NERC CIP-013: Building and Evidencing a Supply Chain Risk Plan

NERC CIP-013 is the North American electric reliability standard that forces utilities to manage cyber risk from the vendors who supply and support their control systems, and it is about to get stricter. CIP-013-2 requires a documented supply chain cyber security risk management plan, its implementation, and a review every 15 calendar months. FERC Order No. 912, issued on 18 September 2025, directed NERC to tighten how risks are identified, reassessed and responded to and to bring Protected Cyber Assets into scope, and CIP-013-3, which adds Shared Cyber Infrastructure for virtualised environments, has a US effective date of 1 July 2028. This guide goes deeper than the NERC CIP Guide: it walks through each requirement part, how to build and evidence the plan, the identity controls hidden inside R1.2, what is changing, and the audit pitfalls. It is written for CIP compliance managers, OT security leads, procurement and supplier risk teams at registered entities with high or medium impact BES Cyber Systems.

Key takeaways

• Three requirements, one plan: R1 documents the plan, R2 implements it, and R3 has the CIP Senior Manager or a delegate approve it at least every 15 calendar months.
• Six procurement topics: R1.2 covers vendor incident notification, coordinated response, notice when vendor staff no longer need access, vulnerability disclosure, software integrity and authenticity, and vendor-initiated remote access.
• Contracts are not the measure: R2 does not require renegotiating existing contracts, and contract terms and vendor performance are outside the requirement, so evidence focuses on what your processes did.
• Order 912 raises the bar: NERC must add a maximum time between procurement risk assessment and installation, periodic reassessment of existing vendors, a process to track and respond to all identified risks, and coverage of PCAs.
• Versions are moving: CIP-013-3 adds Shared Cyber Infrastructure from 1 July 2028, and Project 2025-06 balloted draft CIP-013-4 and CIP-010-6 in July 2026 in response to Order 912.

What it is and who it applies to

CIP-013 (Cyber Security, Supply Chain Risk Management) exists to mitigate cyber security risks to the reliable operation of the Bulk Electric System (BES) by implementing security controls for supply chain risk management of BES Cyber Systems. It was created after FERC Order No. 829; CIP-013-1 was approved by FERC on 18 October 2018 and CIP-013-2, which responded to Order No. 850 by extending scope to access control and monitoring systems, was approved on 18 March 2021.

CIP-013 governs procurement and the vendor relationship. The operational controls that act on what you buy sit in sibling standards: vendor remote access in CIP-005-7 R2.4, R2.5 and R3, and software source and integrity verification before installation in CIP-010-4 R1.6. FERC's Order 912 names these three together as the SCRM Reliability Standards, and an auditor will usually test them together.

Structure and key requirements

The "as applicable" wording in R1.2 matters. Not every purchase raises every topic: a firmware patch from an existing vendor raises R1.2.5 and perhaps R1.2.4, not R1.2.3. Your plan should say how you decide applicability and record the decision for each procurement, because "not applicable" without a reason is a common audit finding.

Identity and NHI requirements

Three of the six R1.2 topics are identity controls in disguise, and they extend to machine identities as much as people.

• R1.2.3 access termination: the vendor must tell you when a representative should no longer have remote or onsite access. Your side of the process is revoking the account, rotating any shared or vendor-known passwords, and removing keys or certificates issued to that person. Tie the vendor notice to the CIP-004 access revocation workflow so the clock is tracked. See the Vendor Offboarding and Termination Guide.
• R1.2.6 remote access, including system-to-system: system-to-system access means service accounts, API credentials, VPN certificates and vendor monitoring agents that connect without a person at the keyboard. Inventory each one, record its owner at the vendor and on your side, scope it to the systems it needs, and make sure CIP-005 R2.4 and R2.5 detection and disabling cover these sessions too. The Vendor Privileged Access Management (VPAM) Guide and the OT Remote Access Guide go into design options.
• R1.2.5 software integrity: verification relies on the vendor's signing keys and certificates. Record which signing certificate or published hash each product uses, how you obtain it out of band, and what you do when it changes. A compromised vendor signing identity defeats this control, which is the lesson of the SolarWinds supply chain compromise, where a trojanised but legitimately built update reached thousands of customers.

Where vendors operate remote access or privileged access tooling for you, treat that supplier as tier zero. See Remote access and PAM vendors as tier-zero suppliers.

Implementation steps

1. Scope the inventory: list every high and medium impact BES Cyber System, EACMS and PACS, and the vendors, products and services behind each, including integrators and managed service providers. Plan ahead for PCAs and, from 2028, Shared Cyber Infrastructure.
2. Write the R1.1 assessment method: define the questions, evidence and scoring used to assess vendor risk at procurement and at vendor transition, with risk tiers driving depth (a questionnaire for low risk, documentation review and calls for high risk).
3. Build R1.2 into procurement: add standard RFP and contract language for each of the six topics, and a fallback for vendors who will not agree, such as compensating controls recorded in the assessment. R2 does not require that the vendor accepts your terms, but it does require that you followed your process.
4. Connect operations: route vendor incident notices into the CIP-008 process, vendor access notices into CIP-004 revocation, vulnerability disclosures into CIP-007 patch evaluation, integrity checks into CIP-010 R1.6 change control, and remote access into CIP-005 R2 and R3.
5. Pilot on live purchases: run the process on the next few procurements, collect evidence, and adjust templates before rolling out across business units.
6. Add reassessment now: Order 912 directs a maximum interval between assessment and installation and periodic reassessment of existing vendors. Adopting both early avoids a rebuild later; set a default such as reassessing when installation slips beyond a defined period and reviewing high risk vendors annually.
7. Track every identified risk: keep a register of risks found in assessments with the response chosen (accept, mitigate, transfer, avoid) and the owner, which anticipates the Order 912 response directive.
8. Approve and diarise R3: have the CIP Senior Manager or delegate sign the plan, and set reviews well inside 15 calendar months.

Evidence and assessment

The measures are short: M1 is the documented plan, M2 is evidence of implementation such as correspondence, policy documents or working documents showing the plan in use, and M3 is the dated plan approved by the CIP Senior Manager or delegate with evidence of review within 15 calendar months. Evidence must be kept for three calendar years, or until mitigation of a noncompliance is complete if longer.

• Sample by procurement: auditors typically pick procurements in the audit period and ask to see the R1.1 assessment and the R1.2 topics addressed for each, so index evidence by purchase order.
• Show the decision trail: keep vendor responses, your risk rating, compensating controls and who approved the purchase.
• Prove the operational links: a vendor incident notice and your response, a revoked vendor account with timestamps, a verified hash for a patch.

Metrics that show the programme works:

• Percentage of in-scope procurements with a completed R1.1 assessment before purchase.
• Median time from vendor access-termination notice to account revocation.
• Percentage of vendor software and patches with recorded integrity verification.
• Number of open supply chain risks past their target response date.
• Count of active vendor remote access accounts, human and system-to-system, against the approved list.
• Days since last R3 approval (alert well before 15 calendar months).

Mapping to other frameworks

For asset owners also using IEC 62443, CIP-013 aligns with the supplier requirements of the asset owner programme; see the IEC 62443-2-1 Asset Owner Security Programme Guide and the OT Product Procurement Guide.

What is changing

Order 912 declined to mandate validation of vendor-provided information and declined to extend scope to low impact assets, though FERC encouraged voluntary validation. It also did not require renegotiating existing contracts.

Common pitfalls

• A plan with no evidence of use: a well-written plan fails R2 if procurements in the audit period show no assessments.
• Missing EACMS and PACS purchases: firewalls, jump hosts, logging and badge systems were added by CIP-013-2 and are easy to leave out of procurement triggers.
• Ignoring system-to-system access: vendor monitoring connections and service accounts are covered by R1.2.6 but rarely on the vendor access list.
• Integrity checks against the same channel: downloading a hash from the same compromised portal as the software adds little; obtain hashes or signing certificates out of band.
• Late R3 review: reviews at month 16 or later create a violation; schedule at 12 months.
• Treating transitions as procurement only: R1.1 includes transitions between vendors, so exiting a vendor needs its own risk review of credentials, data and access left behind.

Practitioner checklist

• Inventory vendors, products and services for every high and medium impact BES Cyber System, EACMS and PACS.
• Document the R1.1 assessment method, including vendor transitions.
• Embed all six R1.2 topics in RFP and contract templates, with recorded applicability decisions.
• Link vendor access notices to CIP-004 revocation and measure time to revoke.
• List every vendor remote access path, including system-to-system service accounts and certificates.
• Verify integrity and authenticity of every vendor patch using out-of-band hashes or signatures.
• Keep a register of identified supply chain risks with owners and responses.
• Index evidence by procurement and retain it for three calendar years.
• Have the CIP Senior Manager approve the plan within 12 months of the last approval.
• Track CIP-013-3, Order 912 and Project 2025-06 and plan for PCAs and Shared Cyber Infrastructure.

Standards and references

• NERC: CIP-013-2 Cyber Security, Supply Chain Risk Management
• NERC: CIP-013-3 redline to last approved (Project 2016-02)
• FERC: Order No. 912, Supply Chain Risk Management Reliability Standards Revisions
• NERC: Standards and Compliance Bulletin, 1 June 2026
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: NERC CIP Guide · Third-Party Risk Management Guide · OT Third-Party and Integrator Access Guide · Software Supply Chain Security Guide. This guide summarises NERC CIP-013 and related FERC actions as published at the date above and is not legal advice.