NERC CIP-013 supply chain risk

What does NERC CIP-013 supply chain risk require, and who pays for it?

CIP-013-2 has been enforceable since 1 October 2022 and applies to high and medium impact BES Cyber Systems and their associated Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS). Low impact systems are outside its scope. The registered entity owns the obligation: it must document a supply chain cyber security risk management plan, implement it, and review and approve it at least once every 15 calendar months. No outside firm can take that accountability, and no CIP certificate exists to show compliance. The Compliance Enforcement Authority, a Regional Entity or NERC, monitors the entity through audits, spot checks, self-reports and other tools, so the evidence must exist in the entity's own records before anyone asks for it.

Cost and effort depend mainly on three things: how many procurement actions touch in-scope systems each year, how many systems and vendors fall under the plan, and how mature the entity's existing procurement and security review process already is. One-time costs include drafting the plan, mapping which contracts and purchase categories are affected, and building a review workflow with an approval record. Recurring costs include reviewing vendor responses, tracking the six vendor topics in Part 1.2 against each purchase, keeping revision history for the 15-month review, and maintaining the related CIP-005 and CIP-010 controls. A consultant or implementation partner may be paid to draft templates, run a gap review or set up tracking, but the CIP Senior Manager or delegate still approves the plan. Ask any provider for a written scope listing the systems, vendor categories and deliverables it covers, and confirm with the entity's Regional Entity how it expects evidence to be kept.

How the six Part 1.2 vendor topics reach procurement

CIP-013-2 Part 1.2 does not require a fixed contract clause list. It asks that procurement processes address, as applicable, six vendor topics, so each topic has to be tied to a specific purchase and its risk. The cards below describe what each topic means in practice and what to ask a vendor to confirm in writing before the order closes.

Incident notification

Part 1.2 asks procurement to address how a vendor tells the entity about cyber security incidents that could affect the purchased product or service. In practice, ask the vendor to confirm in writing which incidents it reports, the channel used, and the time it commits to for first notice. Check that the notice path reaches the people who can start the entity's own Cyber Security Incident response under CIP-008-6.

Coordinated incident response

This topic covers how the vendor and the entity work together once an incident is confirmed. Procurement should identify a named vendor contact, the roles each party takes, and how evidence and logs are shared. Ask the vendor to confirm whether it will support investigation on site or remotely, and whether any support is included in the purchase price or billed separately.

Notice when access should end

Part 1.2 covers notice to the entity when vendor remote or onsite access should be terminated, such as when a vendor employee leaves or a project closes. Ask the vendor to commit in writing to a notice path, a named point of contact, and a process for confirming that accounts were removed. This links directly to the disable steps in CIP-005-7 R2 Parts 2.4 and 2.5.

Disclosure of known vulnerabilities

This topic asks procurement to address how the vendor discloses vulnerabilities it knows about in the purchased product. Ask whether the vendor publishes advisories, how quickly it shares details with customers, and whether it provides fixes or compensating guidance. The entity needs this information to feed its vulnerability assessments under CIP-010-4.

Software integrity and authenticity

Part 1.2 asks procurement to address how the entity can verify that software and firmware are genuine and unaltered. Ask the vendor to state how releases are signed, where hashes or certificates are published, and how patches are delivered. Those answers support the source and integrity check that CIP-010-4 R1 Part 1.6 requires before a baseline change.

Coordination of vendor remote access controls

This topic covers how the vendor's remote access to an entity's systems is controlled, including authentication, session recording, and the route through an Intermediate System. Ask the vendor to describe in writing which accounts it uses, whether multi-factor authentication applies, and how sessions are logged. The answers should match the vendor remote connection rules in CIP-005-7 R3 for EACMS and PACS.

How CIP-005 and CIP-010 carry vendor controls into operations

What CIP-013 compliance costs and who is paid for each part

This table compares each cost component of CIP-013 compliance by the party paid for it, whether it is one-time or recurring, and what drives it up. No fee figures are given because none were supplied, so use the right-hand column to ask each provider for a specific line item in its quote. The main takeaway is that the registered entity keeps accountability for the plan even when partners and auditors carry parts of the work.

Cost component	Who is paid	One-time or recurring, and main cost driver
Internal CIP Senior Manager and procurement staff time	Registered entity (internal salaries)	Recurring. Driven by the number of vendors in procurement and how often the plan is reviewed on its 15-month cycle.
Legal review of vendor terms	Outside counsel or internal legal	One-time for new contract templates, then at each renewal. Driven by how many contracts include the six vendor topics and how often terms are renegotiated.
Implementation partner work on plan drafting and evidence	Implementation partner under a written, fixed scope	One-time for drafting and evidence setup, periodic for refreshes. Driven by the size of the plan, the number of procurement workflows and the evidence the entity asks for.
Tooling for software verification and remote access logging	Software vendor or open-source project, with support contracts where used	Recurring license or support. Driven by the number of assets, user seats and whether the tool is community or commercial edition. Confirm license terms before purchase.
Independent auditor	Regional Entity or NERC for compliance monitoring, and any independent assessor the entity hires for readiness	Periodic. The audit is performed by the Compliance Enforcement Authority, so ask any outside assessor for its scope and whether it reviews only readiness.

What makes CIP-013 effort larger or smaller

CIP-013 applies to high and medium impact BES Cyber Systems and their associated EACMS and PACS, so the size of that population sets the starting point. Five further drivers, from vendor count to evidence maturity, decide how much recurring work the procurement process creates. Check each one against your own environment before you request a quote.

High and medium impact system count

CIP-013-2 reaches only high and medium impact BES Cyber Systems and their associated EACMS and PACS. Each system in that population needs a procurement path covered by the plan, so the count of these systems, and the number of their associated access and physical control systems, is the first driver of effort. Confirm the list from your CIP-002 categorization before scoping vendor work. Low impact systems fall outside CIP-013-2 but have their own vendor remote access rules under CIP-003-9.

Number of active vendors and products

Every vendor and product that supplies a covered system must be assessed against the plan during procurement planning, including the risks of installing a product and of switching vendors. A short list of vendors with stable product lines is far cheaper to keep current than a long tail of small suppliers, each with its own support terms. Build a vendor register that maps each vendor to the systems it touches, and review that register at each plan review.

Share of vendor remote access

Vendor remote access triggers the most operational controls in this area, including CIP-005-7 R2 Parts 2.4 and 2.5 for determining and disabling active vendor sessions, and CIP-005-7 R3 for vendor connections to EACMS and PACS. The more systems a vendor reaches remotely, the more session logs, disablement steps and coordination records you must keep. Ask each vendor which systems it accesses remotely, how sessions start, and who can end them.

Contract renewal cycle

CIP-013-2 R2 requires you to implement the plan but does not require renegotiating or abrogating existing contracts, so contract terms already in force remain a gap to manage. Each renewal is the natural point to add the six vendor topics from Part 1.2, including incident notification, vulnerability disclosure and software integrity verification. Long renewal cycles leave older terms in place for years, so map which contracts renew before the next plan review.

Evidence maturity

Evidence for R2 can include correspondence, policy documents or working documents showing the plan was used, and evidence for R3 includes revision history or workflow records with documented approval. Teams that record procurement decisions in a ticketing or workflow system produce this evidence as a by-product of normal work. Teams that rely on email threads and ad hoc spreadsheets spend time reconstructing it before each audit. Ask how your current procurement tool stores approvals and reviews.

How a CIP-013 program moves from plan to Regional Entity audit

The sequence turns CIP-013-2 from a policy document into a plan that is implemented, reviewed and evidenced, so the registered entity can show a monitoring team how its procurement decisions follow the plan. Each phase closes with a named output that feeds the next.

Confirm categorization under CIP-002
The CIP Senior Manager or delegate confirms which BES Cyber Systems are rated high or medium impact, because CIP-013-2 applies only to those systems and their associated EACMS and PACS. Low impact systems fall outside CIP-013-2 and are handled under CIP-003-9 Attachment 1 Section 6 instead. The output is a current list of in-scope systems and the vendors that supply them, which defines what the plan must cover.
Draft the R1 supply chain risk management plan
Write a documented plan that addresses how vendor risk is identified and assessed during procurement planning, covering risks from installing vendor products and risks from switching vendors (Part 1.1). The engineering, procurement and security teams should each review the draft against their own process. The output is a approved-for-review plan with named owners and a clear link to the in-scope systems list.
Map procurement steps to the six vendor topics
Walk through the purchasing workflow and identify where each of the six Part 1.2 topics applies: incident notification, coordinated incident response, notice when vendor access should end, disclosure of known vulnerabilities, software integrity and authenticity verification, and coordination of vendor remote access controls. Under R2, existing contracts are not renegotiated, so the mapping should show where new procurements and renewals pick up these topics. The output is a procurement checklist tied to each topic, marked as applicable or not applicable with a reason.
Implement the plan in live procurements
Apply the procurement checklist to new acquisitions and cover related operational controls, including software source and integrity verification before baseline changes under CIP-010-4 R1 Part 1.6, and vendor remote access controls under CIP-005-7 R2 Parts 2.4 and 2.5 and R3. Keep correspondence, policy documents and working records that show the plan was used, since these are the R2 evidence types. The output is a set of completed procurement records that trace back to the plan.
Run the 15-month review and record approval
Review the plan at least once every 15 calendar months and obtain CIP Senior Manager or delegate approval (R3). Use the revision history or workflow record to show what changed and who approved it. The output is a dated review record, an updated plan version where changes were needed, and a signed or system-recorded approval.
Prepare the evidence package for a monitoring engagement
Assemble the plan versions, procurement records, implementation evidence and review approvals in one indexed location so the team can answer an evidence request without rebuilding the record. Confirm the audit notice period and evidence retention rules with the Regional Entity and your compliance lead before a notice arrives. The output is an evidence index mapped to R1, R2 and R3 that the CIP Senior Manager can present to the Compliance Enforcement Authority.

Who owns CIP-013 work, who can help, and where independence ends

The registered entity owns CIP-013 compliance from start to finish. Its CIP Senior Manager or delegate must approve the supply chain cyber security risk management plan, and the entity decides which vendors it buys from and which contract terms it accepts. The standard places responsibility on the entity, so every obligation in Parts 1.1 and 1.2 traces back to a named internal owner.

Plan ownership: The entity writes, maintains and approves the plan required by R1, and it records the review and approval required by R3.
Procurement decisions: The entity decides how its procurement processes address the six vendor topics in Part 1.2, as applicable.
Contract authority: The entity negotiates or accepts vendor terms, since R2 does not require renegotiating existing contracts.
Operational controls: Internal staff run the related controls in CIP-005 and CIP-010 and keep the resulting records.
Evidence custody: The entity retains the artifacts it will show an auditor.

Before engaging any outside party, confirm in writing which of these tasks you will keep in-house and which you will delegate.

How to choose an implementation partner for CIP-013

CIP-013-2 makes the registered entity answerable for its supply chain risk plan, so any partner you bring in must fit inside that accountability. The cards below cover the checks that separate a partner that prepares work for your CIP Senior Manager from one that creates new exposure.

CIP and BES experience

Ask for evidence that the partner has worked inside high and medium impact BES Cyber System environments, not only general security or IT projects. CIP-013-2 covers procurement of high and medium impact BES Cyber Systems and their associated EACMS and PACS, so the partner should be able to explain how those scopes differ from ordinary enterprise procurement. Ask which CIP standards their staff have worked against and how they handle the 15-month review cycle in CIP-013-2 R3.

Written fixed scope

Require a written scope with named deliverables and dates before work starts. A fixed scope should state which parts of the R1 plan the partner drafts, which procurement steps it supports, and what it will not touch, including existing contracts. CIP-013-2 R2 requires implementing the plan without renegotiating or abrogating existing contracts, so a scope that promises contract changes is a warning sign.

Evidence ownership split

Ask the partner to show, in writing, which evidence it prepares and which evidence the registered entity keeps. For R2, evidence may include correspondence, policy documents or working documents showing the plan was used. For R3, it includes revision history, workflow records and documented approval. A clear split avoids a situation where the record of plan use exists only in a contractor's system.

BCSI access by partner staff

Confirm how partner personnel reach BES Cyber System Information while supporting procurement or evidence work. Ask whether staff will receive personnel risk assessments and training consistent with CIP-004-7, who approves their access, how access is revoked, and where any BCSI is stored. The answers should match the CIP-011-3 handling rules that the entity already applies to its own staff.

Documents the CIP Senior Manager owns

Ask the partner to deliver the risk management plan, procurement procedures and approval records in formats the entity can edit, version and approve itself. The CIP Senior Manager or delegate must approve the plan under CIP-013-2 R3, so a document that only the partner can update or only exists in a partner portal weakens that accountability. Ask for source files, revision logs and a handover session before the engagement closes.

Vendor topic coverage

Check that the partner can map its procurement support to the six topics in CIP-013-2 Part 1.2: incident notification, coordinated incident response, notice when remote or onsite access should end, disclosure of known vulnerabilities, software integrity and authenticity verification, and coordination of vendor remote access controls. Ask for a sample checklist for one topic and how it links to the CIP-010-4 and CIP-005-7 controls the entity already runs.

What delays CIP-013 projects and what buyers ask before hiring help

Can we run CIP-013 compliance ourselves without outside help?

Yes, many registered entities write and maintain their own supply chain risk management plan. The plan has to be documented, implemented through procurement, and reviewed and approved by the CIP Senior Manager or a delegate at least every 15 calendar months. What usually determines whether an in-house team can keep up is the number of high and medium impact BES Cyber Systems, the number of active vendors, and whether procurement, security and operations staff have time to follow the plan on every purchase. A partner can help with the technical side, such as preparing evidence of software integrity checks or vendor remote access controls, but accountability stays with your organization. Ask yourself whether the people who will answer an auditor can also show the plan being used.

How much internal time does a CIP-013 program take?

The effort depends on scope more than on the standard's length. The main drivers are the count and impact rating of the BES Cyber Systems, the number of vendors that touch them, how many procurements happen each year, and how much of the plan already exists. Some work is one-time, such as drafting the plan, mapping vendor topics to procurement templates, and setting up the approval workflow. Other work recurs, including reviewing the plan at least every 15 calendar months, checking procurements against the six Part 1.2 topics, and keeping revision history and approval records. Before you request a quote, ask the partner to break its estimate into one-time and recurring hours and to state which roles, such as procurement, legal and CIP operations, its figures assume will be available.

Do we have to reopen existing vendor contracts to meet CIP-013?

No. Under requirement R2, the entity must implement its plan, but the standard does not require renegotiating or abrogating existing contracts, and contract terms and vendor performance are outside its scope. In practice, the plan applies to procurements going forward, so the gap work usually focuses on how new purchases, renewals and vendor access changes are handled. Existing vendors may still be asked for information during routine interactions, but that is a business choice rather than a standard requirement. Confirm with your legal and compliance teams how renewal and amendment triggers will be recorded in your procurement workflow.

What happens if the 15-month CIP-013 review slips?

A missed review is a compliance issue under requirement R3, which requires review and CIP Senior Manager or delegate approval of the plan at least once every 15 calendar months. The practical risk is that the gap becomes visible during a Regional Entity audit or monitoring engagement, where evidence of the last review and approval will be requested. Put the review on the compliance calendar with a named owner, keep approval records in a system that shows dates and revisions, and check the calendar before the audit notice arrives. If a review is late, document the cause, complete the review and approval promptly, and report it through your internal compliance process so that the Regional Entity sees a controlled response.

How does the CIP-013-3 revision change the supply chain plan?

CIP-013-3 was approved in FERC Order No. 919 as part of the virtualization revisions and takes effect on 1 July 2028, according to NERC's listing. Entities should plan for the revision as a change to a working program rather than a rewrite. Engineers should check how virtualized environments, such as hypervisors, containers and cloud-hosted management systems, appear in the vendor inventory, procurement criteria and software integrity checks. Compliance leads should compare the revised requirement text with the current plan line by line and record which changes affect procurement templates and evidence. Confirm the exact scope and wording with the standard itself and with your Regional Entity before you finalize the plan.

Can a partner guarantee that our CIP-013 audit passes?

No. A partner can prepare systems, procedures and evidence for review, but it cannot guarantee an audit outcome. Compliance monitoring is carried out by the Regional Entity or NERC, which issues findings, and the registered entity remains accountable for meeting the standard. DeployOpen plans, implements and documents systems and evidence for compliance assessments, but it does not issue audit reports or certifications, and only the independent monitoring body makes compliance determinations. When you evaluate any firm, ask what it will deliver in writing, who owns each control, and how the evidence will be organized for the auditor.

What should a written scope for CIP-013 help include?

A written scope should name the systems covered, the procurement steps that will change, the deliverables, and the roles that remain with your organization. Typical items include the risk management plan draft, the procurement checklist covering the six Part 1.2 vendor topics, the review and approval workflow, and evidence mapping for requirements R2 and R3. For operational links, it should state whether work touches CIP-005-7 vendor remote access or CIP-010-4 software integrity verification. Ask for acceptance criteria, a list of assumptions about your inventory and staffing, and a statement of what is excluded, such as contract renegotiation. Fixed-scope agreements are agreed in writing before work starts, which makes these details easier to verify.

What the CIP-013-3 revision changes in 2028

CIP-013-3 is the revision that takes effect on 1 July 2028, and it arrived through FERC Order No. 919, the virtualization package that approved eleven revised CIP standards. NERC lists CIP-013-3 among them with the same 1 July 2028 effective date. Until then, CIP-013-2 remains the enforceable supply chain standard, and it still applies to high and medium impact BES Cyber Systems and their associated EACMS and PACS. A registered entity should not treat the 2028 date as a reason to pause its current plan. The virtualization changes are designed to accommodate virtual environments, so the procurement process and the 15-month review cycle you run today will need to be checked against the revised text before that date arrives.

The standard has been revised twice before in ways that show what the supply chain requirement is built to cover. CIP-013-1 responded to FERC Order No. 829 and was approved on 18 October 2018. CIP-013-2 followed in response to FERC Order No. 850, which pushed the requirement to cover Electronic Access Control or Monitoring Systems and Physical Access Control Systems. It was approved on 18 March 2021. Each revision widened the set of systems the vendor controls must reach, so a shift in the 2028 text may affect not only the procurement clauses but also which assets and vendor relationships fall inside the plan. Track the scope language closely, since a change there can alter contract requirements that were already negotiated.

Before you plan any changes, confirm the revised CIP-013-3 wording directly against the NERC standard, not against secondary summaries, including this page. Compare the Part 1.2 vendor topics, the review cadence in R3 and any changed references to CIP-005 and CIP-010 controls, then map each difference to your current risk management plan, procurement templates and contract language. Ask your vendors and integrators which of their services depend on virtualized platforms, because those are the agreements most likely to need amendment. Record the findings in your change workflow so the approval and revision history that the standard's evidence requirements call for shows when each decision was made.

How DeployOpen prepares CIP-013 procurement and evidence

DeployOpen works on CIP-013 supply chain risk as an implementation partner for self-hosted open-source platforms inside the entity's own infrastructure. We prepare the systems, procurement records and evidence that support the entity's plan, while the CIP Senior Manager or delegate keeps ownership of the plan, its approval and its vendor decisions.

How we scope

Engagements are fixed-scope, with the systems, deliverables and timelines agreed in writing before work starts.
We confirm which platforms touch high or medium impact BES Cyber Systems and their associated EACMS and PACS.
The written scope states which procurement records, vendor topics and related CIP-005 and CIP-010 controls are included.

How we build

We help set up procurement intake and vendor assessment workflows that record risks from installing products and switching vendors.
We configure software source and integrity checks, such as hash verification before baseline changes, for the platforms we deploy.
We test vendor remote access paths and document how access is determined, enabled and disabled for the in-scope systems.

How we hand over

We deliver documented procedures, configuration records and workflow evidence that show the plan is used in practice.
Revision history and approval records for the plan are set up so the CIP Senior Manager can show each 15-month review.
The entity receives a handover covering the evidence location, retention approach and open items for its own compliance team.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Retainers can cover periodic evidence refresh ahead of the 15-month review and changes to vendor or platform configuration.
Before engaging, ask us to confirm in writing which CIP-013 evidence each deliverable produces and how it is stored.