How NERC CIP penalties are calculated and why the amount varies
When a finding or an audit notice lands on your desk, the first question is what the penalty could be. NERC and the Regional Entity set a CIP penalty in three steps under the Sanction Guidelines in Appendix 4B. The first step produces a base amount from the Violation Risk Factor and Violation Severity Level of the requirement that was violated, multiplied by the number of days the violation lasted. The second step adjusts that base for entity size, assessed risk, violation duration and time horizon, and for aggravating and mitigating factors. The third step applies final adjustments for settlement, extenuating circumstances or inability to pay. The base table in Appendix 4B runs from per-day starting ranges of $1,000 to $3,000 at the lowest risk and severity to up to $20,000 to $1,291,894 at the highest, so the requirement and the severity of the failure drive most of the spread before any adjustment is applied.
The factors that move the figure are where an organization has the most influence. Aggravating factors include repeat violations with the same root cause, ignored Remedial Action Directives, concealment, lack of cooperation and management involvement, and the Sanction Guidelines presume that a penalty is doubled where those factors apply. Mitigating factors include an effective internal compliance program and timely, thorough cooperation. Settlement credit depends on how quickly and in what way the entity engages. The statutory maximum of $1,584,648 per violation, per day, referenced from 18 CFR 385.1602(d) and adjusted by FERC Order No. 906, is a ceiling set by statute, not a typical outcome. Confirm with your Regional Entity how the current Sanction Guidelines apply to your specific findings, and do not treat the ceiling as a forecast.
Only NERC and the Regional Entities, operating under FERC oversight, set and assess CIP penalties. DeployOpen is not part of that process. We do not set, negotiate or predict penalty amounts, and we do not speak for your organization in enforcement discussions. Where we help, it is on the controls and evidence side: preparing systems, configuration records and documentation so that your team can show what was in place, when it failed and what was done about it. Your compliance and legal leads should own the enforcement strategy, and any estimate of exposure should come from them and from the Sanction Guidelines themselves.
The three steps the Sanction Guidelines use to set a CIP penalty
The Sanction Guidelines build a CIP penalty in a fixed sequence: a starting amount from the requirement's risk and severity, adjustments for how the violation happened and how the entity behaved, and final reductions for settlement and hardship. Each step produces a figure that the next step modifies, so the final number can be traced back to its starting point.
Identify the requirement's risk factor and severity level
The Compliance Enforcement Authority first reads the violated requirement and its Violation Risk Factor (VRF), which reflects how much the requirement matters to reliability, and assesses the Violation Severity Level (VSL), which reflects how far the entity fell short of the requirement. These two ratings select a cell in the Appendix 4B base penalty table. The output is a starting range of per-day amounts, ranging from $1,000 to $3,000 for a Lower risk factor and Lower severity violation up to $20,000 to $1,291,894 for a High risk factor and Severe severity violation. Ask your Regional Entity which VRF and VSL it has assigned to each requirement at issue, because the cell determines everything that follows.
Set the starting amount from the base table
Within the selected cell, the Sanction Guidelines generally use the lowest value of the range as the starting point. The Compliance Enforcement Authority then considers entity size, the assessed risk to the bulk electric system, and the violation's duration and time horizon, which are the factors that can move the figure within or beyond the base. The output is a single per-day starting amount for each violation. Confirm with the Regional Entity how it counted days, since a violation that runs for a long period multiplies this amount.
Apply aggravating factors
Aggravating factors can raise the amount. The Sanction Guidelines list repeat violations still ongoing within five years with the same root cause or programmatic failures, ignoring Remedial Action Directives, intentional violations, concealment or lack of cooperation, and management involvement. Where these apply, the presumption is to double the penalty. The output is an adjusted amount that reflects the entity's conduct during the violation, so the entity's records of what it knew and when it acted are the evidence that matters here.
Apply mitigating factors
Mitigating factors can lower the amount. NERC may reduce a penalty for an effective internal compliance program and for timely, thorough cooperation during the review. A clean compliance history earns no reduction, and NERC may not raise a penalty solely because an entity has no or a poor compliance program. The output is a mitigated amount. Documented internal controls, a working compliance program and prompt, complete responses to information requests are the evidence that supports a reduction.
Apply settlement credit
If the entity settles in good faith without undue delay, NERC may lower the penalty further, and it may lower it more when the entity also accepts responsibility for the violation. Settlement is the first of the final adjustments in Section 3.4. The output is a settlement amount. Timing matters here: delay in engaging on settlement can remove the reduction that good-faith early engagement would have earned.
Consider extenuating circumstances and ability to pay
The last adjustments address the entity's circumstances. NERC may significantly reduce or eliminate a penalty in unique extenuating circumstances, such as a significant natural disaster or a pandemic. It also considers the entity's inability to pay. The output is the final penalty amount. These adjustments are the exception, not the norm, so an entity relying on them should document its circumstances with specifics and be ready to support any claim of inability to pay with financial evidence.
Which factors raise or lower a CIP penalty
NERC sets a CIP penalty in stages: a base amount, then adjustments for aggravating and mitigating factors, then final adjustments. The cards below cover the inputs that move the number up or down, and the ones a registered entity can influence before a violation is found.
Entity size and assessed risk
Entity size and the assessed risk of the violation both feed the base amount, alongside the requirement's Violation Risk Factor and Violation Severity Level. Size is judged against the entity's own footprint, so a large utility with many BES Cyber Systems is not measured the same way as a small registered entity. Ask your Regional Entity how it documents the size and risk basis in its findings, and keep your own record of which systems were in scope and what could have been affected.
Violation duration and time horizon
The base penalty is tied to how long the violation lasted and the time horizon over which it occurred. A gap that is closed quickly after discovery is treated differently from one that persists across audit periods. Track the start date of each noncompliance from your own records, not from the date someone noticed it, because the duration used in the calculation depends on when the condition actually began.
Repeat violations with the same root cause
A repeat violation of the same requirement, still ongoing within five years, with the same root cause or a programmatic failure is an aggravating factor, and the presumption is to double the penalty. Two separate lapses that look unrelated can still share one cause, such as a change process that never covered a class of assets. Review past findings and Mitigation Plans for shared causes before you file a new Self-Report, so the root cause analysis is accurate.
Intentional violations and concealment
Intentional violations, concealment and lack of cooperation are aggravating factors that can also double the penalty presumption. Concealment includes withholding evidence or describing a gap in a way that the records later contradict. Build a practice in which staff record what they found, when, and what they changed, and make sure responses to information requests match the logs. Consistent, accurate records are the best protection against these factors.
Ignoring directives and management involvement
Ignoring a Remedial Action Directive and management involvement in a violation are both aggravating factors, and management involvement also carries the doubling presumption. Make sure directives from the Regional Entity reach the named owners, are logged with a response date, and are escalated to senior management when they are not met. Confirm the reporting line for each CIP requirement so that a known gap cannot sit with a manager who never acts on it.
Effective program and cooperation
An effective internal compliance program and timely, thorough cooperation are mitigating factors that can lower a penalty. A documented program shows who owns each requirement, how controls are tested, and how gaps are escalated. Cooperation means responding within the requested time, providing complete evidence and explaining root causes clearly. Clean compliance history earns no reduction, and NERC may not raise a penalty only because a program is absent or weak, so the credit comes from demonstrated practice rather than from the absence of past findings.
How self-reporting and settlement change the final number
Self-reporting is the one lever that can lower a CIP penalty before the Regional Entity has assessed anything, but it only works if the timing is right. Credit requires that the entity report within a reasonably prompt time, typically within three months of discovery, and that the report comes before the Regional Entity has detected the problem. An entity that finds a gap in a CIP-007-6 patch cycle or a CIP-010-4 configuration check and sits on it for several months may lose the credit entirely, even though the underlying violation is the same. Your compliance team should therefore record the discovery date for every potential noncompliance and set an internal deadline well inside the three-month window.
Timing also depends on what the Regional Entity has already started. A notification letter for a Compliance Audit, Spot Check or Self-Certification generally ends eligibility for self-reporting credit on the requirements that letter covers. Before any notice arrives, confirm with your Regional Entity which in-scope requirements are named, because a self-report filed after a letter may still be processed but will not reduce the penalty for those requirements. Keep this in mind when planning internal reviews during an audit window, since findings that surface then are treated differently from findings you disclose on your own initiative.
Settlement is the second adjustment. NERC may lower a penalty when the entity settles in good faith and without undue delay, and it may lower it further when the entity also accepts responsibility for the violation. Responsibility is not a formality: it is a decision that your senior management and counsel should make early, with a clear account of root cause and the mitigation already under way. Extenuating circumstances, such as significant natural disasters or a pandemic, can reduce a penalty substantially or remove it, but the bar is high and the facts must be documented at the time. Ask your Regional Entity and counsel how settlement timing and responsibility are weighed in practice, and confirm which mechanics apply to your situation. For the steps of filing and what outcomes follow, see the sibling topic on self-reporting a CIP violation.
Who sets the penalty and when a finding becomes public
The Compliance Enforcement Authority, which is usually the Regional Entity and sometimes NERC itself, runs the monitoring engagement and decides the penalty amount under the Sanction Guidelines. It starts from the base amount in the Appendix 4B table, based on the requirement's Violation Risk Factor and Violation Severity Level, then weighs entity size, assessed risk, duration and the time horizon. It then applies aggravating and mitigating factors and, finally, settlement or extenuating circumstances. The same team negotiates any settlement and decides whether the matter is resolved through a lighter path.
- Base amount: The starting point comes from the risk factor and severity table, and the lowest value in the applicable range is generally used as the start.
- Adjustments: Aggravating factors such as ignored Remedial Action Directives or management involvement can double the penalty, while an effective internal compliance program can reduce it.
- Settlement: Good faith settlement without undue delay can lower the amount, and accepting responsibility can lower it further.
- Disclosure control: NERC does not release findings of potential noncompliance publicly until final disposition.
- Ask the Regional Entity: Confirm the audit schedule, the team's specific questions and the expected timeline for the draft report.
Before engaging, confirm with your Regional Entity how it applies these steps to your registration and which evidence it expects to see.
The registered entity owns the facts. Its compliance staff, operations teams and any outside advisers must establish what happened, when it was discovered, what systems were affected and what has already been fixed. During the 30-day window to comment on a draft Compliance Audit report, the entity can correct factual errors, present evidence of compliance and explain mitigating circumstances. It must also identify any Confidential Information in the report so that it can be redacted before the report leaves NERC's hands.
- Factual accuracy: Check dates, system categorizations and asset lists against your own records before commenting.
- Evidence: Provide the logs, configuration records and procedure documents that show the controls actually operated.
- Confidential Information: Mark security-sensitive details, such as network architecture or BES Cyber System Information, for redaction within the comment window.
- Response discipline: Keep a single, documented response record so that positions stay consistent across the audit and any later mitigation.
- Internal review: Decide early who signs the response, usually a senior compliance or legal owner, rather than leaving it to the technical team alone.
Check the deadline for your draft report comments as soon as you receive it, because the 30-day window is short relative to the work of gathering evidence.
The Federal Energy Regulatory Commission oversees the reliability program and receives the final Compliance Audit report from NERC. FERC's role at this stage is oversight rather than a separate penalty decision for each finding. Because NERC holds findings of potential noncompliance until final disposition, a matter typically remains non-public through the audit, the comment period and the penalty or settlement process. Publication timing depends on how the matter is resolved, so entities should confirm the current disclosure rules with their Regional Entity rather than assume a fixed date.
- Final report: FERC receives the final report after the comment process and any redactions are complete.
- Oversight role: FERC supervises NERC's enforcement program under the Federal Power Act framework.
- Non-public until disposition: Findings of potential noncompliance are not released publicly before final disposition.
- Redaction effect: Confidential Information marked during the comment window is handled before the report is passed on.
- Outcome uncertainty: No timeline or penalty result can be promised in advance, because each matter depends on its facts and its resolution path.
Ask your Regional Entity to confirm how it will handle disclosure for your matter and what steps it expects you to take before the final report is issued.
What to gather before estimating your exposure
Before anyone can estimate a CIP penalty, the compliance lead needs a written record of what is in scope, what went wrong, and what the organization did about it. The six items below feed the Sanction Guidelines inputs directly, and the Regional Entity will ask for most of them. The organization owns this inventory, and an implementation partner can help organize it but cannot issue findings.
Registered functions and impact ratings
List each NERC registered function the organization holds and the CIP-002 impact rating (high, medium or low) of every asset involved. The rating determines which requirements and Applicable Systems apply, and therefore which base penalty row is in play. Check the rating against the bright-line criteria in Attachment 1 of CIP-002-5.1a, and record the date each rating was last reviewed. A rating that was wrong at the time of the violation changes the entire analysis.
Requirements and Applicable Systems
Name each CIP requirement implicated and the Applicable Systems it covers, such as high impact BES Cyber Systems, medium impact BES Cyber Systems with External Routable Connectivity, or associated EACMS, PACS and PCA. The Violation Risk Factor and Violation Severity Level are set per requirement, so a vague reference to a standard number will not support a penalty estimate. Ask which sub-requirement and table row the Regional Entity is likely to cite.
Start and end dates of each violation
Record when each noncompliance began, when it was corrected, and how the organization established both dates. Duration drives the per-day base penalty, so the difference between a few weeks and several months can move the estimate substantially. Keep the system logs, change tickets or configuration records that show the dates, because an assessor will test them rather than accept an internal summary.
Prior violations of the same requirement
Gather any earlier violation of the same requirement with the same root cause, along with its disposition and mitigation status. NERC treats repeat violations still ongoing within five years with the same root cause or programmatic failure as an aggravating factor, with a presumption of doubling the penalty. Include closed matters as well, since the Regional Entity will check its own records. Confirm the disposition history with the Regional Entity before assuming a prior matter is out of scope.
Evidence of an effective internal program
Assemble documentation of the internal compliance program: the governance structure, periodic internal control reviews, training records, and how issues were detected and escalated. NERC may reduce a penalty for an effective program and for timely, thorough cooperation, but a clean compliance history earns no reduction. The program evidence should show how controls work in practice, not only that policies exist. Ask the Regional Entity which program artifacts it weighs most heavily.
Notification letters and self-report timing
Record any notification letter received for an audit, Spot Check or Self-Certification, and the date it arrived. Receiving such a letter generally ends eligibility for self-reporting credit on the in-scope requirements, so this date can change the penalty outcome on its own. Also record when the organization discovered each issue, since self-reporting credit typically requires a report within about three months of discovery and before detection.
What the $1,584,648 statutory maximum means for a CIP finding
The $1,584,648 figure is a ceiling, not a typical penalty. It is the maximum civil penalty referenced by NERC's Sanction Guidelines through 18 CFR 385.1602(d), as adjusted by FERC Order No. 906 (January 2025) and shown in the eCFR in October 2026. The amount applies per violation, per day. The Sanction Guidelines do not start from it: the penalty for a CIP finding is built from the base table in Appendix 4B, then adjusted for aggravating and mitigating factors, settlement and any extenuating circumstances. The ceiling simply marks the outer boundary of what a Compliance Enforcement Authority can assess for a single violation on a single day.
The ceiling matters for a CIP finding because violations are counted separately. A single requirement can be violated on many days, and a single event can breach more than one requirement, such as a CIP-007-6 patching gap that also exposes a CIP-010-4 baseline or CIP-005-7 access control issue. Each of those can be treated as its own violation with its own duration. That is why a finding that looks modest in a spreadsheet can carry a large theoretical exposure. Your compliance team should map each noncompliant condition to its requirement and start date, and record when it ended, because the duration drives the day count that the Sanction Guidelines use in the calculation.
Most findings resolve far below the ceiling. The Appendix 4B base table starts at much lower per-day amounts for lower risk and lower severity violations, and the Sanction Guidelines then apply credit for an effective internal compliance program, timely cooperation and settlement. Do not rely on this page for current figures. Before you use any dollar amount in a board paper, a risk register or a settlement discussion, confirm the adjusted maximum and the table values directly in the eCFR entry for 18 CFR 385.1602 and the current Appendix 4B. Ask your Regional Entity or legal counsel how they apply the per-day count to multi-requirement findings.
Common questions about NERC CIP penalties
Can an organization calculate its own NERC CIP penalty?
No. The Compliance Enforcement Authority, which is a Regional Entity or NERC, decides the penalty, but an organization can model the drivers that move it. The Sanction Guidelines in Appendix 4B work in three steps: a base amount set by the requirement's Violation Risk Factor and Violation Severity Level, adjusted for entity size, assessed risk, violation duration and time horizon, then adjusted for aggravating and mitigating factors, and finally for settlement, extenuating circumstances or inability to pay. Modeling these drivers shows where exposure concentrates, such as a long-running gap on a high risk requirement. It does not produce a figure the regulator will accept. Ask the Regional Entity for its penalty process before relying on any internal estimate.
Does a clean compliance history reduce a NERC CIP fine?
No. Under the Sanction Guidelines, a clean compliance history earns no reduction. What can reduce a penalty is an effective internal compliance program and timely, thorough cooperation during the review. The reverse also applies: NERC may not raise a penalty solely because an entity has no or a poor compliance program. Aggravating factors, by contrast, can double a penalty, including repeat violations of the same root cause still ongoing within five years, ignoring a Remedial Action Directive, intentional violations, concealment, and management involvement. The practical lesson is to document the internal controls that prevented or caught problems, and to show the regulator how the program responded.
Does self-reporting always reduce a NERC CIP penalty?
No. Self-reporting earns credit only when the report is made within a reasonably prompt time, typically within three months of discovery, and before the entity has been detected. Receiving a notification letter for a Compliance Audit, Spot Check or Self-Certification generally ends eligibility for credit on the requirements in scope. An entity that waits, or that reports only after the Regional Entity has raised the issue, should expect little or no self-reporting credit. Because the timing rule is strict, the internal process for escalating possible noncompliance needs to run on days rather than quarters. Confirm the current expectations with the Regional Entity for your region.
Can a consultant negotiate a NERC CIP penalty for us?
A consultant can support the response, but NERC and the Regional Entity decide the outcome. The organization owns the compliance program, its submissions and its settlement decisions. An implementation partner can help reconstruct the evidence for a violation, document the root cause, prepare the Mitigation Plan and organize the records that support mitigating factors. DeployOpen prepares systems, controls and evidence for compliance work, but it does not issue audit reports, attestations or certifications, and it does not represent a registered entity before the regulator. Scope any outside help in writing, and confirm with counsel who signs and submits each document.
How long does a NERC CIP penalty process take?
No duration is fixed in the sources available to this page, so confirm the expected timeline with the Regional Entity handling your matter. The process length depends on the violation, the number of requirements involved, whether the entity settles in good faith without undue delay, and how quickly the Mitigation Plan is accepted. The Sanction Guidelines reward prompt settlement and acceptance of responsibility, so delay usually works against the entity. Ask the Regional Entity for its current milestones, the points at which the entity must respond, and the documents it expects. Plan internal resources for the full period, not only the first submission.
What must an organization provide during a CIP enforcement review?
The organization must provide evidence that the requirement was met or, where it was not, a clear account of what happened and what has changed. Typical items include:
- A timeline of the noncompliance, with discovery date, duration and the systems affected.
- The root cause analysis and whether the same cause appeared before.
- Evidence of internal controls, training records and management oversight.
- The Mitigation Plan with milestones and completion evidence.
- Any Confidential Information the entity wants redacted, identified within the comment window on the draft report.
The entity has 30 days to comment on the draft Compliance Audit report and to identify Confidential Information for redaction. Missing that window can cost the entity a chance to correct the record.
Are NERC CIP violations and penalties made public?
Not while they are open. NERC passes the final Compliance Audit report to FERC and does not release findings of potential noncompliance publicly until final disposition. This protects the process while facts are still being established, but it does not make the matter private. Once disposition is final, the outcome is part of the public record, and FERC and NERC may disclose it through their own channels. Confidential Information, such as details about BES Cyber System Information, is handled through the redaction process. Organizations should plan for eventual disclosure in their communications and board reporting, and confirm the exact disclosure terms with the Regional Entity and counsel.
How DeployOpen supports CIP evidence and remediation planning
DeployOpen plans, implements and documents the systems and evidence that show CIP controls operated, under a fixed-scope written agreement agreed before work starts. In practice that means building or hardening the platforms a registered entity uses for the controls behind a penalty case, such as baseline configuration monitoring, patch tracking, access records and backup testing, and then documenting how each one ran and who reviewed it. Where a Regional Entity asks for the factual record of a possible violation, DeployOpen can help assemble it from system logs, configuration history and change tickets, so the entity can see the timeline, root cause and scope in one place. Because most penalty factors turn on that record, the first question to settle is which systems and time periods the record must cover.
DeployOpen does not issue audit reports, attestations or findings. It does not set, estimate or negotiate penalties with NERC or a Regional Entity, and it does not guarantee any outcome, including whether a self-report earns credit or whether a settlement is reached. The organization owns its controls, its compliance program, its Self-Reports and Mitigation Plans, and every response it sends to NERC. Any remediation scope DeployOpen prepares should be reviewed by the entity's compliance staff and counsel before it is relied on externally.
Before engaging any implementation partner, ask for a written statement of the systems in scope, the evidence each deliverable produces, and which tasks remain with the entity's own staff. Confirm with the Regional Entity which record formats it accepts and which retention period applies, because the evidence set has to match what the audit team will request. Ask how changes to the scope are documented and priced, and how the partner handles confidential information such as BES Cyber System Information, since that material is governed separately under CIP-011-3.
