NERC CIP for low impact only entities: scope and audit

How NERC CIP compliance works for low impact only entities

If every asset your organization owns or operates contains only low impact BES Cyber Systems, the first question is scope, and that is set by CIP-002-5.1a, the categorization standard, before any other CIP requirement applies. CIP-003-9 is then the main control set you must implement. There is no CIP certificate: the Compliance Enforcement Authority, a Regional Entity or NERC, monitors compliance through audits, Spot Checks, Self-Certifications, Self-Reports and other mechanisms. NERC's 2024 TFE annual report counted 1,725 US registered entities subject to the CIP standards, of which 270 reported having high or medium impact BES Cyber Systems. That leaves a large group of entities whose obligations are mostly low impact, so the practical work is confirming which group you are in.

Your actual obligations depend on your asset list and the Attachment 1 categorization, not on your registration category or on how large your operation is. Start by listing each asset that could contain BES Cyber Systems and rating it against the bright-line criteria. Under CIP-002-5.1a Requirement R1 Part 1.3, you must identify the assets that contain low impact BES Cyber Systems, but you do not have to keep a discrete list of each low impact system. Record the basis for each rating and the approval by the CIP Senior Manager, and retain that evidence for three calendar years. Confirm the categorization with your Regional Entity's guidance before relying on it, because a misrating is the most common reason a low impact program turns out to be incomplete.

What CIP-003 requires and what it does not

Requirement R2 applies to any entity with at least one asset containing low impact BES Cyber Systems. The entity must implement documented cyber security plans that cover the six sections listed in Attachment 1 of the standard. The plans do not need to be separate for each asset, but the entity must be able to show which plan applies where and that the plan is actually followed. The obligation is about having written, implemented controls that match the low impact risk, not about building a catalog of every device.

Cyber security awareness: A documented method for reinforcing security awareness at least once every 15 calendar months.
Physical security controls: Documented controls that restrict physical access to low impact BES Cyber Systems or their Cyber Assets.
Electronic access controls: Documented controls for electronic access into the assets, including any Electronic Access Points for external routable connectivity.
Cyber security incident response: A documented response process for low impact incidents.
Transient cyber assets and removable media: Documented controls for the use of these media on low impact assets.

Confirm with your Regional Entity how it expects the sixth section, vendor electronic remote access, to be evidenced under the version enforceable from 1 April 2026. Check the exact wording of Attachment 1 in the NERC standard PDF before finalizing plan language.

Who the CIP Senior Manager is and what the role carries

CIP-003-9 requires every entity with low impact BES Cyber Systems to name one CIP Senior Manager. The role is small on paper but carries real accountability, and the cards below cover what the standard asks, what delegation can and cannot move, and what an assessor will check.

One named individual

CIP-003-9 R3 requires you to identify a CIP Senior Manager by name, so a job title or a team alias does not satisfy it. Choose one person who has the authority to approve the cyber security policies and plan. Record the name in a document an auditor can retrieve, and confirm that the person knows they hold the role.

Changes documented within 30 days

When the CIP Senior Manager changes, the entity must document the change within 30 calendar days. Missed updates are a common finding because the person leaves or moves roles and nobody updates the record. Assign an owner for the update in your offboarding and role-change procedures, and keep the dated record of the change.

Delegations that stay with the senior manager

The CIP Senior Manager may delegate specific actions to named delegates, but delegation does not transfer accountability. The senior manager remains answerable for the outcome, so each delegation should be written down, limited to defined tasks and reviewed when people change. Ask an assessor's likely question early: can you show who approved each delegated action and when?

Accountability for the plan

The CIP Senior Manager is the person an auditor expects to answer for the cyber security plan that covers low impact BES Cyber Systems. That means knowing which plan sections are in place, which are owned by others, and where evidence sits. Schedule a periodic review with the senior manager so they can sign off on the plan's current state rather than learning about gaps during an audit.

Fit with executive ownership

Many organizations place the senior manager inside operations, security or compliance, then report progress to an executive sponsor. Decide whether the sponsor is the same person or a separate officer, and make sure the sponsor understands the reporting line. Confirm with your own governance documents that the senior manager has the authority the standard implies, not only the job title.

What the assessor asks to see

Expect the assessor to ask for the current name, the date of the last update, the record of any change within the required window, and the list of delegations with their scope. They will also ask how the senior manager approved the plan. Prepare these records in one folder, and test the retrieval before the audit notice arrives so the evidence is available on request.

How often a low impact entity is audited

Most low impact only entities should expect a risk-based audit schedule rather than a fixed cycle. Under Section 403.10.1 of the NERC Rules of Procedure, Balancing Authorities, Reliability Coordinators and Transmission Operators receive a Compliance Audit at least once every three years. Every other registered entity is audited on a risk-based schedule set by its Regional Entity, and an entity whose assets contain only low impact BES Cyber Systems usually falls into that second group. Do not assume the three-year rule applies to you because your program is small. Ask your Regional Entity in writing which schedule it has assigned to your registration, which functions you are registered for, and what it weighs when it sets that schedule, such as past findings, changes in your asset footprint and recent compliance history.

An audit is not the only way a low impact entity hears from its Compliance Enforcement Authority. Monitoring can also come through Spot Checks, Self-Reports that you file when you find a possible noncompliance, and periodic data submittals that the Regional Entity requests. Self-Certifications are another route, and the Compliance Enforcement Authority gives at least 60 days' notice before one is due. In a Self-Certification you may state that you are compliant, not compliant, that you own no Facilities subject to the requirement, or that the requirement does not apply. Receiving the request is not a finding of compliance, so the reader should keep the evidence for each statement ready in case it is tested. Confirm with the Regional Entity which of these routes it uses for low impact entities and how it selects them, because the answer shapes how much of your CIP-003 evidence must be retained and easy to retrieve at short notice.

How a Self-Certification works and what a reply must say

A Self-Certification is a written, dated statement from the entity to its Compliance Enforcement Authority about one requirement at a time, backed by an evidence index that a compliance lead can defend if the CEA follows up. It confirms the entity's position on each requirement and does not, on its own, establish that the entity is compliant.

Receive the CEA notice and confirm scope
The Compliance Enforcement Authority, usually the Regional Entity, sends notice that a Self-Certification is due. The notice gives at least 60 days before the response is required, and the notice is the starting point for everything that follows. The compliance lead, with the CIP Senior Manager, confirms which requirements are listed, which assets and BES Cyber Systems they touch, and whether the entity's current CIP-002 categorization still matches the facilities it operates. The step closes when the team has a written scope list and a named owner for each requirement. Ask the CEA to clarify anything ambiguous before work starts, and record the answer.
Assess each requirement against the current facts
For each listed requirement, the compliance lead checks the entity's assets and controls as they exist today, not as they were documented at the last review. Low impact entities should pay particular attention to the CIP-003-9 cyber security plan sections and the CIP Senior Manager designation, since those are the controls most often in scope. The step closes with a working note per requirement stating what the entity does, which asset types it applies to, and whether any requirement does not apply because the entity owns no Facilities subject to it. Where a gap is found, the team records it now rather than waiting for the reply.
Choose the statement for each requirement
For each requirement, the entity selects one of the statements the Self-Certification form allows: compliant, not compliant, owns no Facilities subject to the requirement, or the requirement does not apply. The choice must match the evidence the team can produce, not the answer the entity hopes the CEA will accept. Statements of non-compliance do not need to be softened, and they should be followed by the entity's remediation or self-reporting route under the enforcement process. The step closes with a signed-off table of statements that the CIP Senior Manager or an authorized delegate has reviewed.
Build the evidence index
The team builds an index that maps each stated position to the documents, screenshots, configuration exports, logs, training records or meeting minutes that support it. Each evidence item gets a file name, a date, an owner and the requirement it supports. Evidence must cover the period the Self-Certification describes, and the entity should keep it for at least the three calendar years that CIP-002-5.1a sets for its evidence. The step closes when a reviewer who did not prepare the index can trace every compliant statement to at least one dated item and can see which items are missing.
Review the reply with the executive owner
A senior officer or the CIP Senior Manager reviews the draft reply, the statements and the evidence index together. The review checks that each statement is accurate, that no requirement has been left blank, and that any claim of not applicable has a stated reason. Legal or regulatory counsel may also review the wording, particularly where a statement of non-compliance is made. The step closes with recorded approval, the name of the approver and the date of approval, all retained with the evidence index.
Submit a dated statement and retain the package
The entity submits the Self-Certification response by the date in the CEA notice, using the method the CEA specifies. The submitted statement is dated, signed by the authorized person, and stored with the evidence index, the approval record and the working notes. The step closes with a confirmation of receipt from the CEA, or a record of the submission method if no confirmation is returned. The team should note the response date in its compliance calendar so the next cycle starts from a known baseline.
Track what the CEA does next
Receiving a Self-Certification is not a finding of compliance. The CEA may review the response, request more evidence, open a Spot Check, schedule a Compliance Audit or take other monitoring steps. The compliance lead tracks any follow-up request, answers it from the same evidence index, and records each answer with its date. If a gap was disclosed, the entity should follow its remediation and mitigation process rather than wait for the CEA to raise it. The step closes when the CEA confirms no further action is needed, or when each open request has an owner and a delivery record.

What must be in place before a low impact audit

A Regional Entity reviewing a low impact only program will start with whether the categorization, the plan and the people behind them are current and documented. The six cards below cover the records an auditor asks for first, and each one should be dated, owned and traceable to the requirement it supports.

Current categorization record

Keep the CIP-002-5.1a categorization record showing which assets contain BES Cyber Systems and why each one rates as low impact. The standard requires evidence for each requirement to be kept for three calendar years, so retain prior versions alongside the current one. A discrete list of low impact systems is not required, but the asset identification must be defensible. Confirm that the record was reviewed after any asset change or new connection.

Dated CIP-003 cyber security plan

Hold one or more documented cyber security plans covering the six sections of Attachment 1, each with an approval date and the name of the approver. Auditors check that the plan on file is the version in force, not a draft. Record each revision and the reason for it. Confirm that the plan reflects the CIP-003-9 requirements now enforceable, including the vendor remote access section.

Named CIP Senior Manager and change log

Identify the CIP Senior Manager by name and keep a dated log of every change to that designation. CIP-003-9 R3 requires the change to be documented within 30 calendar days. The log should also show any delegations of authority under the plan, with the delegate's name and the dates they applied. Check that the named person can still answer for the program, since a stale name is a simple finding to avoid.

Evidence of plan implementation

A plan on paper does not show it is operating. For each Attachment 1 section (security awareness, physical access controls, electronic access controls, incident response, transient cyber assets and removable media, and vendor remote access), keep records that show the control ran. Examples include training completion, badge or lock records, access logs, incident tickets and malware scan results. Match each record to a specific section so the assessor can follow the trail without help.

Vendor remote access records

Vendor electronic remote access to low impact BES Cyber Systems became enforceable on 1 April 2026. Keep records of each vendor session or access grant, including who connected, when, the purpose, and the controls applied, such as disabling access when work ends. Retain records showing how vendor communications were detected and how any malicious activity was responded to. Confirm with your Regional Entity which evidence formats it accepts before the audit notice arrives.

Evidence index mapped to requirements

Build one index that lists each evidence item, its storage location, its owner, its retention end date and the requirement it supports. This turns a scattered folder set into a document an auditor can follow directly. Review the index on a set schedule and after each plan revision. An implementation partner can help structure the index and collect records, but the entity owns the controls and the evidence it produces.

Who owns the work for a low-only program

This table compares what the registered entity, an implementation partner such as DeployOpen, and the Compliance Enforcement Authority or its auditors each own across a low impact only CIP program. Read each row as a split of accountability: the entity decides and signs, the partner prepares systems and evidence, and only the CEA or its auditors issue findings. Confirm the split in your written scope before work starts.

Area	The registered entity	Implementation partner (for example DeployOpen)	Regional Entity or independent assessor
Categorization decisions	Owns the CIP-002 categorization and confirms every asset is rated low impact	Documents the asset review and drafts supporting records for entity sign-off	Reviews categorization during an audit or spot check and issues any finding
Cyber security plan authorship and approval	Approves the CIP-003 cyber security plan sections and assigns senior approval	Drafts plan sections and maps them to the Attachment 1 topics for review	Tests whether the plan exists, is implemented and is reviewed
CIP Senior Manager designation	Names the CIP Senior Manager and records each change within the required window	Prepares the delegation record template and change-tracking workflow	Checks the named individual and change dates against records
Evidence collection	Keeps evidence for the retention period and answers for its accuracy	Configures logging, exports and records that show the controls operate	Samples evidence, judges sufficiency and requests more when needed
System hardening and remote access configuration	Decides acceptable vendor access and accepts residual risk	Configures systems, vendor access paths and detection, and documents settings	Assesses the configured state against the requirement during monitoring
Audit or monitoring response	Leads the response, owns Mitigation Plans and signs submittals	Assembles evidence packages and prepares technical explanations on request	Issues findings, decides the schedule and determines any violation

What usually delays a low-only program

Low impact only programs rarely fail on technical controls. They stall on scope creep, missed administrative deadlines, and assumptions about what an outside review or a self-attestation means. The cards below cover the decisions that most often cost time, and how to avoid each one.

Building inventories CIP-003 does not require

Many teams start by cataloguing every low impact BES Cyber System, then discover the work was never required. CIP-002-5.1a R1 Part 1.3 requires entities to identify the assets that contain low impact BES Cyber Systems, not a discrete list of those systems. CIP-003-9 R2 requires implemented cyber security plans covering the six Attachment 1 sections, and does not require an inventory or lists of authorized users. Before building anything, confirm with your Compliance team which artifacts the plan actually needs, and document that boundary so the scope decision can be defended at audit.

Missing the 30-day Senior Manager change window

CIP-003-9 R3 requires naming a CIP Senior Manager and documenting any change within 30 calendar days. The requirement carries a Medium Violation Risk Factor, and it is easy to miss during reorganizations, retirements or leave coverage because nobody owns the trigger. Assign a named owner to watch HR and org changes, keep the designation in a controlled document with a dated change log, and confirm that any delegations are recorded alongside it.

Treating a Self-Certification as a clearance

A Self-Certification is a request for the entity to state its compliance status, and it is not a finding of compliance. The entity may report that it is compliant, not compliant, owns no applicable Facilities, or that a requirement does not apply, and the Compliance Enforcement Authority gives at least 60 days' notice before the submission is due. Treat each Self-Certification as a signed statement backed by evidence, and keep the supporting records ready for any follow-up review.

Weak vendor remote access evidence

Vendor electronic remote access for low impact assets is enforceable under CIP-003-9, and the evidence is often thin because access happens through informal tools or shared accounts. Auditors look for documented methods to determine, disable and detect malicious vendor communications, plus records showing that controls worked in practice. Inventory every vendor pathway, log sessions with the vendor identity, and test the disable procedure at least once so the evidence reflects operation, not intent.

Unclear ownership of categorization decisions

The CIP-002 categorization decides whether a program is low only, and a change in that decision reshapes every other obligation. Problems arise when operations, engineering and compliance each assume another group signed off on the impact rating for a substation, generation site or control system. Record who approves the categorization, what evidence supports each rating against the Attachment 1 criteria, and when the review repeats after a material change to the asset or its connectivity.

Questions low impact entities ask before hiring help

Can a low impact only entity run its NERC CIP program in-house?

Yes, in principle. A low impact only entity has no high or medium impact BES Cyber Systems, so CIP-004 through CIP-011 mostly do not apply, and the core work sits in CIP-002 categorization and the CIP-003 cyber security plan. Whether in-house staff can carry it depends on whether someone can own the six plan sections, maintain asset identification, name and document the CIP Senior Manager, and produce evidence on request. Many entities split the work: internal staff own the policy and decisions, while an outside implementation partner prepares documentation, configuration evidence and remote access tooling. Confirm the scope of your own assets with your Regional Entity before deciding.

How much effort does a low impact CIP program typically need?

The effort depends on the number of asset sites, how many of them have Cyber Assets that could be low impact BES Cyber Systems, whether any vendor remote access exists, and how many people must be trained on the plan. Effort is usually front-loaded in the first categorization and plan write-up, then recurs through annual review, change tracking and evidence collection. Ask your Regional Entity or a qualified consultant to walk through your asset list, and request a written estimate that breaks effort into categorization, plan drafting, technical controls and evidence preparation. No general figure is given here because it turns on your environment.

What must the organization provide to an implementation partner?

A partner can only prepare systems and evidence that the entity can describe and access. Before work starts, the entity should provide:

The current CIP-002 categorization record and asset list by site
Network diagrams and any inventory of Cyber Assets at low impact sites
Existing security policies, access records and vendor remote access arrangements
A named internal owner for decisions, and the name of the CIP Senior Manager
Written permission and a secure channel for access to your environment

The written scope should state which deliverables the partner produces and which decisions remain with your team.

How do we confirm the Regional Entity audit schedule?

Ask your Regional Entity directly. Under Section 403.10.1 of the NERC Rules of Procedure, Balancing Authority, Reliability Coordinator and Transmission Operator entities receive a Compliance Audit at least once every three years, while other registered entities are audited on a risk-based schedule that the Regional Entity sets. Because most low impact only entities fall into the risk-based group, there is no fixed cycle to rely on. Request your current monitoring schedule in writing, ask what risk factors drove it, and record the contact who confirmed it. Review the NERC Rules of Procedure in the context of your registration category, since your category determines which rule applies.

Is a Self-Certification required for a low impact only entity?

A Self-Certification is not a standing annual filing that every entity must make, but the Compliance Enforcement Authority can request one. When it does, it gives at least 60 days' notice, and the entity may state that it is compliant, not compliant, owns no Facilities subject to the requirement, or that the requirement does not apply. Receiving a Self-Certification request is not a finding of compliance, but the answer must be accurate and supported by evidence. Keep the evidence for each CIP-003 requirement ready at all times, and treat any request as a formal monitoring activity. Confirm the process and timing with your Regional Entity under Appendix 4C.

What does the $1,584,648 maximum civil penalty figure mean for a low impact entity?

The figure is the maximum civil penalty referenced by NERC's Sanction Guidelines under 18 CFR 385.1602(d), stated as $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 and shown in the eCFR in October 2026. It is a statutory ceiling, not a typical outcome. Actual penalties depend on factors such as the seriousness of the violation, duration, the entity's compliance history, self-reporting, and mitigation. A low impact only entity can still incur penalties for a missed CIP-003 requirement, so the practical lesson is to document controls, self-report issues promptly, and keep evidence current. Check the current figure in the eCFR before citing it internally.

Does bringing in outside help change who is accountable for compliance?

No. The registered entity remains accountable for its CIP compliance, and it owns its controls, its CIP Senior Manager designation and its evidence. An implementation partner, such as DeployOpen, prepares systems, documentation and evidence under a written scope, but it does not issue audit reports or certifications. Only the Compliance Enforcement Authority, through its monitoring activities, determines compliance outcomes. Contracts should state clearly which tasks the partner performs, which remain with your staff, and who signs off each deliverable. There is no CIP certificate to buy, so be cautious of any offer that implies one.

How DeployOpen works on this

DeployOpen helps low impact only entities prepare the systems and evidence that show their CIP-003 cyber security plan is implemented, working inside the entity's own infrastructure. DeployOpen does not issue audit reports or determine compliance; the Compliance Enforcement Authority and its audit or self-certification process do.

How we scope

Engagements are fixed-scope, with the low impact asset types, sites and plan sections agreed in writing before work starts.
The written scope names which plan sections, vendor remote access paths and CIP Senior Manager records are covered.
Scope also states what is excluded, such as any high or medium impact systems, so the boundary is clear to your auditor.

How we build

We prepare the documented cyber security plan sections against your asset list and current CIP-003-9 wording.
We configure vendor remote access controls for low impact assets, including determining, disabling and detecting vendor sessions where applicable.
We set up logging and change records that hold evidence for the three calendar years the standards require for retention.

How we hand over

You receive the plan documents, configuration records, runbooks and evidence index mapped to each requirement.
Documentation covers who owns each control, how it is reviewed and when the CIP Senior Manager record was last updated.
Your team can run the controls after handover without depending on DeployOpen for day-to-day operation.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the initial engagement.
Retainer support can keep evidence current ahead of a Self-Certification or a Regional Entity audit notice.
Before any engagement, ask us to confirm which deliverables your auditor or Regional Entity will expect to see.