Power grids, water systems, and energy pipelines are the most critical infrastructure on Earth. NERC CIP standards protect the Bulk Electric System from cyber threats that could cause cascading failures affecting millions of people.
The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are mandatory cybersecurity requirements for the Bulk Electric System (BES). Unlike most security frameworks, NERC CIP compliance is legally mandatory — violations can result in fines up to $1 million per violation per day. CIP standards apply to utilities, transmission owners, generation owners, and other BES operators in the US, Canada, and portions of Mexico.
BES Cyber Systems (BCS) are classified by impact on the reliability of the BES: High Impact — Control Centers managing the real-time operations of the interconnection. Most stringent requirements. Medium Impact — Transmission substations above 345 kV, large generating facilities. Significant requirements with some flexibilities. Low Impact — Smaller systems with limited impact. Baseline requirements only. The classification drives which CIP standards and requirements apply.
CIP-002 (Classification) → CIP-003 (Security Management Controls) → CIP-004 (Personnel and Training) → CIP-005 (Electronic Security Perimeters) → CIP-006 (Physical Security of BES Cyber Systems) → CIP-007 (Systems Security Management) → CIP-008 (Incident Reporting and Response) → CIP-009 (Recovery Plans) → CIP-010 (Configuration Change Management) → CIP-011 (Information Protection) → CIP-013 (Supply Chain Risk Management) → CIP-014 (Physical Security).
The ESP defines the logical border around BES Cyber Systems. All access into the ESP must be controlled and monitored:
All Electronic Access Points (EAPs) into the ESP must have access controls. No unmonitored inbound connections. Inbound and outbound traffic must be monitored. Interactive Remote Access requires multi-factor authentication.
Remote access to BES Cyber Systems requires: encrypted communication, MFA, intermediate system (jump server), monitoring, and session termination capabilities. One of the most challenging requirements for legacy OT environments.
Dial-up connections to High and Medium Impact BCS must meet ESP requirements. Legacy serial/dial-up connections are common in older substations and create significant compliance challenges.
Physical security perimeters around BCS must have monitored access with 24/7 video monitoring, visitor controls, and documented physical access logs. Physical and cyber security are tightly coupled in NERC CIP.
CIP-007 is one of the most technically demanding standards, covering operational security of BES Cyber Systems:
Disable all unnecessary ports and services. Document all enabled ports with business justification. This is the principle of least functionality applied to OT/ICS environments — challenging with legacy systems that may have undocumented services.
Evaluate and document applicability of security patches within 35 calendar days of release. Apply or document compensating mitigations. OT patch management is complex — patches must be tested in lab environments before production deployment to avoid operational disruptions.
Implement malicious code prevention tools (anti-malware). For systems where anti-malware cannot be deployed (legacy PLCs, RTUs), implement and document compensating mitigating controls (application whitelisting, network segmentation, read-only media).
Generate logs for security-relevant events. Retain logs for minimum 90 calendar days. Review logs for security events. CIP-007 log requirements drive significant SIEM and log management investment in utility environments.
Shared accounts are prohibited for High and Medium Impact BCS (same principle as SOX/HIPAA — individual accountability). Password and authentication requirements. Account management with quarterly reviews.
Added in response to nation-state supply chain attacks (SolarWinds-type threats to the grid), CIP-013 requires:
Utilities must develop and implement plans for managing cybersecurity risks in the supply chain. Plans must address vendor remote access, software integrity verification, and vendor notification of compromises.
Verify the integrity of software and firmware used in High and Medium Impact BCS. Compare vendor-supplied hashes against installed versions. Detect unauthorized modifications before deployment.
Utilities must have a process for vendors to notify them of cybersecurity incidents. Vendors supplying High and Medium Impact BCS components must be contractually required to disclose incidents affecting their products.
Vendor remote access to BCS must meet the same requirements as employee remote access (MFA, monitoring, intermediate systems). Vendor access must be individually authorized and monitored.
You are the CIP Compliance Officer for a regional transmission organisation (RTO) with a 500kV transmission substation. Complete each CIP compliance task — asset classification, access point inventory, patch exception documentation, and audit readiness preparation.