Guides for vendors, integrators and contractors selling into NERC CIP environments: what CIP-013 procurement asks of them, vendor remote access, software integrity, incident and vulnerability notification, and personnel risk assessments for contractor staff.
What utilities subject to NERC CIP will ask of vendors: the six CIP-013 procurement topics, remote access controls, software integrity verification, personnel risk assessments for vendor staff, and the assurance evidence buyers accept.
How vendor remote access is controlled across impact levels: Intermediate Systems, encryption and MFA for Interactive Remote Access, determining and disabling active vendor sessions, vendor connections to EACMS and PACS, and low impact vendor access.
What CIP-010 Part 1.6 and CIP-013 expect when installing vendor software, firmware and patches: verifying source and integrity where the vendor provides a method, procurement terms, baselines, and where FERC's 2025 order points next.
How CIP-013 procurement handles vendor-identified incidents, coordinated response and vulnerability disclosure, how those link to the entity's CIP-008 reporting duties, and what FERC's 2025 order adds on responding to supply chain risks.
What contractor and vendor staff need before they get authorized electronic or unescorted physical access: identity confirmation, seven-year criminal history checks, verification of assessments done by the contractor, training, and revocation on termination.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.