NERC CIP Guide: Compliance for the Bulk Electric System

NERC CIP is the mandatory cyber security regime for the North American bulk electric system, and compliance is judged on the evidence an entity can produce, not only on the controls it runs. The Critical Infrastructure Protection standards apply to registered entities such as balancing authorities, generator owners and operators, transmission owners and operators, and reliability coordinators, and are enforced through audits and financial penalties. The family is changing quickly: low impact vendor remote access controls took effect in 2026, internal network security monitoring (CIP-015-1) is phasing in, and FERC has approved virtualisation revisions. This guide explains what each standard requires in practice, how to build and evidence a programme, and where identity and access controls carry much of the compliance weight. It is for CIP compliance managers, OT security engineers and the IT teams that support them.

Key takeaways

• Categorisation drives everything. CIP-002 decides whether a BES Cyber System is high, medium or low impact, and that rating, plus External Routable Connectivity, decides which requirement parts apply.
• Remote access is the most scrutinised boundary. CIP-005 requires an Intermediate System, encryption and multi-factor authentication for all Interactive Remote Access, and the ability to see and disable vendor sessions.
• Identity controls carry much of the weight. CIP-004 sets hard timelines for authorisation, verification and revocation, and CIP-007 R5 covers default, generic and shared accounts.
• The rulebook is moving. CIP-003-9, CIP-015-1 and FERC Order No. 919 virtualisation changes all need planning now, with compliance dates running to 2028 and beyond.
• Evidence is the deliverable. Design every process to produce dated, attributable records as a by-product, not as an annual scramble before audit.

How NERC CIP works and the standards at a glance

NERC develops reliability standards; in the United States FERC approves them under section 215 of the Federal Power Act, after which they are mandatory. NERC and six Regional Entities (MRO, NPCC, ReliabilityFirst, SERC, Texas RE and WECC), together the ERO Enterprise, monitor compliance through audits, spot checks, self-certifications, self-reports and investigations. The standards protect BES Cyber Assets: Cyber Assets that, if rendered unavailable, degraded or misused, would adversely affect reliable operation of the bulk electric system within 15 minutes. Many requirements also apply to associated Electronic Access Control or Monitoring Systems (EACMS, such as firewalls and Intermediate Systems), Physical Access Control Systems (PACS) and Protected Cyber Assets (PCA). Each requirement part has its own applicability column, so read the table row, not the standard title.

Versions shown are those read for this guide; check NERC's US effective dates list for the version in force on a given day, because several change again under Order No. 919. The NIST mapping is indicative: CIP is usually more prescriptive on timelines. See the NIST SP 800-53 Guide.

Categorising BES Cyber Systems (CIP-002)

CIP-002 R1 applies the Attachment 1 criteria; R2 requires review at least every 15 calendar months with CIP Senior Manager approval. High impact covers the largest control centres (for example, reliability coordinator control centres under criterion 1.1). Medium impact includes generation with an aggregate net Real Power capability of 1,500 MW or more in one interconnection (criterion 2.1) and transmission facilities at 200 to 499 kV above a weighted threshold (criterion 2.5). Remaining in-scope assets, such as smaller substations and generation, are low impact.

Tie categorisation to engineering change: a new generator, uprated unit or added routable link can move an asset into a higher category long before the 15-month review. See the OT Security Guide for zones, the Purdue model and OT inventories.

Electronic Security Perimeters and remote access (CIP-005)

CIP-005-7 R1 places every applicable Cyber Asset connected by a routable protocol inside a defined ESP, with all ERC passing through an identified Electronic Access Point (EAP). Inbound and outbound permissions need a documented reason, with everything else denied by default (R1.3). Dial-up must be authenticated where technically feasible (R1.4), and EAPs for high impact systems and medium impact control centres need methods to detect known or suspected malicious communications in both directions (R1.5).

• Interactive Remote Access (IRA): user-initiated remote access over a routable protocol from outside the ESP. R2.1 requires it to pass through an Intermediate System, so the initiating device never connects directly to an applicable Cyber Asset; R2.2 requires encryption to the Intermediate System.
• Multi-factor authentication: R2.3 requires MFA for all IRA sessions. See the MFA Guide.
• Vendor sessions: R2.4 and R2.5 require methods to determine active vendor remote access sessions, including system-to-system access, and to disable them. R3.1 and R3.2 extend this to EACMS and PACS associated with high and medium impact systems with ERC.

The Intermediate System is itself an EACMS and inherits patching, logging, access management and CIP-013 obligations. Treat it as a tier-zero jump host: no browsing, no trust from the corporate domain, recorded sessions and vaulted credentials. Decision point: an entity-run jump host in a DMZ gives full control and evidence; a vendor-hosted access platform is quicker to deploy but must still meet EACMS obligations and produce evidence you can hand to an auditor. See the Remote Access Identity Guide.

Low impact requirements (CIP-003-9)

CIP-003-9, enforceable from 1 April 2026, requires a cyber security plan for assets containing low impact BES Cyber Systems covering six Attachment 1 sections: awareness, physical security controls, electronic access controls, incident response, transient cyber asset and removable media malicious code mitigation, and vendor electronic remote access security controls.

• Section 3: permit only necessary inbound and outbound routable access, and authenticate dial-up.
• Section 6 (new in version 9): methods to determine vendor electronic remote access, to disable it, and to detect known or suspected malicious communications inbound and outbound.
• Governance: policies reviewed at least every 15 calendar months; a change of CIP Senior Manager documented within 30 calendar days.

Low impact programmes often span hundreds of small sites. Standardise one site design (firewall pattern, remote access path, vendor approval workflow) and evidence it by template rather than designing each substation separately.

System security and configuration control (CIP-007 and CIP-010)

A mitigation plan is not a waiver: track its dated actions to completion. See the Vulnerability Management Guide.

Where identity fits: CIP-004 and CIP-007 R5

• Shared and generic accounts: HMI logins, relay passwords and vendor maintenance accounts are often shared. A list of who knows each one only stays current if the access workflow maintains it. See the OT and ICS Identity and Access Guide.
• Service accounts: historian, SCADA and backup service accounts fall under the same controls. Inventory, scope and rotate them where the vendor allows. See the Service Account Security Guide.
• Privileged access tooling: a vault can produce much of the CIP-004 and CIP-007 R5 evidence, but if it controls access to the ESP it becomes an EACMS. See the Privileged Access Management Guide.
• Vendors: named vendor accounts with MFA through the Intermediate System satisfy CIP-005 R2.4 and R2.5 far more cleanly than a standing shared login. See the Third-Party Access Guide.

Supply chain, incident response and network monitoring

• CIP-013-2 supply chain: applies to high and medium impact systems and their EACMS and PACS. R1.1 covers procurement risk; R1.2.1 to R1.2.6 cover vendor notification of incidents, coordinated response, notification when a vendor representative's access should end, vulnerability disclosure, software integrity and authenticity verification, and coordination of vendor remote access controls. R2 does not require renegotiating existing contracts; R3 requires plan review every 15 calendar months.
• CIP-008-6 incident response: test plans at least every 15 calendar months. Notify the E-ISAC and NCCIC (part of CISA) within one hour of determining a Reportable Cyber Security Incident, and by the end of the next calendar day for an attempt to compromise, covering functional impact, attack vector and level of intrusion, with updates within 7 calendar days of new information.
• CIP-015-1 internal network security monitoring (INSM): FERC Order No. 887 (January 2023) directed it and Order No. 907 (issued 26 June 2025) approved it. It covers networks inside the ESPs of high impact systems and medium impact systems with ERC. R1 requires a risk-based rationale for network data feeds, methods to detect anomalous activity and methods to evaluate it, with escalation into the CIP-008 plan; R2 retains data on anomalies until evaluation is complete; R3 protects that data from unauthorised deletion or modification. Order No. 907 also directed NERC to extend INSM to EACMS and PACS outside the ESP.

Order No. 907 took effect on 2 September 2025. Compliance starts on the first day of the first calendar quarter 36 months later for the first group of control centres, with 24 further months for remaining systems: on that arithmetic, 1 October 2028 and 1 October 2030; confirm against the NERC implementation plan. ReliabilityFirst advises starting small, using SPAN ports or taps, segmenting with VLANs and planning storage early.

Virtualisation revisions (FERC Order No. 919)

FERC issued Order No. 919 on 19 March 2026 (Federal Register 24 March 2026, effective 26 May 2026). The changes run through existing standards rather than a new one, with modified versions including CIP-004-8, CIP-005-8, CIP-007-7.1, CIP-010-5 and CIP-013-3.

• New definitions: Cyber System, Management Interface, Shared Cyber Infrastructure and Virtual Cyber Asset, with 18 existing definitions modified.
• Logical boundaries: CIP-005 recognises logical isolation and policy enforcement points alongside physical perimeters.
• Per system capability: replaces some "technically feasible" provisions, and FERC directed an exception programme with reporting and an annual report.
• Timing: the later of 1 April 2026 or the first day of the first calendar quarter 24 months after the effective date, which points to 1 July 2028, with early adoption options.

Entities already running virtualised control centres gain most from early adoption; physical-only environments can start with hypervisor and management interface inventory.

Audits, penalties and evidence

Regional Entities set audit scope and frequency through risk-based monitoring, working from NERC's Reliability Standard Audit Worksheets (RSAWs). Possible violations are resolved as compliance exceptions, Find, Fix, Track and Report dispositions, settlements or Notices of Penalty. Under section 215 of the Federal Power Act, penalties can reach USD 1 million per violation per day (a cap adjusted for inflation), scaled by risk, duration and the entity's internal compliance programme.

• Evidence by design: access approvals, quarterly verification sign-off, patch evaluation logs, baseline comparisons and drill reports should all be dated and attributable as they happen.
• Sampling: auditors sample populations (terminations, changes, patches), so keep each population complete and queryable.

Metrics that show the programme is working

• Percentage of terminations with IRA and physical access removed within 24 hours (target 100 percent).
• Percentage of applicable assets with patch sources evaluated within 35 days, and mitigation plans past their dated actions.
• Baseline deviations found by CIP-010 monitoring without an authorised change record.
• Percentage of remote sessions through the Intermediate System with MFA and a tested disable method.
• Percentage of shared and generic accounts with a current list of who knows the password.
• Possible violations found internally versus at audit; self-reporting early with a credible mitigation plan is usually treated more leniently.

Building or maturing a CIP programme

1. Scope: confirm registrations, run CIP-002 categorisation and inventory BES Cyber Systems, EACMS, PACS and PCA with ERC status.
2. Govern: appoint the CIP Senior Manager, document delegations, approve policies and build a calendar for every 15-day, 35-day, quarterly, 15-month and 36-month obligation.
3. Architect: define ESPs, EAPs and the Intermediate System pattern; standardise one low impact site design.
4. Control identity: connect HR leaver and transfer events to revocation, build the shared account register and enforce MFA on all IRA.
5. Harden and baseline: capture baselines, close unneeded ports, start the 35-day patch cycle and the transient cyber asset process.
6. Test and roll back: pilot changes at one site or in a test environment that models the baseline (CIP-010 R1.5 for high impact), verify CIP-005 and CIP-007 controls after each change (R1.4), and keep the previous rule set and configuration so a change can be reversed within the maintenance window.
7. Monitor and respond: stand up logging and alerting, run a CIP-008 tabletop and pilot CIP-015-1 collection points.
8. Prove it: run a mock audit against the RSAWs, sample your own populations and self-report findings.

Small versus large entities: an entity with only low impact assets needs a lean CIP-003 plan, a site template and a vendor access workflow. Utilities with high impact control centres need compliance tooling, test environments and a compliance function independent of operations.

Common failure patterns

• Categorisation lagging engineering: a new tie line or routable link changes the impact rating or ERC status, but CIP-002 is only revisited at the 15-month review.
• Partial revocation: the directory account is disabled, but local relay and HMI accounts, shared passwords and BCSI repository access are forgotten.
• Standing vendor access: always-on tunnels and shared support accounts with no reliable disable method. The Colonial Pipeline ransomware attack began with an unused VPN account without MFA, the pattern CIP-005 R2.3 and R2.5 target.
• Mitigation plans as parking lots: deferred patches under dated plans that are never revisited.
• Intermediate Systems treated as ordinary servers: jump hosts joined to the corporate domain, used for browsing, or missing from EACMS patching and logging scope.
• Evidence rebuilt before audit: controls that operated but left no dated trail for the sampled period.

Practitioner checklist

• Tie CIP-002 categorisation to engineering change so new assets and routable links trigger review.
• Keep one inventory of BES Cyber Systems, EACMS, PACS and PCA with impact rating and ERC status.
• Route all Interactive Remote Access through a hardened Intermediate System with encryption and MFA.
• Document and test a method to see and disable every vendor remote session, including system-to-system access.
• Automate leaver and transfer events into revocation, with alerts at the 24-hour and next-day deadlines.
• Maintain a register of shared and default accounts and the people who know each password.
• Run the 35-day patch evaluation cycle and track every mitigation plan action to a date.
• Implement CIP-003-9 Section 6 vendor controls at every low impact site.
• Plan CIP-015-1 collection points and data protection, and assess Order No. 919 impacts.
• Run a mock audit against the RSAWs at least annually and self-report what it finds.

Standards and references

• NERC: CIP-002-5.1a Cyber Security, BES Cyber System Categorization
• NERC: CIP-003-9 Cyber Security, Security Management Controls
• NERC: CIP-004-7 Cyber Security, Personnel and Training
• NERC: CIP-005-7 Cyber Security, Electronic Security Perimeter(s)
• NERC: CIP-007-6 Cyber Security, System Security Management
• NERC: CIP-015-1 Cyber Security, Internal Network Security Monitoring
• FERC: Order No. 907, Critical Infrastructure Protection Reliability Standard CIP-015-1
• Federal Register: Order No. 919, Virtualization Reliability Standards

Related NHI Mgmt Group resources: OT Security Guide · OT and ICS Identity and Access Guide · Third-Party Access Guide · Global Cybersecurity Regulatory Map. This guide summarises the NERC CIP Reliability Standards and related FERC orders and is not legal advice.