Who must comply with NERC CIP

Who must comply with NERC CIP, and how a registered entity knows it is in scope

NERC CIP applies to every organization registered with NERC as a owner or operator of bulk electric system assets, because the standards become mandatory once FERC approves them. The NERC Compliance Registry identified about 1,673 unique US entities subject to mandatory CIP compliance as of June 2025, according to FERC's Order No. 919, and NERC's 2024 TFE annual report counted 1,725 US registered entities subject to the CIP standards, of which 270 reported having high or medium impact BES Cyber Systems. Scope is set by two decisions working together: the functions an entity is registered for, and the impact rating each of its BES Cyber Systems receives under CIP-002. Your first task is to confirm your registration record with the Regional Entity and then run a documented categorization. Pull your registration from the NERC Compliance Registry and check that every registered function and facility matches what you actually operate.

There is no CIP certificate to apply for. Most registered entities do not receive a scope decision from anyone outside the company. They make it themselves, record it, and approve it under CIP-002 at least every 15 calendar months, even when the result is that nothing is identified. The NERC CIP standards page shows which versions are currently enforceable, so the categorization should cite the version in force on the date you approve it. Confirm with your Regional Entity how it expects scope to be documented before an audit notice arrives, because the auditor will test your categorization first and most other requirements depend on it.

The registered entity owns every obligation, whatever outside help it uses. The CIP Senior Manager or a properly delegated person signs the categorization, the policies and the compliance decisions, and the Regional Entity holds the entity accountable for any gap. DeployOpen can prepare systems, configuration baselines, network diagrams and evidence packages for a categorization and the controls that follow from it, but it does not issue audit reports, attestations or certifications. Ask any implementation partner to state in writing which tasks it performs, which the entity keeps, and who signs each record, and treat any proposal that implies a partner can certify your CIP status as a warning sign.

Registration, applicable functions and the 13 mandatory standards

NERC registration decides which CIP standards reach an entity. The functions an entity performs on the bulk electric system set its obligations, and CIP-002 then sorts its assets into impact tiers. The cards below group the 13 standards NERC lists as mandatory in the United States as of 17 October 2026 by the work they require.

Registration by function

NERC registers each entity by the functions it performs, such as Balancing Authority, Transmission Operator, Generator Owner, Generator Operator or Reliability Coordinator. Functions set which CIP requirements apply. Check the entity's registration record in the NERC Compliance Registry, then confirm with the Regional Entity which listed functions carry CIP obligations. Registrations change after acquisitions, new generation or new transmission assets, so re-check them on a fixed schedule.

CIP-002 sets the scope

CIP-002-5.1a is the scoping standard. It requires an entity to identify its BES Cyber Systems and rate each one high, medium or low impact using the bright-line criteria in Attachment 1. Every other CIP standard points back to those ratings, so an error here changes the size of the whole program. The identifications must be reviewed and approved by the CIP Senior Manager or a delegate on a fixed cycle, even when nothing is identified.

Governance and personnel: CIP-003 and CIP-004

CIP-003-9 sets security management controls, including the CIP Senior Manager, cyber security policies and the cyber security plan that carries most obligations for low impact assets. CIP-004-7 covers personnel: security awareness, role-based training, personnel risk assessments, access authorization and revocation, and protection of BES Cyber System Information. Confirm which of these apply to your asset mix before building a program around them.

Perimeters and physical security

CIP-005-7 governs Electronic Security Perimeters, Electronic Access Points and remote access, while CIP-006-6 covers physical security plans and Physical Security Perimeters for BES Cyber Systems. CIP-014-3 adds physical security for critical Transmission stations and substations, including third-party verification of the station list and third-party review of security plans. Confirm which of these reach each site, since CIP-014 applies at the station level.

Operations, response and recovery

CIP-007-6 covers ports and services, security patch management, malicious code prevention, event logging and system access control. CIP-008-6 requires Cyber Security Incident response plans, CIP-009-6 requires recovery plans with verified backups, and CIP-010-4 requires baseline configurations, change control and vulnerability assessments. Together these four standards generate most of the recurring evidence an auditor asks for.

Information, communications and supply chain

CIP-011-3 protects BES Cyber System Information, including copies stored off premises, and governs how Cyber Assets are reused or disposed of. CIP-012-2 protects Real-time data sent between Control Centers against disclosure, modification and loss of availability. CIP-013-2 requires a supply chain cyber security risk management plan for procurement, which is where vendor obligations enter the program.

How the high, medium and low impact split decides the size of the obligation

The impact rating an entity gives its BES Cyber Systems under CIP-002-5.1a decides which CIP requirements apply to them, so it sets the size of the obligation before any control is built. The standard's Attachment 1 applies bright-line criteria to sort systems into high impact, medium impact and low impact. High impact covers mainly the Control Centers of Reliability Coordinators and qualifying Balancing Authority, Transmission Operator and Generator Operator Control Centers. Medium impact includes examples such as generation of 1500 MW or more at one plant, or Transmission Facilities at 500 kV or higher. Low impact covers other BES Cyber Systems at listed asset types. An entity should read Attachment 1 against its own asset list, line by line, and record which criterion puts each system in its category.

Most CIP requirements are scoped by Applicable Systems, not by the entity as a whole. Tables in standards such as CIP-007-6 name high impact BES Cyber Systems, medium impact BES Cyber Systems with External Routable Connectivity, and associated EACMS, PACS and PCA separately. An entity whose systems are all low impact may therefore face mainly the low impact plan under CIP-003-9 Requirement 2 and Attachment 1, rather than the full CIP-004 through CIP-011 set. Confirm this with the Regional Entity or your own counsel before scoping a lean program, because a single misclassified system can bring a much larger set of requirements into play.

For context, NERC's 2024 TFE annual report counted 1,725 US registered entities subject to the CIP standards, and 270 of them reported having high or medium impact BES Cyber Systems. Most registered entities in scope therefore hold low impact systems, which is why the low impact plan carries more of the workload across the population than the high and medium tables do. Ask for the impact rating of each system, the criterion applied, and the date of the last categorization review, since CIP-002-5.1a R2 requires that review and senior manager approval at least once every 15 calendar months.

What applies to a Control Center, a plant-only owner and a low impact-only asset owner

An entity that owns a Control Center, or a generation or transmission facility that meets a medium impact bright line, usually carries the broadest CIP scope. Most of the CIP-004 through CIP-011 requirements apply to the BES Cyber Systems rated high or medium, along with the Electronic Access Control or Monitoring Systems, Physical Access Control Systems and Protected Cyber Assets associated with them. The applicable systems differ by requirement, so the same asset can fall under some standards and not others.

Broad requirement set: Most CIP-005, CIP-006, CIP-007, CIP-010 and CIP-011 obligations are scoped to high and medium impact systems, and high impact systems add operational exercise duties under CIP-009.
Supply chain obligations: CIP-013 procurement planning applies to the high and medium impact systems and their associated access and monitoring systems.
Electronic security perimeters: Entities must define Electronic Security Perimeters and manage Electronic Access Points, including Interactive Remote Access controls.
Physical security: Physical Security Perimeters and their monitoring fall under CIP-006 for these systems.
Audit exposure: Balancing Authority, Reliability Coordinator and Transmission Operator registrations face a Compliance Audit at least once every three years, so evidence must be ready on a regular cycle.

Confirm with your CIP-002 categorization which bright lines your assets meet and which Applicable Systems columns apply to each requirement.

Why there is no NERC CIP certificate to obtain

No certification body issues a NERC CIP certificate, so a buyer should not pay anyone for one. Compliance is monitored by the Compliance Enforcement Authority, which is either a Regional Entity or NERC itself. It works through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging, periodic data submittals, investigations and complaints. The registered entity owns its compliance position at all times, and the evidence it keeps is what a monitoring team reviews. Any offer of a CIP certificate, seal or attestation from a commercial body should be treated as a sales claim, not as evidence of compliance, and the CIP Senior Manager should ask the offeror which Regional Entity or NERC process it is relying on.

The schedule for formal audits depends on the registration. Under Section 403.10.1 of the NERC Rules of Procedure, entities registered as a Balancing Authority, Reliability Coordinator or Transmission Operator receive a Compliance Audit at least once every three years. Other registered entities are audited on a risk-based schedule set by the Regional Entity. Confirm your entity's registrations in the NERC Compliance Registry and ask your Regional Entity how it sets your audit risk profile, since that schedule, not an external certificate, determines when an assessor arrives.

Because nothing is certified in advance, the work that matters is continuous: keeping evidence current for each applicable requirement, and being able to show it on request. An implementation partner can help build and test that evidence, but only the registered entity and the Compliance Enforcement Authority determine compliance. Reports and findings come from the Regional Entity or NERC, not from a consultant or a certification body. Budget for recurring internal monitoring and evidence upkeep rather than a one-time certification fee.

Questions registered entities ask about NERC CIP applicability

Does a registered entity with only low impact assets fall under NERC CIP?

Yes. Low impact BES Cyber Systems are inside the CIP Reliability Standards, so an entity whose listed assets contain only low impact systems is still a registered entity with obligations. The load is lighter because most of the detailed requirements apply to high and medium impact systems. The main obligations for low impact assets sit in CIP-003-9 R2 and its Attachment 1, which cover security awareness, physical and electronic access controls, an incident response plan, malicious code mitigation for Transient Cyber Assets and Removable Media, and, since 1 April 2026, vendor electronic remote access controls. Under CIP-002-5.1a R1 Part 1.3, the entity must identify the assets that contain low impact systems but does not have to keep a discrete list of each low impact system. Confirm your registration status with your Regional Entity, because registration, not the size of the asset, determines whether the standards apply to you.

Must a vendor or contractor comply with NERC CIP directly?

Usually not as a registered entity, but its work can still bring it into the program. The CIP Reliability Standards place obligations on registered entities, not on their suppliers. Vendors feel the standards through contracts and procurement, because CIP-013-2 requires the registered entity to maintain a supply chain cyber security risk management plan that covers how it buys high and medium impact systems and their EACMS and PACS. Vendors also feel the effects through access rules, such as personnel risk assessments and remote access controls that the entity must enforce on outside staff. Whether a specific vendor is a registered entity depends on its own function in the bulk electric system, which the NERC Compliance Registry determines. Ask the customer which obligations it expects you to meet by contract.

Can an entity decide on its own that NERC CIP does not apply to it?

Not reliably. An entity can and should analyze its own facilities against the registry criteria and the CIP-002-5.1a bright-line rules, but the conclusion must be checked with the Regional Entity and documented. NERC and the Regional Entities monitor compliance under Section 400 of the NERC Rules of Procedure, and an assessor will ask how the entity reached its scope decision. An unsupported self-determination that an entity is out of scope is a compliance risk in its own right, because an auditor who later finds a registrable function can treat the gap as a violation. Keep the analysis, the registry records and the correspondence together so the decision can be tested.

How often must categorization of BES Cyber Systems be reviewed?

At least once every 15 calendar months. Under CIP-002-5.1a R2, the entity must review its identifications and have the CIP Senior Manager or a delegate approve them at that interval, even when the review finds no BES Cyber Systems at all. The clock matters because a missed review is a violation regardless of whether the categorization changed. Build the review into the compliance calendar, tie it to events such as new substations, retired generation or changed control centers, and keep the approval record with the date and approver's name. Confirm with your Regional Entity how it expects the review to be evidenced.

What does an entity need from its own team before bringing in outside help?

It needs a named CIP Senior Manager, an inventory of its facilities and cyber assets, and a clear account of which systems it operates. Outside help works faster and more accurately when the entity can answer several questions itself: which facilities it owns or operates, which control centers and generation or transmission assets are in the registry, and what networks, remote access paths and vendors touch them. Decide who will own each control, who approves exceptions, and who will receive audit notices. Outside partners prepare systems, controls and evidence, but the entity keeps accountability. Written scope before work starts also helps, because the entity can compare quotes on the same basis.

Can a consultant take over accountability for NERC CIP compliance?

No. A consultant or implementation partner can prepare systems, run technical tasks, draft documentation and assemble evidence, but accountability stays with the registered entity and its CIP Senior Manager. The Regional Entity audits and enforces against the registered entity, not against the partner. Only the Compliance Enforcement Authority can make a compliance determination, and no firm can issue a CIP certificate because none exists. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, and it prepares evidence for assessments, but it does not issue audit reports, attestations or certifications. Ask any partner to state in writing which tasks it performs, which the entity keeps, and how it will support an audit.

How to confirm your scope before you buy outside help

This sequence tells you whether NERC CIP applies to your organization and which requirements follow from your impact ratings, so you can scope any outside help against records you own. Each step produces a document that stays under your control.

Confirm your NERC registration functions
Start by checking which NERC registration functions your organization holds, such as Balancing Authority, Transmission Operator, Generator Owner or Generator Operator. Compare them against the records held by your Regional Entity, since the Compliance Registry is the record that determines which standards bind you. Your compliance lead or regulatory counsel should own this check, and the output is a short registration statement, dated and signed off by an accountable officer, that lists each function and the Regional Entity of record. If the registry and your internal records disagree, resolve the difference before going further.
Assign the CIP Senior Manager
Name a CIP Senior Manager who has overall responsibility for the CIP program and can approve the categorization and policies. The CIP Senior Manager may delegate specific tasks in writing, but the accountability stays with that named person. The output is a signed appointment record, with any delegations listed and the scope of each delegation written down. Outside advisers can support this role but cannot hold it, so confirm the appointment before any partner is engaged.
Inventory the assets at your facilities
Build a complete list of the facilities, control centers, generation plants, substations and transmission assets your registration covers. Include the Cyber Assets and systems at each site that could affect BES reliability operations, drawing on engineering drawings, network diagrams and asset registers. Your operations and engineering staff own this inventory. The output is a dated asset list that shows where each system sits, who operates it and which network zones it belongs to, so the next step has a complete starting point.
Run the CIP-002 categorization
Apply the bright-line criteria in CIP-002-5.1a Attachment 1 to each asset and its BES Cyber Systems. Rate each system as high, medium or low impact, and record the reasoning for every rating, including systems judged not to be BES Cyber Systems. Engineering and operations staff perform the analysis, and the compliance team checks it against the standard's text. The output is the categorization record, which you review and document as the basis for every later scoping decision.
Obtain CIP Senior Manager approval
CIP-002-5.1a requires the CIP Senior Manager or a delegate to approve the identifications, and it must be reviewed and approved at least once every 15 calendar months, even if nothing has been identified. Circulate the categorization record for review, resolve open questions, and record the approval with its date. The output is a signed approval that shows the categorization is current, which becomes the evidence auditors ask for first.
Document the list of BES Cyber Systems
Turn the approved categorization into a written list of high, medium and low impact BES Cyber Systems and the assets that contain them. For low impact assets, the standard requires identifying the assets, but a discrete list of each low impact BES Cyber System is not required, so document the level of detail your records support. The output is a controlled document, version-numbered and stored where change control applies, that you can show to the Regional Entity.
Map which requirements apply
With the approved list in hand, determine which CIP standards and requirement parts apply to each impact category and to associated systems such as Electronic Access Control or Monitoring Systems, Physical Access Control Systems and Protected Cyber Assets. Most CIP requirements use Applicable Systems tables, so the same system can fall under different parts. The output is an applicability matrix, signed by the CIP Senior Manager, that defines the scope any consultant or vendor must work within.
Decide what to buy and what to keep
Only after the applicability matrix is approved, decide which tasks, if any, to hand to an implementation partner. Ask for a written scope that references your matrix, and confirm that the organization keeps ownership of controls, policies and the evidence record. Partners prepare systems and evidence, but they do not issue compliance determinations, and the Regional Entity remains the body that monitors compliance. The output is a scoped request built on documents you already own.

Who owns the obligation, who prepares evidence and who monitors it

The registered entity is the organization NERC has registered for a function such as Transmission Owner, Generator Owner or Balancing Authority. It holds the legal obligation to comply with each applicable CIP requirement, whether or not it uses contractors. Within the entity, the CIP Senior Manager is the named individual accountable for the program, and that person or a documented delegate approves the policies, categorizations and plans the standards require. Approval decisions cannot be handed to a partner, and the entity must be able to show who made each one and when.

Ownership of controls: The entity decides how each requirement is met, documents that decision and accepts the risk if a control fails.
Signed approvals: The CIP Senior Manager or delegate approves the CIP-002 identifications, policies and plans, and records the approval.
Evidence it can produce: The entity must retrieve its own records during an audit, including logs, access reviews and change tickets.
Self-reporting: The entity is expected to report possible violations it discovers, which makes internal monitoring part of its job.
Vendor oversight: Under CIP-013, the entity remains accountable for how its suppliers and contractors affect its systems.

Before engaging any partner, confirm in writing which approvals, records and decisions stay with the CIP Senior Manager and which technical tasks the partner will perform.

Questions to ask before engaging an implementation partner

A partner can prepare systems, documents and evidence, but it cannot own the CIP program or speak for the entity. These checks test whether a prospective partner understands that line before any work starts, and whether the work it proposes can be handed over and audited cleanly.

Experience with the Regional Entity process

Ask which CIP standards and Regional Entity audits the partner has supported, and how it prepared evidence for a Compliance Audit or Spot Check. Ask how it handles the notification period, the Evidence Request Tool and the audit period. Experience with the process matters more than general security credentials, because CIP is monitored by the Regional Entity, not by a certification body. Ask for specifics about what was delivered, not a list of standards.

Understanding of the CIP-002 bright lines

Categorization decides which other CIP requirements apply, so a partner should explain how it applies the high, medium and low impact criteria in CIP-002-5.1a Attachment 1 before proposing any technical work. Ask how it would document the identifications, the annual CIP Senior Manager approval, and how it treats assets near a threshold. A partner that skips categorization and starts with tooling is a warning sign.

A written, fixed scope

Ask for a written scope that names the systems, sites, deliverables and exclusions before work begins, along with what the entity must provide and decide. Check whether the scope separates one-time work, such as building a plan or configuring a monitoring tool, from recurring work, such as evidence collection or patch tracking. Vague scopes make cost and effort impossible to compare, and they hide the recurring work that drives long-term spend.

How evidence is handed over

Ask in what form evidence will be delivered, who owns the repositories, and how records are named, dated and retained. The entity must be able to produce evidence for the audit period without the partner present. Confirm that exports, logs and screenshots can be read without the partner's tools, and that the entity holds administrator access to every system that stores its evidence.

Personnel and access rules for outside staff

Partner staff who touch BES Cyber Systems, their access records or BES Cyber System Information fall under the entity's personnel and access controls. Ask how the partner will meet personnel risk assessment, training and access revocation requirements for its own staff, and how it logs remote sessions. Require that access be granted through the entity's processes and removed when an engagement ends.

No representation to auditors

Get written confirmation that the partner will not speak for the entity to a Regional Entity, sign attestations or respond to a notice on its behalf. Accountability stays with the registered entity and its CIP Senior Manager or delegates. Ask who will attend audit interviews, who approves responses, and how the partner's documents are reviewed by the entity before they are submitted.

How DeployOpen works on this

DeployOpen helps registered entities prepare the systems, documentation and evidence that support their own NERC CIP scoping decisions. The registered entity and its CIP Senior Manager keep ownership of categorization and compliance, while DeployOpen plans and implements the self-hosted open-source platforms inside the client's own infrastructure. Engagements are fixed-scope, with the work agreed in writing before it starts.

How we scope

Review the asset inventory and the entity's current CIP-002 categorization records with the CIP Senior Manager or delegate.
Define in writing which facilities, BES Cyber Systems and supporting platforms fall inside the engagement.
Agree deliverables, timelines and responsibilities for each system before any implementation work starts.

How we build

Plan and implement self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks.
Configure access, logging and configuration monitoring so that the platforms generate the records an auditor would ask to see.
Test the configured controls against the written scope and document the results for the entity's review.

How we hand over

Deliver system documentation, configuration records and evidence mapped to the applicable CIP requirements for the entity's review.
Train the entity's staff to operate, maintain and produce evidence from the platforms without relying on DeployOpen.
Clarify that only the registered entity and its Regional Entity auditors determine compliance, and DeployOpen does not issue audit reports or attestations.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope work is complete.
Keep platforms updated and documented as the entity's categorization changes or new CIP versions become enforceable.
Confirm with the entity's CIP Senior Manager which scope changes need a new written agreement before work continues.

Who must comply with NERC CIP