FERC Order 912 CIP-013 changes: what they require

What FERC Order 912 changes for CIP-013 and who acts on it

FERC Order No. 912, issued 18 September 2025, directs NERC to submit new or modified supply chain standards within 18 months, and CIP-013-2 remains enforceable today for high and medium impact BES Cyber Systems and their associated EACMS and PACS. If a regulator, customer or contract now expects your supply chain plan to reflect the order, the work in front of you is a gap assessment of your current plan against the order's aims, not a rewrite against standards that are not yet final. The order asks whether plans adequately identify and respond to supply chain risks, and it extends supply chain protections to Protected Cyber Assets. Read the order's text yourself and confirm the exact deadline date it sets, since the 18-month period is the figure your planning should anchor to. Then check whether your procurement and vendor processes already cover the six Part 1.2 topics in CIP-013-2 and the related vendor access and software integrity requirements in CIP-005-7 and CIP-010-4.

Ownership is split in a way that matters for any outside engagement. Your organization owns its supply chain risk management plan and the decisions that come from it. An implementation partner can prepare systems, procurement records, configuration evidence and documentation so that the plan can be shown to work, but it cannot decide your risk tolerance or certify your program. Only an independent auditor or the Compliance Enforcement Authority, a Regional Entity or NERC, assesses compliance and issues findings. Ask any partner to state in writing which artifacts they will produce and which decisions remain with your staff, and ask your auditor early which evidence they expect to see for the revised plan content once it is known.

Plan for the gap now rather than waiting for the final text. Practical first steps include inventorying which vendors touch high and medium impact systems, confirming which of those vendors have agreed to incident notification, vulnerability disclosure and access termination terms, and checking whether Protected Cyber Assets are covered by the same procurement controls as the BES Cyber Systems they support. Document the results, assign an owner for each gap, and record the dates of your reviews. Where the order encourages but does not require vendor data validation, decide deliberately whether to adopt it as a voluntary practice and document that decision. The later 2028 changes in CIP-013-3 will need the same inventory, so the work is reusable.

How to update a supply chain plan before the revised CIP-013 takes effect

This sequence turns FERC Order No. 912 and the coming CIP-013-3 changes into a dated, evidenced update to the supply chain risk management plan, starting from a verified system inventory and ending in a documented review cycle.

Monitor NERC filings and FERC action
Assign one compliance lead to track NERC's standards development filings and FERC orders on supply chain, including Order No. 912 and the CIP-013-3 revisions approved in Order No. 919. Record each filing, its status and any comment or effective date in a regulatory watch log. Confirm current status on NERC's CIP standards page rather than relying on secondary summaries. The output is a dated watch log that the team reviews at a fixed internal cadence and that names which draft language could change your procurement obligations.
Inventory high and medium impact systems
Using your CIP-002 categorization, list every high and medium impact BES Cyber System, then record the associated Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) that support them. Include the vendor, product, version and support status for each asset, and note which systems have vendor remote access. Operations, engineering and the vendors' own service records usually hold details the CIP team lacks, so involve them. The output is a reconciled asset inventory signed off by the CIP Senior Manager or delegate.
Map procurement clauses to CIP-013-2 Part 1.2
Compare each existing purchase template, master services agreement and vendor security addendum against the six topics in CIP-013-2 Part 1.2: incident notification, coordinated incident response, notice when vendor access should end, disclosure of known vulnerabilities, software integrity and authenticity verification, and coordination of vendor remote access controls. Mark each topic as addressed, partly addressed or absent, and cite the clause. The output is a gap register linking each in-scope product or vendor to the contract language that covers, or fails to cover, each topic.
Identify Protected Cyber Asset coverage
Order No. 912 directs NERC to consider extending supply chain protections to Protected Cyber Assets (PCAs). Using the inventory, list the PCAs associated with high and medium impact BES Cyber Systems, noting which are vendor-supplied firmware, software or managed devices. Assess which of these would fall under a revised standard and which already fall under existing vendor controls. Confirm the final scope when NERC files its revised standards, since the requirements are not yet set. The output is a PCA coverage map marking each asset as covered, likely affected or out of scope, with the reason.
Revise procurement checklist and vendor requirements
Turn the gap register into a revised procurement checklist that buyers and engineers apply before purchasing or renewing in-scope equipment and services. Include the Part 1.2 topics, software source and integrity verification steps tied to CIP-010-4 R1 Part 1.6, and vendor remote access controls tied to CIP-005-7 R2 and R3. Agree contract amendment wording with legal for the gaps that remain. The output is an approved checklist, a list of contracts to amend at renewal, and an owner for each open item.
Document the updated plan and its approval
Revise the written supply chain cyber security risk management plan to describe the risk identification and response process, the inventory and PCA scope, the procurement checklist and the monitoring of FERC and NERC action. Record the approver and date, and keep prior versions. Confirm that the plan describes what the organization actually does, because the auditor tests implementation as well as the document. The output is an approved plan version with a change history, ready for an independent compliance review.
Set the review and update cycle
Schedule the plan review to meet the 15-month review cycle that CIP-013-2 requires, and add an earlier trigger when NERC or FERC finalizes a revised standard. At each review, refresh the inventory, the gap register and the watch log, and record any vendor incidents or vulnerability notices that changed the risk picture. The output is a review calendar, a retained record of each review and an updated plan version or a documented decision that no change was needed.

Which six vendor topics CIP-013-2 Part 1.2 procurement must address

CIP-013-2 Part 1.2 asks procurement processes to address six vendor topics, as applicable. Each topic needs a documented decision: either the clause or process covers it, or the entity records why it does not apply to that purchase. The cards below show what each topic typically records and which operational requirement it feeds in the CIP program.

Incident notification

Procurement records the vendor's obligation to notify the entity of security incidents that could affect the purchased product or service, along with the contact path and timing the entity expects. This topic supports the entity's own incident handling under CIP-008-6 and its supply chain plan, so the notice clause should match the entity's internal escalation process. Check that the clause names who receives notices and how quickly they must arrive. Confirm the notice window in your own contract template before relying on it.

Coordinated incident response

Procurement sets out how the vendor will work with the entity during an incident, including who leads technical response, what information the vendor shares, and how both parties coordinate communications. Without this, a vendor's response may run on its own timeline and conflict with the entity's CIP-008-6 response plan. Review whether the clause covers onsite and remote responders and whether it addresses evidence preservation. Ask the vendor to show how its response team would engage with your operations staff.

Notice when vendor access should end

Procurement requires the vendor to tell the entity when its remote or onsite access to a system should be removed, such as when a project ends, a staff member leaves, or a subcontractor rolls off. This topic feeds CIP-005-7 R2 Parts 2.4 and 2.5, which require the entity to determine and disable active vendor remote access. Check that the notice obligation covers personnel changes at subcontractors as well as the primary vendor. Record who on the entity side acts on each notice.

Disclosure of known vulnerabilities

Procurement requires the vendor to disclose known vulnerabilities in the products and services it supplies, with enough detail for the entity to assess exposure and plan mitigations. This information feeds the vulnerability assessment and patch tracking work under CIP-010-4, so the clause should specify the form and timing of disclosures. Check whether the vendor commits to disclosing vulnerabilities in third-party components it bundles. Confirm how the entity will record each disclosure and its disposition.

Verification of software integrity

Procurement addresses how the vendor provides software and patches with verifiable integrity and authenticity, such as signed packages, published hashes, or a documented release process. This topic supports CIP-010-4 R1 Part 1.6, which requires the entity to verify the software source and integrity before it changes a baseline. Decide which verification method the entity will use for each product and document it. Confirm that the vendor's signing keys and distribution channels are described in the contract or security documentation.

Coordination of vendor remote access controls

Procurement records how the vendor's remote access tools, accounts and session controls will be coordinated with the entity's own controls, including who approves access and how sessions are logged. This topic supports CIP-005-7 R3, which governs vendor remote connections to EACMS and PACS, and it connects to the Interactive Remote Access controls in CIP-005-7. Check whether the vendor will use the entity's intermediate system or require a separate path, and document that choice. Ask the vendor to describe its multi-factor authentication and session recording approach.

Should you plan for CIP-013-2 now or prepare for CIP-013-3 in 2028?

This table compares keeping the current CIP-013-2 plan and updating it later against building toward the order's aims and the CIP-013-3 changes now. Read each row as a trade-off: the first column names the factor, and the two columns show what each path means for effort and rework. The main takeaway is that the choice depends mostly on near-term procurement and audit exposure.

Factor	Keep CIP-013-2 and update later	Build toward Order 912 and CIP-013-3 now
When it fits	Entities with limited near-term procurement of high or medium impact BES Cyber System equipment and services, and no audit or contract demand for new supply chain content	Entities with active procurements, vendor contract renewals or audit exposure before 2028, or that want one plan cycle to cover the revised standards
Internal effort now	Lower. Focus on meeting the six Part 1.2 vendor topics in CIP-013-2 and the operational controls in CIP-005-7 and CIP-010-4	Higher. Requires reviewing the plan against the order's aims on risk identification and response, and drafting for Protected Cyber Assets
Internal effort later	Higher and compressed. Plan review, procurement language, and vendor notices must be reworked close to the 2028 effective date	Lower. Changes are mainly confirmation and alignment once the final text and effective dates are confirmed
Rework risk	Higher if the final standards add requirements that current contracts and procurement templates do not already cover	Moderate. Drafting to aims before final text may need edits if NERC's submitted language differs from the order's expectations
Dependency on final text	Low for current compliance, high for the 2028 update	High. Confirm final wording with NERC's published standards before locking clauses
Vendor contract impact	Contract amendments may come late, when vendors have less time to agree terms	Earlier requests for vendor cooperation on verification and notification, which may need added contract terms
Questions to ask an advisor	What procurement events are scheduled before 2028, and which vendor terms would need reopening?	Which drafting elements can be tied to final NERC text, and which must wait for it?

Why Protected Cyber Assets and vendor data validation change the scope

Extending supply chain protections to Protected Cyber Assets (PCAs) widens the inventory that a CIP-013 procurement process must cover, and PCAs should not be assumed to be covered by the current CIP-013-2 scope. Order No. 912 directs NERC to develop new or modified supply chain standards that extend these protections to PCAs, which means the procurement controls that today reach high and medium impact BES Cyber Systems and their associated EACMS and PACS may need to reach PCAs as well. Start by listing every PCA associated with your high and medium impact BES Cyber Systems, identifying the vendors that supply their hardware, firmware, software and remote access, and checking which of those vendors are already bound by your procurement terms. Gaps found now will be cheaper to close than gaps found after the revised standard is final.

The order declined to require entities to validate data received from vendors, but it encourages that validation as a voluntary practice. That leaves a decision for each organization: adopt vendor data validation, such as checking software hashes, vulnerability disclosures or provenance claims against an independent source, or decide not to. Either choice should be written down with the reasons, the systems it applies to and the review date, so the record shows a considered position rather than an omission. If you adopt it, confirm with your vendors what data they can supply and how, and build the check into your procurement or change process so the evidence is produced routinely.

The revised standard text governs, not this summary or the order's discussion. Once NERC files the final standards and FERC approves them, read the adopted requirement language directly, compare it against your current CIP-013-2 plan and your PCA inventory, and confirm the effective date for each change with the NERC CIP standards page before you set internal deadlines.

Who owns the CIP-013 plan, who prepares the evidence and who assesses it

The registered entity owns the CIP-013 supply chain cyber security risk management plan and every decision it records. The entity decides which vendors and procurement processes are in scope, which risks it accepts, and which mitigations it funds. Approvals that belong to the CIP Senior Manager or a documented delegate stay with that person, even when outside help drafts the material.

Plan ownership: The entity adopts, maintains and reviews the plan, including the 15-month review cycle that CIP-013-2 requires.
Procurement decisions: Purchasing staff decide which vendor terms, contract clauses and notification commitments are accepted.
Risk acceptance: Leaders document which supply chain risks remain after mitigation and who approved them.
Senior Manager approvals: The CIP Senior Manager or delegate signs off on the plan and its changes.
Operational follow-through: Staff perform vendor access reviews, software integrity checks and vulnerability handling as the plan describes.

Before engaging any partner, confirm internally who holds each approval and where the signed records will be kept.

What usually delays a CIP-013 update or inflates its cost

Most delays in updating CIP-013 plans come from gaps in scope, ownership and evidence rather than from the technical controls themselves. The cards below cover the mistakes that most often push work into rework, so that the inventory, procurement and evidence steps start early enough to absorb the changes FERC Order No. 912 is expected to produce.

Assuming the current plan already meets the order

Order No. 912 asks whether supply chain risk management plans adequately identify and respond to supply chain risks, a question that goes beyond whether a plan exists. An existing CIP-013-2 plan may be complete on paper yet still be unable to show how risks were identified and acted on. Ask the plan owner to walk through two recent procurements and show the risk identification and response steps that were actually taken.

Leaving Protected Cyber Assets out of inventory

Order No. 912 directs NERC to extend supply chain protections to Protected Cyber Assets, which many entities have not included in their vendor inventories. Inventories built only around BES Cyber Systems, EACMS and PACS will miss the devices and software that the new scope is likely to cover. Confirm with engineering which PCAs exist at each high and medium impact site and record the vendors and products behind each one.

Procurement not told which contracts need clauses

Procurement teams often do not know which purchase orders, renewals or service agreements touch in-scope systems, so new vendor terms are never applied. CIP-013-2 Part 1.2 already lists six vendor topics that procurement must address where applicable, including incident notification, vulnerability disclosure and software integrity. Map each in-scope system to its contracts, flag renewal dates and give procurement a short clause checklist to apply at each renewal.

Vendor answers that cannot be evidenced

A vendor statement that it follows secure development practices gives an auditor little to test. The useful question is what the vendor will produce when asked, such as a notification record, a patch advisory or a signed software hash. Before signing, ask each vendor for a sample of the artifact it will provide and confirm the delivery channel and contact. This is a procurement check, not a request that the vendor sign off as compliant.

Relying on a single document

A plan written once and stored in a policy library shows design, but not that the entity carried it out. CIP-013 audits look for records of procurements, vendor notices and reviews that tie back to the plan. Keep a short evidence log for each in-scope procurement and each vendor event, with dates, owners and the artifact received. Review the log against the plan at the 15-month review point the standard already requires.

Waiting for final text before inventory

The final CIP-013 revision text will change the wording of requirements, but the inventory of vendors, systems and contracts will be needed whatever the wording. Teams that wait for final text usually start the inventory late and compress it into a short window, which raises consulting and internal labor costs. Start the inventory now using the scope already in CIP-013-2, and treat the revised text as a gap analysis to run once it is published.

Questions buyers ask about the FERC Order 912 CIP-013 changes

What does FERC Order No. 912 require entities to do now?

Order No. 912 directs NERC to change the standards, so it does not add a new obligation for registered entities yet. Issued on 18 September 2025, it tells NERC to submit new or modified supply chain standards within 18 months. Those standards must address whether entities' supply chain risk management plans adequately identify and respond to supply chain risks, and they must extend supply chain protections to Protected Cyber Assets. The order names CIP-005-7, CIP-010-4 and CIP-013-2 as the standards in scope. Until FERC approves revised standards, your current CIP-013-2 plan and its requirements govern. The order also declined to require validation of vendor data, while encouraging it as a voluntary practice. Read the FERC Order No. 912 public inspection copy and confirm the details with NERC and your Regional Entity.

Is CIP-013-2 still enforceable today?

Yes. CIP-013-2 has been enforceable since 1 October 2022. It applies to high and medium impact BES Cyber Systems and their associated EACMS and PACS, while low impact systems are outside its scope. Part 1.2 requires your procurement processes to address, as applicable, six vendor topics:

incident notification
coordinated incident response
notice when vendor remote or onsite access should end
disclosure of known vulnerabilities
verification of software integrity and authenticity
coordination of vendor remote access controls

These obligations stay in force while NERC prepares the Order No. 912 revisions. Confirm with your Regional Entity which of your systems fall under the standard, since scoping depends on your CIP-002 categorization.

What does the 18-month deadline mean in practice?

The 18-month deadline applies to NERC, not to your organization. NERC must submit the new or modified supply chain standards within 18 months of the order, which was issued on 18 September 2025. Counting from that issue date, the submission window closes in March 2027. Submission is only one step, because FERC must still approve the revised standards and set their effective dates. Entities usually need to plan around the approved effective date, which may fall well after submission. Confirm the exact deadline and the current status of the NERC standards project with NERC, and check the order text for any transition provisions that apply to your registration.

How does CIP-013-3 relate to the Order No. 912 changes?

CIP-013-3 comes from a different FERC action. FERC approved it in Order No. 919 as part of the virtualization revisions, and NERC lists it with an effective date of 1 July 2028. Order No. 919 addressed virtualization, while Order No. 912 directed separate supply chain work. The supplied facts do not say whether NERC will fold the Order No. 912 changes into CIP-013-3 or into a later version. Treat CIP-013-3 as the 2028 baseline for supply chain requirements and watch the NERC standards project for the final text. Ask your Regional Entity or counsel how the two sets of changes will sequence for your systems.

Do we have to change vendor contracts before the revised standard takes effect?

No supplied fact sets a contract change date, so confirm the answer with counsel and your Regional Entity. Your existing CIP-013-2 procurement process already has to address the six Part 1.2 topics where they apply, which means current contracts should be reviewed now. Check notification timelines for incidents and vulnerabilities, how and when vendor remote access ends, how software integrity and authenticity are verified, and how vendor remote access controls are coordinated. Gaps found in that review can be corrected at renewal or through amendments. Any additional terms required by the revised standard will depend on its final text, so keep a clear record of which contracts you reviewed and when.

How much internal effort does the supply chain update need?

No supplied fact gives an effort estimate for the Order No. 912 changes, so the effort depends on your environment and the final standard text. The main drivers are the number of high and medium impact BES Cyber Systems and their EACMS and PACS, the number of vendors and procurement workflows that touch them, the maturity of your existing supply chain plan, and how complete your inventory of Protected Cyber Assets is. Internal staff usually own the risk decisions, vendor relationships and procurement approvals. Ask your Regional Entity or NERC for the current standards drafts, then size the work against them. Build the inventory and vendor map first, since most later tasks depend on them.

Can an outside partner prepare the CIP-013 work for us?

Yes, an implementation partner can prepare systems, controls and evidence, but it cannot issue audit results. DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares compliance readiness work. Engagements are usually fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so a quote follows from that written scope. Your organization still owns its supply chain plan, vendor decisions and attestations. Only your Regional Entity, through its monitoring program, determines compliance, and any outside review of your program is performed by a party you engage for that purpose.

How DeployOpen prepares CIP-013 supply chain evidence in your environment

DeployOpen works on the supply chain side of NERC CIP as an implementation partner. We prepare the systems, procurement records and evidence that your team and an independent Regional Entity audit will examine, while your organization keeps ownership of its CIP-013 plan and compliance decisions.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
We map which high and medium impact BES Cyber Systems and associated EACMS and PACS fall under your CIP-013-2 plan.
We confirm with your compliance team which vendor-facing controls already exist, so the scope reflects your actual procurement and access paths.

How we build

We help configure procurement checklists that address the six vendor topics named in CIP-013-2 Part 1.2.
We set up software source and integrity verification steps that feed CIP-010-4 baseline change records.
We prepare vendor remote access controls and logs aligned with CIP-005-7 Parts 2.4, 2.5 and R3, tested in your environment.

How we hand over

We deliver documented procedures, configuration records and sample evidence packages mapped to each requirement part.
We walk your staff through how each artifact is generated, stored and retrieved for an audit request.
We record open gaps and assumptions so your team can plan any changes ahead of the CIP-013-3 effective date of 1 July 2028.

How we support

Ongoing support, upgrades and periodic testing of supply chain controls are available as a retainer.
We can re-check evidence packages when FERC acts on the Order No. 912 standard changes that NERC develops.
Auditors and certification bodies issue any assessment outcome. Confirm audit scheduling and expectations with your Regional Entity.

FERC Order 912 and upcoming CIP-013 supply chain changes