Do you need NERC CIP, NIS2, or both?
NERC CIP applies if you own or operate BES assets that are registered in the United States, and NIS2 applies through national transposition laws if an EU entity falls within one of the 18 sectors in Annex I or II, which includes energy. A multinational energy group with CIP-registered assets in North America and EU entities in scope will usually need both, and the first priority is usually the regime that already has a live enforcement relationship with your business. For a US asset owner, that is CIP, because NERC and the Regional Entities monitor compliance through audits, spot checks and self-reports. For an EU entity, the first step is confirming which national law transposes NIS2 for that Member State and whether the entity is classified as essential or important (Article 3).
Neither regime produces a certificate. NERC has no CIP certificate, and compliance is shown through evidence reviewed by the Compliance Enforcement Authority. NIS2 creates no certificate of compliance either, and national competent authorities oversee it through inspections, security audits, information requests and administrative fines. Any vendor or consultant who offers a CIP or NIS2 certificate should be asked to explain what that document actually proves. The two regimes are also enforced by different bodies, so one program's evidence will not automatically satisfy the other's auditor. Confirm with each authority which records it expects, and plan separate evidence packages where the wording differs.
Before you commit budget, build a register that lists every entity and asset, its CIP impact rating under CIP-002-5.1a and its NIS2 classification by Member State. Then confirm the current enforceable versions with NERC, since several CIP standards have 2026 and later effective dates, and check the NIS2 national law with local counsel, since the European Commission's July 2026 pages describe pending amendments as a proposal. NERC's CIP standards page is the natural starting point for the US side.
How NERC CIP and NIS2 differ on scope, enforcement and penalties
This table compares NERC CIP and NIS2 on scope, legal form, requirement style, reporting clocks, supply chain rules, supervision and penalty references. Read each row as a question to put to your legal and compliance teams, since the two regimes apply to different entities in different jurisdictions. The main takeaway is that CIP is a prescriptive, asset-scoped rulebook enforced by NERC and Regional Entities, while NIS2 is an entity-wide, risk-based directive whose penalties depend on national law.
| Factor | NERC CIP (North America) | NIS2 (EU) |
|---|---|---|
| Who is in scope | Registered bulk electric system entities; about 1,673 unique US entities in the NERC Compliance Registry as of June 2025 | Essential and important entities across 18 sectors, as transposed into each Member State's law |
| Legal form | NERC standards become mandatory in the US once FERC approves them under section 215 of the Federal Power Act | Directive (EU) 2022/2555, bound through national transposition laws; Member States may adopt higher rules |
| Number of sectors or assets | 13 CIP standards mandatory as of 17 October 2026, scoped by high, medium and low impact BES Cyber Systems | 18 sectors: 11 of high criticality in Annex I and 7 other critical sectors in Annex II |
| How requirements are written | Prescriptive, with bright-line impact criteria in CIP-002-5.1a and requirements scoped by Applicable Systems tables | Risk-based measures under Article 21, with technical detail in Implementing Regulation (EU) 2024/2690 for listed digital providers |
| Incident reporting clock | CIP-008-6 Part 4.2: initial notification within one hour of determining a Reportable Cyber Security Incident; next calendar day for attempts | Article 23(4): early warning within 24 hours, incident notification within 72 hours, final report within one month |
| Supply chain rules | CIP-013-2 R1 requires documented supply chain cyber security risk management plans for high and medium impact BES Cyber Systems and their EACMS and PACS | Article 21(2)(d) requires supply chain security covering each entity's relationship with direct suppliers and service providers |
| Supervision model | Compliance Enforcement Authority (a Regional Entity or NERC) runs Compliance Audits, Spot Checks, Self-Certifications and Self-Reports | National competent authorities use inspections, security audits, security scans and information requests; essential entities face ex ante supervision, important entities ex post |
| Penalty reference | NERC Sanction Guidelines cite a maximum civil penalty of $1,584,648 per violation, per day, under 18 CFR 385.1602(d), as adjusted by FERC Order No. 906 | Administrative fines are set by national law and are not stated in this comparison; confirm the figures with the competent authority in each Member State |
| Proof produced | No certificate; the Compliance Enforcement Authority records findings and sanctions from audits, self-reports and data submittals | No certificate of compliance; evidence is examined by the competent authority during inspections or audits |
Which entities fall under CIP and which fall under NIS2
CIP scope follows the asset, not the company. Under CIP-002-5.1a, an organization categorizes each BES Cyber System as high, medium or low impact using the bright-line criteria in Attachment 1. High impact covers mainly Control Centers of Reliability Coordinators and qualifying Balancing Authority, Transmission Operator and Generator Operator Control Centers. Medium impact includes examples such as generation of 1500 MW or more at one plant, or Transmission Facilities at 500 kV or higher. Low impact covers other BES Cyber Systems at listed assets. A company that is not a utility in name can still carry CIP obligations if one of its systems meets a criterion, and a large utility can have assets that fall outside CIP. Ask your compliance team for the current categorization of each asset and the written basis for each decision, because that record, not your corporate profile, defines what CIP covers.
NIS2 scope follows the entity. NIS2 covers 18 sectors, and energy is one of the 11 high-criticality sectors in Annex I. Within scope, an organization is classified as essential or important under Article 3, which determines the supervision regime: essential entities face ex ante supervision and important entities ex post supervision under Articles 32 and 33. NIS2 is a directive, so its obligations reach you through the national transposition law of each Member State, adopted under Article 41 and applied from 18 October 2024. Confirm with each EU subsidiary which national law applies, how that state classified the entity, and whether any Member State has adopted stricter rules under Article 5. The Commission's 20 January 2026 proposal, COM(2026) 13, would add a small mid-cap category. It is still a proposal awaiting approval by the European Parliament and the Council, so plan against the current text.
The two regimes will rarely produce the same scope. An energy group may have CIP-registered assets in the United States and NIS2 entities in the EU, and the same corporate family can be inside one regime and outside the other for different reasons. A US generation site may be medium impact under CIP while an EU subsidiary is classified as important under NIS2 for a different reason, and a small EU affiliate may fall outside NIS2 entirely. Build a single register that records, for each legal entity and each asset, the regime, the classification and the authority that supervises it. That register is the input every later decision on incident reporting, supplier controls and evidence depends on.
How incident reporting clocks differ under CIP-008-6 and NIS2 Article 23
Under CIP-008-6, the clock starts when the responsible entity determines that an event is a Reportable Cyber Security Incident affecting an applicable system. Part 4.2 then sets two timing rules. The initial notification is due within one hour after that determination. Where the event is determined to be an attempt to compromise an applicable system rather than a successful compromise, the notification is due by the end of the next calendar day after the determination. The standard keys the clock to the entity's own determination, so documenting when and by whom that determination was made is part of meeting the deadline.
- Trigger: the entity's determination of a Reportable Cyber Security Incident, not the time the activity was first detected.
- Shortest window: one hour from determination for a Reportable Cyber Security Incident.
- Attempts: a longer window, ending the next calendar day, for attempts to compromise an applicable system.
- Scope: only applicable systems under the CIP categorization, so the plan must state how each system maps to high, medium or low impact.
- Recipient: the notification goes to the agencies named in the CIP-008-6 reporting procedures, which the entity should confirm against its current plan.
Confirm the exact reporting recipients and form in the current standard text and your Regional Entity's guidance before building the workflow.
Under NIS2 Article 23, essential and important entities report significant incidents to their CSIRT or, where applicable, their competent authority in three stages. The early warning is due within 24 hours. The incident notification is due within 72 hours. The final report is due within one month of the notification. The trigger is a significant incident as defined under the applicable national law and the Implementing Regulation for the entity's sector, which differs in detail from the CIP definition and must be read against national transposition.
- Early warning: within 24 hours, covering whether the incident may be caused by unlawful or malicious acts or could have a cross-border impact.
- Incident notification: within 72 hours, with an initial assessment of severity and impact.
- Final report: within one month of the incident notification, with root cause and mitigation detail.
- Recipient: the CSIRT or competent authority in the Member State, so each EU jurisdiction where the entity operates may apply its own procedure.
- Trigger source: significant incident criteria in Implementing Regulation (EU) 2024/2690 and national law, not a single bright-line test.
Confirm with each national competent authority which form, portal and contact the entity must use, and whether the national law adds steps beyond Article 23.
The two regimes send reports to different bodies. A CIP-008-6 notification goes to the entity's reporting recipients under the North American framework, while NIS2 reports go to a CSIRT or competent authority in an EU Member State. An event affecting a system used in both regions can therefore require notifications to a NERC-side recipient and to one or more EU authorities, each with its own form and clock. Neither report satisfies the other, and a notice to one authority does not discharge the duty to the other.
- Separate recipients: NERC and the Regional Entity for CIP, and national CSIRTs or competent authorities for NIS2.
- Separate forms: each authority sets its own content and format, so templates should be prepared in advance.
- Language and channel: confirm required languages and submission channels for each EU jurisdiction.
- Cross-border effects: an EU report may need to note cross-border impact, which NIS2 treats as a reporting factor.
- Records: keep copies of each submission with timestamps for both programs.
Confirm the recipient list and submission method with each authority before an incident occurs, not during one.
A single event can start both clocks. Consider an illustrative case: a ransomware alert on a corporate network segment that shares an identity provider with a control center. The CIP clock starts only when the entity determines the event is a Reportable Cyber Security Incident affecting an applicable system. The NIS2 clock starts when the entity assesses the event as a significant incident under the relevant national law. The two determinations may happen at different times, and the earlier one sets the earlier deadline. Waiting for the second determination to finish before reporting the first can cause a missed deadline.
- Determination timing: record when each determination is made, because each clock runs from its own trigger.
- Earliest deadline: the shortest window, often the CIP one hour or the NIS2 24-hour early warning, drives the first action.
- Parallel tracks: assign one owner for each regime so reports do not compete for the same staff.
- Shared facts: reuse one timeline of events across both submissions, adjusted to each form.
- Updates: later findings may require updated reports under both regimes.
Test the parallel-clock sequence in a tabletop exercise before relying on it.
The practical step is to map each event to both definitions in the incident response plan. The plan should state the CIP-008-6 test for a Reportable Cyber Security Incident and for an attempt to compromise, the NIS2 test for a significant incident under each applicable national law, and the decision owner who applies each test. Triage records should show which tests were applied, the time of each determination, and the reports sent. Without this mapping, staff may apply only the stricter or more familiar test and miss the other.
- Dual classification: add fields in the incident record for CIP and NIS2 categories.
- Named owners: assign a person to decide on each regime and a backup.
- Prepared templates: draft initial notices and final report outlines for each authority.
- Scope mapping: link BES Cyber Systems, EACMS, PACS and PCA inventory to the NIS2 service scope.
- Review cycle: update the plan when CIP or national NIS2 rules change.
Confirm the current CIP-008-6 text, the national NIS2 law and the reporting contacts with counsel and each authority before finalizing the plan.
Supply chain obligations: CIP-013-2 R1 and NIS2 Article 21(2)(d)
Both regimes require you to manage the cyber risk your suppliers bring into your environment, but they express the duty differently. CIP-013-2 prescribes a documented plan for specific systems, while NIS2 sets a risk-based obligation that you must evidence through your own measures.
CIP-013-2 R1 documented plans
CIP-013-2 R1 requires documented supply chain cyber security risk management plans for high and medium impact BES Cyber Systems and their associated EACMS and PACS. The scope follows the CIP-002 categorization, so a North American group must first confirm which of its assets fall in those tiers. Low impact assets are not covered by R1, which matters when mapping the same vendor across both regions.
NIS2 Article 21(2)(d) supplier relationships
Article 21(2)(d) requires supply chain security, including the security-related aspects of the relationship between each entity and its direct suppliers or service providers. The duty applies to essential and important entities in the EU, not to a specific asset list. Scope your EU supplier inventory by entity and by service, because the obligation attaches to the relationship rather than to a named system.
Implementing Regulation 2024/2690 requirements
Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements for Article 21(2) measures for specific digital service categories, including managed and managed security service providers and cloud providers. If your EU operations depend on those providers, check whether the regulation's detailed requirements apply to them and what they must show you. Energy utilities that buy these services should confirm the position with their national authority.
Prescriptive plan content versus risk-based measures
CIP-013-2 tells you what the plan must address, and NIS2 tells you what outcome to reach. A CIP plan must be documented and reviewed against defined topics, so an auditor can check each element. NIS2 leaves the method to you, but you must justify your choices if a regulator asks. Build one supplier process with a CIP-specific annex, rather than two separate programs that drift apart.
Vendor evidence to request
Ask suppliers for evidence that maps to both regimes: their security practices for remote access and patching, incident notification commitments, vulnerability handling, and the terms that let you verify their controls. For CIP-regulated systems, confirm the vendor will support your documented plan and reporting clocks. Request evidence in the contract rather than after an incident, and record what you received and when it was reviewed.
Confirm specifics with regulators and counsel
How each supply chain duty applies to your entities, vendors and contract structure depends on facts that this comparison cannot settle. Confirm the scope of CIP-013-2 with your Regional Entity and NERC, and confirm the transposition of NIS2 in each Member State where you operate with national authorities or counsel. Treat the mapping between the two regimes as a working aid, not as a finding of equivalence.
How NERC and EU regulators supervise compliance differently
This sequence shows how each regime finds out whether an entity complies, what enforcement tools it uses and where the evidence ends up. Neither regime produces a certificate that proves compliance on its own.
Register the entity under the applicable regime
In the United States, NERC and the Regional Entities work from the NERC Compliance Registry, which identifies the entities subject to mandatory CIP compliance. In the EU, each Member State's national law determines whether an organization is an essential or important entity under NIS2. The output is a defined list of the entities and systems each regulator will oversee. Ask your compliance team to confirm the registration status of every legal entity and asset in scope before building any evidence set.
Assign the Compliance Enforcement Authority role
Under the NERC Rules of Procedure, the Compliance Enforcement Authority is a Regional Entity or NERC itself, and it is the body that monitors CIP compliance for a given registered entity. Your team should know which authority holds that role for each of its facilities, because the authority sets the audit schedule and the evidence requests. The output is a named point of contact for each region. Confirm this with the relevant Regional Entity before the first monitoring activity.
Monitor CIP compliance through audits and self-reports
Appendix 4C of the NERC Rules of Procedure lists the monitoring tools available to the Compliance Enforcement Authority: Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, self-logging, periodic data submittals, investigations and complaints. Self-Reports and self-logging are filed by the entity itself, while audits and spot checks are run by the authority. The output is a set of records and submittals that the entity must keep ready at any time. Ask for the current list of required data submittals in writing, since the schedule for each one depends on the requirement.
Apply the NIS2 supervision regime by entity category
NIS2 classifies in-scope entities as essential or important under Article 3. Essential entities face ex ante supervision, which means oversight before any failure is known, while important entities face ex post supervision, which applies once there is evidence of non-compliance. Both categories carry the same risk-management and reporting obligations under Articles 21 and 23. The output is a supervision track that determines how and when a national competent authority will act. Confirm with national counsel how your Member State has transposed these categories.
Respond to inspections, audits, scans and information requests
Under Articles 32 to 34, national competent authorities use inspections, security audits, security scans and information requests to check compliance. The entity supplies documents, system details and test results on the authority's request, and the authority decides whether further measures are needed. The output is a body of evidence that the authority reviews and can challenge. Keep a register of past requests and responses so that answers stay consistent across inspections.
Face sanctions under the applicable framework
NERC's Sanction Guidelines in Appendix 4B guide how penalties are set for CIP violations, and the civil penalty ceiling referenced by those guidelines is set in 18 CFR 385.1602. NIS2 provides for administrative fines under Articles 32 to 34, with the amounts set by national law. The output is a penalty or enforcement outcome that is specific to the regime and the violation. Ask counsel to model the exposure for each regime separately, because the two sets of rules do not share a penalty structure.
Confirm that no certificate closes the cycle
Neither regime issues a CIP or NIS2 certificate. A regulator's findings, closed audit reports and enforcement outcomes are the documented results, and they are not a certificate of compliance. Any third-party certificate your organization holds is a voluntary assurance and does not replace regulator oversight. The output is an internal record that states what each regulator has concluded and what remains open. Ask every vendor offering a CIP or NIS2 certificate to explain exactly what the document proves and who issued it.
Where the CIP and NIS2 work overlaps
NERC CIP and NIS2 cover different legal ground, but the operational work behind them often overlaps in incident handling, supplier management, access control and evidence. Mapping sources can point you to that overlap, but they do not replace a line-by-line review against each obligation.
Incident response and reporting
CIP-008-6 requires an initial notification within one hour of determining a Reportable Cyber Security Incident, while NIS2 Article 23 sets an early warning within 24 hours, a notification within 72 hours and a final report within one month. One incident response plan can feed both clocks, but the trigger definitions differ. Check whether an event that is reportable under CIP is also a significant incident under NIS2 and who receives each notice.
Supplier and supply chain risk
CIP-013-2 R1 requires documented supply chain cyber security risk management plans for high and medium impact BES Cyber Systems and their associated EACMS and PACS. NIS2 Article 21(2)(d) requires supply chain security covering the relationship between each entity and its direct suppliers or service providers. A single supplier register and risk assessment can serve both, but CIP's scope is limited to listed systems while NIS2 applies to the whole entity. Confirm which vendors fall under each.
Access control and remote access
CIP requirements scope access controls by Applicable Systems, and CIP-003-9 adds vendor electronic remote access controls for low impact BES Cyber Systems. NIS2 Article 21 asks for access control and related policies across the entity's network and information systems. Shared identity tooling can support both, but teams should confirm which accounts, vendor sessions and jump paths sit inside a CIP boundary and which only fall under NIS2 measures.
Risk management policies
Both regimes expect a documented risk-based approach to security governance, but CIP expresses it through specific requirements tied to impact ratings, while NIS2 Article 21 sets general measures that Member States transpose and that ENISA guidance explains. A common risk register can record both sets of obligations. Check that the register captures CIP impact categorization under CIP-002-5.1a and the NIS2 essential or important classification under Article 3.
Evidence collection
CIP compliance is monitored through Compliance Audits, Spot Checks, Self-Certifications and periodic data submittals, while NIS2 oversight uses inspections, security audits, security scans and information requests. The same logs, change records and configuration snapshots may serve both, but each regulator expects evidence in its own format and retention. Ask the Compliance Enforcement Authority and the national competent authority what they will request before building one evidence library.
Mapping gaps to review
The CIS Controls Navigator for v8.1 lists mappings to NIS2 and to NERC-related work, and ENISA maps Implementing Regulation 2024/2690 to ISO/IEC 27001:2022 and NIST CSF 2.0. NIST does not check the correctness of non-NIST mappings, and ENISA states its mapping is not a measure of equivalence or full coverage. Treat any mapping as a starting index, then review each CIP requirement and NIS2 measure individually for gaps.
Who assesses each framework and what proof it produces
This table compares who oversees NERC CIP and NIS2, what each one issues, how often assessment happens and how evidence is requested. Neither framework produces a certificate, so the practical question is what a regulator can ask for and who will ask. Use it to plan one evidence set that answers both oversight models.
| Dimension | NERC CIP | NIS2 |
|---|---|---|
| Who assesses compliance | The Compliance Enforcement Authority, either a Regional Entity or NERC, under the NERC Rules of Procedure | National competent authorities in each Member State, under the national law that transposes NIS2 |
| What is issued | No CIP certificate exists. Outcomes are findings, possible violations and sanctions, not a pass mark | No certificate of compliance exists. Outcomes are inspection results, orders and administrative fines |
| Supervision model | Compliance Audits, Spot Checks, Self-Certifications and Self-Reports, with self-logging and periodic data submittals | Inspections, security audits, security scans and information requests, with essential entities supervised ex ante and important entities ex post |
| Audit cycle | Confirm the audit cycle for each registered entity with its Regional Entity, since it depends on registration and history | Confirm the supervision timing and scope with the national competent authority, since national laws set the details |
| How evidence is requested | Through periodic data submittals and requests during audits, spot checks and investigations, so evidence must be retrievable on short notice | Through information requests and on-site or remote inspections, so evidence must show how measures under Article 21 operate in practice |
| What the entity must show | That each applicable requirement is implemented and that records exist for the period assessed, by impact category of each system | That risk-management measures are in place and that significant incidents were reported in the staged timelines of Article 23 |
| Role of third-party reports | Not a substitute for Regional Entity review. Ask the Regional Entity how it treats external assessments | No certification route is defined, so external reports do not replace authority supervision. Confirm national practice |
Running both programs: order of work and shared evidence
This sequence sets the scope of each regime first, then builds one inventory, one incident process and one evidence set that serves both NERC CIP and NIS2 without duplicating work. Each step closes with a named output so the team can see when it is finished.
Confirm CIP registration and BES Cyber System categorization
Start with the North American side because it sets the boundary for every other step. The compliance lead confirms with the Regional Entity or NERC Compliance Registry which functions the organization is registered for, then the OT and engineering teams apply the CIP-002-5.1a bright-line criteria to classify each BES Cyber System as high, medium or low impact. Ask the Compliance Enforcement Authority to confirm any categorization you are unsure of, since that record drives scope for the rest of the program. The step is done when a signed categorization list exists for every asset in scope, with the rationale for each classification kept on file.
Map NIS2 entity status by member state
For each EU operating company, determine whether it falls within one of the 18 NIS2 sectors and whether it is classified as essential or important. Classification depends on the national transposition law, not only on the Directive, so legal counsel in each Member State should confirm the national sector list, registration duties and competent authority. Record which entities are in scope, which authority supervises them and whether any national rule goes beyond the Directive under Article 5. The step is done when each EU entity has a written status memo signed by the legal owner, and any open questions are assigned to a named person with a date to resolve them.
Build one asset and system inventory
Create a single inventory that tags each asset with its CIP impact rating, its Applicable Systems role (such as EACMS, PACS or PCA where relevant) and its NIS2 entity and sector. Shared fields prevent the two programs from disagreeing about what exists. Owners of OT and IT assets should validate the entries, and any asset that exists only in one regime should still be recorded so the gap is visible. The step is done when the inventory reconciles to the CIP categorization list and to the NIS2 entity memos, with no asset missing an owner or a rating.
Set up a combined incident classification and two reporting clocks
Build one incident triage procedure that records the facts needed by both regimes. CIP-008-6 requires an initial notification within one hour after determining a Reportable Cyber Security Incident, and by the end of the next calendar day for an attempt to compromise an applicable system. NIS2 Article 23(4) requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Map each classification outcome to the clocks that start, name the reporting contact for each regulator, and test the procedure in a tabletop exercise. The step is done when the runbook lists both clocks side by side and the exercise has produced a written list of corrections.
Add supplier evidence for CIP-013-2 and Article 21(2)(d)
Collect one supplier record that answers both CIP-013-2 R1 and NIS2 Article 21(2)(d). CIP-013-2 requires documented supply chain cyber security risk management plans covering high and medium impact BES Cyber Systems and their associated EACMS and PACS. Article 21(2)(d) asks for security-related aspects of the relationship between the entity and its direct suppliers or service providers. Confirm with each supplier which contract terms, security questionnaires and incident notification duties apply, and record which suppliers serve both regimes. The step is done when each in-scope supplier has one evidence file with a named owner and a review date, and gaps in contract language are logged for legal review.
Run a combined gap review against each regime
Compare the current controls to the CIP requirements that apply to each categorized asset and to the NIS2 risk-management measures for each entity. Use NERC's published requirement text and the Article 21 measures as the authoritative sources, and treat any framework crosswalk as a starting point only, since NIST and ENISA both state that mappings do not establish equivalence. Record each gap with the regime it affects, the owner and the remediation option. Confirm open interpretations with the Regional Entity or the national competent authority rather than assuming an answer. The step is done when every gap has an owner, a remediation decision and an entry in the program plan.
Retain evidence once and tag it for both regimes
Store each control artifact one time in a controlled repository, with metadata that shows which CIP requirement, NIS2 measure or both it supports. Retention periods and audit formats differ by regime, so confirm the retention expectations for each with the Compliance Enforcement Authority and the national authority before setting rules. DeployOpen can prepare this evidence structure, run the gap review and document the controls as part of a written scope, but it does not issue audit reports, attestations or certifications. Independent auditors and the regulators make those determinations. The step is done when a sample audit request for each regime can be answered from the repository without rebuilding evidence by hand.
What drives the cost and effort of meeting both
The cost of running one program across NERC CIP and NIS2 is mostly internal staff time, with tooling, independent assessment and outside implementation work as smaller and more variable components. Internal time covers the operations staff who maintain BES Cyber System inventories and access records, the compliance team that prepares evidence for a Compliance Audit or a NIS2 national inspection, and the security and legal staff who handle reporting clocks. Tooling covers logging, asset inventory, access control and evidence repositories. Independent assessment is a separate line item: NERC's Compliance Enforcement Authority audits CIP entities, while NIS2 supervision is carried out by national competent authorities, so you may pay outside assessors for readiness work that no regulator requires. DeployOpen's fixed-scope work is quoted from a written scope, so ask each vendor and assessor to itemize who performs each task and what is delivered.
Some work is one-time and some recurs, and the split should shape your budget. One-time work includes CIP-002-5.1a categorization of BES Cyber Systems into high, medium and low impact, mapping those systems to NIS2 risk-management measures under Article 21, and remediating gaps found in the first assessment. Recurring work includes collecting evidence for each Applicable Systems table, monitoring incident reporting readiness for the one-hour and next-day clocks in CIP-008-6 and the 24-hour, 72-hour and one-month stages in Article 23(4), and reviewing supplier arrangements under CIP-013-2 and Article 21(2)(d). Standard revisions add a moving cost. CIP-015-1 is subject to enforcement from 1 October 2028, CIP-015-2 carries an effective date of 1 October 2029, and the virtualization revisions in Order No. 919 are listed as effective 1 July 2028. Ask vendors how they will absorb these changes within the agreed scope. For penalty exposure, the only reference to plan around is the maximum in NERC's Sanction Guidelines, which the eCFR lists as $1,584,648 per violation, per day, as adjusted.
Questions energy groups ask before choosing a path
Can one compliance program satisfy both NERC CIP and NIS2?
One program can share controls across both regimes, but it cannot replace either one, because each law names its own obligations and its own enforcing authority. NERC CIP sets prescriptive, enforceable requirements for BES Cyber Systems by impact rating, while NIS2 sets risk-management measures under Article 21 that Member States transpose into national law. A single asset inventory, access control design, incident response process and supplier register can serve both. Keep CIP-specific evidence in its own runbook, including the one-hour initial notification under CIP-008-6. Track NIS2 early warning at 24 hours and incident notification at 72 hours on a shared playbook with separate timers. Confirm with counsel which national NIS2 law applies to each EU entity, because the transposed rules vary by Member State.
Do we need outside help to run both programs?
Outside help is optional, and the decision depends on internal capacity and on the evidence gaps you already know about. Both regimes place accountability on the registered or in-scope entity, so ownership stays with your own leaders. External firms are usually engaged for defined work such as gap assessments, control design, configuration hardening, documentation, testing and evidence packaging. DeployOpen plans, implements, documents and supports self-hosted platforms inside client infrastructure and prepares systems and evidence for compliance assessments. It does not issue audit reports or certifications. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support is available as a retainer. When comparing proposals, ask which CIP standards and NIS2 measures are in scope, what each deliverable contains, who performs testing, and which items recur after delivery.
What does a dual compliance effort require from our staff?
The work draws on people who can make decisions only the entity can make. Expect four groups of responsibilities:
- Asset owners confirm BES Cyber System categorization under the bright-line criteria in CIP-002-5.1a, along with NIS2 sector and entity classification.
- Operations staff confirm access, patch and logging processes against the Applicable Systems tables, such as those in CIP-007-6.
- Security and legal teams own the incident playbook, reporting roles and regulator contacts.
- Procurement adds supplier clauses that support the CIP-013-2 supply chain risk management plan and the supply chain security measure in Article 21(2)(d).
The largest effort usually sits in the asset inventory, because both regimes depend on knowing exactly what is in scope. Assign a named owner to each group before work begins so that decisions do not stall.
How long does dual compliance take, and what can we confirm with regulators?
No supplied figure gives a total duration, so the timeline depends on scope. The main drivers are the number of BES Cyber Systems and their impact categories, the number of EU entities and Member States involved, the quality of existing evidence, and whether upcoming standard versions change your designs. Confirm the applicable standards and effective dates with NERC and your Regional Entity, using the NERC CIP standards page as the starting point. For NIS2, the national competent authority confirms whether you are classified as essential or important and which transposition law applies. Ask any implementation provider for a written schedule with milestones tied to those confirmed dates, and ask how changes in scope will be priced and scheduled before work starts.
Which should we do first, NERC CIP or NIS2?
Start with the regime that is enforceable against your assets today. For a registered US bulk electric system entity, that is usually NERC CIP, which NERC and the Regional Entities monitor and enforce. The NERC Sanction Guidelines reference a maximum civil penalty of $1,584,648 per violation, per day, as adjusted and shown in the eCFR in October 2026. NIS2 timing depends on national transposition, which Member States had to adopt by 17 October 2024 and apply from 18 October 2024. A practical sequence is to confirm BES categorization, build a shared inventory and access model, close current CIP gaps against the effective versions, and then add NIS2 reporting and supplier measures. If your EU operations carry more risk than your North American assets, reverse the order, but make that choice after confirming the enforceable deadlines for each.
What changes with the 2026 CIP versions and the NIS2 amendment proposal?
Several dates matter for design decisions. CIP-003-9 became enforceable on 1 April 2026 and adds vendor electronic remote access controls for low impact BES Cyber Systems. CIP-012-2 became enforceable on 1 July 2026 and adds protection of Real-time data availability between Control Centers. FERC Order No. 919 approved revised standards that accommodate virtualization, which NERC lists as effective 1 July 2028. CIP-003-11 under Order No. 918 is effective 1 July 2029, and CIP-015-1 network monitoring is subject to enforcement from 1 October 2028. On 20 January 2026 the Commission proposed targeted NIS2 amendments (COM(2026) 13), including a small mid-cap category. The proposal still needs approval by the European Parliament and the Council, so current obligations apply. Read the proposal text and confirm status with your national authority before changing scope.
Do we get a certificate for NERC CIP or NIS2?
No. Neither NERC CIP nor NIS2 issues a certificate of compliance. CIP compliance is monitored by the Compliance Enforcement Authority through Compliance Audits, Spot Checks, Self-Certifications, Self-Reports, periodic data submittals, investigations and complaints. NIS2 is overseen by national competent authorities through inspections, security audits, security scans, information requests and administrative fines. What you can produce is an evidence set: documented categorizations, configurations, logs, test results, incident records and any self-certifications you submit. DeployOpen prepares systems, controls and evidence for compliance assessments but does not issue audit reports, attestations or certifications. Ask any provider to list the evidence it will deliver in writing and to confirm that the deliverables do not imply a certificate.
Confirm these points with the regulator or your counsel
Start with your CIP registration status, because it decides which standards bind you at all. NERC's Compliance Registry determines which entities are registered and which impact ratings apply to your BES Cyber Systems under CIP-002-5.1a. Confirm with your Regional Entity which CIP versions are enforceable on your audit date, since several new versions have different effective dates. CIP-003-9 and CIP-012-2 are already enforceable, while CIP-002-8, CIP-003-11 and the virtualization revisions in Order No. 919 take effect later. Ask for the registration record in writing and keep a dated copy for your evidence file.
For each EU member state where you operate, confirm which national law transposes NIS2 and whether you are classified as an essential or important entity under that law. The Directive sets the outline, but national laws decide competent authorities, registration steps, reporting channels and penalty levels, and Article 5 allows Member States to set higher requirements. Ask local counsel whether your subsidiaries fall in scope under their own national rules, and whether any sector-specific obligations apply to your energy activities beyond the Directive. Do not assume one country's transposition matches another's.
Treat the proposal COM(2026) 13 as pending law, not current obligation. It would amend NIS2, including a new small mid-cap category, but it still needs approval by the European Parliament and the Council. Check the Commission's legislative tracker before each planning cycle and record the status you relied on. Plan your program against the NIS2 text in force today, and identify which obligations would change if the amendment passes, so your legal team can review the impact when the text is final.
How DeployOpen scopes and delivers readiness for both frameworks
DeployOpen is a Chainscore Labs company that plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For energy groups facing NERC CIP and NIS2 together, we start from a written scope that separates the CIP-registered systems from the EU-facing entities and shared controls, then build and document the evidence each regime will ask for.
How we scope
- Agree in writing which CIP-registered assets, BES Cyber System impact categories and EU entities each engagement covers.
- Map shared controls, such as incident response, supply chain and access management, to the separate obligations each regime sets.
- Define deliverables, timelines and exclusions before work starts, since most engagements are fixed-scope.
- Confirm with your regulators, Compliance Enforcement Authority and national competent authority which obligations apply to your entities.
How we build
- Implement and harden self-hosted platforms in your own cloud, data center or air-gapped network, with no change of hosting location.
- Configure incident workflows that support the CIP-008-6 one-hour notification and the NIS2 24-hour, 72-hour and one-month reporting stages.
- Build supplier records and risk plans that address CIP-013-2 supply chain plans and NIS2 Article 21(2)(d) supplier security.
- Test applications, infrastructure and integrations within the agreed scope and document the findings and remediation.
How we hand over
- Deliver control documentation mapped to CIP requirement parts and NIS2 measures, so one evidence set serves both reviews.
- Provide runbooks and reporting templates your staff can operate after the engagement closes.
- Record which evidence supports which obligation, and state clearly that DeployOpen prepares evidence but does not issue audit reports or certifications.
- Walk your compliance and operations teams through the handover before the scope is closed.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope work ends.
- Track changes to CIP standards and NIS2 implementing rules, such as new effective dates, and scope updates to the program.
- Agree retainer scope and response expectations in writing, with the exact terms set out in the quote.
- Ask for a quote based on your written scope, since DeployOpen does not publish a price list.
