What is NERC CIP?
Before we delve into the depths of NERC CIP, let’s break down what these acronyms mean. NERC stands for North American Electric Reliability Corporation, a regulatory authority that develops and enforces reliability standards for the Bulk Electric System (BES). On the other hand, CIP refers to the Cyber Information Protection program, which outlines the requirements for securing assets used in maintaining the BES. NERC CIP operates across the continental United States, eight provinces in Canada, and one state in Mexico.
NERC CIP standards are the backbone of our power grid’s cybersecurity. They establish a baseline for security measures, procedures, and controls that utilities and other organizations must adhere to, protecting critical cyber assets from potential threats and attacks. Understanding these foundational elements is crucial as we explore how NERC CIP standards play a vital role in ensuring the security and reliability of our electric infrastructure.
12 NERC CIP Requirements
Let’s look at the 12 fundamental requirements of NERC CIP. These requirements cover many areas, from identifying and categorizing BES Cyber Systems (CIP-002-5.1a) to managing electronic access to these systems (CIP-005-7). They form the pillars of our cybersecurity posture, ensuring the integrity and reliability of our power grid.
- CIP-002-5.1a – Cyber Security – Critical Cyber Asset Identification
- Purpose: To identify and categorize BES Cyber Systems and their associated BES Cyber Assets. This ensures the appropriate application of cyber security requirements.
- CIP-003-8 – Cyber Security – Security Management Controls
- Purpose: To specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems against compromise.
- NOTE: Version 9 of this standard has been approved and has an effective date of April 1, 2026.
- CIP-004-6 – Cyber Security – Personnel and Training
- Purpose: To focus on ensuring that personnel with access to critical cyber assets are appropriately trained and qualified to perform their duties securely.
- CIP-005-7 – Cyber Security – Electronic Security Perimeter(s)
- Purpose: To manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security Perimeter to protect critical cyber assets from unauthorized access.
- CIP-006-6 – Cyber Security – Physical Security of Critical Cyber Assets
- Purpose: To manage physical access to Bulk Electric System (BES) Cyber Systems by specifying a physical security plan.
- CIP-007-6 – Cyber Security – Systems Security Management
- Purpose: To establish and maintain system security management controls to protect against malware, unauthorized software, and security vulnerabilities.
- CIP-008-6 – Cyber Security – Incident Reporting and Response Planning
- Purpose: To show that organizations have a defined Incident Response Plan to ensure reliable operation of the BES.
- CIP-009-6 – Cyber Security – Recovery Plans for Critical Cyber Assets
- Purpose: To show that organizations have a defined Business Continuity and Recovery Plan in the event of a cybersecurity incident to ensure reliable operation of the BES.
- CIP-010-4 – Cyber Security – Configuration Change Management and Vulnerability Assessments
- Purpose: To establish and define a change management process for configuration changes to critical cyber assets and vulnerability assessment requirements.
- CIP-011-3 – Cyber Security – Information Protection
- Purpose: Specifying information protection requirements to protect BES Systems that could lead to instability of the BES.
- CIP-012-1 – Cyber Security – Communications between Control Centers
- Purpose: To protect the confidentiality and integrity of Real-time Assessment and Real-time monitoring data transmitted between Control Centers.
- NOTE: An updated version has been submitted for regulatory approval.
- CIP-013-2 – Cyber Security – Supply Chain Risk Management
- Purpose: To mitigate cyber security risks to the reliable operation of the Bulk Electric System (BES) by implementing security controls for supply chain risk management of BES Cyber Systems.
A complete list of the standards, plus all the archived inactive versions, can be found here:
Reliability Standards (nerc.com)
NERC CIP 3 Tier Assets
It is important to remember that NERC CIP is not a one-size-fits-all program. A printer in a corporate office will not be held to the exact stringent requirements as a control board on a wind turbine. In conjunction with the reliability standards, NERC CIP has defined Three (3) tiers of assets. These are Low Security Assets, Medium Security Assets, and High Security Assets. (Impact Rating Criteria for cyber assets is defined within Attachment 1 (Page 14) of the CIP-002-5.1a BES Cyber System Configuration Standard.)
- Low-Security Assets
- Low-security assets are those that, if compromised, would have the most negligible impact on the reliable operation of the BES.
- Typically, do not directly affect the reliability or operation of the BES.
- Examples: Administrative systems, non-critical IT infrastructure, or non-essential facilities.
- Medium Security Assets
- Medium security assets are considered to have a moderate impact on the reliable operation of the bulk electric system if compromised.
- Compromise could lead to disruptions or impact the availability of certain services.
- Examples: Substation control systems, communications networks, or regional control centers.
- High Security Assets:
- High-security assets are the most critical components of the bulk electric system, and their compromise could result in significant disruptions or failures.
- Protection of these assets is of utmost importance to ensure the reliability and security of the electric grid.
- Examples: Primary control centers, major generation facilities, critical substations, or key transmission lines.
Overall, NERC CIP standards play a crucial role in enhancing the cybersecurity posture of the North American Bulk Electric System. The BES’s reliable operation depends on these standards, which help reduce the risk of cyberattacks. Organizations subject to NERC CIP must implement and comply with these requirements.
Power Grid Cybersecurity from PSM Partners
Seeking to enhance your company’s cybersecurity and incident response capabilities in accordance with NERC CIP standards? Our expert team specializes in Power Grid Cybersecurity, ensuring full compliance with NERC CIP requirements while fortifying defenses against evolving threats specific to the energy sector. Safeguard your critical assets and uphold the reliability of your operations with tailored solutions from PSM Partners. Contact us today to learn more about how we can support your cybersecurity journey.