Buyer guides for registered entities and their suppliers: how CIP-002 categorization sets scope, how CIP audits work, what CIP-013 asks of vendors, how to run a CIP compliance program, and which CIP changes take effect through 2029.
How CIP-002-5.1a categorization works and why it decides the size of a CIP program: the asset types considered, the high, medium and low impact bright lines, what low impact entities must still do, External Routable Connectivity, and the Control Center definition change coming in 2028.
How CIP compliance is monitored and audited: who audits (Regional Entities and NERC, not certification bodies), how often, the notice periods and audit period, what auditors use (RSAWs and evidence), the draft report process, other monitoring tools, and penalty exposure.
What CIP-013-2 requires of registered entities and, through procurement, of their vendors: the risk management plan, the six vendor topics, the related CIP-005 and CIP-010 controls, contract limits, review cycles, history and the 2028 revision.
How registered entities organize a CIP compliance program: scoping through CIP-002, the CIP Senior Manager and delegations, policies, the recurring calendar of 15-month, 35-day and quarterly obligations, evidence retention, self-reporting and self-logging, and FERC's paperwork burden estimates.
The CIP timeline as of October 2026: what became enforceable in 2026, the virtualization suite and Control Center definition in July 2028, INSM and the CIP-014 revision in October 2028, and the low impact and INSM expansions in 2029, with early adoption options.
What NERC CIP compliance costs a registered entity: the published FERC paperwork estimates for new standards, recurring internal work, penalty exposure, and how impact rating and the number of BES Cyber Systems drive effort.
Which organizations NERC CIP applies to: registered entities under FERC-approved standards, how many US entities are in scope, the high, medium and low impact split, and why there is no certificate to obtain, only ongoing compliance monitored by a Regional Entity.
A working checklist for a NERC CIP program: categorization, the CIP Senior Manager and policies, the recurring 15-day, 35-day, quarterly and 15-month tasks, evidence retention, and what must be ready before an audit notification arrives.
What NERC CIP consultants and implementation partners do for registered entities, how their work relates to published FERC effort estimates, and why the registered entity, its CIP Senior Manager and the Regional Entity auditors keep roles a consultant cannot take.
Splitting NERC CIP work between the registered entity, contractors and vendors: accountability that stays with the CIP Senior Manager and delegates, recurring technical tasks partners commonly run, and the personnel and access rules that apply to outside staff.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.