Preparing for the NERC CIP virtualization standards in 2028 starts with a documentation update, not a virtualization project
If your organization owns or operates BES Cyber Systems, the 11 revised standards approved in FERC Order No. 919 take effect on 1 July 2028, and most of the work ahead is documentation. The revisions update perimeter-based language, add terms for virtualization infrastructure and virtual machines, and broaden change management beyond baseline-only configuration. They do not require you to adopt virtualization. Your first task is to read each affected standard against your current program and list every policy, procedure, baseline and diagram that now needs a revision. For FERC's estimate of the effort involved, see the Federal Register order. FERC estimated that 400 entities would update compliance documentation at 57.7 hours ($4,905) per standard, or 577 hours and $49,045 per entity across the 10 affected standards, using an $85 loaded hourly wage. Treat that figure as FERC's planning estimate, not a quote. Your own hours will depend on how many systems you run, how many standards your registration touches, and how mature your existing documentation is.
Cost in this work comes mostly from internal staff time, plus any outside help you buy. Internal compliance, operations and change management staff own the controls and approve revised documents. An implementation partner can prepare systems, baselines and evidence in your environment, but it does not decide your compliance position and does not issue any report or attestation. Only the Compliance Enforcement Authority, a Regional Entity or NERC, monitors compliance. Before you engage anyone, ask for a written scope that lists which standards, which Applicable Systems and which documents are covered, who approves each deliverable, and what happens if FERC or NERC changes the implementation plan. Confirm the effective dates and inactive dates directly on the NERC CIP standards page before you set internal deadlines. Early adoption is available after you notify your Regional Entity, so decide early whether a staged adoption suits your change calendar.
How the 1 July 2028 effective date and early adoption work
This sequence moves a registered entity from deciding whether to adopt the virtualization standards early to holding documented, notified and auditable compliance under the revised set. Each step produces a specific artifact that the next step depends on.
Confirm the effective date for your entity
The CIP compliance lead, with the registered entity's senior manager, reads NERC's implementation plan for the virtualization set and records the default date. NERC makes the standards effective on the later of 1 April 2026 or the first day of the first calendar quarter 24 months after the approving order's effective date, which NERC lists as 1 July 2028. Confirm the date against the NERC CIP standards page, since the inactive dates for the current versions differ. The step closes with a dated memo stating the default effective date and the current-version inactive dates that apply to each standard.
Decide whether to adopt early
Leadership decides whether the entity will adopt the revised standards before the default date. The implementation plan allows early adoption at 6, 12 or 18 months after the order's effective date, provided the entity notifies its Regional Entity. Weigh the readiness of the current program, the planned virtualization projects and the documentation workload against each option. The output is a signed decision record that names the chosen adoption date, or confirms the default 1 July 2028 date, and the business reasons behind it.
Map current controls to the revised standards
Staff who own each CIP standard compare the current versions with the revised set, including CIP-002-7, CIP-003-10, CIP-004-8 through CIP-011-4.1, and CIP-013-3. The review focuses on perimeter-based wording, the new virtualization infrastructure and virtual machine terms, and the broader change management scope. Staff who own the program should confirm which requirements apply to the entity's own asset types. The output is a gap list that names each requirement, the current control, the revised language, and the gap or confirmed match.
Close gaps and assign owners
Each gap from the list is assigned to a named owner with a target date set inside the entity's own schedule. Typical gap work covers baselines for virtual infrastructure, change management records and updated asset inventories. Where virtualization is not planned, the work may be limited to terminology and documentation. An implementation partner can prepare systems and evidence under a written scope, but the entity keeps ownership of each control. The output is a remediation tracker with owners, dates and evidence locations.
Update compliance documentation
Owners revise the policies, plans, procedures and evidence index for each affected standard so the documents reflect the revised requirements. FERC's Order No. 919 estimated the documentation effort for the 10 affected standards, and that estimate is a useful benchmark for planning staff time, which the entity should confirm against its own program size. The step closes when each updated document carries a revision date, an approver and a reference to the standard version it implements.
Notify the Regional Entity of early adoption
If the entity chose early adoption, it notifies its Regional Entity before the adoption date and keeps proof of the notice. Confirm the notice format and contact with the Regional Entity, since the notification process is set by the Regional Entity and not by this page. The output is a copy of the notice, its transmission record and a dated internal memo linking the notice to the decision record from the second step.
Verify readiness and retain evidence
Before the adoption or effective date, an internal reviewer tests a sample of controls against the revised language and confirms that the evidence is complete, dated and retrievable. Independent assessors and auditors make the compliance findings, so this check is an internal readiness review and not an audit. The output is a readiness sign-off that names any open items, along with an evidence retention plan that matches the audit period the Regional Entity will request.
Which current versions retire and when
This table pairs each currently effective CIP version with its NERC inactive date and the 2028 successor that replaces it. Read the middle column as the date after which the current version is no longer the one to operate against, and confirm every date on the NERC CIP standards page before you set internal deadlines. Most current versions retire on 30 June 2028, so the bulk of documentation and configuration work converges on one cutover date.
| Current version | NERC inactive date | 2028 successor |
|---|---|---|
| CIP-002-5.1a | 30 June 2028 | CIP-002-7 (virtualization) and CIP-002-8 (Control Center definition), both effective 1 July 2028 |
| CIP-003-9 | 30 June 2028 | CIP-003-10, effective 1 July 2028. CIP-003-11 follows on 1 July 2029 |
| CIP-004-7 and CIP-005-7 | 30 June 2028 | CIP-004-8 and CIP-005-8, effective 1 July 2028 |
| CIP-006-6 | 30 June 2028 | CIP-006-7.1, effective 1 July 2028 |
| CIP-007-6 | 30 June 2028 | CIP-007-7.1, effective 1 July 2028 |
| CIP-008-6 and CIP-009-6 | 30 June 2028 | CIP-008-7.1 and CIP-009-7.1, effective 1 July 2028 |
| CIP-010-4 and CIP-011-3 | 30 June 2028 | CIP-010-5 and CIP-011-4.1, effective 1 July 2028 |
| CIP-013-2 | 30 June 2028 | CIP-013-3, effective 1 July 2028 |
| CIP-014-3 | 30 September 2028 | No 2028 successor in the researched facts. Confirm the CIP-014 status on the NERC page |
What changes even if you never virtualize
Order No. 919 approved 11 revised CIP standards with virtualization in mind, but several of its changes reach every registered entity, including those with no virtual machines at all. These cards cover the wording, definitions, change management and exception language that will appear in your documents whether or not you ever deploy a hypervisor.
Perimeter-based language updated
The revised standards update language that assumes a fixed, physical perimeter around BES Cyber Systems. Read the CIP-005-8 and CIP-006-7.1 requirement text against your current Electronic Security Perimeter and Physical Security Perimeter descriptions. Check whether any boundary definition still assumes hardware alone defines where a system sits. Record each change in your documentation before the 1 July 2028 effective date.
New virtualization terms in the Glossary
Order No. 919 adds 4 new and revises 18 NERC Glossary definitions tied to virtualization infrastructure and virtual machines. These terms will shape how auditors read your asset inventory and how you classify systems that share a host. Map each term to the BES Cyber System, EACMS, PACS or PCA inventories you already maintain, and flag any inventory field that cannot record a virtual host relationship.
Change management beyond baseline configuration
CIP-010-5 broadens change management beyond baseline-only configuration, so changes to the wider environment now fall within the program. Compare your current change tickets with the revised CIP-010-5 requirement wording. Confirm that your change records capture software, firmware and environmental changes, not only baseline deviations. Ask your configuration management tool vendor whether it can export that history as audit evidence.
Per system capability replaces technically feasible
CIP-005-8 and related standards replace 'where technically feasible' with 'per system capability', but Order No. 919 directed NERC to create criteria for invoking it. Until those criteria are in your procedures, any control you currently exempt on feasibility grounds needs a documented basis. Review each current exception, record the system limitation that justifies it, and track it against the mandatory ERO Enterprise reporting the order requires.
Mandatory reporting and FERC annual report
Order No. 919 requires mandatory reporting to the ERO Enterprise when entities invoke per system capability, and an annual anonymized report to FERC. Your reporting procedure will need a trigger, an owner and a retained record for each invocation. Confirm with your Regional Entity how and when those reports are submitted, since the reporting form and cadence depend on NERC's implementation work.
What FERC's documentation estimate covers and what it leaves out
FERC's estimate measures only the paperwork of updating compliance documentation. In Order No. 919, FERC estimated that 400 entities would update their compliance documentation at 57.7 hours and $4,905 per standard, or 577 hours and $49,045 per entity across the 10 affected standards, using an $85 loaded hourly wage. The figure is a burden calculation for the reporting requirement, not a forecast of what a registered entity will spend to meet the 2028 standards. Read it as the floor for one category of work: revising policies, plans, procedures and records so they match the new language for virtualization infrastructure, virtual machines and per system capability.
The estimate leaves out most of the cost that drives a CIP program budget. It does not include tooling or monitoring platforms, testing of changed controls, audit preparation, operational changes to change management or baselines, training, or the engineering work to virtualize any system. It also does not account for the difference between a standard count and a system count. An entity that runs virtualized Electronic Access Control or Monitoring Systems, or that plans to adopt the revised language early, will carry costs that the per-standard figure does not capture. Ask whether your estimate uses the same $85 wage and the same 10 standards, and whether it has any line for technical work.
Build your own estimate from your standard count and your systems, and have the internal team or an implementation partner review it. List each of the 11 approved standards, mark which ones apply to your high, medium and low impact BES Cyber Systems, and then count the systems, procedures and evidence sets affected by each. Separate one-time work (documentation rewrites, test plans, new baselines) from recurring work (periodic reviews, evidence collection, change records). Confirm the effective dates against the NERC CIP standards page with your Regional Entity, and ask any partner for a written scope that names the standards, systems and deliverables before accepting a quote.
Who should adopt early and who should wait
Entities that already run virtual machines, hypervisors or virtualized components inside their CIP scope have the most to review in the revised standards, because current procedures may describe virtual assets in terms the 2028 set replaces. Early adoption is a choice made after notifying your Regional Entity, and it can be taken at 6, 12 or 18 months after the order's effective date. Confirm the notice mechanics with your Regional Entity before you pick a date.
- Early adoption moves your baseline: Once you adopt, the revised standards govern the systems you have scoped, so every affected procedure must match the new text on your chosen date.
- Existing evidence may need re-mapping: Baselines, change records and access reviews written for virtual machines may use terms that the new virtualization definitions extend or change. Compare them against the revised wording.
- Earlier dates compress the work: Adopting at 6 months leaves less time for policy updates, training and evidence collection than waiting for 1 July 2028, and an audit could fall during the transition.
- Mixed versions add risk: If some Applicable Systems adopt early and others do not, you run two versions side by side. Record which version governs each system.
Check whether your current documentation already describes virtualized assets, and ask your Regional Entity how it expects adoption notices to be submitted.
Entities planning virtualization projects before 1 July 2028 face a timing choice: build to the revised standards from the start, or build to current versions and update later. The revised standards do not require virtualization, so the decision rests on your project schedule and on how much capacity you have for a second documentation cycle.
- Design to the revised text: Architecture documents, change procedures and baselines written now against the virtualization terms avoid a second rewrite close to the 2028 effective date.
- Tie adoption to cutover: Align the adoption date with the cutover of each virtual environment, so the version that governs a system matches its actual configuration.
- Plan for a dual-version period: Systems migrated before adoption are governed by the current version, so evidence collected during that window must satisfy the language that applies on the day of the audit.
- Start Regional Entity conversations early: Notify your Regional Entity before the adoption date you select and keep the notice with the system's configuration history.
Ask your project team to list every planned migration date and map each one against the 6, 12 and 18 month options before contracts for virtual infrastructure are signed.
Entities that do not plan to virtualize BES Cyber Systems still face the 1 July 2028 effective date for the revised set. The virtualization language does not require you to adopt virtualization, so your practical work is reviewing the revised text for changes that reach physical environments and retiring current versions on schedule.
- Confirm the change list: Read the revised standards to find changes that affect physical systems, including the broader change management language that goes beyond baseline-only configuration.
- Plan for retirement dates: NERC lists 30 June 2028 as the inactive date for several current versions, so the move to successor versions has a fixed deadline.
- Early adoption still requires notice: Even without virtualization, you may adopt the revised standards early, with notice to your Regional Entity at 6, 12 or 18 months after the order's effective date.
- Budget for documentation updates: FERC estimated that 400 entities would update compliance documentation at 57.7 hours ($4,905) per standard, or 577 hours and $49,045 per entity across the 10 affected standards, using an $85 loaded hourly wage (FERC Order No. 919). Treat that figure as the regulator's estimate and compare it with your own staff rates.
Ask your compliance team to confirm whether any Applicable Systems are virtual today, since that answer decides which tab applies to your program.
How to get ready for 2028 in five phases
This sequence takes a CIP program from knowing which virtualization revisions touch its environment to documented, approved changes that the entity can show its Regional Entity. Each phase produces a named output that feeds the next.
Inventory affected standards and Applicable Systems
Start by listing every BES Cyber System, EACMS, PACS and PCA your categorization under CIP-002 currently produces, then map each one to the standards and requirement tables that apply to it. Include the 11 revised standards approved in Order No. 919, along with CIP-002-8 and CIP-003-11, so you see the full 2028 and 2029 picture. The output is a standards-to-systems matrix that your compliance lead and system owners both sign off on. You know this step is done when every system has a named owner and no Applicable Systems category is left unassigned.
Run a gap analysis against the revised versions
Compare your current procedures, baselines and evidence against the text of each revised standard, one requirement at a time. Focus on the new virtualization vocabulary, the broader change management scope beyond baseline-only configuration, and the perimeter language that now has to account for virtual machines and virtualization infrastructure. The output is a gap register that lists each gap, its severity, the requirement it affects and the owner responsible for closing it. The step is complete when every requirement in the matrix has either a verified status or a documented gap.
Update procedures and baseline configurations
Revise the cyber security policies, procedures and baseline documentation to close the gaps from the previous step. This covers virtualization infrastructure and virtual machines, change management records, and the configuration baselines that CIP-010 monitoring will check against. Decide early whether you will adopt virtualization or only keep the current architecture compliant, because the answer changes how much documentation you write. The output is a versioned set of updated procedures and baselines, approved under your existing governance process. You know it is done when each gap register entry points to a specific revised document.
Collect evidence and test the new change management
Run the updated change management and configuration monitoring process on live changes, including at least one change that touches a virtual or virtualized component if your environment has one. Capture the records an auditor would ask for, such as change requests, approvals, baseline comparisons and verification results. Test the process before the effective date so problems show up while you can still fix them. The output is an evidence package for each revised requirement, with dated samples and a short note on any exceptions found. The step is done when the evidence package can answer the audit question for each requirement without further reconstruction.
Approve the program and notify the Regional Entity
Take the updated program through your internal approval chain, including the CIP Senior Manager where your governance requires it, and record the approval date and version. If you intend to adopt the revised standards early, notify your Regional Entity before you do so, since Order No. 919 allows early adoption at 6, 12 or 18 months after the order's effective date. Confirm with your Regional Entity how it wants notice given and what it will expect to see. The output is a signed approval record and a copy of the notice. Confirm timing with your Regional Entity and your internal approval cycles, because they set how long this phase takes.
What must be in place before the 2028 effective date
The 2028 virtualization set changes the standards that already govern your program, so most of the work is confirming what you have today. The checks below connect scoping, change records, supplier obligations, document control, staff knowledge and audit evidence, and each one should be verified before a Compliance Audit asks for it.
Confirm the CIP-002 categorization
Every virtualization revision inherits its scope from your BES Cyber System categorization under CIP-002. Re-run the Attachment 1 bright-line criteria against your current asset list, and check whether the revised Control Center definition in CIP-002-8 changes any high or medium impact rating. Record the date of the review and the name of the approver, because an inaccurate categorization makes every later control test measure the wrong systems.
Baselines and change records
The virtualization revisions broaden change management beyond baseline-only configuration, so a baseline snapshot alone will not satisfy the updated language. Check that each in-scope system has a documented baseline, that changes to virtual machines and virtualization infrastructure are logged with an authorization and a verification step, and that the records can be matched to specific systems. Ask your tooling team to show a sample change traced from request to verified baseline.
Supplier plans that match CIP-013-3
Revised CIP-013-3 expects your supply chain risk management plan to cover the vendors you rely on for virtualization platforms, hypervisors and hosted management consoles. Compare each plan against the vendors actually in your environment, not the ones listed in the original procurement. Confirm that vendor remote access, software integrity and vulnerability notification terms exist in contracts, and that the plan's 15-month review has a recorded completion date.
Document version control
Because the revised standards carry new version numbers and an effective date of 1 July 2028, your CIP documents will exist in two versions for a period. Put policies, plans and procedures under version control with a change log that states which standard version each text satisfies. Set a retirement step so that the current versions, such as CIP-007-6 or CIP-010-4, are not used as evidence after their inactive dates, which NERC lists as 30 June 2028 for most of them.
Staff who know the new terms
Order No. 919 adds Glossary definitions for virtualization infrastructure and virtual machines, and the operators who run hypervisors, cluster managers and cloud-hosted consoles need to apply them correctly. Confirm that engineers, change approvers and compliance staff can explain which systems fall inside an Electronic Security Perimeter when virtual machines move between hosts. Record the training in your CIP-004 training program so that the training evidence and the new definitions match.
Evidence that can be pulled on request
A Compliance Audit asks for evidence covering the audit period, and the Regional Entity will expect it in the format it requests. Test your retrieval process by picking one requirement from each in-scope standard and producing its evidence within a short internal deadline. Keep the evidence in a location with access logging and retention rules, and confirm the retention period with your Regional Entity and your counsel, because it must cover the full audit period.
Where an implementation partner fits and where it stops
An implementation partner helps you prepare for the 2028 virtualization standards, but it does not own the compliance outcome. DeployOpen can plan the work, implement and harden the systems involved, and prepare configuration evidence and documentation drafts inside your own cloud accounts, data centers or air-gapped networks. That work is delivered under a fixed-scope written agreement that sets out scope, deliverables and timelines before anything starts. Your organization remains responsible for its controls, its Electronic Security Perimeter decisions, its CIP Senior Manager delegations and every document that goes to a regulator. Any draft DeployOpen prepares, such as an updated baseline procedure or a change management record template, becomes yours only after your own people review, approve and adopt it.
Compliance is assessed by the Compliance Enforcement Authority, which is a Regional Entity or NERC, through Compliance Audits, Spot Checks, Self-Certifications and the other mechanisms in the NERC Rules of Procedure. DeployOpen does not issue audit reports, attestations or certificates, because there is no CIP certificate to issue, and it does not guarantee an audit result. A partner that promises a clean audit is describing an outcome it cannot control. Ask any prospective partner to put in writing which deliverables are configuration evidence, which are drafts for your review, and which decisions remain with your staff, such as whether a system is a Protected Cyber Asset or whether a Technical Feasibility Exception is still needed once the 2028 language applies.
Questions buyers ask about the 2028 virtualization standards
Do we have to virtualize our BES Cyber Systems to comply?
No. The virtualization revisions do not require an entity to adopt virtualization. They update perimeter-based language, add terms for virtualization infrastructure and virtual machines, and broaden change management beyond baseline-only configuration. An entity running physical hardware still has to meet the revised standards by their effective date, because the same wording applies to every environment. The practical question is whether your current architecture fits the revised language without rework, and that is a review your team or an assessor should document before the deadline. Confirm the exact applicability of each revised standard with your Regional Entity and the standard text.
When must we adopt the virtualization standards?
The virtualization standards are effective on 1 July 2028, which NERC lists as the effective date for the 11 revised standards approved in FERC Order No. 919. NERC's implementation plan allows early adoption at 6, 12 or 18 months after the order's effective date, but an entity must notify its Regional Entity before adopting early. Early adoption makes sense when you plan to virtualize during this window or when you want to finish documentation work before the existing standards retire. Ask your Regional Entity how early adoption notice is expected to be recorded so the change is traceable during an audit.
Which current CIP versions retire on 30 June 2028?
NERC lists 30 June 2028 as the inactive date for CIP-002-5.1a, CIP-003-9, CIP-004-7, CIP-005-7, CIP-006-6, CIP-007-6, CIP-008-6, CIP-009-6, CIP-010-4, CIP-011-3 and CIP-013-2. CIP-014-3 has a later inactive date of 30 September 2028. Your compliance calendar should move every affected requirement to the new version before those dates, and the change should be tested in your change management process first. Check the NERC CIP standards page for any later updates before you finalize the calendar.
What does FERC estimate the documentation work costs?
FERC estimated in Order No. 919 that 400 entities would update compliance documentation, at 57.7 hours and $4,905 per standard, or 577 hours and $49,045 per entity across the 10 affected standards. That figure used an $85 loaded hourly wage. Treat it as a federal paperwork burden estimate, not a budget. Your actual cost depends on how many standards and asset types you own, how well your current evidence is organized, how many sites and Cyber Assets are affected, and whether your staff or an outside party does the drafting. Ask any provider for a written scope that lists each standard, asset class and deliverable before comparing quotes.
Can our internal team prepare the documentation ourselves?
Often yes, if your team already knows the current CIP program and has time to update procedures, baselines and evidence. The work is mostly document revision, mapping new terms to existing controls and collecting evidence that the revised requirements are met. Internal teams usually struggle with capacity during the same window as other CIP changes, such as CIP-015 and the per system capability revisions. A partner can prepare systems, configuration evidence and drafts, but the registered entity owns its controls and the independent auditor or Regional Entity makes the compliance determination. Decide early which tasks you will keep in-house and which you will hand off.
What should we ask a partner before signing a fixed-scope agreement?
Ask for a written scope that names each affected standard, each asset class (such as high impact BES Cyber Systems or associated EACMS and PACS), each deliverable and the evidence it will produce. Confirm who owns the controls, who prepares the evidence and who makes the compliance determination, since only the registered entity and the Regional Entity or auditor fill those roles. Ask how the partner handles changes to scope if you choose to virtualize, how the work is tested before cutover and what happens to documentation after delivery. Request a list of excluded items and the acceptance criteria for each deliverable. DeployOpen agrees scope, deliverables and timelines in writing before work starts.
How DeployOpen prepares systems and evidence for the 2028 changes
DeployOpen works with your team to plan, build and document the systems and evidence that the 2028 virtualization revisions touch, inside your own infrastructure. The organization keeps ownership of its CIP program and compliance decisions, while an independent auditor or the Compliance Enforcement Authority assesses the result.
How we scope
- Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
- Scope maps which BES Cyber Systems, EACMS, PACS and PCAs run on virtual infrastructure or may move to it.
- Confirm with your Regional Entity whether an early adoption notice is needed before choosing a 2028 or earlier path.
How we build
- Configure virtualization infrastructure and virtual machines to match documented baselines and change management records.
- Test configuration monitoring, patch tracking and access logging in virtual environments against your written procedures.
- Validate backups and recovery steps for virtual systems, recording results so they can serve as audit evidence.
How we hand over
- Deliver updated procedures, diagrams and evidence collection guides mapped to each revised standard in scope.
- Document where existing controls already satisfy revised language and where a documentation update is still needed.
- Provide a walkthrough so your compliance staff can produce evidence on request without depending on the implementation team.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can keep configuration baselines, evidence sets and recovery tests current as standards and platforms change.
- Ask any quote to state which items are one-time deliverables and which recur under a retainer.
