NERC CIP low impact requirements checklist: what CIP-003-9 requires

What a NERC CIP low impact requirements checklist must cover

If every asset you own contains only low impact BES Cyber Systems, CIP-003-9 R2 requires you to implement documented cyber security plan(s) that cover the six sections of Attachment 1, and R3 requires you to name a CIP Senior Manager and document any change to that name within 30 calendar days. Those two obligations are the core of the checklist. Your organization owns the controls and the decisions behind them. An implementation partner can help you draft the plan, configure systems and assemble evidence, but only an independent auditor or the Regional Entity acting as Compliance Enforcement Authority concludes whether you comply. Before you start, confirm with your Regional Entity which of your assets are low impact, since CIP-002-5.1a sets that scope.

The six Attachment 1 sections are the working checklist. Section 1 covers reinforcing cyber security practices at least once every 15 calendar months, which is the awareness piece. Section 2 covers need-based physical access controls. Section 3 covers electronic access controls that permit only necessary inbound and outbound routable communications and authenticate Dial-up Connectivity. Section 4 covers a Cyber Security Incident response plan that includes E-ISAC notification of Reportable Cyber Security Incidents, tested at least once every 36 calendar months and updated within 180 calendar days after a test or actual incident. Section 5 covers malicious code mitigation for Transient Cyber Assets and Removable Media. Section 6, new in CIP-003-9, requires methods to determine, disable and detect known or suspected malicious communications for vendor electronic remote access. For each section, record the owner, the procedure, the date of last review and the artifacts that show it ran, such as training attendance, access change tickets, drill reports and vendor session logs.

The checklist is also defined by what it leaves out. CIP-003-9 does not require a discrete inventory of low impact BES Cyber Systems or lists of authorized users, although you must still identify the assets that contain them. Ask your compliance lead or consultant to confirm which of the CIP-004 to CIP-011 requirements apply to your specific asset types, because most of them are scoped to high and medium impact systems. Also confirm whether any CIP Exceptional Circumstances procedure is needed, since CIP-003-9 Part 1.2 lists it as a topic to address. Plan the next review cycle now, because the CIP-003-11 changes for low impact assets with external routable connectivity take effect on 1 July 2029.

Which policies and the CIP Senior Manager does a low impact program need?

CIP-003-9 sets a short list of governance obligations for low impact programs: one documented cyber security plan that covers six sections, and a named CIP Senior Manager. Each card below covers one obligation, what it asks for, and what an auditor will look for. The asset identification step under CIP-002-5.1a comes first, because it defines what the plan protects.

Documented cyber security plan under R2

Requirement R2 applies to any entity with at least one asset containing low impact BES Cyber Systems. The entity must implement documented cyber security plans that address the six sections of Attachment 1. The plan is the core artifact of the program, so it should name the assets it covers and show how each section is met. Check that the document is current, approved and tied to the sections an auditor will test, rather than a generic policy with no asset references.

CIP Senior Manager identified by name

Requirement R3 requires the entity to identify a CIP Senior Manager by name. This person is accountable for the CIP program and is the named contact for the Compliance Enforcement Authority. Confirm that the designation is documented, that the individual has the authority to approve the plan, and that the name matches current employment records. A vacant or outdated designation is one of the simplest findings an assessor can raise.

Change documentation within 30 days

Any change to the CIP Senior Manager must be documented within 30 calendar days of the change. Staff turnover, reorganization and acting appointments all trigger this clock. Keep a dated record of each change, including the effective date and the approver. Assessors commonly compare the change log against HR and org chart records, so a gap between the two can become an issue even when the program is otherwise sound.

Medium Violation Risk Factor

R3 carries a Medium Violation Risk Factor. This rating affects how the Compliance Enforcement Authority weighs a violation when setting penalties and mitigation expectations. It does not lower the duty to comply. Use the rating to prioritize internal reviews: the Senior Manager designation and its change log should be checked at least as often as the plan sections, because they are simple to verify and easy to let drift.

Delegation of CIP authority

The CIP Senior Manager may delegate specific authorities to other named individuals. Each delegation should be written, identify the delegate by name, and state the scope of the authority delegated. The Senior Manager remains accountable for the delegated work. Confirm that delegations are reviewed when roles change, and that no delegate is acting on an authority that was never documented or has already been withdrawn.

Asset identification under CIP-002-5.1a

No discrete inventory of low impact BES Cyber Systems is required, and no list of authorized users is required for low impact assets. Entities must still identify the assets that contain low impact BES Cyber Systems under CIP-002-5.1a R1 Part 1.3. This identification sets the boundary of the plan. Keep the asset list current, and record the basis for each categorization so an assessor can trace the scope back to the impact criteria.

What each of the six Attachment 1 sections requires

Section 1 asks the entity to reinforce its cyber security practices for low impact assets at least once every 15 calendar months. The obligation is about keeping people current, not about running a specific course. Staff who work on or near low impact assets should be reminded of the practices in the plan, and the entity should be able to show when that reminder happened and what it covered.

Cadence: Set a reinforcement date no later than 15 calendar months after the previous one, and track it on a calendar that the compliance lead owns.
Audience: Include employees, contractors and anyone else who performs work at the assets, not only the operations group.
Format: Briefings, newsletters, toolbox talks and short e-learning modules can all qualify if they reinforce the plan's practices.
Evidence: Keep the agenda or slide deck, the attendance or distribution list, and the date for each reinforcement.

Confirm with your Regional Entity how it expects reinforcement to be documented, since auditors often ask for the content as well as the date.

What CIP-003-9 does not require for low impact assets

CIP-003-9 does not ask a low impact entity to run the high and medium impact program. Requirement R1, the cyber security policy requirement that most people associate with CIP-003, applies to high impact and medium impact BES Cyber Systems. For assets that contain only low impact BES Cyber Systems, the obligation sits in Attachment 1 and in the cyber security plan under R2. The main thing a low impact program does not need to carry is the 15-month awareness cycle written for high and medium systems, because low impact assets have their own awareness requirement in Attachment 1 Section 1. Read the two as separate obligations so that the program does not over-build or double count evidence.

Two items often get built by default and are not required here. A discrete inventory of low impact BES Cyber Systems is not required. CIP-002-5.1a R1 Part 1.3 asks you to identify the assets that contain low impact systems, not to list each system. Lists of authorized users for low impact access are also not required under CIP-003-9. Keep the asset identification current, because it is the basis for deciding which assets fall under R2 at all. Keep any user or system lists you already maintain for operations, but do not treat them as a CIP-003 compliance artifact unless your plan relies on them.

Most requirements in CIP-004 through CIP-011 are scoped to high impact and medium impact systems, or to subsets such as medium impact systems with External Routable Connectivity. Their Applicable Systems columns, which list the system categories each Part covers, decide whether a requirement reaches your environment. Read each Part's table on its own, because one standard can apply to a Part differently from the next. Confirm your scope against your CIP-002 categorization record, and have someone other than the author check it. If your categorization is wrong, the wrong set of requirements will look satisfied on paper.

How to check the program is ready before a Regional Entity review

A Regional Entity reviews a low impact program by asking for documents and evidence that show the plan exists, is current and is followed. The six checks below walk through those artifacts in the order an auditor usually asks for them. Each check names the record to pull, the test to run and the person who should sign off before the review starts.

Confirm the categorization record

Start with the CIP-002 categorization record that shows which assets contain low impact BES Cyber Systems. Confirm that each listed asset was reviewed against the Attachment 1 bright-line criteria and that the rating date and approver are recorded. Compare the asset list with the current fleet, since a station added or retired after the last review changes which plan applies. The CIP Senior Manager or delegate should approve the record, and the operations lead should confirm the asset list matches field reality.

Confirm the plan covers six sections

Check that the CIP-003-9 cyber security plan addresses all six sections of Attachment 1, and that the plan carries an approval date and revision history. Read each section against the operating practice it describes, not against the document's table of contents. Missing sections, undated revisions or sections that describe tools the site no longer uses are common findings. The CIP Senior Manager approves the plan, and the technical owner of each section confirms the content is accurate.

Confirm awareness and incident response testing

Pull the dated records for reinforcing cyber security practices, which must occur at least once every 15 calendar months under Section 1. Then pull the incident response plan test record, which must show a test at least once every 36 calendar months, and the plan update made within 180 calendar days after that test or any actual incident. Calendar gaps are the most common problem, so calculate the next due date for each item. The security lead prepares the records and the CIP Senior Manager signs off on the test results.

Confirm vendor remote access methods

Under Section 6, the plan must describe methods to determine, disable and detect known or suspected malicious communications for vendor electronic remote access, and this requirement has been enforceable since 1 April 2026. Gather one or two examples of each method, such as session logs, access enable and disable records, or alerting tied to vendor sessions, and confirm each example matches what the plan describes. The operations manager should walk through a vendor session from start to finish to verify the evidence trail is complete.

Confirm CIP Senior Manager documentation

Verify that the CIP Senior Manager is identified by name and that every change in that role is documented within 30 calendar days. Check that any delegations of authority are written down, name the delegate, and state the scope of what the delegate may approve. A name that refers to someone who has left the company is a finding even when the plan itself is current. The chief executive or designated officer should confirm the current designation, and the HR or legal contact should confirm the employment status of the named individuals.

Confirm evidence retention and location

Check that every record referenced in the plan is stored where an auditor can reach it, with a retention rule that covers the audit period the Regional Entity will request. Confirm that files are not overwritten by later revisions and that access to the evidence store is limited to people who need it. Test the retrieval path by pulling three records at random and timing how long each takes, since a slow retrieval during an audit creates its own questions. The compliance lead owns the retention rule, and the IT administrator confirms the storage controls.

In what order should a low impact plan be built?

The sequence moves from confirming which assets are low impact to a tested, reviewed cyber security plan with evidence behind each of its six sections. Each step closes with a named output so the program can be checked at every stage.

Confirm asset categorization under CIP-002-5.1a
Start by confirming which of your facilities contain BES Cyber Systems and that none of them rate as high or medium impact under the bright-line criteria in CIP-002-5.1a Attachment 1. The entity owns this decision, and it usually needs the operations, engineering and compliance teams to agree on the asset list. You know this step is done when you hold a documented categorization record that names each asset containing low impact BES Cyber Systems. A discrete list of individual low impact systems is not required, but you must be able to show which assets are in scope.
Assign and document the CIP Senior Manager
Name one individual by name as the CIP Senior Manager under CIP-003-9 R3. This person is accountable for the low impact program, and the entity owns the appointment. Record any later change in writing, and confirm the documentation deadline for changes in the NERC standard text before you rely on it. The output is a signed or approved designation that auditors can match against the plan's ownership and approval records.
Draft the cyber security plan against the six sections
Write the documented cyber security plan that CIP-003-9 R2 requires, organized around the six sections of Attachment 1: reinforcing awareness, need-based physical access, electronic access controls, incident response, transient assets and removable media, and vendor electronic remote access. Map each section to the asset types in scope and to the people who own the work. The output is an approved draft in which every section states what the entity does, who does it, and where the evidence is kept. Ask any implementation partner to work from this structure and deliver the plan in writing, with the timing confirmed in the written scope.
Implement controls and collect evidence
Put each documented control into operation, starting with the vendor electronic remote access controls, which are enforceable for low impact assets from 1 April 2026. For each section, define the evidence that shows the control works, such as access logs, firewall rule reviews, awareness materials, removable media procedures and vendor session records. A partner can configure systems and gather this evidence, but the entity owns the controls. The output is an evidence index that links each plan section to dated records.
Test the incident response plan
Test the Cyber Security Incident response plan covering E-ISAC notification of Reportable Cyber Security Incidents, which Attachment 1 Section 4 requires at least once every 36 calendar months. Use a tabletop exercise or a simulated scenario, record who was notified, how the E-ISAC step was handled, and where the plan fell short. The plan must then be updated within 180 calendar days after a test or an actual incident. The output is a test record and a dated plan revision that shows the lessons learned.
Schedule the periodic review and reinforcement cycle
Set up a recurring review calendar for the reinforcing cyber security practices required at least once every 15 calendar months under Attachment 1 Section 1, and for the plan itself. Assign owners for each recurring task and keep the calendar with the evidence index. Confirm your compliance monitoring approach with the Regional Entity, since low impact entities are generally audited on a risk-based schedule. The output is a maintained calendar and a review log that shows each cycle was completed on time.

Which gaps show up most often in low impact programs?

Low impact programs usually fail on documentation and scope rather than on technology. The gaps below cluster around the CIP-003-9 cyber security plan, the vendor remote access section, the incident response test cycle, the CIP Senior Manager record, and assumptions carried over from higher impact standards.

Plan covers only some sections

CIP-003-9 R2 requires a documented cyber security plan that includes all six sections of Attachment 1, and Part 1.2 lists the seven topics the plan must address. Teams often write a strong access control section and leave out awareness, transient assets and removable media, or CIP Exceptional Circumstances. Avoid this by mapping each Attachment 1 section to a named plan heading and a named owner, then checking the draft against Part 1.2 before approval.

Vendor remote access handled outside the plan

Section 6 of Attachment 1 requires methods to determine, disable and detect known or suspected malicious communications for vendor electronic remote access, and this has been enforceable since 1 April 2026. Vendor logins often run through a support tool or a contractor's own account that sits outside the written plan. Avoid this by inventorying every vendor remote path that reaches low impact assets, documenting it inside the plan, and keeping the disable and detection steps as evidence.

Incident response plan not tested on schedule

Section 4 of Attachment 1 requires a Cyber Security Incident response plan that covers E-ISAC notification of Reportable Cyber Security Incidents, and it must be tested at least once every 36 calendar months. Plans are often written at adoption and then never exercised, or tested without a record of the update that follows. Avoid this by setting a test date in the compliance calendar, recording the test scenario and attendees, and updating the plan within 180 calendar days of the test or an actual incident.

No dated record of CIP Senior Manager change

CIP-003-9 R3 requires naming a CIP Senior Manager by name and documenting any change within 30 calendar days. When a senior manager retires or moves roles, the replacement is sometimes named in email or a board minute without a dated change record. Avoid this by keeping one controlled document that lists the current CIP Senior Manager, the effective date, and the date of each prior change, and by adding a 30-day trigger to the role change process.

Assuming CIP-005 or CIP-007 apply

Teams that come from medium or high impact programs sometimes build Electronic Security Perimeters, ports and services baselines, or 35-day patch cycles for assets that only hold low impact BES Cyber Systems. CIP-003-9 Attachment 1 sets the low impact control set, and CIP-005 and CIP-007 are scoped to other system types. Avoid this by confirming the CIP-002 categorization for every asset, then writing down why each higher impact standard is or is not in scope.

Access and awareness controls with no evidence

Section 1 of Attachment 1 requires reinforcing cyber security practices at least once every 15 calendar months, and Section 3 requires electronic access controls that permit only necessary inbound and outbound routable communications. Programs often run these activities but keep no dated reminder, attendance list, or firewall rule review. Avoid this by defining what evidence each practice produces, storing it on a fixed schedule, and reviewing it before any Regional Entity request.

Common questions about low impact CIP-003-9 requirements

Do I need a discrete inventory of low impact BES Cyber Systems under CIP-003-9?

No. CIP-003-9 does not require a discrete list of low impact BES Cyber Systems or a list of authorized users. You still have to identify the assets that contain low impact BES Cyber Systems under CIP-002-5.1a R1 Part 1.3, and your documented cyber security plan must cover the six sections of Attachment 1 for those assets. Many entities keep an asset-level register anyway, because it makes the scope of each plan section easier to show during an audit. Confirm with your Regional Entity whether it expects any additional records for your specific assets.

Can a low impact CIP program be run in-house?

Yes, in many cases. The obligation sits with the registered entity, and the work is mostly policy writing, plan maintenance, access and physical controls at each asset, incident response testing, and record keeping. Staffing depends on how many assets you have, how many remote vendors connect to them, and how much of the environment is already documented. Entities with few assets often run the program with existing IT and operations staff, while entities with many sites or complex vendor access may want outside support for the technical controls. Your internal team should own the decisions and the evidence, whatever help you bring in.

What can an outside implementation partner do for a low impact program, and what can it not do?

A partner can help prepare systems and evidence: configuring vendor remote access controls, documenting electronic access rules, setting up malicious code checks on transient assets and removable media, building incident response tabletop material, and organizing records for review. A partner cannot own your controls, decide your risk acceptance, or sign off on compliance. DeployOpen plans and implements these items under a written, fixed scope, but it does not issue audit reports or attestations. Only the Regional Entity acting as Compliance Enforcement Authority decides whether your program meets the standard. Ask any partner to state its role in writing before work starts.

How does the Compliance Audit schedule work for risk-based entities under Section 403.10.1?

Section 403.10.1 of the NERC Rules of Procedure requires a Compliance Audit at least once every three years for entities registered as Balancing Authorities, Reliability Coordinators or Transmission Operators. Other registered entities, which often include low impact only owners, are audited on a risk-based schedule set by the Regional Entity. That means the timing and depth of an audit depend on how the Regional Entity assesses your risk, not on a fixed cycle. Because the schedule can change, keep your plans and evidence current at all times, and confirm your registration category and the most recent notice from your Regional Entity.

What must the CIP Senior Manager document under CIP-003-9 R3?

The CIP Senior Manager must be identified by name, and any change to that designation must be documented within 30 calendar days of the change. The requirement carries a Medium Violation Risk Factor, so missed updates after a staff change are a common finding. Keep the documentation with your policies, record the effective date, and check it whenever a role changes hands. The Senior Manager is accountable for the program, so the person named should have the authority and knowledge to approve the plan and its updates. Delegations of authority under CIP-003 should be recorded in the same place.

How does the 2026 vendor remote access requirement differ from the CIP-003-11 changes?

The 2026 requirement is in CIP-003-9 Attachment 1 Section 6, enforceable since 1 April 2026. It asks you to determine, disable and detect known or suspected malicious communications for vendor electronic remote access to low impact assets. CIP-003-11, approved in Order No. 918 with an effective date of 1 July 2029, adds remote user authentication, protection of authentication information in transit and malicious communication detection for low impact assets with external routable connectivity. In short, the 2026 change asks for vendor access controls now, while the 2029 change extends authentication and communication protections. Plan the 2026 work first, then add the later controls to the same design and documentation.

How DeployOpen prepares low impact evidence

DeployOpen helps low impact entities prepare the systems, documentation and evidence that a CIP-003-9 cyber security plan needs. We work inside your own infrastructure on a written scope, and we do not issue compliance reports or attestations; those come from the Compliance Enforcement Authority or your own compliance team.

How we scope

We confirm which assets contain low impact BES Cyber Systems and which of the six Attachment 1 sections apply to them.
We agree in writing which plan sections, systems and documents are in scope before any work begins.
Engagements are fixed-scope, with deliverables and timelines set out in the agreed statement of work.

How we build

We set up the access controls, remote access paths and incident response procedures that the plan sections describe.
We configure vendor electronic remote access controls for malicious communication detection, disablement and logging.
We draft the cyber security plan and supporting procedures so they match the systems as they are deployed.

How we hand over

We deliver the plan, configuration records, test results and evidence index to your named compliance owner.
We document the CIP Senior Manager identification and the process for logging changes within 30 calendar days.
We walk your team through where each piece of evidence lives so they can answer an audit request themselves.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial handover.
We can help you plan the 15-month awareness and 36-month incident response testing cycles as recurring tasks.
Ask us to confirm the scope and support terms in writing before any retainer or follow-on work starts.

NERC CIP low impact requirements checklist