and approval deadline on the compliance calendar, name the CIP Senior Manager and any delegate in writing, and decide the evidence format before the meeting. Confirm with your Regional Entity which dated records it accepts, such as electronic signatures on an approved list. Keep the review record even when the answer is that nothing changed, because that record is the evidence that the entity looked. Organizations that want to see the full text of the requirement and its measures can read the NERC CIP-002-5.1a standard PDF directly.

Which identifications, people and records fall under the 15-month cycle

The 15-month review and approval only works if the list it covers is complete and the right person signs it. Each card below covers one scoping input: the R1 identification list, the registration that sets what applies, the people who approve, and the events that should trigger a review before the cycle comes due.

The R1 identification list

Confirm that the list covers every Control Center, substation, generation resource, restoration asset and protection system you own or operate. Each item should show how it was tested against the Attachment 1 bright-line criteria and what impact rating resulted. Keep the list as the single input to R2, so the review has a fixed starting point. Ask whether any asset was screened out and where that decision is recorded.

Registration and Applicable Systems

Your NERC registration determines which functions you perform, and the impact ratings determine which Applicable Systems each CIP requirement reaches. Check that the registration on file still matches the functions you perform today. A change in ratings can add or remove requirements from high, medium and low impact tables, so review the mapping whenever the list changes.

CIP Senior Manager and delegates

The CIP Senior Manager must be named, and approval of the R1 identifications sits with that role or a documented delegate. Confirm the delegation is written, current and covers the approver's authority to sign. Keep a record that shows who approved, when, and under which delegation, because an approval without a traceable signer will not satisfy the evidence expectation.

Change triggers for interim review

The 15-month clock is a maximum, not a schedule to wait for. Plan an interim review when a new asset is commissioned, an asset is retired, or a rating or capability changes, such as a generation increase, a voltage change or a new control function. Document each trigger, the date it was raised and the outcome, so the next scheduled review starts from a current list.

Reviews when nothing is identified

R2 applies even when R1 identified no high or medium impact items, and the review and approval still need dated records. An empty list is still a list, so record the review, the reasoning for the empty result and the approval. Teams often skip this step because nothing changed, which is the case auditors most often ask about.

How an auditor tests the R2 review and approval

This table lists the steps a Compliance Enforcement Authority takes when it tests CIP-002-5.1a R2, what it asks you to produce, what passes and where entities usually stumble. The assessor reviews your dated records and the audit or spot check outcome is a compliance determination, not a certificate. Read each row as a question the assessor will put to your evidence before the engagement starts.

Test step	What the assessor requests	What passes	Common findings
Check the review and approval dates against the 15-month limit	Dated records of the most recent R2 Part 2.1 review and Part 2.2 approval, plus the prior cycle for comparison	Each review and approval falls within 15 calendar months of the previous one, with dates that can be traced to signed or system-stamped records	Dates typed into a spreadsheet without source records, or an approval dated after the 15-month window closed
Confirm the approver is the CIP Senior Manager or a documented delegate	The approval record, the CIP Senior Manager's identity and any delegation document in effect on the approval date	The approver's name and role match the CIP Senior Manager or a delegation that was documented and in force when the approval was signed	Approval by a manager who was not named as CIP Senior Manager or delegate, or a delegation that expired before the approval
Confirm the review covered the current R1 identifications	The R1 identification list in force, the R2 review record and the comparison showing what was checked	The review addresses every R1 identification currently on record, including Control Centers, substations, generation, and protection systems	A review that cites an older asset list, or that reviews the identification process but not the resulting list
Confirm the no-identification case was reviewed and approved	For entities with no identified items, the review and approval records for that outcome	Records show the review and CIP Senior Manager or delegate approval even though nothing was identified	No record at all because the team assumed a review was unnecessary when nothing qualified
Sample asset changes and test for interim review	A sample of asset additions, retirements or reclassifications, with the change tickets and any dated review tied to each	Changes that could affect R1 results are reflected in the record, either in the cycle review or in an earlier documented update	Commissioned or retired assets with no link to the categorization record, or changes discovered only at the next scheduled review
Verify the evidence is retained and retrievable	The records in their native form, such as signed approvals, version history or approved lists, produced on request	Evidence can be produced in the format it was created in, with metadata that shows when and by whom it was made	Screenshots of approvals without the underlying record, or documents that cannot show prior versions
Confirm how the result is reported	The audit, spot check or self-certification scope and the findings issued by the Compliance Enforcement Authority	Findings are issued by the Regional Entity or NERC, and any issues are handled through the enforcement process described in the NERC Rules of Procedure	Treating an internal readiness review or an implementation partner's summary as if it were the audit outcome

Steps to run the R2 review and approval so it holds for the next audit

This sequence turns the R2 obligation into a repeatable cycle that produces a dated review record and a documented approval, which is what an auditor will ask to see for CIP-002-5.1a. It works the same way whether the entity has high, medium or low impact assets, or none at all.

Confirm the current R1 list and its owner
Start from the most recent approved R1 identifications and name the person who maintains them, usually a CIP compliance lead or a delegate in operations engineering. Pull the list, the Attachment 1 criteria applied to each asset, and any supporting one-line diagrams or asset inventories. Confirm that the list matches the current fleet, including recently commissioned or retired Control Centers, substations and generation resources. The output is a single baseline document with a version number, an owner and the date of the last approval, which becomes the reference for every later comparison.
Set the 15-month due date and an internal reminder
Calculate the date by which the review under Part 2.1 and the approval under Part 2.2 must both be complete, counting 15 calendar months from the last approval. Set an earlier internal reminder with a named owner and an escalation contact so the work starts with enough time to finish inside the window. Record both dates in the compliance calendar and in the ticketing or task system the team already uses. The output is a calendar entry and a reminder that show who is accountable, when work starts and what happens if the date is at risk.
Review the identifications with asset owners
Walk through each R1 identification with the people who run the assets, such as transmission, generation, control center operations and substation engineering. Ask whether any Control Center, plant, station, restoration asset or protection system has changed in ownership, configuration, connectivity or ratings since the last review. Check whether any new BES Cyber System has appeared and whether any high, medium or low impact designation no longer holds. Update the list where needed, even if the answer is that nothing changed. The output is a review record listing each asset reviewed, the reviewer, the date and every change made or the statement that no change was needed.
Obtain CIP Senior Manager or delegate approval
Send the updated list and the review record to the CIP Senior Manager, or to a delegate named under the entity's delegation records. The approver should review the changes against the Attachment 1 criteria and either approve or return the list with comments. Approval should be captured as a dated electronic signature, a signed document or an approved list stamped by the approver, and it must be given even when no identifications exist. The output is an approved record that names the approver, the approval date and the list version approved.
File the dated record in the controlled repository
Store the baseline, the review record, the change log, the approval and any supporting diagrams in a controlled repository with restricted write access and a clear folder structure by review cycle. Confirm that the stored files preserve their dates and signatures and that superseded versions remain retrievable. Where the team uses a wiki or document platform with version history, such as a self-hosted system that records who changed what and when, use it to keep the change trail intact, and confirm that the platform's retention and access settings meet the entity's own evidence policy. The output is a repository entry that an auditor can locate and read without help from the person who created it.
Reset the calendar and document any delegation changes
Once approval is recorded, set the next due date 15 calendar months out, add the next internal reminder and update the owner for the next cycle. Check the delegation records for the CIP Senior Manager and any delegate, and confirm that the person who approved held the delegation on the approval date. If a delegate was added, removed or changed during the cycle, file the updated delegation record with its effective date. The output is an updated calendar, a current owner list and a delegation file whose dates match the approval records, so the next cycle starts from a known position.

Which evidence passes an R2 review and how to keep it current

An R2 review is only as strong as the records behind it. The cards below cover the dated review and approval records, the delegation trail, the version history of the identification list, and the change log that connects asset changes to review dates. Together they show an assessor that the list was checked, approved by the right person and kept current.

Dated review record

Keep a dated record showing that the R1 identifications were reviewed and, where needed, updated under Part 2.1. The record should name the reviewer, the scope reviewed and the outcome, including a no-change outcome when nothing qualified. An assessor will look for the date against the 15-calendar-month cycle, so confirm the date is captured at the time of review, not reconstructed later.

Approval record with signature

Part 2.2 requires the CIP Senior Manager or a delegate to approve the identifications. The measures accept dated records such as electronic signatures or approved lists, so the approval should be a dated, attributable act by a named person. Confirm with your Regional Entity which form of approval it accepts before you rely on a workflow tool's sign-off feature.

Delegation record

If the CIP Senior Manager delegates approval, keep a written delegation that names the delegate, the scope of authority and its effective dates. Without it, an approval signed by a delegate can be questioned. Review the delegation whenever the role holder changes, and retain superseded delegations so the approval history stays traceable.

Version history of the identification list

Hold the identification list in a tool that keeps every version, with what changed, when and by whom. XWiki records page history this way and lets you compare any two versions or roll back, which helps show the list as it stood at each review date. Confirm the tool's retention settings so older versions are not purged before your audit period ends.

Access rights for editing and approval

Restrict who can edit the list and who can record approvals. BookStack assigns abilities through roles and lets you override permissions per role at the shelf, book, chapter or page level. Check that editors cannot approve their own changes and that access reviews are logged, since an assessor may ask who could alter the record.

Change log linking assets to review dates

Maintain a change log that records each asset addition, retirement or reclassification and the review date that picked it up. This shows that changes were considered before the next cycle closed, rather than discovered at audit time. Confirm with your compliance lead how far back the log must reach and whether it sits in the same tool as the list.

What meeting the R2 review and approval costs in money and effort

This table breaks the R2 review and approval cycle into the people, records and outside help that cost time or money, and marks which items are one-time and which recur every cycle. Read it as a checklist for what to price and what to ask for in a written quote. The main takeaway is that most of the cost is staff time, which a self-hosted record system reduces only on the license side.

Cost component	One-time or recurring	What drives it	How to keep it down
Engineering and operations time for each review cycle	Recurring, every 15 calendar months at most	Number of R1 identifications to re-check, number of Control Centers and substations in scope, and how many changes occurred since the last cycle	Keep a current list of Cyber Assets and facilities so each review starts from the prior record instead of a blank sheet
CIP Senior Manager or delegate time for approval	Recurring, at each approval	Size of the identification list, whether a delegate is documented in advance, and how many separate sign-offs the approval needs	Name a delegate in writing ahead of time and present a short, dated summary so approval is a single review
Asset owner time for confirming changes	Recurring, when assets are added, retired or re-rated	Number of business units that own facilities or systems, and how quickly they report changes to the CIP team	Set a standing change-notification step in procurement and commissioning so owners flag changes as they happen
Record keeping and evidence retention	Recurring for upkeep, one-time for setup	Volume of dated review records and approval evidence, such as signatures or approved lists, and how they are indexed for an audit	Use version-controlled documentation so each review and approval is dated, attributable and easy to retrieve
Tool setup and migration of existing records	One-time	Whether records are in spreadsheets, shared drives or an existing document system, and how much history must be carried over	Migrate only the current identification list and the last two approved cycles, and archive older records in a read-only form
Software license for a self-hosted wiki or document system	Recurring if commercial, nil for many open-source options	License terms, support contracts and whether the team needs paid support or hosting	Confirm the license and edition limits with the vendor, then price only the infrastructure and staff time that remain
External review or consultant time, if bought in	Recurring or one-time, depending on scope	Scope of the review, number of identifications, number of cycles covered and whether the work includes the CIP Senior Manager approval packet	Ask for a fixed-scope quote that states the scope, deliverables and number of cycles, and confirm that the organization keeps ownership of the approval

Who owns the R2 review, who can help, and what the auditor will not do

The registered entity owns the R2 obligation in full. The CIP Senior Manager, or a delegate the entity has formally named, must approve the R1 identifications at least every 15 calendar months, and the people who know the assets must do the review work that feeds that approval. The entity decides what changed, what was added or retired, and whether the lists still match the Attachment 1 criteria.

CIP Senior Manager: Holds final accountability for the approval and must either sign it or be covered by a documented delegation that is current on the review date.
Compliance lead: Sets the review calendar, tracks the 15-month clock for each approval, and keeps the dated records together.
Asset owners and engineering: Confirm which Control Centers, substations, generation resources and protection systems exist, and report commissioning, retirement or ratings changes.
Operations: Flags changes in how assets are operated or connected, which can alter a bright-line result under R1.
Delegation records: Keep the written delegation current, since an expired or unclear delegation can leave an approval without a valid signer.

Before the next due date, confirm who signs, who reviews, and where the dated approval record will be kept.

Where entities miss the 15-month deadline and how to close each gap

Most missed CIP-002 R2 reviews are not technical failures. They come from assumptions about when the review is required, from approvals that cannot be proven, and from identification lists scattered across files. Each card below names one gap and a fix that an auditor can verify from records.

Treating a no-identification year as exempt

Part 2.1 and Part 2.2 apply even when the entity has no identified BES Cyber Systems. An entity with zero high or medium impact findings still needs a dated review and a dated approval inside each 15-calendar-month window. Check that the recurring calendar includes this item regardless of the result, and keep a short signed record stating that the review found no changes.

Letting the deadline pass without changes

Some teams assume that if no asset or system changed, no review is needed. The standard requires the review on a fixed cycle, so a quiet year still counts. Set a reminder well ahead of the deadline, tied to the approval date rather than to any change ticket, so the review happens whether or not operations generated work.

Approving without a dated signature

The R2 approval must be traceable to the CIP Senior Manager or a documented delegate. A verbal sign-off or an undated email does not show when approval happened. Keep an electronic signature or an approved list with a visible date and name, and retain it so it can be produced for the Regional Entity.

Delegations not documented

If someone other than the CIP Senior Manager signs the approval, the delegation must be written down and current. Gaps appear when a delegate leaves or changes role and the approval still names them. Maintain a delegation record with start dates and scope, and confirm it is updated whenever personnel change.

Identification lists kept in several places

When the R1 list lives in spreadsheets, email attachments and a wiki page, the reviewer cannot tell which version was approved. Replace the copies with one controlled list that stores each approved version, the date, and the editor. Wiki version history, such as the record kept by XWiki, can show what changed and who changed it, but it must be the approved record, not a draft.

Interim asset changes not feeding the review

Commissioning a new substation, retiring a generation resource or changing a Control Center can alter the R1 identifications between scheduled reviews. If these changes are logged in engineering tickets that never reach the compliance owner, the next review starts from an outdated list. Route change requests that touch in-scope assets to the compliance owner so the review reflects them.

What buyers ask about the CIP-002 R2 review before hiring help

How much effort does the CIP-002 R2 review take each cycle?

The effort depends mostly on how much has changed since the last approval, not on the fact that the review recurs. A stable fleet with no new Control Centers, substations, generation resources or protection systems usually needs a documented re-check of the R1 list and a dated sign-off. Effort rises when the entity has added or retired assets, changed ownership or operating roles, or changed how a facility connects to the bulk electric system. Ask any partner to break the work into asset list validation, Attachment 1 criteria re-application, evidence assembly and approval routing, and to state which of those steps assume your current R1 documentation is accurate. The standard requires the review at least every 15 calendar months, so plan a repeatable cycle rather than a one-time project.

Can a small entity run the CIP-002 R2 review in-house?

Yes, a small entity can run the review in-house if it has someone who understands the Attachment 1 bright-line criteria and keeps accurate records of its facilities. The R2 obligation is narrow: review the R1 identifications, update them if needed, and have the CIP Senior Manager or delegate approve them, with dated evidence. The harder part is the R1 analysis that feeds it, because a mistake there carries into every later cycle. Many small entities use outside help for a first baseline or a second-opinion check, then keep the recurring review in-house. Whatever you choose, confirm that your staff can show the review and approval dates in records an auditor can read.

How early should we start before the 15-month date?

Start early enough that the review and approval can finish, with time left over for corrections, before the 15-month date. The standard sets the outer limit, but the time you need depends on how many assets you hold and how many people must contribute and sign. Work backward from the last approval date in your records, and schedule a internal checkpoint well before the deadline so that a late asset change or a missing signature does not force a rushed approval. Confirm the lead time you need with your own change and approval processes rather than assuming a fixed number of weeks.

What does the review need from the CIP Senior Manager and asset owners?

The review needs the CIP Senior Manager or delegate to own the approval and asset owners to confirm the facts behind each identification. The CIP Senior Manager must approve the R1 identifications at least every 15 calendar months, and that approval can be delegated but the accountability stays with the entity. Asset owners and operations staff must confirm which Control Centers, substations, generation resources, restoration assets and protection systems exist, what they do, and how they connect. Agree on who gathers that input, the deadline for responses and how changes are recorded before the review starts, so the approval reflects current facts.

Can a consultant sign the CIP-002 R2 approval?

No, a consultant cannot sign the R2 approval. The entity's CIP Senior Manager or a properly delegated person must approve the R1 identifications. An implementation partner can prepare the asset inventory, draft the analysis, organize the evidence and build the approval record, but the entity owns the decision. Independent auditors and the Compliance Enforcement Authority assess that the approval happened and that the evidence supports it. Ask any partner to confirm in writing which steps it performs and which remain with your staff.

What happens if the 15-month CIP-002 R2 date is missed?

A missed date is a violation of R2, and the severity level rises the longer the review or approval slips. R2 carries a Lower Violation Risk Factor, but its Violation Severity Levels step up when the review or approval slips to 16, 17 or 18 calendar months. Beyond those levels, the consequences depend on how the Regional Entity assesses the violation, including whether it was self-reported and what mitigation the entity completes. Penalty exposure is set by the Sanction Guidelines, and the maximum civil penalty referenced there is $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 (January 2025). Treat the 15-month date as a hard control in your compliance calendar.

What should we ask a partner for in a fixed-scope quote?

Ask for a written scope that names each deliverable, the assets and systems in the review, the responsibilities split, and the evidence the partner will produce. A useful quote lists the R1 inventory validation, the criteria re-application, the review record template, the approval workflow and the evidence package, plus what you must supply such as asset data and staff time. Ask which costs are one-time, such as an initial baseline, and which recur with each 15-month cycle, and what changes would trigger a new quote. Confirm that the partner will not sign the approval and that its work is documented for an independent assessor. Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.

How DeployOpen prepares the R2 review record and evidence

DeployOpen works with the entity's own CIP team to prepare the systems, records and evidence behind the CIP-002-5.1a R2 review and approval cycle. The entity keeps ownership of its categorization decisions and of the CIP Senior Manager approval, while DeployOpen helps make each review dated, traceable and ready for a Regional Entity audit.

How we scope

The written scope names which R1 identifications, asset lists and approval records are in the review cycle.
The scope states who performs the review, who holds the CIP Senior Manager or delegate approval, and who signs off.
Scope is fixed and agreed in writing before work starts, and pricing follows from that written scope.

How we build

We set up a version-controlled record for each 15-month review, so changes to categorization lists are logged with dates and authors.
We configure role-based access so reviewers, approvers and auditors see only the pages their role requires.
We build a repeatable checklist that prompts the Part 2.1 review and the Part 2.2 approval before each 15-month deadline.

How we hand over

We deliver the review procedure, the approval template and the dated evidence set in a format the entity can maintain.
We document how signed approvals, such as electronic signatures or approved lists, are stored and retrieved for an assessor.
We walk the entity's compliance staff through the record so they can run the next cycle without outside help.

How we support

Ongoing support, upgrades and periodic record checks are available as a retainer, if the entity wants help between review cycles.
Support covers updates when R1 identifications change, such as new assets or retired systems, and the matching evidence updates.
Confirm with DeployOpen which support level fits your team before the scope is signed, since retainer terms are set in writing.