What happens when a CIP requirement is missed: penalties under the Sanction Guidelines, Self-Reports and self-logging, Compliance Exceptions and FFT, Mitigation Plans, and Technical Feasibility Exceptions for requirements that cannot be met as written.
How NERC and Regional Entities set CIP penalties: the risk factor and severity table, entity size, risk, duration, aggravating and mitigating factors, settlement credit, the statutory maximum, and when findings become public.
When and how to self-report possible CIP noncompliance: what a Self-Report contains, the timing that earns penalty credit, and the likely outcomes, from Compliance Exception and FFT to a Mitigation Plan.
How CIP self-logging works: eligibility after a formal review of internal controls, what the log must contain, the presumption of Compliance Exception treatment, how often the Regional Entity reviews logs, and how it differs from Self-Reports.
What a CIP Mitigation Plan must contain, submission deadlines, milestone spacing, review and deemed acceptance by the Regional Entity and NERC, deadline extensions for outages, and how repeat violations with the same root cause raise penalties.
The lighter resolution paths for CIP noncompliance: which risk levels qualify for Compliance Exceptions and Find, Fix, Track and Report, what each requires, how they affect compliance history, and how self-logging feeds them.
When a CIP requirement cannot be met as written: which requirements are TFE-eligible, the grounds for approval, compensating measures, the 60-day review, how many entities hold TFEs, and how 'per system capability' replaces TFEs from 2028.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.