What NERC CIP BES Cyber System categorization decides for your organization
If a customer, contract or Regional Entity now expects you to be NERC CIP compliant, the first question is which of your systems fall under the standards at all. CIP-002-5.1a categorization sorts BES Cyber Systems into high, medium and low impact, and that result decides which other CIP requirements apply to each system. There is no CIP certificate to obtain. Compliance is ongoing and is monitored by your Regional Entity (or NERC), so the categorization you present on audit day has to be current, approved and defensible. The standard requires you to review the identifications and have the CIP Senior Manager or a delegate approve them at least once every 15 calendar months, even when nothing has been identified, and to keep evidence for three calendar years.
The effort and cost of the program follow from two inputs: how many BES Cyber Systems you identify and what impact rating each receives. A high or medium impact system pulls in the largest set of requirements, including the electronic and physical perimeter controls, personnel and training obligations, and recovery and change management tasks. A low impact system carries a lighter set, centered on the CIP-003 cyber security plan. Your costs therefore split into one-time work (asset identification, documenting the rationale behind each rating, and building the first approved list) and recurring work (the 15-month review, reclassification when assets change, and the evidence that proves the list was reviewed). Ask any consultant or implementation partner to price these as separate line items, tied to a written list of the assets and systems in scope.
Your organization owns the list and the approval. Your CIP Senior Manager signs the categorization, and no outside party, including a consultant or your Regional Entity auditor, can take that role. An implementation partner can help gather configuration data, map systems to the Attachment 1 criteria and prepare the evidence package, but the rating decisions remain yours. Before you request a quote, confirm your current asset inventory, the Control Center and generation or transmission facts your ratings depend on, and whose sign-off the Regional Entity expects. Then ask for a fixed scope that names the assets, the systems, the deliverables and the review date, so the price reflects the work your categorization actually creates.
What each impact tier brings into the CIP program
High impact BES Cyber Systems sit mainly at the largest control points in the bulk electric system. Under CIP-002-5.1a Attachment 1 Section 1, the category covers BES Cyber Systems at Reliability Coordinator Control Centers, Balancing Authority Control Centers that meet the 3000 MW threshold for generation in one Interconnection or certain critical asset criteria, and Transmission Operator and Generator Operator Control Centers that control assets meeting specified medium impact criteria. Because the category is the most demanding, a high impact system brings the widest set of requirements into play.
- Control Center focus: The category is built around Control Centers, so the first question is whether a Control Center is a Reliability Coordinator, a qualifying Balancing Authority, or a qualifying Transmission or Generator Operator Control Center.
- The 3000 MW Balancing Authority threshold: A Balancing Authority Control Center reaches high impact at 3000 MW or more of generation in one Interconnection, so the generation total the entity controls matters as much as the building that houses the system.
- Full requirement set: High impact systems bring the broadest set of CIP requirements, including the most intensive monitoring obligations in CIP-015 once that standard is enforced.
- Control Center definition change: CIP-002-8 revises the NERC Glossary definition of Control Center, effective 1 July 2028, which feeds these criteria.
Confirm your Control Center list against the Attachment 1 criteria with your CIP Senior Manager before the rating is approved.
Medium impact is the largest tier in most programs. Attachment 1 Section 2 lists 13 criteria, and each one reaches a different class of asset. Illustrative examples include a generating plant rated at 1500 MW or more, reactive resources of 1000 MVAR or more, Transmission Facilities at 500 kV or higher, and automatic load shedding of 300 MW or more. An entity with several of these assets often finds that its medium impact population is larger than its high impact population.
- Generation and reactive resources: A single plant at 1500 MW or more, or reactive resources at 1000 MVAR or more, can bring systems into medium impact scope.
- Transmission and substations: Transmission Facilities at 500 kV or higher qualify, and 200 to 499 kV substations qualify under a connectivity and weighted value test.
- Protection and load shedding: Special Protection Systems and Remedial Action Schemes whose failure would cause IROL violations, and automatic load shedding of 300 MW or more, fall into this tier.
- Narrowing by External Routable Connectivity: Many requirements, such as the Interactive Remote Access controls in CIP-005-7 R2 and the training in CIP-004-7, apply to medium impact systems only where External Routable Connectivity exists. Mapping that connectivity is often the largest task in this tier.
Ask for each medium impact system's connectivity status in writing, because it decides which requirement tables apply.
Low impact covers BES Cyber Systems at listed asset types that are not rated high or medium. The program for this tier is built mainly on CIP-003-9 R2 and its Attachment 1, rather than on the full CIP-004 through CIP-011 set. Entities must identify the assets that contain low impact BES Cyber Systems, but CIP-002-5.1a R1 Part 1.3 does not require a discrete list of every low impact BES Cyber System. That difference shapes how the work is organized.
- Asset-level identification: The obligation is to identify the assets that contain low impact systems, which is a lighter task than inventorying each system.
- Cyber security plan: CIP-003-9 R2 and Attachment 1 require security awareness every 15 calendar months, physical and electronic access controls, an incident response plan tested every 36 months, and controls for Transient Cyber Assets and Removable Media.
- Vendor electronic remote access: Since 1 April 2026, CIP-003-9 includes vendor electronic remote access controls for low impact systems.
- Later expansion: CIP-003-11, effective 1 July 2029, adds remote user authentication, protection of authentication information in transit and malicious communication detection for low impact assets with external routable connectivity.
Confirm with your CIP Senior Manager which assets contain low impact systems and whether any of them have external routable connectivity today.
How NERC CIP BES Cyber System categorization runs from inventory to approval
The categorization sequence moves from a complete inventory of candidate assets to a rated, rationalized and approved list of BES Cyber Systems, and that approved list then sets which other CIP requirements apply to the entity.
Build the asset and system inventory
Start by listing every facility and asset type that R1 of CIP-002-5.1a asks the entity to consider: Control Centers and backup Control Centers, Transmission stations and substations, generation resources, restoration assets such as Blackstart Resources and Cranking Paths, Special Protection Systems, and certain Distribution Provider Protection Systems. Operations, planning and engineering staff usually contribute the facility data, and the CIP Senior Manager or delegate confirms the scope. The output is a consolidated inventory of candidate assets, with a note for each asset on the data source used to populate it.
Identify the BES Cyber Systems at each asset
For each candidate asset, determine which BES Cyber Systems perform the reliability functions that could affect the BES if they were compromised. Engineering and control system owners typically map these systems, and the result is a system list tied back to the asset inventory. Entities should confirm the interpretation of BES Cyber System boundaries with their Regional Entity where a grouping decision is unclear.
Apply the Attachment 1 impact criteria
Test each asset and its BES Cyber Systems against the high impact criteria in Section 1 of Attachment 1, then the medium impact criteria in Section 2, which contains 13 criteria, and then the low impact criteria in Section 3. Each test uses thresholds such as generation at one plant, Transmission Facility voltage, or automatic load shedding, so the reviewer needs current operating data. The output is a rating worksheet that records the rating assigned to each system and the criterion relied on.
Record the rationale for each rating
Write down, for every high and medium rating and for every asset rated low, the specific Attachment 1 criterion, the data used, and the person who performed the analysis. Where the entity concludes a system is not high or medium, it should record why each relevant criterion was not met. This rationale is the piece an auditor is most likely to ask to see, so it should be readable without the engineer who wrote it. The output is a signed rating record kept with the categorization evidence.
Identify assets that contain low impact systems
Assets rated low impact do not require a discrete list of their low impact BES Cyber Systems under CIP-002-5.1a R1 Part 1.3, but the entity must identify the assets that contain them. This list drives the CIP-003 low impact controls, including the security awareness, physical access, electronic access and incident response obligations. The output is a list of low impact assets, which the entity maintains as its scope for low impact controls.
Obtain CIP Senior Manager or delegate approval
Once the high, medium and low identifications are complete, the CIP Senior Manager or a properly delegated person reviews the results and approves them. The approval must be documented and dated, and it must cover the identifications even when the entity has no high or medium systems. The output is a signed approval record that the Regional Entity will request first during an audit.
Review and re-approve on a fifteen-month cycle
CIP-002-5.1a R2 requires the entity to review its identifications and have the CIP Senior Manager or delegate approve them at least once every 15 calendar months, even if nothing has been identified. Each review should check whether plant changes, new Control Center functions, or changes to the BES have altered any rating. The output is a dated review record, which either confirms the existing approval or triggers a new categorization cycle when something changed.
Retain evidence and track the high violation risk
Keep the inventory, rating worksheets, rationale, low impact asset list and approvals for three calendar years, as CIP-002-5.1a requires for evidence of each requirement. R1 carries a High Violation Risk Factor, so an error in the identification process has consequences that extend beyond the categorization itself. Confirm retention and access rules with the CIP Senior Manager before the evidence is moved to any new storage location, including cloud storage.
How External Routable Connectivity narrows the requirements that apply
Categorization sets the impact tier of each BES Cyber System, but External Routable Connectivity decides how much of the medium impact program applies to it. A medium impact BES Cyber System without External Routable Connectivity sits outside several of the controls an entity might expect from its tier. Two examples from the standards show the effect. CIP-005-7 R2, which requires Interactive Remote Access through an Intermediate System with multi-factor authentication, applies to medium impact BES Cyber Systems only when they have External Routable Connectivity. CIP-004-7 training follows the same narrowing for those systems. High impact systems are not narrowed this way, so the connectivity question matters most at the medium tier.
CIP-015-1 internal network security monitoring shows the other direction of the rule. It applies to high impact BES Cyber Systems in every case, and to medium impact BES Cyber Systems only where they have External Routable Connectivity. An entity with a medium impact system that is isolated from routable networks may find that the monitoring obligation falls away, while a neighboring system with a routable path to the same network takes it on. Because CIP-015 is subject to future enforcement, the reader should confirm the current effective dates on the NERC CIP standards page before planning around it.
Practically, document connectivity for each BES Cyber System as part of the categorization record, not as a later engineering exercise. For every system, record whether it has a routable path into or out of its network, the devices that provide that path, and the date of the last review. Keep the record with the CIP-002 identifications and review it at the same 15-month approval cycle, since a new firewall rule, remote access tool or network segment can change the answer. Ask the CIP Senior Manager or delegate to sign off on the connectivity determinations so that the scope of CIP-004, CIP-005 and CIP-015 can be traced back to a documented decision.
What makes NERC CIP BES Cyber System categorization larger or smaller
Categorization scope is set by how many facilities and systems an entity operates, how those systems connect to the outside, and how much usable asset data already exists. The cards below cover the drivers that move effort up or down and one practical control for each.
Control Center count and role
Each Control Center and backup Control Center must be evaluated against the high and medium impact criteria in Attachment 1 of CIP-002-5.1a. A single control room that qualifies as high impact brings a large set of other requirements with it, while a backup site that is only lightly connected may sit lower. Check which facilities actually perform Control Center functions, and record that reasoning, before counting systems. Confirm with your Regional Entity how it reads these criteria, and note that the Control Center definition changes in CIP-002-8, effective 1 July 2028.
Generation and Transmission asset mix
The number and type of generation resources and Transmission Facilities determine how many asset-level criteria apply. Plants near a threshold, such as generation at the 1500 MW level or Transmission Facilities at 500 kV, can change impact rating when output or voltage data is updated. Substations at 200 to 499 kV, Special Protection Systems and automatic load shedding also add criteria. Keep a single register that records nameplate and operating values with their source and date, so a rating change can be traced and reproduced.
BES Cyber Systems per asset
Each asset can contain several BES Cyber Systems, and each system must be identified, grouped and rated. An asset with dozens of relays, controllers and workstations may produce a longer list than one with a few programmable devices, even when both sit at the same impact level. Group Cyber Assets by function and shared network boundary where the standard allows it, and document the grouping rationale. This keeps the identification list short enough to review on the 15-month cycle.
External Routable Connectivity
Whether a system has External Routable Connectivity decides whether several medium impact requirements apply, including CIP-005-7 R2 interactive remote access and CIP-004-7 training scope. A system with no routable path outside its perimeter carries a lighter obligation set than one reachable from a corporate network or a vendor link. Map each network path for every medium impact system, including vendor and remote access routes, and retain the diagrams with the date reviewed. Changes to connectivity are a common source of missed scope.
Reusable asset and configuration records
Current asset inventories, network diagrams and configuration baselines reduce the time needed to identify systems and confirm their ratings. Teams that keep these records in sync with the field, and that can export them in a consistent format, spend less time reconstructing facts for the review. Where records are scattered across spreadsheets, engineering drawings and vendor tools, expect a discovery phase before categorization can start. Ask for a written inventory of sources, owners and last update dates before estimating effort.
Review and approval participants
CIP-002-5.1a R2 requires the identifications to be reviewed and approved by the CIP Senior Manager or a delegate at least once every 15 calendar months, even when nothing is identified. The number of engineers, operators, compliance staff and managers who must confirm each rating adds coordination time, and disagreements about borderline assets extend the cycle. Define a single review workflow with named reviewers, a documented decision log and a delegation record that is current. Assign one owner to resolve borderline ratings before the approval meeting.
Which approach fits your categorization work
This table compares three ways to run CIP-002 categorization, showing who performs each task, who signs the approval, what a partner delivers and when each approach fits. Read it by matching your asset count, record quality and number of sites to the fit row. In every approach, the registered entity keeps accountability for its identifications and their approval.
| Approach | Who performs the work | Who approves and what the partner delivers | When it fits |
|---|---|---|---|
| In-house categorization | Registered entity staff build the asset inventory, apply the Attachment 1 criteria and write the rating worksheets | The CIP Senior Manager or delegate approves the identifications. No outside deliverables are produced | Small asset sets with current, well-maintained records and staff who already know the Attachment 1 criteria |
| Partner-prepared inventory and evidence | Staff own the decisions. The implementation partner gathers asset data, drafts rating worksheets and assembles the evidence folder | The CIP Senior Manager reviews the draft worksheets and signs the approval. The partner delivers the inventory, worksheets and evidence folder in writing | Mid-sized fleets where records exist but are spread across systems, and staff lack time to reconcile them |
| Partner-led workshop with senior manager review | The partner facilitates workshops with operations, engineering and the CIP Senior Manager to walk through each asset type | The CIP Senior Manager reviews the workshop output and approves the identifications. The partner delivers workshop notes, a draft categorization and the evidence folder | Large, multi-site fleets with scattered or inconsistent records, or where operations and engineering disagree on asset boundaries |
| Asset inventory source | Entity provides the authoritative list of Control Centers, stations, generation and other listed asset types | Partner reconciles the list against entity records and flags gaps for the entity to resolve | Use this row to decide how much reconciliation work the partner should carry in each approach |
| Rating worksheet ownership | Entity staff confirm each rating against the bright-line criteria, including the connectivity questions that narrow later requirements | The CIP Senior Manager signs off on each rating. Partner support does not transfer rating authority | Applies to all three approaches. Ask who signs off on each worksheet line before work starts |
| Review cycle | Entity schedules the review of identifications at least once every 15 calendar months under CIP-002-5.1a R2 | CIP Senior Manager approves each review, including reviews with no changes | Applies to all three approaches. Confirm who runs the recurring review after the first categorization |
| Evidence retention | Entity keeps evidence for three calendar years and owns the storage location | Partner may format or index the evidence folder but the entity holds the originals | Useful for any approach where outside staff handle inventory data. Confirm access and retention terms in writing |
| Fixed-scope agreement | Entity and partner agree scope, deliverables and timelines in writing before work starts | Partner delivers only the items named in the written scope. Quotes follow from that scope | Use the written scope to compare approaches on equal terms. DeployOpen does not publish a price list |
How the 2028 Control Center definition change affects NERC CIP BES Cyber System categorization
The revised Control Center definition takes effect on 1 July 2028, and any categorization you completed under CIP-002-5.1a must be rechecked against it before then. CIP-002-8 was approved by FERC on 19 March 2026 and revises the NERC Glossary definition of Control Center. That definition is not a standalone term. It feeds the high and medium impact criteria in Attachment 1, which ask whether a control center performs functions that bring a BES Cyber System into one of those categories. If the wording changes which facilities count as a Control Center, a system that was rated low or medium under today's text could move to a different rating, and the BES Cyber Systems, EACMS, PACS and PCAs that depend on that rating would move with it. The practical first step is to list every facility your current categorization treats as a control center, a backup control center, or a non-control-center location, and to read the revised definition against each one.
The 2028 timing also matters because the virtualization set takes effect on the same date. FERC Order No. 919 approved 11 revised CIP standards that accommodate virtualization, including CIP-002-7, and NERC lists them as effective 1 July 2028. CIP-002-7 and CIP-002-8 both touch the same categorization text, so your compliance team should not plan the two changes separately. Virtualized environments such as hypervisor hosts, shared management planes and cloud-hosted control functions are the places where a facility boundary is most likely to be disputed, so inventory them now. Ask your Regional Entity how it expects the two revisions to be applied to your facilities, and keep a written record of each decision and its date.
Confirm the final approved text, the effective dates and the list of standards affected on the NERC CIP standards page before you rely on any of this. Do not treat this page as the authoritative reading of CIP-002-8 or of the virtualization revisions. Your CIP Senior Manager should document the rechecking work as a dated review under your CIP-002 identification process, and should involve the Regional Entity if a facility is borderline. Any consultant or implementation partner can help gather the inventory and prepare the analysis, but the registered entity owns the categorization decision and its approval.
What to have ready before an audit asks for categorization evidence
A Regional Entity auditor starts categorization testing with the record, not the narrative. The cards below cover the artifacts that most often decide whether a CIP-002 review holds up, and how to check each one before notification arrives. The auditor tests the evidence and issues the findings; the organization and its preparers only assemble and verify it.
Current dated approval
CIP-002-5.1a R2 requires the identifications to be reviewed and approved by the CIP Senior Manager or a delegate at least once every 15 calendar months. Confirm that a signed or otherwise recorded approval exists, that it is dated, and that it falls inside the 15-month window. Check that the delegate, if used, is documented in the delegation record. Ask the approver to confirm the approved list matches the current inventory.
Rating rationale per system
Each BES Cyber System needs a written reason for its high, medium or low rating, tied to a specific Attachment 1 criterion. Sample one system, trace its rating to the criterion cited, and confirm the underlying facts (generation megawatts, voltage level, control center role) are documented and current. A rating with no criterion behind it is a common finding.
Connectivity record for medium impact
Several medium impact requirements apply only to systems with External Routable Connectivity, so the record must show, for each medium impact system, whether it has that connectivity. Pick one system with connectivity and one without, then check network diagrams and access paths against the record. Stale diagrams after a network change are a frequent gap.
Low impact asset list
For low impact BES Cyber Systems, an entity must identify the assets that contain them, although a discrete list of each low impact system is not required. Confirm the asset list is complete against the Attachment 1 low impact asset types and that each listed asset can be matched to a CIP-003 low impact control set. Ask who updates the list when a site is added or retired.
Documented reviews with no changes
The 15-month review must leave a record even when nothing changed in the identifications. Auditors look for a dated review entry showing what was examined and who examined it, not only the final approval. Confirm that a no-change review is written down, with the inventory and sources reviewed, so the absence of changes is provable.
Evidence kept for three years
CIP-002-5.1a requires evidence for each requirement to be kept for three calendar years. Confirm that prior approvals, rating rationales and superseded lists are retained, not overwritten, and that they can be retrieved by date. Ask the team to show how an older categorization version would be produced in a test request, since retrieval speed matters during an audit.
Who owns NERC CIP BES Cyber System categorization and who prepares it
The registered entity owns the BES Cyber System categorization. Under CIP-002-5.1a, the entity's process must identify its high and medium impact BES Cyber Systems and the assets that contain low impact systems, and the CIP Senior Manager or a named delegate must approve those identifications. That approval is an accountability decision the entity cannot hand to anyone else. Internal engineering and operations staff supply the system knowledge that makes the identifications accurate, because they know how assets are connected, what they control and how they would be restored.
- Process ownership: The entity writes and maintains the identification process, including how it considers Control Centers, Transmission stations and substations, generation resources and restoration systems.
- Approval authority: The CIP Senior Manager or delegate signs the identifications and repeats the review and approval at least once every 15 calendar months, even when nothing is identified.
- System knowledge: Operations, engineering and asset owners confirm which Cyber Assets belong to each BES Cyber System and how each one is connected.
- Ratings decisions: The entity applies the Attachment 1 bright-line criteria and decides each rating, and it must be able to explain why a given rating applies.
- Records: The entity keeps evidence for three calendar years and produces it when the Regional Entity asks.
Before engaging any outside party, confirm which individuals hold the CIP Senior Manager role and delegations and who can sign the approval record.
An implementation partner can prepare the working material behind categorization. Typical work includes building an asset and Cyber Asset inventory, drafting rating worksheets against the Attachment 1 criteria, documenting External Routable Connectivity, assembling the evidence folder and running the review calendar. The partner prepares these records so the entity can review and sign them. The partner does not approve the list of BES Cyber Systems and does not decide ratings on the entity's behalf, because those decisions belong to the registered entity and its CIP Senior Manager.
- Inventory preparation: The partner can compile candidate asset lists from configuration data, network diagrams and asset registers, then flag gaps for the entity to resolve.
- Rating worksheets: The partner can draft worksheets that map each asset to the relevant Attachment 1 criteria and cite the data used, leaving the final rating to the entity.
- Connectivity records: The partner can document routable paths in and out of each system, which supports the External Routable Connectivity analysis that narrows many requirements.
- Evidence folder and calendar: The partner can organize approvals, dated versions and the 15-month review schedule so records are retrievable.
- Limits on role: The partner cannot sign approvals, cannot act as the CIP Senior Manager and cannot accept the accountability that comes with the identifications.
Ask any partner to state in writing which tasks it performs, which the entity performs and who holds signing authority.
The Regional Entity or NERC, acting as the Compliance Enforcement Authority, tests categorization during a Compliance Audit, a Spot Check or another monitoring activity. The auditor works from the evidence the entity provides: the identification process, the list of identified systems, the rating rationale, the approval record and the review history. The auditor issues findings, and where a violation exists, enforcement follows through the NERC process. No certification body or consultant issues a CIP certificate, and no auditor role is held by an implementation partner.
- Evidence testing: The auditor checks whether the records support the stated identifications and ratings, and whether the approval came from the CIP Senior Manager or a documented delegate.
- Sampling and tracing: The auditor may trace individual assets through the rating criteria and compare the list against network and configuration data the entity supplies.
- Findings, not certificates: Outcomes are findings, possible violations and mitigation expectations, which the entity must answer through the monitoring process.
- Independence: Auditors do not design the entity's program. An entity that asks an outside party to prepare its records should expect the auditor to test the entity's own control, not the consultant's work product.
- Audit period readiness: Records should be complete for the period the Regional Entity reviews, so ask the Regional Entity which audit period and evidence list applies.
Before an audit notification arrives, confirm with the Regional Entity which evidence it will request for categorization.
Questions buyers ask about NERC CIP BES Cyber System categorization
Is there a NERC CIP certificate for BES Cyber System categorization?
No. There is no NERC CIP certificate for categorization or for any other CIP requirement. Compliance is monitored by the Compliance Enforcement Authority, which is a Regional Entity or NERC, through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports and other tools. Your categorization is evidence you produce and keep ready for that monitoring. An outside firm may help you build it, but no firm can issue a certificate that your list is correct.
Who has to sign off on the categorization list?
The CIP Senior Manager or a delegate must approve the identifications. CIP-002-5.1a R2 requires that the list be reviewed and approved at least once every 15 calendar months, even when nothing has been identified. Approval is an accountable act by a named person, so the record should show who approved, when, and against which version of the list. Consultants and implementation partners can prepare the material for that approval but cannot give it.
What drives the effort of categorizing our systems?
The main drivers are the number of facilities and Cyber Assets to review, the mix of asset types the standard covers, how many assets sit near a bright-line threshold, and how well your existing records describe connectivity. Effort rises when asset data is spread across engineering, operations and procurement systems, and falls when a single current inventory exists. Ask any provider to show how they will handle each driver in a written scope before work begins.
Can we categorize our BES Cyber Systems ourselves?
Yes, if staff understand the Attachment 1 criteria and can document each decision. Most of the work is data gathering and disciplined recordkeeping: confirming ratings against the criteria, noting why each asset was included or excluded, and keeping the evidence for the required retention period. Teams without experience in the bright lines often benefit from an independent review before the first approval, which is a judgment for your CIP Senior Manager to make.
What does an implementation partner do for categorization, and what does it not do?
A partner can help gather and organize asset data, map systems against the criteria, draft the identification records, and assemble the evidence package. DeployOpen prepares systems, controls and evidence for compliance assessments; it does not approve categorizations, sign attestations or issue audit reports. Those decisions stay with your CIP Senior Manager or delegate, and any findings come from the Regional Entity auditors.
What happens if we categorize only low impact systems?
You still identify the assets that contain low impact BES Cyber Systems, as CIP-002-5.1a R1 requires. You do not need a discrete list of each low impact system, but the assets must be identified and approved on the same 15-month cycle. Once those assets are identified, CIP-003-9 becomes the main control set, including its security awareness, incident response testing and, since 1 April 2026, vendor electronic remote access controls.
How does the 2028 Control Center change affect our categorization?
CIP-002-8 revises the NERC Glossary definition of Control Center, and it is effective 1 July 2028. That definition feeds the high and medium impact Control Center criteria, so a facility that is categorized today could be categorized differently afterward. Before that date, recheck your Control Center inventory against the revised definition and document the result. Confirm the exact effect for your facilities with your CIP Senior Manager and the Regional Entity.
How long does a categorization project take?
No duration can be stated here because it depends on your asset count, data quality and review cycle. Ask any provider, including DeployOpen, for a written scope that lists the assets in scope, the deliverables, the evidence package and the timeline agreed before work starts. Most of DeployOpen's engagements are fixed-scope, so the scope and timeline are settled in writing up front.
How DeployOpen prepares categorization evidence for your review
DeployOpen helps registered entities prepare the systems, records and evidence behind their CIP-002 categorization, so the CIP Senior Manager can review and approve it. DeployOpen does not decide impact ratings or issue any compliance report; the registered entity owns its categorization, and the Regional Entity audits it.
How we scope
- Engagements are fixed-scope, with the asset list, Attachment 1 criteria and deliverables agreed in writing before work starts.
- We confirm which Control Centers, generation, transmission and restoration assets sit inside the categorization process.
- Scope records which BES Cyber Systems need impact ratings and which assets need a low impact identification.
How we build
- We document a repeatable categorization worksheet that maps each asset to the Attachment 1 criteria it meets.
- We prepare the inventory and connectivity records needed to show External Routable Connectivity for each system.
- We set up a 15-month review calendar so the identifications are re-approved on schedule, even when nothing changes.
How we hand over
- You receive the categorization workpapers, rationale notes, approval records and evidence index in editable form.
- Each identification links to the source data, so your team can trace every rating during its own review.
- A handover session walks the CIP Senior Manager and delegates through the records before they approve them.
How we support
- Ongoing support and periodic re-review of categorization changes are available as a retainer.
- When assets, Control Center functions or connectivity change, we update the worksheet and evidence on request.
- Confirm with your Regional Entity which evidence format it expects before your first audit notification.
