NERC CIP changes and effective dates through 2029

The virtualization revisions approved in Order No. 919 update the perimeter-based language in the CIP standards and add terms for virtualization infrastructure and virtual machines. They also broaden change management beyond baseline-only configuration. NERC lists the revised standards, including CIP-002-7 through CIP-013-3, as effective 1 July 2028, and the order does not require any entity to adopt virtualization. An entity that keeps physical, non-virtualized systems still has to read the revised text, because the new language applies to how its existing systems are described and monitored.

• Optional adoption: Adopting virtualization is optional. An entity that does not virtualize its BES Cyber Systems is not required to deploy a hypervisor or cloud-hosted control environment to meet these standards.
• Perimeter language: Review how your Electronic Security Perimeter and Physical Security Perimeter wording reads against the revised definitions, even if your architecture has not changed.
• Change management: Expect configuration change tracking to cover more than baseline-only changes once the revised CIP-010 language applies.
• Early adoption: Entities may adopt early after notifying their Regional Entity, at 6, 12 or 18 months after the order's effective date.

Confirm with your Regional Entity and your CIP Senior Manager which version of each standard applies to your systems on the date you plan to take action.

CIP-002-8 revises the Control Center definition and takes effect 1 July 2028. The change determines which facilities count as Control Centers for impact rating, so it decides whether some assets move into a different impact category. Entities that operate control functions at facilities they have not previously classified as Control Centers should treat this as a scoping task, not a paperwork update. The definition change flows into later requirements, including the CIP-015 timing for Control Centers and backup Control Centers.

• Scope review: Re-run your CIP-002 categorization against the revised definition before 1 July 2028.
• Backup facilities: Check backup Control Centers, since the CIP-015 dates differ for them.
• Impact changes: A facility reclassified under the revised definition can bring new BES Cyber Systems into high or medium impact requirements.
• Documentation: Update the categorization list, the CIP Senior Manager approval record and related evidence together.
• Dependencies: Map which asset owners, operators and vendors are affected by any reclassification.

Confirm with your Regional Entity how it expects the revised definition to be applied to your facility types before the effective date.

CIP-015-1 adds internal network security monitoring (INSM) inside the Electronic Security Perimeters of high and medium impact BES Cyber Systems. It takes effect 1 October 2028 for high and medium impact systems at Control Centers and backup Control Centers. Other medium impact systems with External Routable Connectivity are due within 24 calendar months after that date. This sequencing means Control Center operators face the first monitoring obligation, while other medium impact entities have a later deadline. Monitoring must be designed to detect anomalous activity between internal assets, not only at the perimeter.

• Control Centers first: High and medium impact systems at Control Centers and backup Control Centers carry the earliest deadline.
• Later medium impact scope: Other medium impact systems with External Routable Connectivity follow 24 calendar months later.
• Extension to EACMS and PACS: CIP-015-2, approved 10 August 2026, extends INSM to associated EACMS and PACS from 1 October 2029 and retires CIP-015-1.
• Low impact: CIP-015 does not apply to low impact BES Cyber Systems.
• Architecture: Confirm which network segments and sensors you can instrument inside the perimeter.

Confirm with your Regional Entity whether your Control Center and backup facilities fall within the first group, and check the CIP-015-2 implementation plan against your own schedule.

CIP-014-4 refines the physical security risk assessment under CIP-014 and takes effect 1 October 2028 under a 24-month implementation plan. It retires CIP-014-3. The revision applies to entities that own or operate Transmission stations and substations covered by the physical security standard. Its practical effect is on how the risk assessment is documented, reviewed and checked by a third party, so entities should expect to revisit their existing evaluations rather than start from zero.

• Timing: The revised standard takes effect 1 October 2028, and the prior version has an inactive date of 30 September 2028.
• Risk assessment: Review how threat and vulnerability evaluations are documented against the refined requirements.
• Third-party review: Confirm how your independent verification and review arrangements will meet the revised text.
• Physical security plan: Check that the physical security plan reflects the updated assessment results.
• Scope: CIP-014 applies to Transmission stations and substations, not to BES Cyber System impact categories.

Confirm the specific changes in the CIP-014-4 implementation plan with your Regional Entity before planning the revised assessment cycle.

CIP-003-11, approved in Order No. 918, adds remote user authentication, protection of authentication information in transit and malicious communication detection for low impact assets. It takes effect 1 July 2029. Low impact entities do not have to meet the high and medium impact requirements, but they must cover these new elements in their cyber security plan. The changes are narrower than the full CIP program, yet they reach the remote access paths that low impact entities use for maintenance and vendor support.

• Remote user authentication: Show how remote users authenticate to low impact BES Cyber Systems.
• Authentication in transit: Protect authentication information while it moves across networks.
• Malicious communication detection: Document how communications to and from low impact assets are monitored for malicious activity.
• Existing 2026 requirement: CIP-003-9, which covers vendor electronic remote access controls, became enforceable 1 April 2026 and sits alongside these changes.
• Plan updates: Revise the cyber security plan and its evidence before 1 July 2029.

Confirm with your Regional Entity whether your assets remain low impact after the CIP-002 review, because that determines whether these changes apply to you.

The registered entity owns its CIP obligations for the whole timeline, from the first-day compliance dates to the retirement of superseded versions. Its CIP Senior Manager approves the policies, the categorization of BES Cyber Systems and the decision to adopt a revised standard early. Adoption timing for the 2028 virtualization set is one example: entities may adopt early after notifying their Regional Entity, at 6, 12 or 18 months after the order's effective date, and that choice belongs to the entity alone.

• Timeline decisions: The entity decides whether to adopt the July 2028 virtualization standards early and whether to plan for the October 2028 INSM and CIP-014 changes on their listed dates.
• Categorization and scope: The entity confirms which assets are high, medium or low impact under CIP-002 and which changes therefore reach its systems.
• Policy and delegation: The CIP Senior Manager signs off on policy, delegations and the cyber security plans that revised standards require.
• Evidence ownership: The entity keeps the evidence that shows compliance and presents it to the auditor.
• Vendor oversight: The entity stays accountable for any partner's work and for the CIP-013 supply chain plan.

Confirm with your CIP Senior Manager which inactive dates and effective dates apply to each standard in your environment before scheduling any project work.

An implementation partner such as DeployOpen prepares systems, configurations, INSM design and evidence so the registered entity can show compliance. Work is normally fixed in scope, with deliverables and timelines agreed in writing before work starts. The partner does not decide what the entity is required to do, does not sign compliance statements for the entity and does not issue reports or certificates. DeployOpen does not guarantee an audit result.

• Scoped preparation: Typical work includes readiness assessments against the 2026 to 2029 changes, configuration baselines, INSM architecture and evidence packages, written in a statement of work.
• Self-hosted platforms: Work can run inside the entity's own infrastructure, so BES Cyber System Information stays under the entity's control.
• Documentation handover: Deliverables should include the procedures and evidence index the entity's own staff can maintain after the project.
• Ongoing support: Retainers can cover upgrades and recurring tasks, scoped separately from the initial project.
• Access rules: Partner staff who reach BES Cyber Systems or BCSI must meet the entity's personnel risk and training requirements.

Ask any partner for a written scope that names the standards and dates it covers, and confirm that the entity retains accountability for every control.

The Compliance Enforcement Authority, which is a Regional Entity or NERC, monitors compliance with the CIP standards. It uses tools such as Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging and periodic data submittals. Under the NERC Rules of Procedure, Balancing Authorities, Reliability Coordinators and Transmission Operators receive a Compliance Audit at least once every three years, while other registered entities are audited on a risk-based schedule set by the Regional Entity.

• Monitoring and findings: Auditors assess evidence against each applicable requirement and issue findings through the audit process.
• Enforcement: Penalties and sanctions follow the NERC Sanction Guidelines, and the statutory maximum is $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 and shown in the eCFR.
• No certificate: There is no CIP certificate, so no consultant, partner or certification body can issue one.
• Version-specific review: Auditors test the version of each standard in force on the date of the audit period.
• Early adoption notice: Entities that adopt early must notify their Regional Entity, which is a point the auditor will check.

Confirm your Regional Entity, your audit schedule and which standard versions apply to you before planning evidence collection.