NERC CIP Reliability Standards (CIP-002 through CIP-015)

Issuing body / enforcer: North American Electric Reliability Corporation (NERC), subject to FERC approval and oversight; enforced by NERC and the eight Regional Entities (audit and penalty authority). Jurisdiction: United States and Canada — owners, operators, and users of the Bulk Electric System (BES); in Canada through provincial/memorandum arrangements.

1. What it is

The CIP (Critical Infrastructure Protection) standards are the mandatory cybersecurity rules for the North American power grid — the only broad mandatory OT-cybersecurity regime in the U.S. outside nuclear. They require registered entities (balancing authorities, transmission owners/operators, generator owners/operators, reliability coordinators, and others) to identify critical cyber assets and protect them across physical security, electronic perimeters, personnel, incident response, recovery, and supply chain. Unlike IEC 62443 (voluntary), CIP is law-backed: violations draw enforceable penalties.

2. Scope, triggers, thresholds

Applicability starts at CIP-002: entities categorize BES Cyber Systems by impact — high, medium, or low — based on bright-line criteria (control centers, generation/transmission facilities above thresholds). Everything else in CIP flows from the impact rating; low-impact systems carry a reduced requirement set (CIP-003).
The family (v6, currently in force):
- CIP-002 — BES Cyber System categorization; CIP-003 — security management controls (incl. low-impact);
- CIP-004 — personnel and training (background checks, access management);
- CIP-005 — electronic security perimeters, remote access (interactive remote access via intermediate systems);
- CIP-006 — physical security of BES Cyber Systems;
- CIP-007 — systems security management (ports/services baselines, patch management — 35-day patch evaluation cycle, malicious-code prevention, security-event monitoring);
- CIP-008 — incident reporting and response (reportable incidents to E-ISAC and DOE);
- CIP-009 — recovery plans; CIP-010 — configuration change management and vulnerability assessments;
- CIP-011 — information protection (BES Cyber System Information);
- CIP-012 — communications between control centers (confidentiality/integrity);
- CIP-013 — supply-chain risk management (vendor risk, procurement controls, vendor remote access);
- CIP-014 — physical security of critical transmission substations;
- CIP-015 — internal network security monitoring (INSM) for high- and medium-impact systems (newer addition).
Trigger: NERC registration as an applicable functional entity with BES assets — thresholds are defined in CIP-002's bright lines, not by company size.

3. Key requirements and compliance obligations

Categorize (CIP-002): documented methodology, reviewed and approved on schedule — miscategorization is one of the most penalized failures.
Perimeter and access (CIP-005/004/006): electronic security perimeters with deny-by-default access points, managed interactive remote access, personnel risk assessments, and physical access controls with logging.
System hardening and monitoring (CIP-007): baseline and disable unnecessary ports/services, evaluate patches within 35 days, deploy malicious-code defenses where technically feasible, and log/monitor security events with alerting.
Incident response (CIP-008): tested response plans and timely reporting — reportable cyber security incidents go to the E-ISAC and DOE (initial notification within 1 hour for the most serious category under current rules — [Flag: confirm the current CIP-008 reporting timelines; they were tightened in the v6 revisions]).
Change and vulnerability management (CIP-010): baseline configurations, authorized-change control, and active vulnerability assessments on a defined cadence (15 months for high/medium).
Supply chain (CIP-013): vendor risk assessments, procurement language, and controls on vendor remote access — the standard most entities find hardest to evidence.
Evidence culture: CIP audits run on RSAWs (Reliability Standard Audit Worksheets) — every requirement needs dated, retained evidence. "We do it but didn't document it" is a violation.

4. Penalties and consequences

FERC-authorized civil penalties up to approximately $1.5–1.6 million per violation per day (inflation-adjusted — [Flag: confirm the current inflation-adjusted figure; FERC adjusts annually and the number moves]). Penalties scale with duration, so a year-long recordkeeping gap multiplies fast.
Regional Entities issue Notices of Penalty; serious cases go to FERC. Beyond fines: mandated mitigation plans, increased audit scrutiny, and reputational damage in a sector where reliability is the license to operate.

5. Version status and live changes (verified 2026-09-30)

In force: the v6 family (CIP-002-5.1a through CIP-015 as applicable) — the baseline every registered entity is audited against today.
v7 virtualization revisions — balloted, awaiting FERC: NERC developed revised standards (CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7, CIP-007-7, CIP-008-7, CIP-009-7, CIP-010-5, CIP-011-4, CIP-013-3) to address virtualization, cloud, and implementation lessons learned (Project 2016-02). Industry balloting showed strong approval (generally 75–96% across standards); the package is in the FERC review/approval pipeline. [Flag: FERC approval timing has slipped before — do not build compliance programs on v7 until FERC issues its order; track the docket.]
CIP-013-4 (supply chain) in draft (May 2026 redline) addressing FERC Order 912 directives — supply-chain requirements are still being hardened.
INSM (CIP-015): internal network security monitoring is now an enforceable expectation for high/medium-impact environments — entities without east-west OT visibility should treat this as a funded program, not a roadmap item.

PE Control Systems (Controls/Automation flagship): the licensed professional credential for control-systems engineers; PEs in the power sector routinely own CIP compliance programs and sign off on the engineering judgments CIP audits probe.
ISA CAP (Controls/Automation flagship): relevant to the automation-system design and lifecycle practices CIP-007/CIP-010 assume.
CISSP (Computer flagship): for the governance, risk, and incident-response dimensions (CIP-008/009).
Vendor/utility-specific CIP training is the norm; there is no single "CIP engineer" certification in the catalogue.

7. Practical notes

CIP-002 categorization errors are the highest-leverage risk: under-scoping excludes systems from protection (a reliability and penalty risk); over-scoping drowns the program in evidence burden. Get an independent review of the categorization.
CIP-013 (supply chain) is where audits hurt most: start vendor-risk documentation and procurement-language updates now — evidence must predate the audit window.
Track the v7 FERC docket quarterly; the virtualization changes will re-scope cloud-hosted and virtualized BES Cyber Systems materially.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

NERC CIP Reliability Standards (CIP-002 through CIP-015)