What CIP-014-3 R2 asks Transmission Owners to prove about their R1 risk assessment
A Transmission Owner that has identified, or is about to identify, its critical stations and substations under CIP-014-3 R1 needs more than its own review of that work. R2 requires an unaffiliated third party to verify the R1 risk assessment, either at the same time as the assessment or after it is finished. The point is to catch self-review blind spots. An analysis team that built the model, chose the contingencies and wrote the conclusions is poorly placed to notice that a station whose loss could cause instability, uncontrolled separation or Cascading was left off the list. The verifier's job is to test the identification itself, not to rubber-stamp the paperwork.
Proving R2 comes down to three things you can show an auditor. First, the verifier's qualifications: Part 2.1 limits who may verify to a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or to an entity with transmission planning or analysis experience. Keep the evidence that the firm or individual meets one of those tests, and confirm unaffiliation in writing. Second, the timing: Part 2.2 sets a 90 calendar day window to complete the verification after R1, and Part 2.3 sets a 60 calendar day window after the verification to either modify the identification as recommended or document the technical basis for not doing so. Third, information handling: Part 2.4 requires procedures, such as non-disclosure agreements, that protect the sensitive data shared with the verifier and keep standard-developed information out of public disclosure.
Three issues usually make R2 hard. Finding a qualified verifier who is genuinely independent of the Transmission Owner's planning group can take longer than expected, so start the search early and ask candidates to show their transmission analysis experience. Sharing one-line diagrams, contingency results and critical load data with an outside party requires NDAs and marking rules settled before the first file moves. Finally, the 90 and 60 day windows run from fixed dates. Build a calendar that tracks the R1 completion date, the verification deadline and the recommendation response deadline, and confirm with your Regional Entity how it expects those dates to be documented. Also plan the R3 notice to the Transmission Operator, which is due within seven calendar days after R2 is completed.
Who must obtain verification and who can serve as verifier
Part 2.1 of CIP-014-3 R2 sets who can verify, but the obligation starts with the Transmission Owner and the R1 risk assessment it produced. The cards below separate the responsible entity, the object under review, the verifier's eligibility and independence, and the records a verifier needs to see.
Transmission Owner as responsible entity
R2 places the verification duty on each Transmission Owner, not on the planner who ran the study or the vendor who modeled it. Confirm which legal entity owns the stations and substations in scope, since a holding company, joint owner or affiliate may have run the R1 work on its behalf. Record who signs off on the verification engagement so the duty can be traced during a Regional Entity review.
R1 risk assessment as the object
The verifier checks the R1 risk assessment itself, including the transmission analysis, the criteria used to decide which stations could cause instability, uncontrolled separation or Cascading, and the list of identified facilities and primary control centers. Confirm that the version you hand over is the final, approved assessment and that its study assumptions, contingencies and data sources are documented.
Eligible verifier categories under Part 2.1
Part 2.1 limits the verifier to a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience. Ask any candidate to show the registration or the documented planning or analysis experience that qualifies it. Treat a general engineering consultancy without transmission study work as a poor fit, even if it is credible on physical security.
Internal staff and the affiliation test
The verifier must be unaffiliated, so internal staff who work in the same planning group that produced the R1 assessment usually do not qualify as independent. Internal analysts from a separate corporate affiliate may still fail the test. Document the reporting lines, the ownership structure and the reasons for any internal choice, and confirm the choice with counsel or your compliance lead before work starts.
R1 update cycle and timing
R1 must be repeated on a 30 or 60 month cycle, and R2 verification is tied to each completed assessment. Decide whether the verification runs concurrently with the R1 work or afterward, and map that choice to your next scheduled update. Confirm the calendar for the 90 day completion window and the 60 day action window before the study starts, not after the findings arrive.
Records the verifier needs
Plan access to the transmission models and study cases, contingency lists, power flow and stability results, the station and substation inventory, and the methodology notes that explain why each facility was included or excluded. Put non-disclosure terms in place before data is shared, because Part 2.4 requires procedures for sensitive information. Limit access to the records the verifier needs and log what was shared.
How to run the verification from engagement to recorded disposition
This sequence takes a Transmission Owner from choosing a qualified verifier to a documented record showing that each R1 recommendation was either acted on or explained. The output is a file an auditor can follow from the verifier's report to the final disposition of every finding.
Confirm verifier eligibility and independence
Before any information is shared, the Transmission Owner confirms that the candidate is an unaffiliated third party and fits one of the Part 2.1 categories: a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience. Compliance or legal staff should document the eligibility basis and the independence check, such as confirming there is no ownership or reporting relationship with the Transmission Owner. The output is a signed eligibility memo that is stored with the R2 evidence.
Execute information protection procedures
Under Part 2.4, the Transmission Owner puts procedures in place before sharing sensitive material. In practice this means executing non-disclosure agreements with the verifier and setting handling rules for station-level data, marking the R1 package as protected, and confirming how information developed under the standard will be withheld from public disclosure. The output is a signed agreement set and a handling procedure that names who may access the package.
Assemble and transmit the R1 package
The Transmission Owner gathers the R1 risk assessment, its supporting transmission analysis, the criteria used to identify stations and substations, and the record of primary control center identification. The package is transferred through a channel that matches the protection rules set in the prior step. The output is a transmittal record listing each document, its version, the date sent and the recipients, which proves what the verifier reviewed.
Obtain the verification report within 90 days
The verifier reviews the R1 assessment either alongside it or after it is completed, and delivers a written verification. Part 2.2 requires completion within 90 calendar days after the R1 risk assessment, so the Transmission Owner should track that date from the R1 completion date and schedule follow-up early. The output is a dated verification report that states the verifier's conclusions and lists each recommendation.
Log each recommendation with an owner
The Transmission Owner records every recommendation from the verification report in a findings register, with a reference number, a short description, the affected station or substation, and a named owner. Each entry is marked open until a disposition is recorded. The output is a complete register that matches the verifier's report item for item, so no recommendation is lost before the decision point.
Decide each disposition within 60 days
Within 60 calendar days of the verification, Part 2.3 requires one of two outcomes for each recommendation. The Transmission Owner either modifies the identification as recommended, or documents the technical basis for not doing so. The technical basis should be specific to the facility and the analysis, not a general statement. The output is a signed disposition for each register entry, with supporting analysis attached where needed.
Notify the Transmission Operator under R3
Where R2 identifies a primary control center that the Transmission Owner does not operate, R3 requires notice to the Transmission Operator that controls it within seven calendar days after R2 is completed. The Transmission Owner should send the notice in writing, identify the facility, and retain the transmittal. The output is a dated notification record that closes the R2 and R3 chain of evidence.
How an auditor tests R2 and what evidence they request
This table walks through how an auditor tests Parts 2.1 to 2.4 of R2 and the R3 notification, with the evidence each step asks for and the findings that most often appear. Read each row as a separate test: the verifier must qualify, the timing must hold, every recommendation must be dispositioned, information must be protected, and the notice to the operating Transmission Operator must follow within the set window.
| Test step | Evidence the auditor requests | Common findings |
|---|---|---|
| Part 2.1: verifier qualification | Verifier's registration or transmission planning and analysis credentials, statement of independence from the Transmission Owner, and the engagement letter naming the verifier | Verifier is an affiliate or a consultant without documented transmission planning or analysis experience |
| Part 2.2: timing against the R1 date | Dated R1 risk assessment, dated verification report, and engagement timestamps showing completion within 90 calendar days | Verification completed after the 90-day window, or the R1 and verification dates cannot be reconciled from records |
| Part 2.3: disposition of each recommendation | Recommendation log, revised identification or revised R1 records, and a dated documented technical basis for each recommendation not adopted | Recommendations left open, actions not dated within 60 calendar days of the verification, or rejections without a technical basis |
| Part 2.4: information protection procedures | Written procedure, signed non-disclosure agreements with the verifier, and records showing how sensitive information was shared and marked | Procedure exists on paper only, NDAs signed after information was shared, or no record of how public disclosure exemption was applied |
| R3: notification to the operating Transmission Operator | Dated notice to the Transmission Operator that controls each identified primary control center, sent within 7 calendar days after R2 completion | Notice missing, sent late, or no link between the notice and the R2 completion date |
| Cross-check: the evidence trail | Single index linking R1, R2 and R3 records by date, version and approver so the auditor can trace each step | Records are scattered across teams, versions conflict, or the approver of the R2 outcome cannot be identified |
Why the verifier's review of R1 decides the scope of R4 and R5
The verifier's review under R2 decides which stations, substations and primary control centers receive the physical threat evaluation under R4 and the security plan under R5. R1 is the transmission analysis that produces that list, so every facility missing from it or wrongly included in it carries that error into the later requirements. A flawed identification passes its mistakes downstream: a station left off the list gets no threat evaluation and no plan, and a station wrongly added absorbs evaluation and planning effort that should go elsewhere. Because R4 and R5 both start from the R1 output, the Transmission Owner should treat the verifier's challenge to that list as the point where scope is settled, not as a formality before the real work begins.
R2 checks the identification itself: whether the R1 analysis was sound in how it judged instability, uncontrolled separation or Cascading, and whether the primary control center determinations were correct. It does not assess the physical security measures at any site. Those measures belong to R6, which provides independent review of the R4 evaluation and the R5 plan. Keeping the two reviews distinct matters in practice. A verifier who signs off on R1 has not endorsed the adequacy of guards, barriers or response, and an R6 reviewer should not be expected to re-test the transmission logic behind the list.
Before the verifier starts, the Transmission Owner should confirm what it will hand over: the R1 study inputs and assumptions, the contingency results behind each station's selection, the primary control center mapping, and the procedures under Part 2.4 that protect sensitive information. The Transmission Owner should also plan who acts on the verifier's recommendations within the 60-day window under Part 2.3, because a recommendation to modify the identification changes the R4 and R5 work already queued. Confirm these steps and the verifier's qualifications against the standard text before scheduling the engagement.
Evidence that proves R2 was met and how to keep it current
An auditor testing CIP-014-3 R2 will ask for proof of who verified the R1 assessment, what they reviewed, when they finished, and what the Transmission Owner did with each recommendation. The cards below cover each record and how to version and retain the set for the Compliance Enforcement Authority. The Transmission Owner owns these records. An implementation partner can help organize them, but only the registered entity answers for them during an audit.
Verifier qualification records
Keep a file showing that the verifier meets Part 2.1: a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with documented transmission planning or analysis experience. Record the registration evidence or the experience basis, the named individuals, and their roles. Confirm that the verifier is unaffiliated with the Transmission Owner, and keep a written statement to that effect with the date it was signed. Auditors often ask for this file first, so store it where the verification report is kept.
Signed verification report with dates
The verification report is the central R2 artifact. It should state the verifier's name, the signatory, the date the verification was completed, and the date of the R1 risk assessment it covers. Part 2.2 allows 90 calendar days between the assessment and the completed verification, so the dates must show that window was met. Store the signed original in a controlled repository, not only as a working draft.
R1 assessment version control
Tie the verification to one exact version of the R1 risk assessment. Record the version identifier, the approval date, the list of identified stations, substations and primary control centers, and a hash or locked copy of the document. If the R1 assessment changes after verification, the report no longer covers the current version, and you must confirm with your Regional Entity how the change is handled. Version control prevents the common finding that the verified document and the audited document differ.
NDA and information protection records
Part 2.4 requires procedures that protect sensitive information shared with the verifier and keep information developed under the standard from public disclosure. Retain the signed non-disclosure agreements, the access list for the shared material, the transmission method used, and the marking or handling rules applied to the report. Record the date each person received access and the date access ended. Confirm with counsel which records must be exempt from public release in your jurisdiction.
Disposition log for each recommendation
Part 2.3 requires a decision within 60 calendar days of the verification on every recommendation. Maintain one row per recommendation with the reference number, the decision (modify the identification or not), the date of the decision, and the technical basis when the recommendation is not adopted. A recommendation without a documented technical basis is the most frequent gap auditors report. Attach the engineering analysis, the approver's name and the date to each row.
R3 notification record
Under R3, the Transmission Owner must notify the Transmission Operator that controls any identified primary control center it does not operate, within seven calendar days after R2 is completed. Keep the notification itself, the recipient, the transmission method, and the date sent and received. Where the Transmission Owner also identifies such a control center in R1, cross-check that the R3 notice names the same facility. A missing or late notice is simple to prove, so keep the record easy to find.
Audit period retention and review
Compliance Audits and Spot Checks look back across a defined audit period, so the R2 file must remain complete for that span. Set a retention schedule for every item above, assign an owner, and review the index each time R1 is reperformed on its 30 or 60 month cycle. Store records in a tool with access logs and version history, and confirm the retention period with your Regional Entity. A single index that links each record to its R1 version makes the evidence easy to produce on request.
Who verifies, who prepares and who audits R2
The Transmission Owner holds the R2 obligation. It must have an unaffiliated third party verify its R1 risk assessment, either concurrently with the assessment or after it. The owner chooses the verifier, agrees the terms under which sensitive information is shared, and decides how each recommendation is handled. Ownership does not transfer to a consultant or to the verifier, so the owner signs off on the outcome and answers for it during an audit.
- Selecting the verifier: Confirm that the candidate is a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience that can be documented.
- Setting the information rules: Put non-disclosure terms and handling procedures in place before the R1 material leaves the company, as Part 2.4 requires.
- Deciding dispositions: Within 60 calendar days of the verification, either modify the identification as recommended or document the technical basis for not doing so.
- Keeping the clock: Track the 90 calendar day completion window from the R1 assessment and the 60 day disposition window from the verification.
- Retaining the record: Keep the verifier's report, the disposition decisions and the dated correspondence so the entity can show each step.
Before engaging anyone, confirm with your Regional Entity how it expects independence and documentation to be shown.
An implementation partner helps the Transmission Owner prepare for R2 without taking over the verification. The partner can organize the evidence package, build a tracker for the two deadlines, draft disposition records for the owner to review and approve, and check that the documents match what was actually done. The partner does not act as the unaffiliated verifier and does not issue any opinion on whether the R1 analysis is correct.
- Evidence package: Assemble the R1 inputs, the R1 results, the list of identified stations and substations and the record of who had access to sensitive information.
- Deadline tracking: Maintain dated entries for the 90 day completion window and the 60 day disposition window, with named owners for each step.
- Draft disposition records: Prepare drafts of the modify or document-basis decisions for the Transmission Owner to approve, with the technical reasoning written in the owner's voice.
- Independence check: Confirm that no firm or person who prepared the R1 analysis is serving as the verifier. A partner that prepared R1 may not be the unaffiliated verifier.
- Handover: Deliver the complete record in an organized form so an auditor can trace each requirement part to a dated document.
Ask any partner to state in writing which parts of R1 and R2 it touched, so the independence question can be answered before the work starts.
The Compliance Enforcement Authority, which is a Regional Entity or NERC, monitors compliance through audits, spot checks, self-certifications and self-reports. An independent auditor may be engaged to test the work in a particular case, but it does not issue a CIP certificate, because no such certificate exists. Its output is a finding, which the Transmission Owner can contest or resolve through the compliance process.
- Testing the records: Check that the R2 verification was completed within 90 calendar days after the R1 assessment and that the disposition decisions fall within 60 calendar days of the verification.
- Testing independence: Look at who performed the verification, their qualifications under Part 2.1 and whether they had any role in preparing the R1 analysis.
- Testing information protection: Review the Part 2.4 procedures and the evidence that sensitive information was shared only under them.
- Testing dispositions: Confirm that each recommendation has either a modification or a documented technical basis for not making it.
- Issuing findings: The Regional Entity determines compliance and any penalty. Audit periods and evidence requests follow the Regional Entity's process.
Ask the Regional Entity which records it will request for R2 and in what format, and plan the evidence file against that list.
What meeting R2 costs in money and effort
This table breaks down the cost and effort components of CIP-014-3 R2 verification, showing who is paid for each, whether it is one-time or recurring per R1 cycle, what drives it up or down, and what to request in a quote. No prices are given here, because none are supplied for this topic, so use the table to structure your own budget request and vendor comparison.
| Cost component | Who is paid or who carries it | One-time or recurring per R1 cycle | What drives it up or down and what to request in a quote |
|---|---|---|---|
| External verifier fees | Unaffiliated verifier (registered Planning Coordinator, Transmission Planner, Reliability Coordinator, or experienced transmission analyst) | One-time per R1 cycle, repeated each time R1 is re-performed | Up: number of stations and substations in the R1 analysis, model complexity, verifier availability within the 90-day window. Down: complete, well-documented R1 inputs. Request: fixed or capped fee, scope of models reviewed, deliverable format, and re-verification terms. |
| Internal staff time for data packaging | Transmission Owner planning and engineering staff (internal cost, or a partner hourly or fixed-scope fee) | Recurring each R1 cycle, with heavier effort the first time | Up: volume and age of power flow, contingency and study files, and gaps in version control. Down: a maintained study data library. Request: an estimate of hours by role and a list of files the verifier will need. |
| Internal staff time for disposition of recommendations | Transmission Owner engineers who decide whether to modify the identification or document the technical basis | Recurring each R1 cycle, within the 60-day window after verification | Up: number and complexity of verifier recommendations, and the need for additional studies. Down: early engagement with the verifier during the R1 analysis. Request: the verifier's commitment to a written findings format that supports a documented technical basis. |
| Legal time for NDAs and information handling | Transmission Owner legal or contracts staff, and outside counsel if used | One-time per verifier engagement, updated when the verifier or data scope changes | Up: new verifiers, unfamiliar agreement templates, and disputes over sensitive information. Down: a standard NDA covering Part 2.4 protections agreed before data sharing. Request: the verifier's standard NDA and confirmation that it addresses protection of sensitive and public-disclosure-exempt information. |
| Secure data transfer and evidence tracking tooling | Transmission Owner IT or security team; tooling may be an internal platform or a managed service | Recurring for storage and access control, with setup as a one-time cost | Up: number of verifiers, sensitivity classification of the data, and need for audit trails. Down: reuse of an existing controlled repository. Request: access logging, role-based access, and retention terms that the auditor can review. Confirm what the verifier's environment requires. |
| Coordination with R3 notification | Transmission Owner compliance staff | Recurring each R1 cycle, due within seven calendar days after R2 completes | Up: multiple primary control centers operated by different Transmission Operators. Down: a current inventory of control center ownership. Request: a checklist that ties verification completion dates to the R3 notification deadline. |
| Auditor sampling and evidence preparation | Transmission Owner compliance team; the Compliance Enforcement Authority's auditor bears the audit cost | Recurring at each Compliance Audit or Spot Check that samples R2 | Up: incomplete records of verifier qualifications, dates, and disposition decisions. Down: a single evidence index linking R1, R2, and R3 records. Confirm with your Regional Entity which records it will request and how it wants them presented. |
| Re-verification if R1 changes | Verifier and internal staff | Recurring when the R1 risk assessment is re-performed, including when the 30 or 60 month cycle restarts | Up: material changes to the transmission system or to identified facilities between cycles. Down: a change log for study inputs. Request: a re-verification scope and fee basis in the original engagement letter. |
Questions about CIP-014-3 R2 verification, cost and outside help
Who is allowed to perform the CIP-014-3 R2 verification?
The verifier must be unaffiliated with the Transmission Owner and must be either a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience. The standard's Part 2.1 sets this limit, so a general security consultant without transmission analysis experience does not qualify on its own. Confirm the verifier's credentials and independence in writing before work starts, and keep that record as evidence for the audit file.
Can an internal team perform the CIP-014-3 R2 verification?
Usually not, because the verifier must be unaffiliated with the Transmission Owner. An internal planning group, even a skilled one, is affiliated with the entity that produced the R1 risk assessment. Internal staff can prepare materials, answer questions and track the R2 schedule, but the independent verification itself needs an outside party that meets Part 2.1. Ask your compliance lead to confirm how your corporate structure affects affiliation before you assign the work.
How do the 90-day and 60-day windows in CIP-014-3 R2 work?
Part 2.2 requires the verification to be completed within 90 calendar days after the R1 risk assessment, and Part 2.3 requires action within 60 calendar days of the verification. For each recommendation, you must either modify the identification as recommended or document the technical basis for not doing so. The 90-day clock starts from the R1 assessment, so schedule the verifier early. The verifier's report date usually sets the start of the 60-day window, so track both dates in one calendar.
What drives the effort and cost of CIP-014-3 R2 verification?
Cost depends on how many stations and substations R1 identified, how complex the transmission model is, and how much supporting analysis the verifier must review. Effort also rises when R1 documentation is incomplete or when Part 2.4 protections, such as non-disclosure agreements and handling procedures for sensitive information, must be set up first. Verification is a one-time activity per R1 cycle, but the work recurs each time R1 is repeated. Ask any provider for a written scope that lists the facilities reviewed, the documents supplied and the deliverables. No public benchmark figure is provided here, so confirm pricing against your own scope.
What should I ask a partner for before hiring them for R2 support?
Ask for a written scope with four parts: the R2 tasks they will support, the evidence they will prepare, the parties who will sign or own each deliverable, and the dates they commit to. Confirm how they handle the Part 2.4 information protection requirements and whether their staff meet the Part 2.1 qualifications. Ask who issues the verification statement and who is responsible for the 60-day action log. Before signing, confirm what the partner will not do.
Can a partner act as the independent verifier for R2?
A partner can act as the verifier only if it meets the Part 2.1 test and is unaffiliated with your organization. DeployOpen plans, implements, documents and supports self-hosted open-source platforms, and runs security testing and compliance readiness work, but DeployOpen does not issue audit reports or attestations. It is not positioned to act as the R2 verifier. The verification must come from a qualified outside party, and the organization owns the decision and the record. Ask any prospective verifier to confirm its qualifications and independence in writing.
What will the auditor ask for to show R2 was met?
Auditors typically ask for the R1 risk assessment, the verifier's qualifications, the completed verification record with its date, the list of recommendations, and the record of each action or documented technical basis within 60 days. They also look for evidence of the Part 2.4 protections, such as signed non-disclosure agreements and access controls on sensitive information. Confirm the exact evidence list with your Regional Entity and your internal compliance team, since requests vary by audit scope.
How open-source tooling can organize the R2 evidence trail
Open-source tools can keep the R2 evidence trail organized, but they do not satisfy CIP-014-3 R2 on their own. The Transmission Owner still has to show that an unaffiliated third party verified the R1 risk assessment, that the verification finished within 90 calendar days, and that the 60-day decision on recommendations was documented. The tools hold the records; the entity owns the obligation. CISO Assistant (AGPL-3.0-only) can hold assessment records, store the R2 verification as a distinct assessment, and map controls across the more than 200 frameworks it ships with. That mapping helps when the same R1 risk assessment evidence also supports a broader program such as ISO 27001 or NIST CSF, but the R2 mapping must still be checked against the standard text by the compliance lead.
Nextcloud (AGPL-3.0-only) can control how the sensitive R1 package moves. Its File Access Control app can deny upload, modification, deletion, download and sync when rules match on user group, IP address, MIME type or file name, so the entity can limit the package to a named verifier group and to approved network ranges. Under R2 Part 2.4, the procedures protecting this information, such as non-disclosure agreements, are the controlling element, and a technical block is only one part of them. Before relying on the setup, confirm that the rules match how the entity's verifier actually connects, and test them with a non-sensitive file.
Confirm three things before you commit to either tool. First, check the license terms with counsel, because AGPL-3.0-only obligations apply when software is modified or offered to users over a network, and the entity's hosting model decides how they apply. Second, confirm the edition, version and any feature limits with the vendor or project, since the supplied facts do not cover every capability. Third, decide where the evidence lives, including retention and access logging, so that the verification record can be produced in a later audit. Details on the project sources are in the CISO Assistant README on GitHub and the Nextcloud admin manual on file access control.
Where Transmission Owners fall short on R2 and how to close each gap
CIP-014-3 R2 is short on paper but easy to get wrong in practice. The gaps below cluster around who verifies, when the work happens, how recommendations are handled, how sensitive data is protected, and whether the record ties the verification to the R1 assessment that is actually in force.
Verifier is not eligible or is affiliated
Part 2.1 limits the verifier to a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or to an entity with transmission planning or analysis experience. Part 2.1 also requires the verifier to be unaffiliated with the Transmission Owner. A consultant tied to the owner's corporate family or an engineer who helped build the R1 analysis can fail this test. Check the verifier's registration or experience record and its ownership before signing. Ask the verifier to confirm in writing that it has no affiliation.
Verification starts too late
Verification may run concurrently with or after the R1 risk assessment, but Part 2.2 requires it to be completed within 90 calendar days after that assessment. Teams often schedule the verifier after the R1 report is final and then lose weeks to scoping and data requests. Set the verification completion date at the time the R1 assessment starts, and track it as a dated milestone with a named owner.
Recommendations handled without a basis
Part 2.3 requires the Transmission Owner, within 60 calendar days of the verification, to either modify the identification as recommended or document the technical basis for not doing so. A disposition that says only "reviewed and accepted" or "not adopted" does not meet the requirement. Log each recommendation, the decision, the engineering reasoning, and the date. Keep the decision memo with the verifier's report so an auditor can follow the chain.
Sensitive R1 data shared without Part 2.4 controls
The verifier will need the R1 analysis, station data and possibly critical infrastructure information. Part 2.4 requires procedures, such as non-disclosure agreements, to protect that information and to protect or exempt information developed under the standard from public disclosure. Before data moves, confirm the NDA covers the verifier's staff and subcontractors, set a secure transfer and storage method, and record who received which files.
No record of the R3 notice
Within seven calendar days after completing R2, Requirement R3 requires the Transmission Owner to notify the Transmission Operator that controls an identified primary control center the owner does not operate. Many owners finish the verification and never send this notice, or send it without a retained copy. Build the notice into the R2 closeout checklist, record the date sent and the recipient, and keep the transmission record with the verification file.
Verified R1 does not match current R1
Verification checks a specific R1 risk assessment. If the R1 analysis is revised, a station is added or removed, or the network model changes, the verification may no longer cover the assessment in force. Give the R1 report a version identifier, reference that version in the verifier's report, and confirm the version still matches the R1 assessment before the R4 and R5 work relies on it.
How DeployOpen prepares the R2 package without issuing the verification
DeployOpen prepares the systems and records that an unaffiliated verifier will need to review, but it does not act as the verifier. Under a fixed written scope, our work covers the self-hosted platforms inside your own environment: the evidence trail for the R1 risk assessment, the disposition tracker that records how each verifier recommendation was handled under Part 2.3, and the information protection setup required by Part 2.4. The verifier must be independent of the R1 work, so DeployOpen will not verify an R1 assessment it helped prepare, and it does not issue audit reports, attestations or certifications. Those belong to the verifier you engage and to the Compliance Enforcement Authority that monitors your compliance.
The information protection setup is where most of the practical work sits. Part 2.4 expects procedures such as non-disclosure agreements for sensitive information shared with the verifier, and protection or exemption of material developed under the standard from public disclosure. On a self-hosted file platform, this can mean a restricted group, a dedicated share for R2 materials and access rules that limit download and sync to named users. For example, the open-source Nextcloud File Access Control app can block actions based on user group or IP address, but you must confirm that its rules meet your own disclosure procedures. Ask your legal and security teams to confirm the procedure text before we configure anything.
To start, book a scoping conversation with DeployOpen. We will ask which R1 documents exist, who wrote them, which verifier you intend to engage, where the evidence will be stored and which deadlines apply, including the 90-day completion window in Part 2.2 and the 60-day action window in Part 2.3. The outcome is a written scope with deliverables and timelines agreed before work starts. Confirm with your verifier whether they need any tooling or access to your platforms, and confirm the requirements directly in the CIP-014-3 standard before finalizing the scope.
