Meet NERC CIP with every piece of evidence in place
Categorise your BES Cyber Systems, apply the CIP standards that cover them and walk into your audit with the evidence ready.
What NERC CIP is and what you'll be asked for
NERC CIP is the set of mandatory cyber security standards for the North American power grid. They are issued by NERC and, in the United States, overseen by FERC. If you own, operate or maintain assets on the Bulk Electric System, you have to show that you comply.
It all starts with knowing what you have. Under CIP-002 you identify your BES Cyber Systems and assign each one an impact rating. That rating drives the requirements of every other standard, and at audit time you will be asked for evidence against each of them.
- Issued by
- NERC, with FERC oversight in the United States
- Standards
- CIP-002 to CIP-014
- Applies to
- Owners and operators of the Bulk Electric System
- Foundation
- Impact rating of BES Cyber Systems
- Oversight
- Periodic audits by the Regional Entity
1
Inventory and rating
You identify your BES Cyber Systems and rate their impact, as CIP-002 requires.
2
Controls
You apply each CIP standard's requirements according to every system's impact rating.
3
Evidence
You keep a continuous record of access reviews, patches, changes and training.
4
Audit
The Regional Entity reviews your evidence. A violation can lead to penalties.
The three impact ratings
High
High impact
Mainly large control centres. They carry the broadest set of requirements.
Medium
Medium impact
Substations, control centres and generation facilities above certain thresholds.
Low
Low impact
All other BES assets. Their requirements are lighter and sit mostly in CIP-003.
CIP standards:
CIP-002 BES Cyber System Categorization
CIP-003 Security Management Controls
CIP-004 Personnel & Training
CIP-005 Electronic Security Perimeter
CIP-006 Physical Security
CIP-007 Systems Security Management
CIP-008 Incident Reporting and Response
CIP-009 Recovery Plans
CIP-010 Configuration Change Management
CIP-011 Information Protection
CIP-013 Supply Chain Risk Management
CIP-014 Physical Security of Transmission
Get ready for NERC CIP in GlobalSuite®
From inventory to audit in one place, with every requirement linked to its owner and its evidence.
Compliance›NERC CIP›BES inventory
BES Cyber Systems38 systems · 12 substations · 2 control centres
CodeSystemImpactStatus
BCS-01
Primary control centre EMS
Transmission network management
HighReviewedBCS-07
North substation protection
Relays and bay controller
MediumReviewedBCS-12
Combined-cycle plant SCADA
Generation control
MediumPendingBCS-21
Las Lomas substation RTU
Telecontrol
LowReviewedCompliance›NERC CIP›Requirements
61
Met
11
Partial
4
No evidence
StandardRequirementCompliance%
CIP-004Quarterly access review100
CIP-005Electronic Access Points92
CIP-007Security patch evaluation70
CIP-010Baseline configuration85
CIP-013Supply chain cyber security risk management plan55
Compliance›NERC CIP›Recurring tasks
Recurring tasksNext 30 days · 9 tasks
TaskOwnerDueStatus
Quarterly access reviewMRM. Ruiz30 SepClosed
Security patch evaluationJNJ. Navarro14 OctIn progress
Recovery plan testASA. Soto22 OctOpen
Staff cyber security trainingLPL. Prieto31 OctIn progress
Compliance›NERC CIP›Evidence
Audit evidenceOrganised by standard and requirement
EvidenceStatusReviewed
Approved BES Cyber System list (CIP-002)Currenttoday
Physical access log (CIP-006)Up to date2 d
Patch evaluation report (CIP-007)Pending1 wk
Tested incident response plan (CIP-008)Filed3 wk
No deadline slips through
Recurring tasks, like the quarterly access review or the 35-day patch evaluation, are created automatically with an owner and a reminder.
Supply chain included
CIP-013 asks you to manage vendor risk. You assess vendors with questionnaires from the third-party risk module.
One control, many frameworks
The work you already do for ISO 27001 or NIS2 carries over to the equivalent CIP requirements, with no duplicate evidence.
NERC CIP fits with what you already do
NERC CIP
BES inventory, requirements by standard, recurring tasks and audit evidence.
You are hereCritical infrastructure
Critical infrastructure protection for energy sector operators in Spain.
See solution →NIS2
The EU cyber security directive, which covers the energy sector.
See solution →ISO 27001
The security management system that shares many controls with CIP.
See solution →
NERC CIP: frequently asked questions
What is NERC CIP?
NERC's Critical Infrastructure Protection standards. They set the cyber security and physical security requirements for anyone operating the interconnected North American power grid.
Who does it apply to?
Registered owners and operators of the Bulk Electric System: generation, transmission and distribution companies, balancing authorities and control centres, among others. Which requirements apply to you depends on the impact rating of your systems.
What is a BES Cyber System?
A group of cyber assets that, if they fail or are compromised, could affect the reliable operation of the power grid. CIP-002 requires you to identify them and rate them as high, medium or low impact.
What happens if I don't comply?
Regional Entities audit compliance, and violations can lead to significant financial penalties as well as mandatory mitigation plans.
Does my ISO 27001 work count?
Partly, yes. Many ISO 27001 controls cover similar CIP requirements, such as access management or incident response. But NERC CIP has its own very specific requirements, so each standard needs a proper review.
Where do I start?
With the inventory and impact rating of your BES Cyber Systems. From there you know which requirements apply. There's more detail in our NERC CIP guide.
Your NERC CIP,
always audit-ready.
See your BES assets and their evidence in GlobalSuite®.