CIP-003-11 low impact changes 2029: what to plan for

What CIP-003-11 requires for low impact assets in 2029

Consider an entity whose only BES Cyber Systems are low impact and who must plan for CIP-003-11, which takes effect on 1 July 2029. The standard adds remote user authentication, protection of authentication information in transit and detection of malicious communications for low impact assets with external routable connectivity. Under the *Order No. 918* approval, these are the new obligations to design for, sitting on top of the CIP-003-9 plan that is already enforceable. The entity owns its controls and its evidence. An implementation partner can prepare systems, configurations and documentation, but only an independent auditor or the Compliance Enforcement Authority, which is a Regional Entity or NERC, judges whether the entity complies. There is no CIP certificate to obtain, so any document that claims to certify CIP-003-11 compliance should be treated with suspicion.

The scope of work depends on two facts the entity should establish now. The first is how many low impact assets have external routable connectivity, since only those assets pick up the 2029 requirements. The second is how remote access is done today: whether users, including vendors, reach low impact Cyber Assets through interactive sessions, shared accounts, VPN gateways or a jump host, and whether those sessions use passwords alone or a second factor. Confirm the exact applicability language in the standard with the NERC CIP standards page and the current CIP-003 PDF, not from summaries. A practical first step is an inventory of every remote path into each in-scope asset, with the authentication method, the credential store and the points where traffic leaves the asset boundary recorded for each one.

Plan the 2029 work alongside the 2028 changes, because CIP-002-8 revises the Control Center definition from 1 July 2028 and affects how the entity is categorized. Re-run the categorization against that revision early, so that a change in scope does not force rework in the final year. Assign a named owner for remote user authentication, a decision on whether the chosen identity provider can enforce multifactor authentication for every remote user, and a test plan that shows credentials stay protected in transit. Open-source identity platforms such as Keycloak, which supports TOTP and WebAuthn passkeys under an Apache-2.0 license, can be evaluated for this role, but the entity must confirm that the chosen configuration meets the standard's wording and that the logs it produces will satisfy an auditor.

What makes the 2029 work larger or smaller

Five factors decide how much CIP-003-11 work an entity faces from 1 July 2029. Count them early, because each one changes whether the low impact assets need new controls or only documented evidence. Check the 2028 CIP-002-8 Control Center change first, since it can move assets in or out of scope before any 2029 control is designed.

Low impact assets with external routable connectivity

CIP-003-11 adds the new controls for low impact assets with external routable connectivity, so this count sets the size of the 2029 work. Build a current inventory of each low impact asset and mark whether it has routable communication outside its own boundary. Assets with no external routable connectivity keep the existing CIP-003 scope. Recheck the list after any substation or site change, since a new link can add an asset to scope.

Remote users and third-party accounts

Every person or vendor account that reaches a low impact asset remotely is a user the new remote user authentication requirement will reach. List internal staff, contractors and vendor support accounts separately, because vendor accounts often sit outside the entity's directory. Ask who holds each account, how it is created and how quickly it is removed. A short, accurate list makes the authentication design much smaller.

Existing multi-factor authentication coverage

Entities that already require multi-factor authentication for remote access will need less change than those relying on shared or single-factor logins. Check whether the identity provider, VPN or jump host enforces a second factor for every remote path, including emergency and vendor paths. Where MFA is partial, plan to close gaps before 2029 rather than document exceptions. Open-source identity options such as Keycloak support two-factor methods, which you should confirm against your own deployment.

Credentials that cross networks in plaintext

Authentication information sent across networks in clear text is the gap that protection of authentication information in transit targets. Trace each remote session and vendor connection to see whether passwords, tokens or session secrets travel unencrypted at any hop, including through proxies and jump hosts. Encrypted transport on the full path, verified by packet capture or configuration review, is the evidence an assessor will ask for. Any legacy protocol found here usually drives the largest engineering effort.

Existing network monitoring for malicious communications

The malicious communication detection requirement is easier to meet where the entity already logs and reviews remote session traffic at low impact sites. Check whether firewalls, VPN concentrators or host sensors record vendor and remote connections, and whether anyone reviews those records. Sites with no monitoring will need a sensor or log collection path that fits their remote access design. Confirm retention and alerting with your own tools, because capability differs by product.

Effect of the 2028 Control Center definition change

CIP-002-8 changes the Control Center definition from 1 July 2028, and that change can move a site between impact categories before the 2029 controls apply. An asset reclassified from low to medium or high brings a different and larger set of requirements, so the 2029 plan can change. Rerun categorization against the revised definition during 2027 and 2028, and record the decision. Treat that result as the baseline for every other 2029 estimate.

How to plan the work between now and 1 July 2029

The sequence below moves from confirming which low impact assets have external routable connectivity to handing a finished, evidenced CIP-003 plan to internal review. Each phase produces a document or check that the next phase depends on, so the work can be scheduled backward from the 1 July 2029 effective date.

Confirm categorization and external routable connectivity
The entity's CIP Senior Manager or delegate confirms, under CIP-002, which BES Cyber Systems sit at low impact assets and which of those assets have external routable connectivity. Check the CIP-002-8 Control Center definition change (effective 1 July 2028) at the same time, since it can affect categorization. The output is a signed categorization record that lists each asset, its connectivity status and the date it was last reviewed. Only assets with external routable connectivity fall within the new CIP-003-11 requirements, so this list sets the scope for every later phase.
Inventory remote user access paths
Operations, engineering and IT staff map every route by which a remote user reaches a low impact asset with external routable connectivity, including vendor sessions, jump hosts, VPNs, cloud consoles and administrative tools. For each path, record who uses it, which credentials or factors are involved, where authentication information travels, and what monitoring already exists. The output is an access path register that can be checked against the CIP-003-9 vendor electronic remote access controls already in force since 1 April 2026, so that work already done is not repeated.
Design authentication and credential protection
Using the register, the entity selects how remote users will be authenticated and how authentication information will be protected in transit. Designs should name the identity provider, the factor types, the session encryption method and the handling of recovery codes and shared secrets. Where an open-source identity platform such as Keycloak is considered, confirm its current two-factor options and one-time password policies against the Keycloak Server Administration Guide and test them in a non-production environment. The output is a written design with a decision record for each access path.
Deploy and test malicious communication detection
Put detection in place for malicious communications on the external routable connectivity of in-scope low impact assets, and test that alerts fire on known test cases. Define who reviews alerts, how quickly they are triaged, and how detections are tuned. Keep records of test runs, alert samples and any false positive handling. The output is a tested detection configuration, a runbook for alert handling and evidence showing the controls operated during the test period. Confirm the exact method with the vendor and with the standard's own wording before design freeze.
Update the CIP-003 plan and evidence
Revise the cyber security plan to add remote user authentication, credential protection in transit and malicious communication detection for the in-scope assets, while keeping the existing Attachment 1 sections in place. Update the procedure for each control, assign owners, and set the evidence each owner must retain. Where the plan is also used for vendor remote access under CIP-003-9, make sure the two sets of records do not contradict each other. The output is a revised plan version with an change log and an evidence matrix that maps each plan statement to the record that proves it.
Hand the evidence to internal review
Before any independent assessment, the entity's compliance function and an internal reviewer who did not build the controls check the evidence matrix against the plan and the records. The reviewer tests a sample of access events, detection alerts and approvals, and confirms that the CIP Senior Manager has approved the revised plan. Gaps go back to the owning phase with a due date. The output is a signed internal review memo listing findings, their closure and the date the plan was approved. Any independent audit or spot check is conducted by the Regional Entity or its designated reviewers, not by the implementation partner.

Which approach fits: in-house, partner-supported or managed

An in-house approach fits entities that already run a mature security and compliance function, have staff who understand the CIP standards, and operate a small, stable set of low impact assets. The entity designs the remote access architecture, selects and configures tools, writes the cyber security plan, and collects evidence itself. This model keeps knowledge inside the organization, but the work competes with existing operations and needs skills in identity, network access and CIP evidence that many utility teams do not hold in depth.

Staff capacity: Confirm that named people can own the remote user authentication, credential protection and malicious communication detection work without pulling them from operational duties.
Skills gap: Identify who will configure multi-factor authentication, encrypted transport and detection tooling, and who will write evidence that an assessor can follow.
Environment fit: This model suits a small number of sites with simple external routable connectivity and few remote users.
Internal cost: Staff time, training and tool licensing are the main costs, and most of them recur every year.
Continuity: Plan for staff turnover, since a single engineer who leaves can take the working knowledge with them.

Before committing, ask whether the team can complete a dry run of the evidence package for one site within the planning window that your CIP Senior Manager has set.

What must be in place before the 2029 date

CIP-003-11 adds four controls for low impact assets with external routable connectivity, and each depends on records you already hold or should build now. The checks below form one readiness sequence: first find the assets and paths, then design the controls, then prove them. Work through them in order, because the later items cannot be verified until the earlier ones are settled.

Accurate low impact asset list

Start with the list of assets and BES Cyber Systems categorized as low impact under CIP-002, then confirm which of them have external routable connectivity. Compare the list against network diagrams, firewall rules and cloud accounts, not only the categorization file. Assets missing from the list are the most common reason a control appears to be in place when it is not. Ask a second person to walk a sample of assets back to their network paths.

Documented remote access paths

For each low impact asset with external routable connectivity, record every path a remote user or vendor can use to reach it, including VPN concentrators, jump hosts, vendor portals, cellular gateways and support tools. Note who owns each path and whether it is used for interactive or machine traffic. An undocumented path cannot be given MFA or monitored, so an auditor will test this record against live traffic.

Working MFA design for remote users

CIP-003-11 requires authentication of remote users for these assets, so design the method before you buy or configure anything. Decide which identity provider issues credentials, which factors apply to employees and which to contractors, and how recovery works when a device is lost. Test the design with real remote logins across each documented path, and keep the test results, since a design on paper will not satisfy an assessor.

Protected authentication traffic

Confirm that authentication information stays protected while it travels between the user and the asset or access point. Check each documented path for encrypted sessions, certificate validity and any legacy protocol that sends credentials in clear text. Record the protocol versions and cipher settings for each path, because a single unencrypted hop on one path can leave the whole control unmet.

Method to detect malicious communications

The standard expects a defined method to detect known or suspected malicious communications on these remote paths. Name the sensor or log source for each path, the signatures or rules it uses, who reviews alerts and how a detection leads to a documented response. Test the method once with a benign simulated event so you can show it works. Confirm the detection covers vendor sessions as well as employee sessions.

Evidence retention and CIP Senior Manager sign-off

Set a retention period for logs, MFA records, configuration exports and test results, and assign owners who can produce them on request. Then have the CIP Senior Manager review and approve the revised plan and the evidence index, and record that approval with a date. Regional Entities test sign-off as well as the controls, so an unsigned update is a gap even when the technology works.

How Keycloak can support remote user authentication

Keycloak, an Apache-2.0 licensed identity and access management server, can supply much of the technical machinery behind remote user authentication for low impact assets. According to the Keycloak Server Administration Guide, it supports two-factor authentication using passkeys, recovery codes, and time-based or HMAC-based one-time passcodes from authenticator apps such as Google Authenticator or FreeOTP. Administrators can set one-time password policies, such as the algorithm, digit count and period, and configure W3C WebAuthn settings for passkeys. These are the settings an entity would review when it defines how a vendor or internal user proves identity before reaching a low impact BES Cyber System remotely.

Keycloak supports the authentication control but does not by itself meet CIP-003-11. The standard's wording governs what must be authenticated, which remote users are in scope, and how authentication information is protected in transit and malicious communications are detected. Those decisions belong to the entity. Before relying on Keycloak, confirm with your compliance lead and the standard text whether the flows you configure, such as a browser login to a jump host or a token issued to an application, match what the requirement covers. Confirm also that the version of Keycloak you deploy offers the settings described in the current guide, since features and defaults change between releases.

Planning should start with an inventory of remote access paths to low impact assets and the identity provider each path uses. Test one-time password enrollment, recovery code handling and passkey registration in a non-production realm, and record the configuration as evidence. Ask any implementation partner to document the exact realm, client and authentication flow settings, and to show how they are backed up and changed under your change management process. An independent auditor will judge the result against your own evidence, so the design record matters as much as the settings themselves.

Who owns the controls, who prepares evidence, and who issues the verdict

The registered entity remains accountable for CIP-003-11 compliance, regardless of who helps build the controls. It decides its low impact categorization under CIP-002-8 inputs, names the CIP Senior Manager, approves the cyber security plan, and makes the operating decisions that the standard assigns to the entity. Those decisions cannot be delegated to a vendor or consultant in a way that transfers the obligation.

Ownership of the plan: The entity approves the policies and the cyber security plan sections that will apply to low impact assets with external routable connectivity from 1 July 2029.
Authentication decisions: The entity chooses how remote users are authenticated and who is authorized to use that access.
Operating evidence: The entity runs the controls day to day and keeps records that show they operated, such as access reviews and detection alerts.
Senior Manager sign-off: The CIP Senior Manager or a documented delegate approves the program and its changes.
Scope confirmation: The entity confirms which assets are in scope before any build work begins.

Before engaging any partner, confirm internally who will own each control after handover and who will answer for it during a Regional Entity review.

How to choose a partner for the 2029 changes

A partner for CIP-003-11 work should be judged on the same things an auditor will judge: whether the low impact program is scoped in writing, whether evidence is handed over in usable form, and whether the partner stays out of the audit itself. The cards below turn those points into checks you can put to a shortlist before signing.

Experience with low impact programs

Ask for examples of CIP-003 low impact cyber security plans the partner has built or reviewed, and whether those engagements covered entities with only low impact BES Cyber Systems. Confirm the partner understands the difference between the CIP-003-9 plan sections and the CIP-003-11 additions effective 1 July 2029. Ask who on the team has worked on remote user authentication and malicious communication detection, and whether those people will do the work or only sell it.

Written fixed scope

Require a written scope that lists which low impact assets with external routable connectivity are covered, which systems are in the authentication and detection work, and which deliverables the partner will produce. Confirm the scope states what is excluded, such as medium or high impact systems and the parts of the program the entity already runs. A scope without named deliverables and dates makes it hard to tell whether the work is finished.

Clear evidence handover

Ask what the partner delivers at the end: configuration files, authentication policy exports, detection rule sets, test records, and a document index that maps each item to the plan section it supports. Confirm the entity keeps ownership and copies of all artifacts and that they are stored in the entity's own repository. Ask how the partner documents what it changed so that the entity's CIP Senior Manager can explain the work to an auditor.

Independence from the audit

The partner prepares systems and evidence, but only the Regional Entity or NERC acting as Compliance Enforcement Authority monitors compliance. Ask the partner to confirm in writing that it will not assess its own work, issue compliance statements or represent the entity to the Regional Entity. Also ask whether the partner has a conflict of interest with any compliance reviewer the entity may use, and who inside the entity signs off on the controls.

How the partner tests authentication

Ask how the partner will test remote user authentication for low impact remote access, including the factors it will use, how recovery codes are issued and revoked, and how one-time password settings are enforced. For example, if the entity uses Keycloak, ask whether the partner will test passkey and TOTP enrollment, lockout behavior and session timeouts, and whether test results will be kept as evidence. Ask what the partner will not test.

How the partner tests malicious communication detection

Ask how the partner will prove that the detection method for malicious communications works, not only that it is installed. Good answers describe test traffic, expected alerts, the response steps and records of each test. Confirm how credentials are protected in transit during the test, and whether the partner will show how detections are reviewed and closed. Ask for a sample test report before committing, and for a quote tied to the written scope.

Questions buyers ask about CIP-003-11 planning

What does CIP-003-11 add for low impact assets from 2029?

CIP-003-11 adds three controls for low impact assets with external routable connectivity, effective 1 July 2029 under FERC Order No. 918: authentication of remote users, protection of authentication information while it is in transit, and detection of malicious communications. Today's low impact plan covers awareness, physical and electronic access, incident response, transient assets and removable media, and vendor remote access. The 2029 change extends electronic access protections to remote users and the credentials they send across the network. Confirm the exact requirement language and applicability with your Regional Entity and the standard itself before scoping work.

Do all low impact entities have to comply with the 2029 changes?

The changes apply to low impact assets with external routable connectivity, so entities whose low impact assets have no such connectivity should confirm that their scope falls outside the new language. Scope depends on your CIP-002 categorization, which is the step that decides which assets are low impact and which have routable connections. Ask your Regional Entity to confirm how it reads applicability, because the audit team makes the final determination during monitoring. Document the reasoning in your categorization records so the decision can be shown later.

What does the work need from our team?

The work needs people who understand your remote access paths, your identity sources and your credential handling, along with a CIP Senior Manager who approves the plan changes. In practice this usually means network and identity engineers who can map every remote user path to a low impact asset, a compliance lead who maps the new language to evidence, and operations staff who can run authentication and monitoring tools day to day. Plan for time to review the current plan, test changes in a non-production setting and record approvals. Confirm internal capacity early so the work does not compete with the 2028 changes.

Can we do this work without an outside partner?

Yes, an entity can do the work with its own staff, and many do. An implementation partner can prepare systems, configure self-hosted tools and assemble evidence, but the organization owns its controls and the compliance decisions. Outside help is most useful when the team lacks identity, network or monitoring skills, or when the timeline overlaps other CIP changes. An independent auditor or the Regional Entity issues no certificate for CIP, so any partner is preparing evidence for monitoring rather than attesting to compliance. Compare options on the written scope rather than on general claims.

How does the 2028 change affect our 2029 planning?

CIP-002-8, which revises the Control Center definition, takes effect 1 July 2028, one year before CIP-003-11. The two dates share a team, a plan revision cycle and a review of your categorization records, so plan them together. Changes to the Control Center definition may affect how you classify assets, which in turn affects whether the 2029 requirements apply to them. Build a single timeline that covers categorization review in the earlier year and authentication and monitoring work in the later year.

Which open-source tools can help with remote user authentication?

Keycloak, licensed under Apache-2.0, supports two-factor authentication with passkeys, recovery codes and TOTP or HOTP codes from authenticator apps, with configurable one-time password policies and W3C WebAuthn settings. It can run inside your own infrastructure, which keeps credentials under your control. Confirm that the chosen login method meets the standard's wording, test recovery procedures and check how logs are retained for evidence. Review the Keycloak Server Administration Guide for configuration details before committing to a design.

What should a quote for this work include?

A quote should state the in-scope low impact assets, the remote access paths covered, the authentication and monitoring components to be configured, and the evidence deliverables. It should also list the one-time work, such as design, configuration, testing and plan updates, separately from recurring work, such as log review, patching and periodic evidence collection. Ask who performs each task, what the entity must provide, and what is excluded. Fixed-scope engagements agree deliverables and timelines in writing before work starts, so require the same clarity from any provider. Ask your Regional Entity to confirm any evidence expectations before the quote is final.

How DeployOpen prepares systems and evidence for the 2029 changes

DeployOpen works with the entity's own team to prepare the self-hosted open-source platforms and evidence that low impact assets will need once CIP-003-11 applies from 1 July 2029. The entity keeps ownership of its cyber security plan, its CIP Senior Manager decisions and its controls, while DeployOpen plans, builds and documents the technical work inside the entity's own infrastructure.

How we scope

Engagements are fixed-scope, with the written scope naming which low impact assets and remote access paths are covered.
The scope lists the remote user authentication, credential protection and malicious communication detection work for assets with external routable connectivity.
Scope also records which items stay with the entity, such as policy approval, CIP Senior Manager duties and the 2028 changes.

How we build

We plan the authentication design for remote users and test multi-factor sign-in on the entity's own identity infrastructure.
We configure Keycloak one-time password and passkey policies where it fits the entity's architecture, and confirm each setting against its current documentation.
We test malicious communication detection and encrypted credential handling in a staging environment before any change reaches production systems.

How we hand over

We document configurations, test results and the evidence each control produces, mapped to the CIP-003 attachment sections the entity uses.
We deliver runbooks so the entity's staff can operate, review and recover each control without ongoing dependence on DeployOpen.
An independent auditor or the Compliance Enforcement Authority decides how evidence is assessed; DeployOpen does not issue audit reports or attestations.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, agreed separately from the fixed-scope work.
Before 2029, we can review how the 2028 changes and the 2029 changes affect the same systems, so work is not repeated.
Ask for the written scope, the deliverable list and the handover format before engagement starts, and confirm exact dates with NERC and your Regional Entity.