Which energy sector framework to pursue first, and when to do both
If you own or operate US bulk electric system assets, NERC CIP is the framework you must meet first. NERC CIP becomes mandatory once FERC approves each standard, and NIST CSF is voluntary with no certificate, so it cannot replace a regulatory obligation. NIS2 binds EU entities in Annex I sectors through national transposition law, which makes it the priority for a European operator. A company with both US and EU assets usually needs both mandatory regimes, and the CSF is the structure most teams use to run them together. Start by confirming your registration status and impact categories under CIP-002 with your Regional Entity and your national competent authority, because those answers decide which obligations apply to which assets. Your compliance lead should also confirm which CIP versions are enforceable on your calendar, since several 2026 revisions carry later effective dates.
Pursue NIST CSF first when no regulator has yet mapped your obligations or when you need a common control vocabulary across business units. Its Govern, Identify, Protect, Detect, Respond and Recover Functions give boards and operations teams one language, and NIST publishes informative references that point to other standards. Treat those mappings as a starting point only, since NIST does not check the correctness of non-NIST mappings. ENISA's own mapping for NIS2 is explicit that it does not measure equivalence with a standard, so a CSF profile will not prove NIS2 or CIP compliance by itself. Build the profile around your regulated assets, then trace each CIP requirement and NIS2 measure back to evidence the auditor or authority can inspect.
Pursue both mandatory regimes in parallel when the same engineering teams run assets in both jurisdictions. The reporting clocks differ, so set up one incident process that can meet NERC's CIP-008-6 notification steps and NIS2's early warning, notification and final report stages. DeployOpen plans, implements and documents evidence for these programs, and it does not issue audit reports or certifications. Ask any implementation partner to show how evidence will be presented to the Compliance Enforcement Authority or your national authority, and to name the scope and deliverables in writing before work starts.
NERC CIP, NIS2 and NIST CSF side by side
This table compares the legal force, scope, asset scoping, reporting clocks, supervision, penalty ceilings and proof produced by NERC CIP, NIS2 and the NIST CSF. Read each row across to see where a utility's obligations differ by jurisdiction, and where the voluntary CSF can organize work that the two mandatory regimes both require.
| Dimension | NERC CIP (United States) | NIS2 (European Union) | NIST CSF 2.0 (voluntary) |
|---|---|---|---|
| Legal force | Mandatory in the US once FERC approves each standard under section 215 of the Federal Power Act | Directive, so binding through national transposition laws in each Member State | Voluntary; NIST is not a regulator, though some customers or suppliers may require it |
| Who is in scope | Entities on the NERC Compliance Registry; about 1,673 unique US entities as of June 2025 (FERC Order No. 919) | Essential and important entities across 18 sectors in Annexes I and II | Any organization, regardless of size, sector or maturity |
| Asset scoping | Bright-line impact categories in CIP-002: high, medium and low impact BES Cyber Systems, with requirements scoped by Applicable Systems | Scoped by entity classification and sector rather than by named asset lists; confirm national scope with the competent authority | Scoped by the organization's own Organizational Profile and risk priorities |
| Incident reporting clock | CIP-008-6 Part 4.2: initial notification within one hour of determining a Reportable Cyber Security Incident; by end of next calendar day for an attempt to compromise | Early warning within 24 hours, incident notification within 72 hours, final report within one month (Article 23(4)) | No reporting clock; reporting duties come from other laws or contracts |
| Supervision style | Compliance Audits, Spot Checks, Self-Certifications, Self-Reports and investigations by the Compliance Enforcement Authority | Ex ante supervision for essential entities and ex post for important entities (Articles 32 and 33) | No regulator; NIST does not run a conformity assessment program |
| Maximum fines | Sanction Guidelines reference a maximum civil penalty of $1,584,648 per violation, per day (18 CFR 385.1602(d), as adjusted) | At least EUR 10 million or 2% of worldwide annual turnover for essential entities; at least EUR 7 million or 1.4% for important entities (Article 34) | None; no penalties attach to the framework itself |
| Proof produced | No CIP certificate; evidence is produced for audits, spot checks and self-certifications | No certificate of compliance; evidence is produced for inspections, audits, scans and information requests | No certification; documented Current and Target Profiles and tier decisions that you choose to keep |
| Where it helps most | Confirm which BES Cyber Systems you hold and map each one to its CIP obligations before your next audit cycle | Confirm your classification and national transposition rules with your competent authority before building evidence | Use it to organize shared controls across both regimes, with official mappings to CIP and NIS2 requirements to confirm with ENISA and NERC |
Which regime applies to which energy entity
If your organization is registered with NERC for functions on the bulk electric system (BES) in the United States, the CIP Reliability Standards are mandatory once FERC has approved them. NERC's Compliance Registry identified about 1,673 unique US entities subject to mandatory CIP compliance as of June 2025, according to FERC Order No. 919. Scope does not start with the organization. It starts with each asset, which CIP-002-5.1a classifies into one of three impact categories using bright-line criteria in its Attachment 1.
- High impact: mainly Control Centers of Reliability Coordinators and qualifying Balancing Authority, Transmission Operator and Generator Operator Control Centers.
- Medium impact: assets such as generation of 1500 MW or more at one plant, or Transmission Facilities at 500 kV or higher.
- Low impact: other BES Cyber Systems at listed assets, which carry fewer requirements but are not exempt.
- Applicable Systems tables: each requirement names the systems it covers, such as high impact BES Cyber Systems or medium impact BES Cyber Systems with External Routable Connectivity, plus associated EACMS, PACS and PCA, as in CIP-007-6.
- Registration: your registered functions determine which standards apply to you, so check the Compliance Registry entry for your entity.
Confirm your impact rating for each asset with counsel and your Regional Entity before you scope controls, because the rating drives which requirements apply.
NIS2 is a directive, so its obligations reach energy companies through national transposition laws in each Member State. The Directive covers 18 sectors: 11 of high criticality in Annex I and 7 other critical sectors in Annex II. Energy sits in Annex I. Once an entity is in scope, Article 3 classifies it as essential or important. Both classes face the same risk-management measures under Article 21 and the same reporting duties under Article 23, but the supervision differs. Essential entities face ex ante supervision, while important entities face ex post supervision under Articles 32 and 33.
- Sector annex: check whether your activity appears in Annex I or Annex II, since that determines the sector and the size thresholds that apply.
- Size and classification: the essential or important label depends on the Article 3 criteria, so do not assume a company is essential because it is large.
- Supervision: essential entities can expect proactive inspections, while important entities are generally supervised after an incident or evidence of non-compliance.
- National law: Member States may adopt or keep rules that go further under Article 5, so the transposition law in your country is the text that binds you.
- Recent proposal: the Commission's January 2026 proposal (COM(2026) 13) would add a small mid-cap category, but it still needs approval by the European Parliament and the Council.
Confirm your sector annex and essential or important classification with counsel and your national competent authority, because those answers set your obligations and fine exposure.
Energy groups that operate in the United States and the EU often face NERC CIP and NIS2 at the same time, and the two regimes do not share a scope model. CIP scopes by asset and impact rating, while NIS2 scopes by sector and entity size and classification. A single corporate group can therefore have some US assets under CIP and some EU entities under NIS2, with some entities in neither. Map each legal entity and each asset separately rather than assuming one program covers both.
- Separate legal entities: each subsidiary may have its own registration, sector and classification, so list them individually.
- Shared control environment: a single control set can serve both regimes, but the evidence and asset lists still differ by regime.
- Different clocks: CIP-008-6 requires an initial notification within one hour of determining a Reportable Cyber Security Incident, while NIS2 uses a 24-hour early warning, a 72-hour notification and a final report within one month.
- Different supervisors: NERC and the Regional Entity enforce CIP, while national competent authorities supervise NIS2.
- Cross-border data: incident and asset records may be needed by more than one authority, so decide early who holds them.
Confirm the scope of each entity and asset with counsel in each jurisdiction, since a group-level view often hides the entity-level obligations that matter.
Incident reporting clocks: CIP-008-6 against NIS2 Article 23
Reporting clocks are usually the first obligation that forces process design, because they run from a moment you define yourself. Under CIP-008-6, Part 4.2 requires an initial notification within one hour after determining a Reportable Cyber Security Incident, and by the end of the next calendar day after determining that an event was an attempt to compromise an applicable system. The trigger is your own determination, so the clock only works if your team can make that determination quickly and record when it was made. Confirm the exact notification recipients and form with your Regional Entity and with the current text of CIP-008-6 before you write the procedure, since the standard's wording governs.
NIS2 Article 23(4) uses a different structure: a staged clock for essential and important entities reporting significant incidents to their CSIRT or competent authority. The stages are an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification. These are three separate deadlines with different content expectations, and they do not map one to one onto the CIP clock. Do not treat the one-hour CIP notification as equivalent to the 24-hour early warning, or the 72-hour notification as a substitute for a CIP filing. Where an energy company falls under both regimes, each obligation needs its own deadline, recipient and evidence trail.
To meet either clock, a team needs decisions made before an incident occurs. Name a triage owner who can classify an event as reportable, an incident decision owner with authority to start the clock, and a deputy for each. Prepare reporting templates for the initial notice, the NIS2 early warning and notification, and the final report, and pre-fill the fields you already know, such as system scope and affected impact categories. Run a tabletop exercise that starts the clock and records the timestamps, so you can see whether triage takes minutes or hours. Ask your compliance counsel which regulator receives each filing in each Member State where you operate.
Who assesses each regime and what proof it produces
This table compares who checks each regime, what evidence or proof comes out of that check, and how often the review happens. Read it to see which regimes produce a regulator finding you must answer and which produce only your own documentation. Confirm review cycles with the regulator or Regional Entity, since no fixed cycle is set out here.
| Dimension | NERC CIP | NIS2 | NIST CSF 2.0 |
|---|---|---|---|
| Legal status | Mandatory in the US once FERC approves each standard under section 215 of the Federal Power Act | Mandatory through national transposition laws in each EU Member State | Voluntary; NIST is not a regulatory agency, though some customers or suppliers may require it |
| Who assesses or supervises | Compliance Enforcement Authority, either a Regional Entity or NERC | National competent authorities, or the CSIRT where applicable | No assessor; NIST does not oversee use of the framework |
| Assessment tools | Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging, periodic data submittals, investigations and complaints | Inspections, security audits, security scans and information requests, with administrative fines | None set by NIST; your own self-assessment against Tiers and Profiles |
| Proof produced | Findings and enforcement outcomes from the Compliance Enforcement Authority; no CIP certificate exists | Supervisory findings and orders; no certificate of compliance exists | Your own Current and Target Profiles and Tier assessment; no certification or conformity assessment program |
| Review cycle | Confirm audit and self-certification schedules with your Regional Entity | Confirm supervision cadence and ex ante or ex post treatment with your national authority | Set internally; NIST does not prescribe a review cycle |
| Who you should ask | Your Regional Entity's compliance contact | Your national competent authority or CSIRT | Your own governance or audit function, and any customer who asks for CSF alignment |
Where the CSF mapping reduces duplicate work
NERC CIP, NIS2 and the NIST CSF share control themes, so one well-kept evidence set can serve more than one regime. The cards below show where official mappings help, and where each regime still needs its own proof.
CSF 2.0 Core as a shared vocabulary
The CSF 2.0 Core is organized into six Functions, 22 Categories and 106 Subcategories. Teams can tag their existing CIP, NIS2 and internal controls to these Subcategories once, then reuse that index in every audit or assessment conversation. Check that each mapping points to a specific control owner and artifact, not only to a Function heading.
NIST reference tool mappings to SP 800-53 and ISO
NIST's CSF 2.0 Reference Tool export lists 363 Implementation Examples and informative references to SP 800-53 Rev. 5.2.0 and ISO/IEC 27001:2022, among others. These links can speed up building a control catalog. Treat them as starting points, because NIST notes it does not check the correctness of non-NIST mappings and listing a mapping does not imply endorsement.
ENISA mappings for NIS2 technical guidance
ENISA's June 2025 technical implementation guidance for Implementing Regulation 2024/2690 includes examples of evidence and mappings to ISO/IEC 27001:2022 and NIST CSF 2.0. For energy companies in NIS2 scope, this offers a route from CSF Subcategories to the evidence a national authority may ask for. Confirm with your national competent authority which evidence format it expects.
CIS Controls Navigator cross-references
The CIS Controls Navigator for v8.1 offers CIS mappings to 30 frameworks and versions, including NIST CSF 2.0, SP 800-53 Rev. 5, ISO/IEC 27001:2022 and NIS2. It is useful for finding where a single technical control, such as access logging, satisfies several requirements at once. Verify each mapping against the CIP requirement text itself, since a shared control topic does not mean the CIP table is satisfied.
Govern Function added in 2.0
CSF 2.0 added the Govern Function to the five Functions of earlier versions. It covers risk strategy, roles, policy and supply chain oversight, areas where NIS2 governance duties and CIP vendor and program requirements often overlap. Assign owners for Govern outcomes early, since leadership accountability is hard to evidence retroactively.
Mappings are not equivalence
ENISA states its mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation's requirements. A CSF Subcategory marked as related to a NIS2 measure does not prove NIS2 compliance. CIP requirement tables, such as those for Electronic Access Control and System Security Management, must still be evidenced directly against the Applicable Systems in scope.
How to sequence NERC CIP, NIS2 and the CSF
This sequence lets one team meet a mandatory US reliability regime and an EU directive from a single set of asset records, incident procedures and control mappings. Each step produces an artifact that the next one depends on.
Confirm entity and asset scope first
Start by establishing which legal entities, sites and operating systems fall under each regime. For US operations, the compliance team checks the NERC Compliance Registry status of each registered entity. For EU operations, legal and the business unit confirm whether the group entity falls in an NIS2 sector in Annex I or Annex II and whether it is a provider type the directive covers. The output is a scope register that names each entity, the regime that applies to it and the owner who signed off. Ask each regulator or registered entity contact to confirm the scope in writing before the next step begins.
Classify assets by impact and entity status
For the US side, classify BES Cyber Systems under the bright-line criteria in CIP-002-5.1a Attachment 1 as high, medium or low impact, and record the Applicable Systems that each CIP requirement table will reach, including EACMS, PACS and Protected Cyber Assets. For the EU side, record whether each in-scope entity is essential or important under Article 3 of NIS2, since that status drives the supervision model under Articles 32 and 33. Pair the two classifications in one inventory so that a single asset can carry both labels. The check that closes this step is a reviewed classification record that the operations and compliance leads have both signed.
Build incident reporting to the shortest clock
Design one incident intake and triage procedure, then attach the reporting clocks to it. Under CIP-008-6 Part 4.2, the initial notification follows within one hour after determining a Reportable Cyber Security Incident, and by the end of the next calendar day after determining that an event was an attempt to compromise an applicable system. Under NIS2 Article 23(4), the early warning comes within 24 hours, the incident notification within 72 hours and the final report within one month of the notification. Because the US clock is the shortest, the runbook should be built around it, with separate notification templates for each regulator and CSIRT. Confirm the notification routes and contacts with NERC, the relevant Regional Entity and the national CSIRT or competent authority, and test the runbook in a tabletop exercise before relying on it.
Map controls to the CSF as the shared structure
Use the NIST CSF 2.0 Core's six Functions (Govern, Identify, Protect, Detect, Respond and Recover) as the common index for controls. Map each CIP requirement and each NIS2 Article 21 measure to the relevant Subcategories, then record the gaps. The CSF is voluntary and carries no certification, so it works as a neutral translation layer rather than as a third compliance obligation. Where a mapping is needed for EU technical evidence, the ENISA NIS2 implementation guidance provides examples of mappings to ISO/IEC 27001:2022 and NIST CSF 2.0, but ENISA states that its mapping is not a measure of equivalence. The output is a single control register with one row per control and columns for each regime's requirement. Confirm any gap decisions with the legal and compliance owners of each regime.
Track the CIP effective dates and virtualization changes
Build a dated change calendar for the CIP standards. NERC lists CIP-003-9 as enforceable from 1 April 2026, adding vendor electronic remote access controls for low impact BES Cyber Systems, and CIP-012-2 as enforceable from 1 July 2026, adding protection of the availability of Real-time data between Control Centers. FERC Order No. 919 approved 11 revised standards that accommodate virtualization, which NERC lists as effective 1 July 2028. Related approvals include CIP-002-8 (effective 1 July 2028), CIP-003-11 (effective 1 July 2029), CIP-015-1 (subject to future enforcement from 1 October 2028) and CIP-015-2 (effective 1 October 2029). Confirm the current list and effective dates with NERC on its CIP standards page, because approvals and effective dates change. The output is a calendar owned by the compliance lead and reviewed at each change cycle.
Assemble shared evidence once
Build the evidence set that both regimes will test, and store it in one repository with a consistent naming scheme. Core items include the asset inventory from step two, access logs and access review records, change and configuration records, network monitoring output and the incident runbook with its test records. Each item should carry a version, an owner and a retention rule. For CIP, the Compliance Enforcement Authority may request evidence through audits, spot checks, self-certifications and periodic data submittals, so the repository should answer those requests without reconstruction. For NIS2, competent authorities may use inspections, security audits, security scans and information requests. Confirm with each regulator which formats and retention periods it expects, since the supplied facts do not set them.
Prepare for the audit and inspection regimes
Assign a named owner for each regime's oversight process and run a readiness review against the evidence repository. For CIP, the Regional Entity or NERC may run a Compliance Audit, Spot Check or investigation, and there is no CIP certificate to show. For NIS2, the national authority may conduct inspections, audits or scans, and essential entities face ex ante supervision while important entities face ex post supervision. Neither regime issues a certificate that can close the question, so the readiness record is the proof. The check that closes this step is a readiness report that traces each in-scope control to its evidence item and identifies open gaps with owners and dates. Ask the regulator or counsel to confirm which evidence will be requested first.
Penalties, legal force and what each regime can cost you
Legal force decides what you owe before any penalty is considered. NERC CIP becomes mandatory in the United States only after FERC approves each standard under section 215 of the Federal Power Act, and NERC and the Regional Entities then monitor and enforce it. NIS2 is a directive, so its obligations reach you through national transposition laws, and Article 5 lets Member States adopt or keep rules that ensure a higher level of cybersecurity. Your exposure in an EU country can therefore go beyond the directive's baseline. The NIST CSF is voluntary. NIST is not a regulatory agency, but some customers and suppliers require it by contract. A 2017 executive order made it mandatory for U.S. federal agencies, which matters only if you sell to them or operate federal systems. Confirm which customer contracts name the CSF before you treat it as optional.
The penalty ceilings differ in how they are counted. NERC's Sanction Guidelines reference 18 CFR 385.1602(d), which sets a maximum civil penalty of $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 (January 2025). Because the amount applies per day, the length of time a gap stays open can matter as much as its severity. An unresolved evidence gap found in an audit is a different exposure from one closed before the audit began. For NIS2, Article 34 sets maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. Because the EU ceilings use a turnover percentage, group structure and worldwide revenue need checking with counsel. Confirm with your national competent authority how the figure is applied under your country's transposition law.
Cost comes from four places: internal staff time, outside assessors and consultants, tooling and remediation of gaps. Asset count drives much of the CIP effort. Scope depends on impact categories and the Applicable Systems tables, so the number of high, medium and low impact BES Cyber Systems, plus their associated EACMS, PACS and PCA, sets how much evidence each requirement needs. Evidence gaps are usually the costliest part: missing access logs, undocumented change baselines, or incident runbooks that cannot meet the reporting clocks in CIP-008-6 or the NIS2 stages of 24 hours, 72 hours and one month. Remediation depends on the age of your control systems and their vendor support. Before requesting a quote, ask for a written scope naming the standards, versions and asset list, a gap assessment deliverable and a remediation plan with a separate line for each item. DeployOpen works to fixed scope agreed in writing and does not publish a price list.
Questions energy teams ask before hiring outside help on CIP, NIS2 and the CSF
Which framework applies first to a US utility?
For a US utility that owns or operates bulk electric system assets, NERC CIP is the mandatory framework that applies first, because FERC-approved CIP standards are enforceable in the United States. The first task is not a document review but an impact categorization under CIP-002-5.1a, which sorts BES Cyber Systems into high, medium and low impact using bright-line criteria. That result decides which requirements apply to which assets. The NIST CSF can be used alongside it as a voluntary structure for governance and reporting, but it does not replace CIP obligations. Confirm your registration status and applicable systems with your Regional Entity and your NERC Compliance Registry record before scoping any work.
Does NIS2 apply to an energy company with EU operations?
It depends on whether the entity is in scope under the national law that transposes NIS2 in each Member State where it operates. NIS2 covers 18 sectors, and energy is among the sectors of high criticality in Annex I. Entities are classified as essential or important under Article 3, and that classification drives the supervision regime. Because NIS2 is a directive, obligations come through national transposition laws, and Member States may adopt higher requirements under Article 5. Check the national competent authority's guidance for each country, and confirm whether any EU subsidiary is itself the regulated entity. The proposed amendments of 20 January 2026 (COM(2026) 13) are still a proposal and should be tracked, not assumed.
Does the NIST CSF certify anything?
No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services and has no plans to develop a conformity assessment program. A CSF profile is a record of your current and target outcomes, not a certificate. If a customer or board asks for proof, the evidence is your Organizational Profile, your control mapping and the artifacts behind it. Any consultant who offers a CSF certificate should be asked which body issues it and whether NIST recognizes that body. Mandatory regimes such as CIP and NIS2 produce regulator-facing evidence instead, which is a different kind of proof.
How long does readiness take, and what drives the effort?
No single duration applies to every energy company, and no researched figure is available here, so confirm estimates against your own asset inventory. The main drivers are the number of BES Cyber Systems and their impact categories, how many sites and control centers are in scope, the state of existing asset inventories, network segmentation and electronic access documentation, and whether OT and IT share tooling. For NIS2, the number of EU jurisdictions and the reporting workflow with national authorities add effort. Ask any provider to break the timeline into discovery, gap analysis, remediation and evidence collection, and to name the dependencies on your outage windows and vendor contracts.
What does the work need from our internal staff?
Outside help cannot replace the people who know your plants and networks. Expect to need three roles at minimum:
- Asset owners, who confirm which systems exist, their function and their impact category.
- OT engineers, who validate network diagrams, electronic access paths, vendor remote access and change procedures in the control environment.
- A compliance lead, who owns evidence, decides policy wording and works with the Compliance Enforcement Authority or the national competent authority.
Plan time for these people during discovery and again before any audit or spot check. Without their sign-off, documentation tends to describe the intended design rather than the operating reality.
Can we do the CIP and NIS2 work ourselves?
Many utilities can do parts of it internally, especially the governance documents, the evidence index and routine change records. The harder parts are an accurate BES Cyber System inventory, OT-safe testing of controls, and building a defensible position on each applicable requirement before an audit. Self-assessment is permitted in the CIP program through Self-Certifications and Self-Reports, but those still need evidence that holds up to review. Assess honestly whether your team has current OT security expertise, time during outage planning, and someone who can hold the compliance pen across both regimes. A partial internal effort with targeted external review is a common middle path.
What should we ask for in a fixed-scope quote?
A fixed-scope quote should state the written scope in plain terms, so you can compare it with other proposals. Ask for:
- The list of standards, requirements and entities covered, including which CIP standards, impact categories and NIS2 jurisdictions.
- Named deliverables such as the asset inventory, gap analysis, remediation plan, evidence index and test results.
- Assumptions about your staff time, access to OT environments, test windows and third-party data.
- Exclusions, including whether audit defense, regulator correspondence or incident response is in or out.
- How changes to scope are priced and approved, and what happens if CIP-003-9, CIP-012-2 or the 2026 CIP revisions change the requirements mid-engagement.
DeployOpen agrees scope, deliverables and timelines in writing before work starts, and prices follow from that written scope.
Sources and further reading
- NERC CIP Reliability Standards (status and US effective dates) ↗
- NERC Rules of Procedure (Section 400, compliance monitoring) ↗
- NERC: CIP-008-6, Cyber Security: Incident Reporting and Response Planning ↗
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 ↗
