NERC CIP (Critical Infrastructure Protection)

Introduction: NERC CIP for the North American Bulk Electric System

The North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards are the mandatory, enforceable cyber and physical security requirements that protect the Bulk Electric System (BES) across the United States, Canada and portions of Baja California, Mexico. Unlike voluntary frameworks, NERC CIP carries the full weight of law: NERC is the Electric Reliability Organisation (ERO) certified by the U.S. Federal Energy Regulatory Commission (FERC) under Section 215 of the Federal Power Act, and its Reliability Standards are approved by FERC and enforced through the Regional Entities. Non-compliance can attract civil penalties of up to USD 1 million per violation, per day.

This guide is written for two audiences simultaneously: the auditor or Regional Entity assessor who must plan and execute a Compliance Audit against the Requirements and Measures, and the implementer, Compliance Officer or CIP Senior Manager who must build, evidence and sustain a defensible security programme. It enumerates every CIP standard currently in force, the associated Requirements (R), the impact-rating methodology of CIP-002, the tiered High/Medium/Low BES Cyber System classification, and the evidence auditors expect to see. It is grounded in the terminology of the NERC Glossary of Terms and the Requirements/Measures/Violation Severity Level (VSL) structure used across the standards family.

What is NERC CIP

NERC CIP is a family of Reliability Standards (the CIP series, CIP-002 through CIP-014, plus CIP-003 low-impact requirements and the newer supply-chain and communications standards) that together define how Responsible Entities must identify, categorise and protect the cyber and physical assets essential to reliable operation of the Bulk Electric System. The standards operate on a risk-based, impact-tiered model: entities first identify their BES Cyber Systems, categorise them as High, Medium or Low impact using the CIP-002 criteria, and then apply a graded set of controls whose stringency scales with impact rating.

NERC CIP is legally distinct from most other cyber frameworks in three ways. First, it is mandatory and audited by government-empowered Regional Entities (such as WECC, SERC, RF, MRO, NPCC, Texas RE) with real financial penalties. Second, it uses a precise defined-term vocabulary — terms like BES Cyber System (BCS), BES Cyber Asset (BCA), Electronic Security Perimeter (ESP), Physical Security Perimeter (PSP), Electronic Access Point (EAP), Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS) and Protected Cyber Assets (PCA) carry legal weight. Third, each Requirement is paired with a Measure describing acceptable evidence and a Violation Severity Level table used to grade non-compliance.

Key defined terms an auditor must master

Who must comply / scope of applicability

NERC CIP applies to Responsible Entities that own or operate elements of the Bulk Electric System. The applicable functional entity types are enumerated in the Applicability section of each standard. An organisation is in scope if it registers with NERC in one or more functional categories and owns BES assets meeting the CIP-002 criteria.

• Entities with NO assets meeting any CIP-002 impact criterion still register but may hold few or no CIP obligations.
• Low impact BES Cyber Systems (e.g. many smaller generation and distribution assets) attract a reduced obligation set concentrated in CIP-003 Requirement R2 (Attachment 1).
• Third parties (vendors, integrators, managed service providers) are drawn into scope indirectly through the supply-chain standard CIP-013 and access-management requirements.
• Cloud and virtualisation now feature in the modernised CIP standards under development to address hosted/managed BES Cyber Systems.

Structure of NERC CIP (the standards family)

The CIP family is organised as discrete numbered standards, each addressing a control domain. Each standard contains numbered Requirements (R1, R2 …), each with associated Measures (M1, M2 …), applicable systems tables (High/Medium/Low), Violation Risk Factors (VRF) and Violation Severity Levels (VSL). The table below summarises the enforceable domains.

Master assessment checklist — every standard and requirement

This is the core audit section. Each subsection below corresponds to a CIP standard and its Requirements. For each, use the table of 'What to verify' against 'Typical evidence'. Do not skip any Requirement; where a Requirement is impact-conditional, verify applicability first via CIP-002.

CIP-002 — BES Cyber System Categorization

CIP-003 — Security Management Controls

CIP-004 — Personnel and Training

CIP-005 — Electronic Security Perimeter(s)

CIP-006 — Physical Security of BES Cyber Systems

CIP-007 — System Security Management

CIP-008 — Incident Reporting and Response Planning

CIP-009 — Recovery Plans for BES Cyber Systems

CIP-010 — Configuration Change Management and Vulnerability Assessments

CIP-011 — Information Protection

CIP-012 — Communications between Control Centers

CIP-013 — Supply Chain Risk Management

CIP-014 — Physical Security (critical Transmission stations and substations)

Scoping, materiality and impact tiering (CIP-002 Attachment 1)

CIP-002 Attachment 1 provides the bright-line criteria that determine impact rating. Scoping errors here cascade across the entire programme, so auditors probe categorisation rigorously. The three tiers and representative criteria are summarised below.

• External Routable Connectivity (ERC) is a pivotal modifier: many Medium-impact obligations (e.g. parts of CIP-005 and CIP-007) apply only where ERC exists.
• The 15-minute adverse-impact test defines whether a Cyber Asset is a BCA — document the reliability-function analysis behind each inclusion/exclusion.
• Categorisation must be reviewed and approved at least every 15 calendar months (CIP-002 R2) and whenever the BES footprint materially changes.
• Under-scoping (missing an asset) and over-scoping (needless burden) are both risks; maintain a defensible, criteria-mapped rationale for every decision.

Implementation approach (phased)

A defensible CIP programme is built in disciplined phases. Each phase below lists key activities and the deliverables an auditor will later expect.

Phase 1 — Registration, scoping and categorisation

• Activities: confirm NERC functional registration; inventory all BES assets and Cyber Assets; apply the 15-minute test; categorise BCS per CIP-002 Attachment 1; identify EACMS, PACS, PCA, TCA and Removable Media.
• Deliverables: High/Medium impact BCS lists, list of assets containing low-impact BCS, categorisation rationale, CIP Senior Manager approval.

Phase 2 — Governance and personnel foundations

• Activities: designate CIP Senior Manager and delegations; write CIP-003 policies; stand up CIP-004 awareness, training, PRA and access-management programmes.
• Deliverables: approved policy suite, designation/delegation records, training curriculum, PRA procedure, access authorisation register.

Phase 3 — Perimeter and system hardening

• Activities: define ESPs and EAPs (CIP-005); deploy Intermediate Systems and MFA for IRA; establish PSPs and physical controls (CIP-006); harden systems, patch, anti-malware and logging (CIP-007); baseline configurations (CIP-010).
• Deliverables: network/ESP diagrams, firewall rule-bases, physical security plan, baseline configuration records, patch-management process.

Phase 4 — Resilience, information protection and supply chain

• Activities: build incident response and reporting (CIP-008); recovery and backup (CIP-009); BCSI protection and disposal (CIP-011); Control Center comms protection (CIP-012); SCRM plan and vendor controls (CIP-013); physical security for critical Transmission (CIP-014).
• Deliverables: IR plan, recovery plan, BCSI programme, CIP-012 plan, SCRM plan, CIP-014 risk assessment and physical plan.

Phase 5 — Evidence, internal controls and audit readiness

• Activities: implement an Internal Controls programme; automate evidence collection; conduct mock audits; remediate gaps; establish self-report and mitigation processes.
• Deliverables: evidence repository, internal controls narratives, mock-audit findings, mitigation plans, self-certification records.

Maturity / internal-controls capability model

While NERC CIP compliance is binary at the Requirement level, Regional Entities increasingly assess the strength of an entity's Internal Controls (via the Internal Controls Evaluation, ICE) to set audit scope and frequency. The maturity model below helps entities self-assess.

Assessment and audit approach

1. Confirm the audit scope: which registered functions, which standards/Requirements, and the audit period (typically since the last audit, on a 3-year cycle for High/Medium impact entities).
2. Validate CIP-002 categorisation first — verify the BCS lists, impact ratings and CIP Senior Manager approvals; scoping errors invalidate downstream conclusions.
3. Request and review the Reliability Standard Audit Worksheets (RSAWs) and supporting evidence for each in-scope Requirement.
4. Test governance: CIP Senior Manager designation, delegations, and policy approvals within 15 months.
5. Sample personnel records for CIP-004: training completion before access, PRAs, quarterly access verification, and 24-hour revocation.
6. Inspect technical controls: ESP/EAP configurations, IRA/MFA, physical access logs (90-day retention), baselines, patch evidence (35-day rule), log review (15-day) and monitoring.
7. Test resilience: IR plan tests (15-month), reporting to E-ISAC/CISA (1-hour rule), recovery-plan tests and backup restoration verification.
8. Examine cross-cutting standards: CIP-011 BCSI handling, CIP-012 comms protection, CIP-013 SCRM implementation, CIP-014 assessments and third-party reviews.
9. Evaluate internal controls (ICE) to gauge sustainability and calibrate sampling depth.
10. Document Areas of Concern, Potential Non-Compliance (PNC) and Positive Observations; agree mitigation plans and, where applicable, self-logging or Find, Fix, Track and Report (FFT) dispositions.

Evidence request list (categorised)

• Governance: CIP Senior Manager designation, delegations, approved cyber security policies with review dates.
• Categorisation: High/Medium BCS lists, list of assets with low-impact BCS, CIP-002 Attachment 1 mapping worksheets, R2 approvals.
• Personnel: training records with dates, PRA/background-check records, access authorisation and quarterly verification, 24-hour revocation tickets.
• Electronic security: network/ESP diagrams, EAP firewall rule-bases with justifications, IRA architecture, MFA enforcement, IDS/IPS at EAPs.
• Physical security: Physical Security Plan, PSP drawings, entry logs (90-day retention), visitor logs, PACS maintenance/test records.
• System management: port/service inventories, baseline configurations, patch evaluation and installation logs (35-day), anti-malware update logs, security-event logs and 15-day reviews.
• Change and vulnerability: change tickets, 30-day baseline updates, 35-day change monitoring, vulnerability assessment reports and remediation.
• Incident and recovery: IR plans and test records, E-ISAC/CISA reporting logs, recovery plans, backup and restoration verification.
• Information protection: BCSI classification and handling, repository access controls, media sanitisation/destruction certificates.
• Supply chain and comms: CIP-013 SCRM plan and procurement records, vendor risk assessments, CIP-012 plan and inter-entity agreements.
• Critical Transmission: CIP-014 risk assessments, third-party verification/review reports, physical security plans.

Roles and responsibilities

KPIs and metrics to track

• Percentage of BES Cyber Systems with current, approved CIP-002 categorisation (target 100%).
• Patch evaluation and remediation completed within the 35-day window (percentage and ageing).
• Security-event log reviews completed within 15 days (on-time rate).
• Access revocations completed within 24 hours of termination (on-time rate).
• Quarterly access verifications and awareness reinforcements completed on schedule.
• Incident response and recovery plan tests completed within 15 months; mean time to report Reportable Cyber Security Incidents versus the 1-hour target.
• Baseline change authorisation compliance and 35-day change-monitoring coverage.
• Number of self-identified versus auditor-identified potential non-compliances (higher self-identification indicates strong internal controls).
• Open mitigation plans, ageing and overdue count.
• Vendor/SCRM assessments completed for in-scope procurements; backup restoration verification success rate.

Readiness checklist

• NERC functional registration confirmed and BES asset inventory complete.
• CIP-002 categorisation done, mapped to Attachment 1, approved within 15 months.
• CIP Senior Manager designated and delegations documented.
• Full CIP-003 policy suite approved and within review cadence.
• CIP-004 training, PRA, access authorisation and 24-hour revocation processes operating with evidence.
• ESPs/EAPs defined, IRA via Intermediate System with MFA, malicious-communications detection where required.
• PSPs established, 90-day physical entry logs retained, visitor control operating.
• Ports/services controlled, 35-day patch process, anti-malware, 90-day log retention and 15-day reviews in place.
• IR plan tested within 15 months and E-ISAC/CISA reporting path validated against the 1-hour rule.
• Recovery plans and backup restoration tested and verified.
• Baselines documented, changes authorised, 35-day monitoring, and vulnerability assessments current.
• BCSI protection, CIP-012 comms plan, CIP-013 SCRM plan and CIP-014 assessments complete with third-party reviews.
• Evidence repository and internal controls programme audit-ready; mock audit conducted.

Common gaps and findings

• Incomplete or unjustified CIP-002 categorisation — missing assets or absent 15-minute-impact rationale.
• Access revocation exceeding the 24-hour window, or shared-account passwords not changed on personnel departure.
• Missed 35-day patch evaluation/installation deadlines without a documented mitigation plan.
• Security-event logs not reviewed within 15 days, or retention short of 90 days.
• Interactive Remote Access without a compliant Intermediate System or without enforced multi-factor authentication.
• Baseline configurations out of date, or changes made without authorisation and 30-day baseline updates.
• Physical access logs not retained for 90 days; visitor escort lapses inside PSPs.
• Incident response or recovery plans not tested within 15 months, or lessons-learned updates not made within 90 days.
• CIP-013 SCRM plan documented but not evidenced in actual procurements; vendor remote-access controls unproven.
• BCSI stored in cloud/third-party repositories without adequate access controls (CIP-011); weak media disposal.
• CIP-014 risk assessments lacking unaffiliated third-party verification/review.

NERC CIP mapped to other frameworks

Frequently asked questions

Need help with NERC CIP?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.