What is NERC CIP self-logging and who qualifies for it
If you have found a possible minor CIP noncompliance and want the lighter path, self-logging is available only after the Compliance Enforcement Authority (CEA) approves your entity following a formal review of its internal controls. Once approved, you log minimal-risk noncompliance instead of filing a Self-Report for each item, and the CEA reviews that log at least every three months and presumptively resolves the logged items as Compliance Exceptions. The program covers minimal-risk items only. Anything that is not minimal risk still belongs on a Self-Report and in the normal enforcement path, so the first question is whether your controls are mature enough to be considered at all. Your organization owns the controls, the risk assessments and the log itself. An implementation partner can help prepare the evidence the CEA will examine, such as documented control design, configuration baselines, monitoring records and how past issues were detected and corrected. Only the CEA decides eligibility, and it does so through its own formal review, so no consultant or internal team can confirm approval in advance. Ask your Regional Entity what the review requires, which internal control documentation it expects, and whether it has a standard application process, and confirm those details directly with it rather than relying on secondhand descriptions. A practical check before you apply is to review your last few years of possible noncompliance and classify each one honestly. If the items cluster in one control area, or if they were found late, the review is likely to focus on why your monitoring did not catch them sooner. Use the NERC Rules of Procedure Appendix 4C to read the monitoring provisions in full, then decide whether your internal controls can support a log that the CEA will review every three months.
What the self-log must contain for each item
This sequence turns each minimal-risk noncompliance into a log entry that carries a description, a risk assessment and a mitigation record, all traceable to evidence an auditor can pull. The result is a log that NERC and FERC can review on request and that the Regional Entity can check at its periodic reviews.
Record the noncompliance description first
The compliance owner for the affected CIP requirement writes a detailed description of what happened: the requirement and part involved, the BES Cyber System, Cyber Asset or access point affected, the date the condition began, the date it was discovered and the date it was corrected. Appendix 4C, section 4.5A requires a detailed description of each minimal-risk noncompliance, so a one-line summary does not meet the rule. The step is complete when a reviewer who was not involved could reconstruct what went wrong without asking anyone. Record the facts only at this stage, leaving the risk judgment for the next step.
Assess and document the risk of each item
The entity documents a risk assessment for the item, stating the potential harm to the reliability of the bulk electric system, the factors that limit that harm, such as the asset's impact rating, network position and any compensating controls that were operating. The assessment supports the minimal-risk designation that makes the item eligible for self-logging. The person who signs the assessment should be identified by role, and the assessment should cite the configuration records, logs or tickets it relied on. The step closes when each entry can show a stated risk conclusion and the sources behind it.
Document mitigating activities completed or planned
For each item, the entity lists the mitigating activities, separating those already completed from those still planned. Each entry should name the action, the system it touched, the responsible role and the completion date or target date. Planned items should be tracked until they are closed, and the log should be updated when they are. Appendix 4C, section 4.5A requires the log to show mitigating activities completed or planned, so an open item without an owner or a status does not satisfy the rule. The step is complete when every item shows either a closed action with a completion record or an open action with a named owner.
Link each entry to its evidence
The entity attaches or references the evidence behind each statement in the entry, such as a change ticket, a scan report, an access review record, a configuration baseline comparison or a training completion report. Each reference should point to a stable location, such as a ticket number, a repository path or a retention system identifier, and the evidence should be retained so that it can be produced later. An auditor should be able to pick any entry, follow the reference and confirm the claim without relying on the author's memory. The step closes when a sample of entries can be traced to evidence end to end.
Apply one entry format to every item
The entity adopts a fixed template for all entries, with the same fields in the same order, such as an item identifier, requirement, date of discovery, description, risk assessment, mitigating activities with status, evidence references and the name of the reviewer. A consistent format lets the compliance team sort, search and compare entries across periods and lets an auditor review the full log quickly. Templates should be version controlled, and changes to the template should be recorded. Confirm the required fields with the Regional Entity before finalizing the template, since the Rules of Procedure set the minimum content and the Regional Entity may ask for more detail.
Make the log available to NERC and FERC
The entity keeps the self-log in a form that can be produced on request to NERC and FERC, and it can also be shared with the Regional Entity at its review. The log should be stored under the entity's records retention rules, with access controls that protect any BES Cyber System Information it contains. The compliance owner should be able to produce a complete, current copy within a short period when asked, and the copy should show the date of the last update. The step is complete when the entity has tested a production of the log and confirmed that the entries, evidence references and revision history come out intact.
Review entries with the Regional Entity cycle
The entity reviews its log entries on a fixed internal schedule and updates open mitigating activities as they close. Appendix 4C, section 4.5 states that the Compliance Enforcement Authority reviews self-logged items at least every three months, so the internal review should be timed to produce a current log before each review. Each review should confirm that every entry is complete, that planned actions have moved forward and that new minimal-risk items have been added. The step closes when the reviewer signs off on the log version that was provided to the Regional Entity.
Self-logging compared with Self-Reports
An entity approved for self-logging may record a minimal-risk noncompliance in its log instead of filing a Self-Report for that item. The log entry carries a detailed description of the issue, a risk assessment, and the mitigating activities completed or planned. The Compliance Enforcement Authority (CEA) reviews the log at least every three months and presumptively resolves logged items as Compliance Exceptions. The CEA still decides how each item is categorized, so the entity should not assume the presumption holds for every entry.
- Log content: Each entry needs a clear description, the risk assessment, and the mitigation status at the time of logging.
- Review cadence: Logs are reviewed in batches at least every three months, not item by item as they are found.
- Availability: Logs must be available to NERC and FERC on request, so entries should be written as if an outside reviewer will read them.
- Mitigation: Completed or planned mitigating activities must be documented, including dates for planned work.
Before relying on this route, confirm with the Regional Entity which items your approval covers and how the CEA has treated comparable entries in the past.
A Self-Report is the route for a possible violation that falls outside the self-logging approval or that the entity cannot classify as minimal risk with confidence. NERC encourages Self-Reports as soon as the entity becomes aware of a possible violation, so the clock on timing starts at awareness, not at the end of an internal investigation. Filing early is also what supports penalty credit and a sound outcome, whether that is a Compliance Exception, a Find, Fix, Track and Report (FFT) resolution, or a Mitigation Plan.
- Trigger: Any possible violation that is not covered by an approved self-logging program, or that may not be minimal risk, calls for a Self-Report.
- Timing: Report once the entity becomes aware of a possible violation, even while the facts are still being confirmed.
- Scope of report: Describe what is known, what is still under review, and the steps already taken.
- Outcome: The CEA decides the resolution path after review, which may include a Mitigation Plan.
Confirm internal escalation rules so the compliance team can file quickly without waiting for management sign-off on every detail.
An entity that has not been approved for self-logging cannot record minimal-risk noncompliance in a log and treat it as settled. Until approval is granted after a formal review of internal controls, every possible violation follows the Self-Report route. Approval depends on the entity's internal controls being reviewed and found adequate, so building a credible control environment is the step that determines when logging becomes available. Entities should ask the Regional Entity how the approval process is run and what evidence it expects.
- Current status: Without approval, all possible violations are handled through Self-Reports and the CEA's standard processes.
- Control review: Approval follows a formal review of internal controls, so documented and tested controls matter.
- Preparation: Maintain records of how issues are identified, assessed and fixed, because the review examines this history.
- Interim practice: Until approval is confirmed in writing, treat each possible violation as requiring a Self-Report.
Ask the Regional Entity what the approval request must include and whether it wants a pre-application discussion before filing.
What Compliance Exception treatment means for compliance history
An entity approved for self-logging gets a presumption that its minimal-risk noncompliance will be resolved as Compliance Exceptions. That presumption is the main reason the program matters to a compliance lead. Under Appendix 4C, the Compliance Enforcement Authority (CEA) reviews the self-log at least every three months, and the entity's log entries are the record it relies on. A Compliance Exception is not counted in compliance history for penalty purposes, so an entry that is properly logged and resolved as a Compliance Exception should not raise the penalty on a later, unrelated finding. Confirm the current wording of section 4A.1 with your Regional Entity before you rely on this in a board briefing, because the treatment depends on the CEA accepting each entry as minimal risk.
The protection has a limit that many programs overlook. The CEA must still consider past Compliance Exceptions when failure to remediate contributed to a later serious or substantial noncompliance. In practice, this means each logged item needs a mitigation plan that is actually finished, with dated evidence, and a root cause that is fixed rather than patched. If the same weakness reappears in a later audit, an earlier self-logged entry can become part of the story. Assign an owner to close each log item, set a review date ahead of the next quarterly CEA review, and record what was changed in the control, not only what was filed.
Two rights remain available to the entity throughout. It may mitigate each logged noncompliance, and it may object to the process if it believes an entry was handled incorrectly. Use both deliberately. Keep the log's description, risk assessment and mitigating activities consistent with what engineers and operators actually did, because the logs are available to NERC and FERC on request. Ask your Regional Entity to confirm in writing how it will communicate review outcomes, what counts as completed mitigation, and how an objection is raised, so that the record of your program is clear before any monitoring engagement begins.
What must be in place before applying for self-logging
Self-logging is granted after a formal review of your internal controls, so the approval case is built before you apply. Each card below is a component the Compliance Enforcement Authority will test, and the log only works if these pieces are documented, owned and running together.
A documented internal controls program
The CEA reviews whether your internal controls can find and fix noncompliance before it spreads. Write down the controls for each applicable CIP requirement, who performs them, how often, and where the results are recorded. Check that the documents match what staff actually do, because a reviewer will sample operations against the written program and any gap weakens the application.
A risk assessment method per noncompliance
Self-logging covers only minimal-risk noncompliance, so every entry needs a documented risk assessment. Define the criteria you use to rate impact on the bulk electric system, such as the systems involved and how long the gap lasted, and apply them the same way each time. The reviewer will test whether your ratings are consistent and whether a higher-risk issue was ever logged instead of self-reported.
A named owner and logging workflow
Assign one accountable owner for the self-log and a written workflow that takes a discovered issue from detection to a logged entry. The workflow should state who triages findings, who approves the risk rating, and how quickly an entry is created. Reviewers will ask for the workflow and check that the owner can produce the log on request for NERC and FERC.
Evidence retention for every entry
Each log entry must be supported by records that show the noncompliance, its duration and the mitigating activities. Set a retention schedule that keeps this evidence for the period the CEA may review, and store it where it can be retrieved without reconstruction. Confirm the retention period with your Regional Entity, since a missing record can turn a logged item into a finding.
Remediation tracking tied to the log
Every logged noncompliance needs completed or planned mitigating activities with dates and owners. Link each log line to its ticket or work order so status can be shown without a separate spreadsheet. The CEA reviews the log at least every three months, so stale or open items without progress are the first thing a reviewer will question.
Staff trained on minimal-risk criteria
Operators and engineers must recognize what qualifies as minimal risk and know when to escalate instead of logging. Train the staff who detect and handle CIP issues on the rating criteria, the escalation path and the difference between self-logging and a Self-Report. Keep training records, because the reviewer may ask how the people closest to the systems understand the process.
NERC CIP self-logging questions compliance leads ask
Can every NERC CIP registered entity self-log noncompliance?
No. Self-logging is available only to entities that the Compliance Enforcement Authority approves after a formal review of their internal controls, so eligibility depends on how well the program is controlled and evidenced, not on registration alone. Approval covers only minimal-risk noncompliance. An entity that has not been approved, or that finds a possible violation outside the approved scope, should file a Self-Report as soon as it becomes aware of the issue. Ask the Regional Entity early whether your controls and compliance history meet its current approval expectations, and confirm in writing which CIP requirements and risk levels are covered.
How long does self-logging approval take?
The timeline is set by the Regional Entity, so confirm it directly with your Regional Entity before planning around any date. The approval depends on how ready your internal controls are when the review starts, how many registered facilities and CIP standards are in scope, and how complete your documentation is. Entities with fragmented evidence, unclear ownership of controls or incomplete risk assessments usually need more back-and-forth before the review can conclude. Ask the Regional Entity for its expected sequence of steps, the documents it will request, and whether it will review a pilot set of logged items before approving the full program.
Who performs the internal controls review for self-logging?
The Compliance Enforcement Authority performs the formal review of internal controls that determines eligibility for self-logging. The registered entity owns the controls being reviewed, prepares the documentation and answers the reviewer's questions. An implementation partner can help organize policies, procedures, configuration evidence and control descriptions, but it cannot make the eligibility decision or speak for the Regional Entity. Assign an internal owner for the review, usually the CIP Senior Manager or a delegate, and make sure that person understands each control well enough to explain how it operates and how its performance is demonstrated.
Can we run the self-logging program in-house?
Many entities can, provided they have staff who understand the CIP requirements, the risk assessment method and the evidence the Regional Entity expects. The program needs a named owner, a logging procedure that records each item consistently, and a routine for preparing risk assessments and mitigating activities. Outside help is usually most useful for preparing for the internal controls review, building evidence collection on existing systems, or testing whether the log is complete before it is shared. Decide which parts you will keep internally, which you will outsource under a written scope, and who signs off on each log entry.
How much effort does self-logging take, and what drives it?
The effort depends on the size of the in-scope environment, the number of CIP requirements covered, and how mature the existing controls and evidence already are. Recurring work includes recording each minimal-risk noncompliance, writing its risk assessment, documenting mitigating activities completed or planned, and keeping logs ready for NERC and FERC requests. One-time work includes the internal controls review, process design and any tooling changes. Effort rises when evidence is spread across tools, when asset inventories are out of date, or when many small issues occur at the same site. Ask any partner for a written scope listing systems, standards, deliverables and the staff you will need to supply, because that scope, not a general rate, determines the quote.
How often does the Regional Entity review self-logs?
The Compliance Enforcement Authority reviews self-logs at least every three months. That cadence is a floor, not a schedule that resets your obligations, so entities should keep logs current throughout the period rather than assembling them before a review. Each entry should carry a detailed description, the risk assessment and the mitigating activities completed or planned. Because the logs are available to NERC and FERC on request, the record must stand on its own without verbal explanation. Confirm with your Regional Entity how it prefers logs to be submitted and whether it expects a standard template.
What happens if the CEA does not accept an item as minimal risk?
An item that the Compliance Enforcement Authority does not accept as minimal risk does not receive the presumptive Compliance Exception treatment that self-logging provides. It moves into the standard compliance process, which may include a Self-Report review, a Mitigation Plan or an enforcement path, depending on the facts. The Regional Entity decides how to handle the item, so ask for its position in writing and confirm which resolution path applies. Keep the original log entry, the risk assessment and evidence of any mitigation already performed, because these records still support your position. Treat any disagreement as a question about the process and raise it promptly with the Regional Entity.
Does a Compliance Exception from self-logging affect our compliance history?
Generally, a Compliance Exception is not counted in compliance history for penalty purposes. However, the Compliance Enforcement Authority must consider past Compliance Exceptions if a failure to remediate contributed to a later serious or substantial noncompliance. This means every logged item still needs a real mitigation track, because weak follow-through can make an earlier minor item relevant later. Entities may also object to the process. Keep mitigation records dated and linked to each entry, and review open items at each internal governance meeting so that none is left unresolved across review cycles.
Who owns the controls, the log and the decision
The registered entity owns everything that self-logging depends on. Its internal controls, its log of minimal-risk noncompliance, the risk assessment attached to each entry and the mitigating activities, completed or planned, are the entity's responsibility from start to finish. An implementation partner such as DeployOpen can help prepare the systems, the logging workflow and the evidence that supports each entry, for example by setting up configuration monitoring output, change records and access review exports so that the entity can show what it checked and when. That preparation is advisory and technical. It does not transfer ownership of any control or any log entry to the partner, and the entity's compliance staff must be able to explain every line of the log without help from outside.
Only the Compliance Enforcement Authority decides. A Regional Entity or NERC determines whether an entity is approved for self-logging after its formal review of internal controls, reviews the logs at least every three months, and decides how each logged item is treated, which under the presumption is a Compliance Exception. No implementation partner, consultant or tool vendor can grant approval, accept a log entry, close an item or issue a resolution. A useful check before engaging anyone is to ask the proposed partner, in writing, what it will deliver and confirm that it does not claim any approval or determination on the entity's behalf. Entities should also confirm with their Regional Entity how it expects logs to be formatted and delivered, because the expectations are set by the CEA, not by the partner.
The practical decision is who signs off on what. Name an internal owner for the log, a reviewer who is independent of the people making the fixes, and a senior accountable officer who approves the self-logging request. Record in the scope agreement which evidence the partner will prepare and which the entity will produce itself. Ask the partner to state its role in each deliverable, and keep the log under the entity's own document control, since NERC and FERC can request it at any time. Ownership stays with the entity, preparation can be shared, and the decisions remain with the CEA.
How DeployOpen prepares CIP evidence for self-logging
DeployOpen works inside your own infrastructure to prepare the systems, controls and records that a self-logging program depends on. We do not decide eligibility or issue determinations, which sit with your Compliance Enforcement Authority, and we do not replace your internal controls review.
How we scope
- Engagements are fixed-scope, with the CIP standards, Applicable Systems and log fields agreed in writing before work starts.
- We map which in-scope controls would need to be reviewed before an entity could request self-logging treatment.
- The written scope names the deliverables, owners and timelines for each control covered by the self-logging log.
How we build
- We configure and document the technical controls that produce evidence for minimal-risk noncompliance tracking in your environment.
- We build a log template with fields for each noncompliance description, risk assessment and completed or planned mitigating activity.
- We test that log entries can be retrieved quickly for NERC and FERC requests, and document the test results for your records.
How we hand over
- You receive the log procedure, control documentation, evidence index and runbooks written for your compliance staff.
- We walk your team through how entries are created, reviewed and retained, so ownership stays with your organization.
- Handover includes a written list of open items, with each gap assigned to a named owner for follow-up.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Retainers can cover log reviews, control updates after standard revisions, and preparation for each Regional Entity review.
- Confirm with your Regional Entity which review cadence and log format it expects before finalizing the scope.
