In the energy sector, the people and accounts that can reach control systems are spread across control centres, generation plants, unstaffed substations and dozens of vendors, and every one of them is a path to physical operations. Protection engineers carry laptops between substations, OEMs support turbines and inverters remotely, contractors hold badges and VPN accounts for years after a project ends, and field devices still rely on local passwords because the communications link to the control centre may be down when they are needed most. Regulators have responded with specific identity requirements: NERC CIP in North America, NIS2 and the electricity network code on cybersecurity in the EU. This guide is for utility and generator security, IAM and OT engineering teams. It focuses on who gets access, how it is granted and removed, and how to handle engineers, vendors and remote sites, and it links to the NHIMG guides on general OT identity and smart grid protocols rather than repeating them.
Key takeaways
- Access lifecycle is the regulated core. NERC CIP-004-7 sets hard clocks: removal within 24 hours of termination for Interactive Remote Access and unescorted physical access, and by the end of the next calendar day for unneeded access after a transfer.
- Every remote session goes through an Intermediate System. CIP-005-7 requires an Intermediate System, encryption and multi-factor authentication for Interactive Remote Access to high impact and medium impact systems with External Routable Connectivity.
- Vendors must be visible and switchable. CIP-005-7 and CIP-003-9 require methods to determine and disable vendor remote access, including system-to-system connections, and CIP-013-2 makes vendors tell you when a representative's access should end.
- Remote substations need offline-capable identity. Plan for local device accounts, vaulted shared credentials and break-glass access that work when the WAN is down, with attribution restored afterwards.
- State actors use valid accounts. CISA's Volt Typhoon advisory describes VPN and edge device compromise, theft of domain credentials and use of stored credentials for utility control systems, so IT identity hygiene directly protects OT.
Who needs access in energy operations
Energy organisations have more distinct access populations than most sectors, and each needs its own provisioning route and review cadence.
| Population | What they reach | Typical identity problem | Control focus |
|---|---|---|---|
| Control room operators | SCADA and EMS consoles, HMIs | Shared console logins across shifts | Attribution by shift, fast user switching, session logging |
| Protection and control engineers | Relays, RTUs, gateways, engineering workstations, field laptops | Device passwords known to the whole team, laptops that move between sites | Vaulted device credentials, managed transient devices, JIT elevation |
| IT and OT administrators | Domain controllers, historians, EACMS, jump hosts | Same admin account used in IT and OT | Separate OT admin identities, tiering |
| OEMs and service vendors | Turbine, inverter, battery and DCS platforms | Always-on remote connections, vendor-managed modems | Brokered, time-boxed and recorded sessions |
| Contractors and field crews | Substations, plant floors, badges and VPN | Accounts outliving the contract | End dates enforced at creation, sponsor attestation |
| Machine identities | ICCP links, historian replication, data diodes, cloud analytics | Service accounts and certificates with no owner | Inventory, ownership, rotation |
For the general OT identity model (IT and OT directory separation, zones and conduits, shared HMI accounts), see the OT and ICS Identity and Access Guide. For substation protocols such as IEC 61850 and IEC 62351 role-based access, see the Smart Grid Security Guide.
NERC CIP identity requirements in practice
NERC CIP applies to Balancing Authorities, Generator Owners and Operators, Reliability Coordinators, Transmission Owners and Operators and some Distribution Providers. CIP-002 categorises BES Cyber Systems as high, medium or low impact, and the identity requirements scale with that category. The values below were read from the standard documents on nerc.com; NERC revises standards regularly, so check its US standards list for the version enforceable on your audit date.
| Standard and part | Requirement | Identity implication |
|---|---|---|
| CIP-004-7 R2 | Training before authorised electronic or unescorted physical access, repeated at least every 15 calendar months | Provisioning workflow must check training status first |
| CIP-004-7 R3 | Personnel risk assessment including a seven-year criminal history check, completed within the last seven years | PRA date is an access prerequisite, tracked per person, including contractors |
| CIP-004-7 R4 | Verify authorisation records every calendar quarter; review privileges at least every 15 calendar months | Quarterly access attestation, with evidence |
| CIP-004-7 R5 | Remove IRA and unescorted physical access within 24 hours of termination; revoke unneeded access by end of next calendar day after a transfer; change shared account passwords within 30 days | HR, badge and IAM systems must be connected tightly enough to meet a 24-hour clock |
| CIP-004-7 R6 | Authorise and review provisioned access to BES Cyber System Information; remove by end of next calendar day after termination | File shares, document systems and vendor portals holding BCSI are in scope |
| CIP-005-7 R2 | Intermediate System for all IRA, encryption terminating at it, MFA for all IRA, methods to determine and disable active vendor remote access | A single brokered path with MFA and a kill switch |
| CIP-005-7 R3 | Determine and terminate vendor-initiated remote connections to EACMS and PACS | Extends vendor controls to the security and physical access systems themselves |
| CIP-007-6 R5 | Enforce authentication where feasible; inventory default and generic accounts; identify who uses shared accounts; change default passwords; password length at least the lesser of 8 characters or device maximum, and 3 character types; change at least every 15 calendar months; limit failed attempts or alert on them | Device-level account management, including relays and RTUs that support only one password |
| CIP-007-6 R4 | Log successful and failed logins; retain 90 days; review at intervals of no more than 15 days for high impact | Authentication logs from jump hosts, EACMS and devices feed review |
| CIP-003-9 Att. 1 s.6 | For low impact systems with vendor electronic remote access: methods to determine it, disable it, and detect malicious communications | Vendor access controls now reach smaller sites and generators |
| CIP-013-2 R1.2 | Procurement must cover vendor notice when remote or onsite access should end, coordinated vendor remote access controls and software integrity verification | Contracts become an input to deprovisioning |
CIP-007-6 Part 5.7 allows either a lockout threshold or an alert after failed attempts. In control rooms, many entities choose alerting to avoid locking out an operator during an event. For programme-level detail on scope and audits, see the NERC CIP Guide.
EU requirements: NIS2 and the network code on cybersecurity
- NIS2 (Directive (EU) 2022/2555): Annex I lists energy subsectors: electricity, district heating and cooling, oil, gas and hydrogen. Article 21(2) requires measures including supply chain security (d), human resources security, access control policies and asset management (i), and multi-factor authentication or continuous authentication where appropriate (j). Article 23 sets reporting stages at 24 hours, 72 hours and one month. National transposition decides the detail. See the NIS2 Directive Guide.
- Network code on cybersecurity (Commission Delegated Regulation (EU) 2024/1366): adopted 11 March 2024 and in force since 13 June 2024, it sets sector-specific rules for cybersecurity aspects of cross-border electricity flows. ENTSO-E describes deliverables including risk assessment methodologies, a cyber-attack classification scale, a gateway security profile and substation automation recommendations, lists of minimum and advanced cybersecurity controls, and an Electricity Cybersecurity Impact Index used to identify high-impact and critical-impact entities. ENTSO-E notes that entities may apply the code voluntarily during the transition. Identity controls for substations and gateways are expected to sit inside those control lists, so track their publication rather than designing to a guess.
- Elsewhere: the US Department of Energy's C2M2 (version 2.1) is widely used for self-assessment, with an Identity and Access Management domain and a Third-Party Risk Management domain scored across three maturity indicator levels.
Engineers: privileged access without slowing operations
- Separate identities: give engineers an OT admin account distinct from their corporate account, with no email or web access, as CISA recommends for administrators. See the Privileged Access Management Guide.
- Elevate per task: tie elevation for relay setting changes or logic downloads to a work order, granted for hours rather than permanently. See the JIT Access Guide.
- Vault device passwords: where a relay or RTU supports only one or two local accounts, store the password in a vault, record each checkout against a work order, and rotate after use or on staff change. This is how CIP-007-6 Part 5.3, identifying who can use shared accounts, is met in practice.
- Control transient laptops: engineering laptops and USB media that move between sites need named ownership, a hardened build and scanning before connection. Treat the laptop as an identity carrier: it often holds cached credentials and configuration files for many substations.
- Use the protocol's own access control where available: newer substation devices support role-based access and central authentication through RADIUS or LDAP. Where they do, prefer named accounts over the shared device password.
Vendors and OEMs: brokered, time-boxed, recorded
- Find every vendor path: list remote support tools, cellular modems on turbine and inverter controllers, OEM cloud connections and site-to-site VPNs. CIP-005-7 counts system-to-system vendor access, not just interactive logins.
- Collapse them onto one broker: route vendor sessions through the Intermediate System with MFA, named vendor accounts and session recording. See the Remote Access Identity Guide and the Privileged Session Management Guide.
- Default off: enable vendor access for an approved window against a ticket, then disable automatically. Keep a tested manual kill switch to meet the "disable active vendor remote access" requirement.
- Tie contracts to deprovisioning: CIP-013-2 Part 1.2.3 requires vendors to notify you when a representative's access should no longer be granted. Feed those notices into the same workflow that handles employee leavers.
- Review quarterly: include vendor accounts in the CIP-004 quarterly authorisation check and remove those unused for a set period. See the Third-Party Access Guide.
Remote substations and unstaffed sites
Substations, wind farms and solar sites are often unstaffed, reached over constrained links, and must be operable during storms and outages when central services may be unavailable. Identity design has to accept that.
| Scenario | Risk | Approach |
|---|---|---|
| Engineer on site, WAN down | Central MFA and directory unreachable, so staff fall back to shared passwords | Local break-glass accounts per site, vaulted with offline retrieval, rotated after every use and logged on return. See the Break-Glass Account Guide |
| Local HMI in the control building | Always-logged-in console reachable by anyone with physical access | Tie physical access (badge logs, CIP-006 controls for high and medium sites) to console use; short screen locks where operations allow |
| Cellular or satellite backhaul | Modem management interfaces with default credentials | Change defaults, restrict management to the broker, inventory every modem as an asset |
| Contractor crews | Physical keys and badges not returned | Expiry on badges, key control registers, revocation within the CIP-004 24-hour window |
| Distributed energy resources and third-party sites | OEM cloud access controlling many sites at once | Contractual access controls, MFA on OEM portals, monitoring of fleet-wide commands |
Threats and incidents
CISA's advisory AA24-038A (February 2024) reports that Volt Typhoon compromised organisations in sectors including energy by exploiting internet-facing VPNs, firewalls and routers, then used valid administrator accounts, extracted the Active Directory database from domain controllers, and in some cases used stored credentials to reach utility control systems. The Colonial Pipeline ransomware attack showed how a single unused VPN account without MFA could lead to a fuel pipeline shutdown, even though the attack hit IT systems.
| Technique (ATT&CK v20) | Energy example | Control |
|---|---|---|
| T1133 External Remote Services / ICS T0822 | Compromised VPN or vendor remote tool into the control network | Single Intermediate System, MFA, vendor access off by default |
| T1078 Valid Accounts / ICS T0859 | Stolen admin or vendor account reused against OT | Separate OT identities, phishing-resistant MFA, quarterly review |
| T1003.003 NTDS | Domain database stolen, hashes cracked offline | No IT domain trust into OT, tiered admin model, monitoring of domain controllers |
| ICS T0886 Remote Services | Lateral movement from jump host to engineering workstation | Allow-listed paths from the broker only, session recording |
Implementation roadmap
- Baseline: inventory every human, vendor and machine identity with access to BES Cyber Systems or EU-regulated assets, and every remote path. Map each to its impact category.
- Connect HR, badge and IAM: automate leaver events into OT account, VPN and badge revocation, and test that the full chain completes inside 24 hours.
- Broker remote access: move vendors first, then internal engineers, onto the Intermediate System. Pilot with one OEM and one site, run old and new paths in parallel for a short period, then close the old path; keep the old path's configuration documented so it can be restored if the broker fails during commissioning.
- Vault device credentials: start with high impact sites, change defaults, record shared account users and set rotation after use.
- Design offline access: define break-glass per site and test it in a maintenance window with operations present.
- Monitor and attest: feed broker, EACMS and device authentication logs to review, and run quarterly attestation with evidence ready for audit.
Detection and measurement
Log broker session starts and ends, MFA failures, vendor access enable and disable events, vault checkouts, device login attempts where supported, and physical access to substations. Correlate vault checkouts with work orders and badge entries.
- Revocation time: median and worst-case hours from termination to removal of IRA and physical access (target well under 24).
- Brokered coverage: percentage of remote paths, including vendor system-to-system links, passing through the Intermediate System.
- Vendor access exposure: hours per month vendor access is enabled, and sessions without a ticket.
- Shared credential hygiene: percentage of device passwords vaulted and rotated within policy after use.
- Attestation quality: accounts removed per quarterly review, and review completion on time.
- Break-glass use: uses per quarter, each matched to an incident or outage and followed by rotation.
Framework mapping
| Control area | NERC CIP | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|---|
| Personnel screening and training | CIP-004-7 R2, R3 | PS-3 | PR.AA-01 |
| Access authorisation and review | CIP-004-7 R4 | AC-2, AC-6 | PR.AA-05 |
| Revocation on leave or transfer | CIP-004-7 R5 | PS-4, PS-5 | PR.AA-01 |
| Remote access and MFA | CIP-005-7 R2 | AC-17, IA-2 | PR.AA-05 |
| Device accounts and passwords | CIP-007-6 R5 | IA-5 | PR.AA-01 |
| Authentication logging | CIP-007-6 R4 | AU-6 | DE.CM-03 |
| Vendor access and supply chain | CIP-013-2, CIP-003-9 | SA-9, SR-6 | GV.SC-07 |
Common failure patterns
- Leaver process stops at the corporate directory: the IT account is disabled but the OT domain account, vault access, vendor portal login and substation badge remain.
- Vendor modems outside the broker: a cellular modem fitted by an OEM gives a direct path that never appears in the remote access inventory.
- One relay password for the whole fleet: the same device password set across every substation, known by former staff and contractors.
- IT admin accounts trusted in OT: a domain trust or reused admin credential lets an IT compromise reach the control network, the pattern CISA describes for Volt Typhoon.
- Break-glass never rotated: emergency credentials printed in a site binder and unchanged for years.
- Compliance scope as security scope: low impact and non-BES sites left with weak vendor access because they fall outside the strictest CIP requirements.
Practitioner checklist
- Inventory all human, vendor and machine identities with OT access, by site and impact category.
- Automate termination and transfer revocation across IAM, VPN, vault and badge systems, and measure it against the 24-hour clock.
- Route all Interactive Remote Access and vendor connections through an Intermediate System with MFA and recording.
- Keep vendor access disabled by default and test the kill switch.
- Vault and rotate shared device passwords, and record who used them.
- Separate OT admin identities from corporate accounts and remove IT domain trust into OT.
- Design and test offline break-glass access for each remote site.
- Write vendor access notification and integrity requirements into contracts.
- Track the EU network code control lists and national NIS2 rules for identity requirements.
Standards and references
- NERC: CIP-004-7 Cyber Security, Personnel and Training
- NERC: CIP-005-7 Cyber Security, Electronic Security Perimeter(s)
- NERC: CIP-007-6 Cyber Security, System Security Management
- NERC: CIP-013-2 Cyber Security, Supply Chain Risk Management
- EUR-Lex: Commission Delegated Regulation (EU) 2024/1366, network code on cybersecurity for electricity
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- CISA: Advisory AA24-038A, PRC state-sponsored actors compromise US critical infrastructure
- US Department of Energy: Cybersecurity Capability Maturity Model (C2M2)
Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · Smart Grid Security Guide · OT Security Guide · Critical Infrastructure Identity Security Guide. This guide summarises NERC CIP, NIS2 and Regulation (EU) 2024/1366 identity requirements and is not legal advice.