Should a utility choose NERC CIP or CIS Controls first?
NERC CIP comes first for in-scope assets. CIP is the mandatory obligation for BES Cyber Systems, enforced in the United States by NERC and the Regional Entities, while the CIS Controls are a voluntary, non-regulatory set of safeguards that the Center for Internet Security says do not replace any regulatory or compliance scheme. The practical sequence is to confirm which assets fall under CIP first, using the impact categories in CIP-002-5.1a, then apply CIS Controls to everything outside that boundary, such as corporate email, business applications and most enterprise endpoints. Doing both is the usual pattern, and the CIS Controls Navigator's mapping to NERC CIP is a useful starting point for cross-referencing, not evidence that a given CIP requirement is met.
Before relying on that mapping, confirm three things with your compliance team and your Regional Entity's expectations. First, the Applicable Systems column in each CIP requirement table decides which assets a Safeguard must cover, so a CIS Safeguard that looks equivalent may not reach a PCA, EACMS or PACS in scope. Second, CIP sets prescriptive limits that CIS does not, such as the 90 consecutive day log retention in CIP-007-6 Part 4.3 and the 35 calendar day patch evaluation window in Part 2.3, so a CIS retention or patching target cannot be assumed to satisfy them. Third, CIS Safeguards are expressed as outcomes you verify yourself, so the evidence you keep for an auditor must be generated for the CIP asset set specifically.
How NERC CIP and CIS Controls differ on scope, enforcement and specificity
This table compares who must comply, what each standard governs, how it is enforced and how prescriptive it is. Read it to see where CIS Safeguards can inform corporate IT while CIP remains the enforceable baseline for operational systems.
| Dimension | NERC CIP | CIS Controls v8.1 |
|---|---|---|
| Who must comply | Registered entities owning or operating BES assets in the United States, as listed on the NERC Compliance Registry | No mandate. Any organization may use the Controls, and CIS says they are free to use to improve the organization's own cybersecurity |
| Source of authority | NERC develops the standards, which become mandatory once FERC approves them under section 215 of the Federal Power Act | Voluntary best-practice guidance published by the nonprofit Center for Internet Security |
| Scope unit | BES Cyber Systems sorted into high, medium and low impact using CIP-002-5.1a bright-line criteria, with requirements scoped by Applicable Systems | Enterprise assets and software, with each Safeguard tied to an asset class and an Implementation Group (IG1, IG2 or IG3) |
| Who enforces | The Compliance Enforcement Authority (a Regional Entity or NERC) through audits, spot checks, self-reports and investigations | Nobody. CIS publishes no enforcement or certificate, and says the Controls do not replace any regulatory scheme |
| Number of requirements | 13 mandatory CIP standards as of 17 October 2026, with sub-parts that vary by standard | 153 Safeguards in 18 Controls for v8.1, with 56 in IG1, 130 through IG2 and all 153 in IG3 |
| Log retention | CIP-007-6 Part 4.3 requires retaining Part 4.1 logs for at least the last 90 consecutive days where technically feasible, except under CIP Exceptional Circumstances | Safeguard 8.10 requires audit logs across enterprise assets to be retained for at least 90 days |
| Patch timing | CIP-007-6 Part 2.3 requires applying, planning or revising a mitigation plan within 35 calendar days of completing the evaluation | Patch management Safeguards call for timely updates without a fixed day count. Confirm the exact interval your Implementation Group requires with CIS guidance |
| Licensing | Standards text is published by NERC for use by registered entities. Confirm reuse terms directly with NERC | Creative Commons BY-NC-ND 4.0. Free internal use, but commercial use requires CIS's prior approval |
| What each is for | Enforceable reliability and security baseline for BES Cyber Systems that can affect grid operation | Prioritized hygiene and defense actions for enterprise IT, usable as a shared baseline and as a mapping source for other frameworks |
Where CIS Safeguards line up with CIP requirements
CIS maintains a mapping between the CIS Controls and NERC CIP, and the CIS Controls Navigator for v8.1 lists NERC CIP among its mapped frameworks. That gives you a traceable starting point: pick a CIP requirement, find the Navigator row that points to it, then check which CIS Safeguard and security function it relates to. Treat the mapping as a topical alignment tool, not a statement that meeting a Safeguard satisfies a CIP requirement. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, and the mapping does not change that.
The gap is in specificity. CIS Safeguards are written for any enterprise, so they do not carry CIP's Applicable Systems tables, the impact categories set by CIP-002 or the evidence expectations an auditor applies to a named BES Cyber System, its EACMS, PACS or PCA. A Safeguard about audit log retention, for example, is a general expectation, while CIP-007-6 Part 4.3 sets a specific rule for the logs covered by Part 4.1. Where a mapped row points to a CIP requirement, ask whether the CIP requirement applies to the asset in question before you count the Safeguard as evidence for it.
Confirm every mapped row against the CIP version in force for each asset and date you are assessing. NERC lists 13 CIP standards as mandatory as of 17 October 2026, and several revisions carry later effective dates, including CIP-002-8 and CIP-003-11 (effective 1 July 2028 and 1 July 2029 respectively, per NERC's CIP standards page and Order No. 918). The Navigator mapping was current when CIS published it, so a row can point to a requirement that has since been revised. Check the NERC standard text directly and record the version you relied on in your evidence file.
Where the CIS and CIP work overlaps
CIS Safeguards and CIP requirements meet in a few operational areas: logging, access, inventory, patching, incident response and governance. In each area a CIS Safeguard can build the program that a CIP requirement tests, but the CIP requirement still sets the scope, the deadline and the evidence NERC or a Regional Entity will ask for.
Audit logging and retention
CIP-007-6 Part 4.3 requires retaining the Part 4.1 logs, where technically feasible, for at least the last 90 consecutive calendar days, except under CIP Exceptional Circumstances. CIS Safeguard 8.10 also calls for retaining audit logs for at least 90 days, which lines up on the number. It does not satisfy Part 4.3, because the CIP requirement applies only to in-scope Cyber Assets and its own logging list. Check which Applicable Systems your logs cover and whether your retention is technically feasible for each asset class.
Patch evaluation and mitigation
CIP-007-6 Part 2.3 requires that, within 35 calendar days of completing a patch evaluation, you apply the patch, create a dated mitigation plan, or revise an existing plan with a stated timeframe. CIS Safeguards on vulnerability management and patching describe the process you should run to meet this, but they do not set the 35-day clock or the mitigation plan format. Confirm that your CIS-based patch cycle starts the CIP clock on the evaluation date and records each decision for the auditor.
Asset inventory and classification
CIP-002-5.1a sorts BES Cyber Systems into high, medium and low impact using bright-line criteria, so asset inventory is a regulatory input, not only a security hygiene task. CIS Safeguards on enterprise asset and software inventory support the discovery work needed to build this list. They do not perform the impact rating. Verify that your CIS inventory captures operational technology assets that CIP treats as in scope, and that classifications are reviewed when the grid topology changes.
Access and remote access controls
CIS Safeguards on account management, access control and secure remote access map to the intent of CIP-004 and CIP-005 controls for authorization, access review and electronic access points. CIP requirements, however, apply to specific Applicable Systems, including Electronic Access Control or Monitoring Systems and Physical Access Control Systems, and they set their own review and revocation rules. Treat a CIS-aligned access program as the foundation, then map each CIP access requirement to its scoped assets and keep separate evidence for each.
Incident response planning
CIP-008-6 requires a Cyber Security Incident response plan for in-scope systems, and CIS Safeguards on incident response management and testing provide a practical structure for building and exercising one. The CIS Controls do not set NERC reporting obligations or timelines, so a CIS-based playbook still needs CIP-specific reporting paths. Confirm that your plan names the BES Cyber Systems it covers and that exercise records show the CIP reporting steps were tested.
Govern function in CIS v8.1
CIS v8.1 realigned its security function mappings to NIST CSF 2.0 and added the Govern function, which covers 25 of the 153 Safeguards. Governance Safeguards help you assign ownership, policy and risk decisions across IT and operational teams, which CIP leaders must also document. The Govern function does not replace CIP's named responsibilities, such as CIP-003 policy and CIP-013 supply chain risk management. Confirm that your governance records show who signs CIP decisions, not only who owns the CIS program.
Why CIP retention and patch rules cannot be met with CIS alone
CIS Safeguard 8.10 and CIP-007-6 both ask for log retention, but they set different obligations. Safeguard 8.10 requires audit logs across enterprise assets to be kept for at least 90 days, a floor that a corporate IT team can meet with a retention setting in its log platform. CIP-007-6 Part 4.3 requires retaining the Part 4.1 logs for at least the last 90 consecutive calendar days, where technically feasible, unless CIP Exceptional Circumstances apply. The word "consecutive" removes gaps, and the scope is set by the Applicable Systems column, so the retention duty attaches to specific BES Cyber System categories, their associated EACMS, PACS and PCA, not to every enterprise asset. Before you rely on a CIS-aligned retention policy, confirm which CIP-registered assets generate Part 4.1 logs, whether each one can actually hold 90 consecutive days, and who documents any technical infeasibility.
The patch rule is where CIS guidance is most likely to fall short. Part 2.3 of CIP-007-6 requires that, within 35 calendar days of completing the evaluation of a security patch, the entity either applies it, creates a dated mitigation plan, or revises an existing plan. That plan must state how the vulnerability will be addressed and give a timeframe. CIS sets the intent through its Safeguards, and the CIS Controls Assessment Specification defines what to measure for each Safeguard, but CIS states that the specification covers what to measure, not how. It does not give a 35-day clock, a dated plan format or a record of who evaluated the patch and when. The utility must define that evidence trail itself, with a timestamped evaluation record, a decision field for each patch, and a link to the asset list that shows which Applicable Systems the patch touches.
The practical decision is to treat CIS as the control design baseline for corporate IT and to write CIP-specific procedures for every Applicable System in CIP-007-6's tables. Ask the compliance team to map each CIS Safeguard you adopt to the CIP requirement it supports, then mark the gaps where CIP demands a prescriptive timeframe, a retention period or a named record that CIS does not supply. Illustratively, a corporate server that also feeds a PACS may be outside CIP-007-6 Part 4.3 for some purposes but inside it for others, so the scoping decision must be documented per asset. The CIS Critical Security Controls Navigator is a useful starting point for the mapping, but its entries do not replace the CIP standard text or the Compliance Enforcement Authority's view of your evidence.
Using CIS Controls outside the CIP boundary
Corporate IT systems that are not BES Cyber Systems, and have no connection that makes them part of an in-scope asset, fall outside CIP. Nothing in CIP requires them to meet CIP requirements, so the CIS Controls are a natural program for them. IG1 is CIS's essential cyber hygiene baseline and a minimum standard for every enterprise, so most corporate IT teams start there. IG2 becomes relevant where the enterprise holds sensitive information or has more operational complexity. Confirm the boundary with your CIP compliance lead before you rely on it, because CIP scope is set by the CIP-002 impact categories and by the Applicable Systems tables in each standard, not by CIS.
- Scope starts with CIP-002: Document which systems were evaluated and classified under CIP-002-5.1a, and keep that record current.
- IG1 as the starting set: Use the 56 IG1 Safeguards as the baseline for corporate IT, then extend to IG2 by risk and data sensitivity.
- Shared identity and network services: Directory, DNS, and remote access services used by both corporate IT and CIP systems need a documented decision on which program governs them.
- Licensing note: CIS Controls content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, and commercial use requires CIS's prior approval. Internal use to improve your own cybersecurity is covered by the CIS statement that the Controls are free for any organization to use.
Check the CIP-002 classification record and ask whether any corporate system is reached by CIP-scoped remote access before you treat it as out of scope.
Low impact BES Cyber Systems at listed assets fall under CIP-003 policy and control obligations, not the full set of CIP requirements. CIP-003-9 added vendor electronic remote access controls for low impact BES Cyber Systems, enforceable from 1 April 2026, and CIP-003-11 (Order No. 918) adds remote user authentication, protection of authentication information in transit, and malicious communication detection for low impact assets, effective 1 July 2029. CIS Safeguards can support the operational evidence behind these controls, but they do not replace the CIP-003 obligations, which are set by the standard. IG1 is the practical starting point for the low impact asset owner, with IG2 added where the asset's operating environment justifies it.
- Map to the current version: Track CIP-003-9 now and plan for CIP-003-11 separately, since they carry different effective dates.
- Remote access controls: IG1 access and account Safeguards can support the vendor remote access controls, but confirm the mapping against the CIP-003 requirement text.
- Authentication in transit: The 2029 remote user authentication requirements are not met by a generic IG1 control set alone, so confirm the technical gap early.
- Evidence format: CIP evidence must show compliance with the standard as written, so keep CIS evidence as supporting material linked to the requirement.
- Licensing note: Commercial use of CIS Controls material requires CIS's prior approval, so check this before building internal templates for sale or redistribution.
Ask your compliance lead which CIP-003 requirements apply to each listed low impact asset and which CIS Safeguards you plan to cite as evidence.
Vendor and cloud systems often sit next to CIP-scoped assets without being BES Cyber Systems themselves. Whether they are in scope depends on the role they play, such as Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS), or Protected Cyber Assets (PCA) associated with an in-scope system. Where a vendor or cloud service is EACMS or PACS for a CIP-scoped asset, the CIP requirements for those systems apply. CIS Safeguards can cover the supplier and cloud configuration work around them, but the CIP Applicable Systems tables decide the obligations. Illustrative example: a cloud-hosted monitoring tool that receives logs from a medium impact control center is a question to put to your CIP team, not an answer you can reach from CIS alone.
- Role over location: Ask whether the system is EACMS, PACS, or PCA for an in-scope asset, regardless of where it runs.
- Log retention: Safeguard 8.10 requires audit logs across enterprise assets to be retained for at least 90 days, and CIP-007-6 Part 4.3 requires the Part 4.1 logs to be retained for at least 90 consecutive calendar days, where technically feasible. Confirm both retention periods in the design.
- Patch timing: CIP-007-6 Part 2.3 sets a 35 calendar day window after evaluation for patches, mitigation plans, or revisions, which CIS does not replace for in-scope systems.
- Contract terms: Ask vendors to commit to the evidence they will provide, the notice they will give, and the access controls they support.
- Licensing note: Using CIS Controls material in vendor contracts or deliverables may need CIS approval if the use is commercial.
Confirm with your CIP compliance lead and each vendor which systems are in scope and which evidence the vendor will provide.
Running CIP and CIS Controls in one program
This sequence sets CIP scope first, then builds CIP evidence for the in-scope systems, and only then reuses CIS-based corporate controls where the CIS-to-CIP mapping and a line-by-line check confirm the evidence actually satisfies the CIP requirement. The result is one program with a clear boundary between regulated and non-regulated assets.
Confirm BES Cyber System categorization under CIP-002
Start with the CIP-002-5.1a impact assessment. Operations, compliance and engineering staff should walk through the bright-line criteria in Attachment 1 and classify each BES Cyber System as high, medium or low impact, then record the basis for each decision. Output: a signed categorization list that names every in-scope asset class and the Applicable Systems associated with it, including EACMS, PACS and PCA. The step is done when the list is approved and every corporate system that is not a BES Cyber System is documented as outside the CIP boundary, so that CIS work does not silently widen or narrow scope.
Build the CIP evidence set for Applicable Systems
For each categorized system, map every CIP requirement part that applies to its impact rating and system type. The compliance lead owns the matrix, while system owners supply the artifacts, such as the Part 4.1 logs and the Part 4.3 retention settings under CIP-007-6, which require retention for at least the last 90 consecutive calendar days where technically feasible. Output: a requirement-by-system evidence register with an owner, storage location and retention rule for each item. Confirm retention settings in the actual logging platform, not only in policy, before marking the register complete.
Adopt CIS Implementation Group 1 across corporate enterprise assets
Apply CIS IG1 to corporate enterprise assets outside the CIP boundary. CIS describes IG1 as essential cyber hygiene and a minimum standard for every enterprise, with 56 Safeguards. IT security owns the rollout, with asset owners confirming device, software, data, user and network coverage. Output: an IG1 Safeguard status record that names the owner and evidence source for each Safeguard. Because CIS states that the Controls do not replace any regulatory or compliance scheme, keep this record labeled as corporate hygiene, not as CIP evidence, unless a reviewer confirms otherwise.
Use the CIS-to-CIP mapping to identify reusable evidence
Use the CIS Controls Navigator mapping to NERC CIP to find candidate overlaps between IG1 Safeguards and CIP requirement parts. The mapping is a starting point that shows where a corporate control may address a CIP topic, not a statement that the control satisfies the CIP requirement. Compliance and the CIP control owners produce a candidate list with one row per reused artifact. Output: a shortlist of overlaps with the CIP requirement part, the CIS Safeguard and the artifact proposed for reuse.
Check each reused artifact line by line against CIP
For every candidate on the shortlist, read the exact CIP requirement part, including its Applicable Systems table, and test whether the artifact covers the requirement's scope, frequency, content and timing. Pay particular attention to prescriptive rules that a general CIS Safeguard does not state, such as the 35-calendar-day window in CIP-007-6 Part 2.3 for patch evaluation and mitigation planning. Output: a signed check sheet with a pass, gap or partial result for each artifact. Any gap moves to a CIP-only control. Only artifacts marked as passing enter the CIP evidence register from the previous step.
Track CIP effective dates from 2026 through 2029
Set up a standards calendar that tracks the versions already in force and the revisions still to take effect. The NERC CIP standards page lists CIP-003-9 as enforceable from 1 April 2026 and CIP-012-2 from 1 July 2026. FERC Order No. 919 approved 11 virtualization-related revisions that NERC lists as effective 1 July 2028, and CIP-003-11 from Order No. 918 is effective 1 July 2029. CIP-015-1 is subject to future enforcement from 1 October 2028. Owners of the compliance program and the CIS mapping review the calendar each quarter. Output: a dated change register that flags which evidence rules, retention settings and mapping rows need revision before each effective date. Confirm all dates against NERC's current status page before acting on them.
Document the boundary and the reuse decisions
Write a short program document that states which systems follow CIP, which follow CIS IG1 only, and which artifacts are shared, with the line-by-line check result attached to each shared artifact. Include the rule that a change to a shared control triggers a re-check against every CIP requirement it supports. Output: an approved program boundary and reuse record that a NERC Regional Entity auditor or an internal reviewer can follow without a walkthrough. The step is complete when the record has been reviewed by the CIP compliance owner and the security lead, and the next review date is set.
What do buyers ask about CIP and CIS Controls work?
Does following the CIS Controls satisfy NERC CIP?
No. CIS publishes a mapping between the CIS Controls and NERC CIP, but a mapping is not a compliance pathway. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. NERC CIP is enforced by the Compliance Enforcement Authority, a Regional Entity or NERC, through audits, spot checks, self-reports and investigations, and there is no CIP certificate. A CIS Safeguard that looks similar to a CIP requirement may still fall short of it on scope, evidence or timing. Use the mapping to find overlap, then check each CIP requirement against the Applicable Systems table in the standard itself, such as the table in CIP-007-6, and against your own registration and impact ratings.
What drives the cost of CIP compliance work and what recurs?
Cost follows the number of BES Cyber Systems, their impact ratings under CIP-002, the number of EACMS, PACS and PCA in scope, and how much evidence your tooling already produces. One-time work includes asset categorization, gap analysis, control design, log and patch process changes, and documentation. Recurring work includes evidence collection for audits and self-certifications, log retention, patch evaluations on the 35-day cycle, access reviews, and annual testing. When you request a quote, ask for the work broken down by phase, by Applicable System category, by who performs each task, and by which evidence will be produced and retained. DeployOpen does not publish prices. Quotes follow a written scope agreed before work starts.
How long does CIP readiness take and what must we supply?
Duration depends on the size and maturity of your asset inventory, the number of impact categories you operate, and how far current processes already match CIP evidence needs. No general timeline is supplied here, so ask any provider for a phased schedule tied to your environment rather than a generic figure. Your team must supply the current asset inventory, network diagrams, the impact categorization record, access lists, existing log and patch records, vendor remote access arrangements, and named owners who can approve process changes. Expect dependencies on operations staff for any change that touches live BES Cyber Systems. Confirm these inputs and the staffing commitments in writing before the schedule is fixed.
Can our team run CIP-aligned controls in-house using the CIS Assessment Specification?
Yes, many teams do, provided they have the skills and time to maintain it. The CIS Controls Assessment Specification defines, for each Safeguard, the inputs, operations, measures and metrics used to verify implementation. CIS says it covers what to measure, not how, so your team must design the procedures, tooling and evidence format. It does not tell you how to meet a CIP requirement's wording, its Applicable Systems scope, or its audit evidence expectations. Expect to write a CIP-specific mapping, keep it current against each version change, and have someone who can explain the result to a Compliance Enforcement Authority auditor. If that combination of skills is missing, an outside team can help with design and testing, but ownership of the program stays with your organization.
Do we need CIS Controls Accreditation to use the CIS Controls?
No. CIS states that the Controls are free for any organization to use to improve its own cybersecurity. CIS Controls Accreditation, run with CREST, accredits CIS SecureSuite member organizations that provide CIS Controls implementation, auditing or assessment services. It is relevant when you buy services from an accredited provider, not when you use the Controls internally. CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members. Those fees apply to the provider's accreditation application, not to your own use of the Controls. Before engaging any provider, ask whether it holds the accreditation, what it covers, and whether it has experience with NERC CIP scoping.
What should a quote for CIP and CIS Controls work include?
A useful quote states the scope in writing, including which CIP standards, which impact categories and which Applicable Systems are covered, and which CIS Safeguards or Implementation Group are in scope. It should list deliverables, such as a gap assessment, control designs, procedures, configuration changes, evidence templates and training, along with the acceptance criteria for each. It should state what is out of scope, such as operational changes, vendor remediation or regulator correspondence. It should name the assumptions about your inputs and who performs each task. Ask how changes in scope are priced, and whether ongoing support, upgrades or testing are separate retainers. DeployOpen's engagements are generally fixed-scope, with scope and timelines agreed in writing before work starts.
What should we ask about the 2026 CIP changes?
Ask which version of each standard applies to each of your systems and on what date it becomes enforceable. NERC lists CIP-003-9 as enforceable from 1 April 2026 and CIP-012-2 from 1 July 2026. Ask about the virtualization revisions approved in FERC Order No. 919, which NERC lists as effective 1 July 2028, and about CIP-015-1 network monitoring, subject to enforcement from 1 October 2028. Ask how your CIS Safeguard mappings will be updated when a CIP version changes, and who owns that update. Confirm the current status on the NERC CIP standards page before relying on any date, since the status of pending standards can change.
What a CIP audit produces and what a CIS assessment does not
There is no CIP certificate. Compliance with the CIP Reliability Standards is monitored by the Compliance Enforcement Authority, which is a Regional Entity or NERC. It uses Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging, periodic data submittals, investigations and complaints. Under the NERC Rules of Procedure Appendix 4C, the output of that process is a finding of compliance or non-compliance against specific requirements, not a document you can hand to a customer as a certificate. For a utility, the practical question is what evidence the Compliance Enforcement Authority will ask for on each Applicable Systems table, such as logs for CIP-007-6 Part 4.1 and retention records for Part 4.3, and whether your corporate CIS-aligned program produces that evidence in the same form.
The CIS Controls are not a certification scheme either. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, and it maps them to frameworks such as NERC CIP rather than issuing a conformity result for them. A CIS-aligned assessment therefore produces a statement about your corporate IT, and its credibility depends entirely on evidence: the asset inventory, log samples, patch records and access reviews that back each Safeguard. The CIS Controls Assessment Specification defines the measures to check against, but it describes what to measure, not how, so your evidence design is your responsibility. Confirm with your auditor and your Compliance Enforcement Authority which of your corporate records they would accept as evidence for any CIP requirement before relying on them.
Before you rely on a CIS-aligned assessment to support CIP positions, decide which claims it can and cannot carry. A corporate assessment that finds a Safeguard implemented on IT systems says nothing by itself about whether a BES Cyber System, EACMS, PACS or PCA inside the CIP boundary meets the matching CIP requirement. Ask your compliance lead to define a written evidence map that names the CIP evidence set for each in-scope system and identifies where CIS results are used only as supporting context. Any penalty exposure should be read from the NERC and FERC sources themselves, not inferred from a CIS assessment result.
How DeployOpen scopes readiness for CIP and CIS Controls
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so readiness work starts from where your CIP-scoped and corporate systems actually run. Engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before work begins.
How we scope
- Written scope lists which systems are in the CIP boundary and which sit under CIS Controls only.
- Asset inventory and impact categorization inputs are reviewed with your compliance team before design begins.
- Deliverables, timelines and exclusions are agreed in writing, and quotes follow from that written scope.
How we build
- Self-hosted open-source platforms are configured inside your cloud accounts, data centers or air-gapped networks.
- Log retention, patch tracking and access controls are built to the evidence you need for each CIP requirement.
- Security testing of applications, infrastructure and APIs can run against the built environment before handover.
How we hand over
- Documentation maps each implemented control to its CIS Safeguard and to the CIP requirement it supports.
- Evidence packages are prepared for your compliance team, while NERC and Regional Entities make the compliance determination.
- Runbooks cover backup, upgrade and patch procedures so your staff can operate the environment after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover periodic review as NERC CIP standards and effective dates change, such as the 2026 and 2028 revisions.
- Confirm with DeployOpen during scoping which support windows, response terms and testing cadence the retainer includes.
