NERC CIP requirements for vendors and suppliers explained

What NERC CIP requirements apply to vendors and suppliers?

The utility or other registered entity owns CIP compliance, not the vendor, but buyers will pass CIP obligations down through their procurement. Under CIP-013-2 Part 1.2, the entity's supply chain risk management plan must address, as applicable, six vendor topics: incident notification, coordinated incident response, notice when vendor remote or onsite access should end, disclosure of known vulnerabilities, verification of software integrity and authenticity, and coordination of vendor remote access controls. A vendor selling into a utility environment should expect questions on each of these topics, and should expect that the entity's procurement terms, not the standard itself, will carry the detail.

Which requirements actually bind a given product or service depends on the impact rating from CIP-002-5.1a and the Applicable Systems listed in each requirement table. A system rated high impact, or a medium impact system with External Routable Connectivity, brings in a different set of controls than a low impact asset, and the associated Electronic Access Control or Monitoring Systems, Physical Access Control Systems and Protected Cyber Assets are scoped in separately. Before answering a questionnaire, ask the buyer which impact category and which Applicable Systems the product will touch, because that answer decides whether vendor remote access, software integrity or personnel checks apply.

NERC issues no CIP certificate. Compliance is judged by the Compliance Enforcement Authority through audits, spot checks, self-certifications and self-reports, so a vendor cannot hand over a certification that satisfies a buyer's CIP obligations. What buyers accept is evidence: documented procedures, contract terms, access logs and third-party reports that show the controls work. Confirm with each buyer which of these artifacts their CIP-013 plan requires, and whether they will accept a third-party audit report in place of a direct assessment of your controls.

Which six procurement topics does CIP-013 ask vendors to address?

CIP-013-2 Part 1.2 requires a utility's procurement processes to address six vendor topics, as applicable. The utility decides which topics apply to each procurement, so vendors should expect the buyer's security team to tailor the list to the product, the access model and the impact level of the system involved.

Incident notification commitments

Buyers usually ask the vendor to commit to notifying them of security incidents affecting the vendor's products, services or systems that could affect the utility's BES Cyber Systems, within a timeframe written into the contract. Vendors should be able to show a documented incident response process, named contacts, and a sample notification record. Ask the buyer which timeframe and channel they expect, because that determines the utility's own CIP-008 reporting clock.

Coordinated incident response

The buyer will often want the vendor to agree in advance on how the two parties will respond together during an incident, including who leads, how evidence is shared and who speaks to regulators. Vendors should be able to produce an incident response plan that covers joint workflows, escalation paths and a tabletop exercise record involving customer contacts. Confirm the coordination roles in writing before a contract is signed.

Notice when access should end

Utilities need to know when a vendor's remote or onsite access should be removed, such as when a project ends or a technician leaves the vendor. Vendors typically commit to a notice process that names the individuals whose access must be revoked and to timely confirmation once that is done. Vendors should show an access roster that is kept current and a documented offboarding procedure that links to their own personnel records.

Disclosure of known vulnerabilities

Buyers commonly require the vendor to disclose known vulnerabilities in its products and to share remediation status, patches and compensating measures that affect the utility's environment. Vendors should be able to show a vulnerability handling process, a way to receive and track disclosures, and a historical record of advisories issued to customers. Ask how quickly the vendor will communicate new findings and whether disclosure covers third-party components.

Software integrity and authenticity

The buyer will usually expect the vendor to describe how it signs or otherwise protects software, firmware and patches, and how the utility can verify the source and integrity before installation. Vendors should be able to publish a hash or signature method, state their signing practices, and document how they handle a compromised build. This topic connects to the verification step in CIP-010 Part 1.6, so confirm which verification methods the vendor actually provides.

Coordination of vendor remote access controls

Buyers often ask the vendor to agree on how remote access will be controlled, including authentication, session logging, the use of an intermediary system and the methods the utility will use to see and end sessions. Vendors should be able to describe their remote access architecture, MFA support and the audit logs they can provide. Agree these controls in the contract so they line up with the utility's CIP-005 remote access methods.

Why CIP-013 does not reach existing contracts

CIP-013-2 requires a utility to implement its supply chain cyber security risk management plan, but it does not require the utility to renegotiate or abrogate existing contracts. The standard's note on Requirement R2 is explicit that contract terms and vendor performance sit outside its scope. For a vendor, the practical consequence is that a signed agreement running before the utility's plan took effect is not automatically reopened because of CIP-013. The plan's six procurement topics (incident notification, coordinated incident response, notice when access should end, disclosure of known vulnerabilities, verification of software integrity and authenticity, and coordination of vendor remote access controls) are applied as the utility procures, so the leverage point is the next purchase order, statement of work, renewal or amendment.

Vendors should not read that scope limit as permission to ignore expectations. Utilities that are subject to NERC CIP still have to show their compliance evidence, and they will often ask current suppliers to confirm the same points through their own vendor management, security questionnaires or account reviews. Before a renewal conversation, a vendor should ask its utility customer which of the six topics the plan addresses, whether the utility will request amendments to existing agreements, and which evidence it expects in the meantime. Those questions are better answered in writing early than discovered during a Regional Entity audit. Vendors should also confirm the exact terms in their own contracts with the utility, since the standard does not set them.

How vendor remote access controls differ by impact level

For high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity, CIP-005-7 Parts 2.4 and 2.5 require the utility to use one or more methods to determine active vendor remote sessions, including Interactive Remote Access and system-to-system remote access, and one or more methods to disable those sessions. The utility owns these methods. The vendor's role is to make its access predictable so the utility can apply them: connect only through the agreed path, identify each session to a named user or service account, and stop the session when the utility asks.

Session identification: Provide the named accounts, source addresses and service identities that will connect, so the utility can match active sessions to authorized vendor staff.
Session logs: Supply logs of vendor-initiated sessions on request, including start and end times and the account used, in a format the utility can correlate.
Disablement on request: Confirm the escalation path and response time for disabling a session or access path, and do not hold a persistent tunnel open between engagements.
Coordination with the utility's methods: Use the intermediary or access path the utility specifies, and test with the utility before go-live that its session detection and disablement methods see vendor traffic.
Scope of system-to-system access: Document every automated connection, such as monitoring agents or patch servers, because these count as remote access too.

Before signing, confirm which Parts apply to your utility's assets and ask the utility to walk you through the methods it has chosen.

How software integrity verification reaches vendor deliveries

Under CIP-010-4 Part 1.6, a registered entity must verify the identity of the software source and the integrity of the software before it changes the baseline of an operating system, firmware, application software or security patch, but only where the source makes a verification method available. For a vendor, that conditional is the key point: if you publish a method, the utility's procedure will likely depend on it, and if you do not, the utility must document why it cannot verify. The obligation applies to high and medium impact BES Cyber Systems and their associated EACMS and PACS, so any vendor delivering software, firmware or patches into those environments should expect the question. The requirement traces to FERC's supply chain orders, Order No. 829 and Order No. 850, which the utility's own CIP-013 plan is also built around.

What should a vendor provide? At minimum, publish a verification method for every deliverable: cryptographic hashes or digital signatures for each release, the signing key or certificate chain needed to check them, and a plain description of how a customer confirms both the source and the file integrity. Document the procedure in a form the utility's engineers can follow without contacting you, and state which artifacts (installers, firmware images, patch bundles) the method covers. Commit in your contract to notice of changes to signing keys, hash algorithms or distribution points, since a silent change breaks the utility's verification step at the worst moment. Confirm the exact scope of Part 1.6 and the procurement terms with the utility's compliance team, and confirm with your own counsel how any notice obligations interact with the vendor terms already in place.

What contractor staff need before they get access

Before a contractor or vendor employee receives authorized electronic or unescorted physical access to high or medium impact BES Cyber Systems, the utility must be able to show that the person's personnel risk assessment was done and meets its standard. The cards below cover the CIP-004-7 elements that reach into vendor staffing, and the records the utility checks.

Criteria for criminal history checks

CIP-004-7 Part 3.3 requires the utility to have criteria or a process for evaluating the criminal history records checks that feed each personnel risk assessment. The utility decides what results disqualify access, so vendors need to know those criteria before staffing a project. Ask the utility which criteria apply, how adverse results are handled, and whether the same standard applies to your subcontractors.

Verifying contractor assessments

Part 3.4 requires criteria or a process for verifying that personnel risk assessments performed by contractors or service vendors meet Parts 3.1 to 3.3. The utility does not always run the check itself, so the vendor's assessment records are what it reviews. Keep dated, attributable records of identity confirmation, criminal history results and the evaluation outcome for every person who may receive access.

Seven-year history check

The criminal history check that vendors commonly associate with CIP-004 covers a look-back period, and that period is the detail to confirm against the standard text before you commit to a staffing process. Do not rely on a summary, including this one. Ask the utility which look-back period it expects and whether it applies to every individual with access, including staff who work only on site.

Access revocation on termination

Access must be revoked within the timeframes the utility's CIP-004-7 access management program sets, and a contractor who leaves a project or the company must lose access promptly. The vendor's role is to notify the utility when a person no longer needs access and to keep its own roster current. Agree in the contract how and how quickly that notice travels, and who records the revocation.

Access authorization and training records

Before a contractor receives authorization, the utility expects training on its security awareness and cyber security practices, and a documented need for the access. Vendors should keep training completion records for each named individual and match them to the access list the utility holds. Ask the utility what training it requires for contractors and whether it accepts the vendor's own program.

What the utility owns and what the vendor can prove

The registered entity owns its CIP compliance. The utility, not its vendor, decides how each requirement is met, keeps the evidence, and answers to its Compliance Enforcement Authority, which is either a Regional Entity or NERC. There is no CIP certificate. Compliance is monitored through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging, periodic data submittals, investigations and complaints. A vendor therefore cannot certify CIP compliance on a utility's behalf, and any document that claims otherwise should be treated with suspicion. What a vendor can do is state what its product or service does, show how it behaves in the utility's environment, and supply records the utility can place in its own evidence file.

Implementation partners such as DeployOpen fit in the same way. They can prepare systems, configure access controls, document baselines and assemble evidence inside the client's own environment, but they do not issue audit reports or attestations. Only the independent auditor or assessor reviewing the utility issues a finding. Before work starts, ask the vendor or partner to state in writing which artifacts it will produce, who will review them, and which CIP requirement each artifact is meant to support. Confirm with your compliance lead which Compliance Audit timing applies to your registration, because that timing sets when evidence requests arrive and how far back the auditor will look. The NERC Rules of Procedure, Section 403.10.1, sets a three-year audit cycle for Balancing Authorities, Reliability Coordinators and Transmission Operators, while other registered entities are audited on a risk-based schedule.

The practical consequence is that vendor evidence needs to be dated, attributable and retained for the audit period, so the utility can produce it without asking the vendor to reconstruct it later. Agree on retention and delivery terms for each evidence type, such as remote access session logs, procurement assessments and patch records, before the engagement begins. Ask suppliers for their own third-party reports where they exist, but recognize that such reports describe the supplier's controls, not the utility's compliance. The utility must still show how those controls apply to its BES Cyber Systems.

How a vendor prepares for a utility's CIP-013 review

The sequence gives a utility's supply chain and compliance staff a written, checkable record of how the vendor's products, remote access, software, vulnerability handling and personnel map to the utility's own CIP-013 plan. The vendor owns its own controls, and the utility owns its plan and its evidence.

Map products to the utility's applicable systems
Start by asking the utility which BES Cyber Systems, and which associated EACMS, PACS and Protected Cyber Assets, the product will touch. Impact rating decides which CIP-013 expectations and which CIP-005, CIP-007 and CIP-010 controls apply. The vendor lists each product, version and component against those system categories and notes where the product sits in the utility's environment. Done means the vendor and utility agree in writing on a product-to-system map that the utility can file with its procurement records.
Document remote access methods and session logs
Describe every way vendor staff or vendor systems can reach the utility's environment: interactive sessions, system-to-system connections, and any intermediate system the utility requires. For each method, state how active sessions are determined and how they are disabled, which supports the utility's obligations under CIP-005. Show sample session logs that record who connected, when, and to which system. Done means the vendor can demonstrate each method end to end, and the utility confirms the method fits its own access design.
Prepare software integrity verification procedures
Write down how the vendor publishes software, firmware and security patches, and how the utility can confirm the source and the integrity of each release before a baseline change. Where the vendor provides a verification method, such as signed packages or published hashes, document how to use it and where the public keys or reference values live. Confirm which items the vendor cannot verify by method, so the utility can record that gap. Done means a procedure exists for each product line and the utility has a copy.
Set vulnerability disclosure and incident notification procedures
Define how the vendor identifies and discloses known vulnerabilities, how it notifies the utility of security incidents affecting the product or its supply chain, and who coordinates the response on each side. Name the contacts, the channels and the information the vendor will provide, and align these terms with the utility's own CIP-008 reporting duties, which the utility carries. Done means the notification and disclosure terms are written, reviewed by both parties, and attached to the contract or support agreement.
Assemble contractor personnel records
For each contractor who will hold authorized electronic or unescorted physical access, gather the records the utility needs to verify under CIP-004: identity confirmation, the criminal history check, the date and scope of the personnel risk assessment, and completed training. Confirm the vendor's own process meets the utility's criteria for verifying contractor assessments. Keep a named list of staff, and a revocation process for staff who leave the project or the company. Done means the vendor can produce each record on request and has a current access roster for the utility.
Gather third-party assurance reports
Collect independent reports that cover the vendor's controls, such as a SOC 2 Type 2 report or a FedRAMP audit report where they apply, along with the scope and period each one covers. Check whether the scope includes the services and facilities the utility will rely on, and note any exceptions the auditor raised. These reports support the utility's administrative evidence, but the independent auditor, not the vendor or any consultant, issues them. Done means the vendor has a current package with scope statements and a list of gaps the utility should review.

Vendor questions about NERC CIP requirements

Can a vendor be NERC CIP certified?

No. There is no NERC CIP certificate. NERC and the Regional Entities monitor compliance through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports and investigations, and the obligations fall on the registered utility or operator, not on its suppliers. What a vendor can do is show the utility the controls and evidence that support the utility's own CIP-013 procurement and monitoring. Ask the utility which of its CIP-013 topics it expects you to address, and in what form it wants the evidence. Independent third-party reports, such as a SOC 2 Type 2 report, are one input a utility may request, but they do not certify CIP compliance on the vendor's behalf.

Which CIP-013 topics apply to my products and services?

CIP-013-2 Part 1.2 lists six vendor topics that a utility's procurement process must address, as applicable: incident notification, coordinated incident response, notice when vendor remote or onsite access should end, disclosure of known vulnerabilities, verification of software integrity and authenticity, and coordination of vendor remote access controls. The word "as applicable" matters. A vendor that delivers only a hardware component may see fewer topics than a managed service provider with remote access to a control center. Ask the utility which systems your offering touches, since its impact rating of each BES Cyber System decides which requirements reach your work. Review the CIP-013-2 standard to see the exact wording the utility is working from.

Does an existing contract have to change for CIP-013?

The standard does not require existing contracts to be renegotiated or abrogated. CIP-013-2 Requirement 2 asks the utility to implement its supply chain risk management plan, and contract terms and vendor performance fall outside that requirement's scope. In practice, utilities often add CIP-related terms when a contract is renewed, amended or newly purchased, because their plan must address the Part 1.2 topics for new procurements. Expect a change request to arrive as an amendment, a security addendum or a question set during renewal rather than as a forced rewrite. Ask the utility which of your current agreements it plans to amend and when, and check whether any change affects pricing or service levels before you agree to it.

Does SOC 2 satisfy NERC CIP evidence requirements?

Not by itself. A SOC 2 Type 2 report is a recognized kind of third-party assurance, and NERC's cloud guidance lists it as an example of administrative evidence showing that a provider's controls are effective. However, the report only covers the criteria and period the auditor tested, and it does not map to specific CIP requirements or parts. The utility still needs evidence tied to its own plan, such as vendor service agreements or vendor service risk assessments that address confidentiality and the provider's access controls. Ask the utility whether it accepts a SOC 2 report as one input, which period it must cover, and which additional artifacts it expects for the Part 1.2 topics. Confirm the scope of the report too, because it may not cover the product or site delivered to the utility.

How do utilities verify contractor personnel risk assessments?

A utility may not simply accept a contractor's word that background checks were done. CIP-004-7 Part 3.4 requires the utility to have criteria or a process to verify that personnel risk assessments performed by contractors or service vendors meet the requirements of Parts 3.1 to 3.3. Those parts cover identity confirmation, a seven-year criminal history check and evaluation criteria. Contractors should expect to supply records that show the check was completed, the scope covered and the date, and to agree to a process for revoking access when an individual leaves or changes role. Ask the utility which verification method it uses, what documents it needs, how long records are kept and how quickly it expects notice of a termination. Keep personal data handling in line with your own privacy obligations when you share screening results.

What should a vendor prepare before a utility CIP audit?

Start by confirming the audit scope with the utility, because the audit targets the utility's registered entity and its program, not your company. Prepare the artifacts that the utility is likely to request from you: the list of your personnel with access and their screening status, documented remote access methods and how sessions are started, monitored and ended, records of vulnerability disclosures and incident notifications, and your process for software source and integrity checks. Make sure your records match your contract commitments, since mismatches draw questions. Note that the Regional Entity selects the monitoring method and schedule, and that a utility is audited at least every three years only if it is a Balancing Authority, Reliability Coordinator or Transmission Operator. Ask the utility's compliance team for its evidence request list early, and agree on a single point of contact for requests.

Who pays for NERC CIP compliance work?

Each party pays for the work it performs. The registered utility or operator owns its CIP obligations and bears the cost of its program, its procurement reviews and any penalties for violations. A vendor pays for its own controls, its evidence, its personnel screening and any assurance report it commissions, such as a SOC 2 examination performed by an independent CPA firm. Costs that recur include staff time for questionnaires, annual or periodic reviews, access logging and screening refreshes. Costs that are often one-time include initial control design, documentation and remediation of gaps. Who pays for changes to an existing contract depends on your agreement, so raise it during amendment talks. Ask any implementation partner or consultant for a fixed-scope written quote that lists deliverables, assumptions and what the utility is responsible for. DeployOpen prepares systems, controls and evidence for assessments, but it does not issue audit reports or certifications.

How DeployOpen prepares vendor evidence for NERC CIP environments

DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure. For vendors and suppliers selling into NERC CIP environments, we prepare the systems, controls and evidence that a utility can review under its CIP-013 procurement and CIP-005 and CIP-010 controls, while the utility owns its controls and an independent party issues any assurance report.

How we scope

We agree a written scope listing the platforms, environments and vendor obligations covered before work starts.
Scope identifies which CIP-013 procurement topics and vendor evidence items the engagement addresses.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing before any work begins.

How we build

We configure vendor remote access paths so active sessions can be determined and disabled, supporting CIP-005 Part 2.4 and 2.5 evidence.
We set up software source verification and integrity checks for releases and patches, supporting CIP-010 Part 1.6 records.
We test access controls, logging and notification workflows, and document the results for the utility's review.

How we hand over

We deliver runbooks, configuration records, test results and evidence packages mapped to the agreed scope.
Documentation is written so the utility can present it to its own auditors or Compliance Enforcement Authority.
We do not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those assessments.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
Retainers can cover evidence refreshes when a vendor release, patch cycle or CIP standard change affects the delivered controls.
Ask any provider which evidence it will keep current, and who pays for each refresh, before signing.

NERC CIP requirements for vendors and suppliers