Guides for entities whose assets contain only low impact BES Cyber Systems: the CIP-003 low impact plan, the 2026 vendor remote access requirement, the 2029 CIP-003-11 changes, and running a lean program when most of CIP-004 to CIP-011 does not apply.
Everything a low impact program must cover under CIP-003-9: policies, the six plan sections (awareness, physical and electronic access, incident response, transient assets and removable media, vendor remote access), the CIP Senior Manager, and what is not required.
Meeting the low impact vendor remote access requirement enforceable since 1 April 2026: determining, disabling and detecting malicious vendor communications, the evidence examples NERC lists, and how it differs from CIP-005 for medium and high impact.
What CIP-003-11 adds for low impact assets with external routable connectivity from 1 July 2029, remote user authentication, protection of credentials in transit and malicious communication detection, and how to plan the work alongside the 2028 changes.
Running NERC CIP when every asset is low impact: how many registered entities report high or medium systems, what CIP-003 requires and does not, the CIP Senior Manager role, risk-based audit schedules and Self-Certifications.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.