Laws and regulations
NERC CIP standards
Mandatory cybersecurity standards for the North American bulk electric system.
Official source Published by North American Electric Reliability Corporation. Summaries in our own words.
What it is
The NERC Critical Infrastructure Protection (CIP) standards are mandatory reliability standards that set cybersecurity and physical security requirements for the systems that operate the North American bulk electric system. They are developed by the North American Electric Reliability Corporation and approved by the US Federal Energy Regulatory Commission and Canadian authorities. They exist because the compromise of control systems and control centres could disrupt the electricity grid across large regions.
Who it applies to
- Registered entities in the bulk electric system, such as balancing authorities, reliability coordinators, transmission owners and operators, generator owners and operators, and certain distribution providers
- Applies in the United States, in Canadian provinces that have adopted the standards, and in the part of Mexico connected to the North American grid
- Requirements scale with the impact rating of each BES Cyber System: high, medium or low
- Vendors and integrators supplying systems to these entities are affected through supply chain risk management requirements in contracts and procurement
- Status
- Mandatory and enforceable standards in the United States since FERC approved the first version in 2008, with regular revisions since then. Each standard carries its own version number and effective date, so the current set is whatever is in force on the NERC reliability standards list.
- Enforcement
- NERC and its Regional Entities monitor compliance through audits, spot checks and self-reports, under FERC oversight in the US and provincial regulators in Canada. Violations can lead to penalties of over one million US dollars per violation per day (the amount is adjusted for inflation), along with mitigation plans.
Key points
- Everything starts with CIP-002: the impact categorisation of your assets determines which requirements apply
- Compliance is evidence-driven: auditors expect documented processes and records showing each requirement was performed on time
- Many requirements have fixed periodic intervals, such as patch evaluation, access reviews and testing of response and recovery plans
- Electronic access to high and medium impact systems must pass through defined perimeters, with controls on interactive remote access
- Reportable cyber security incidents and attempts to compromise must be reported to the E-ISAC and, in the US, to CISA
- Supply chain risk management (CIP-013) requires plans covering vendor risk in procurement, including notification of vendor incidents and software integrity
Where to start
- 1Confirm your NERC registration functions and complete or review the CIP-002 categorisation of your assets
- 2Map applicable requirements per impact level and identify the evidence you need to produce for each
- 3Check the effective dates of current and upcoming standard versions so your programme tracks changes
How it is structured
| CIP-002 | Identification and categorisation of BES Cyber Systems by impact |
|---|---|
| CIP-003 | Security management controls and policies, including requirements for low impact assets |
| CIP-004 | Personnel and training, background checks and access management |
| CIP-005 and CIP-006 | Electronic security perimeters and remote access, physical security of BES Cyber Systems |
| CIP-007 | System security management: ports and services, patching, malware prevention, logging, account management |
| CIP-008 and CIP-009 | Incident reporting and response planning, recovery plans |
| CIP-010 and CIP-011 | Configuration change management and vulnerability assessments, information protection |
| CIP-012, CIP-013 and CIP-014 | Communications between control centres, supply chain risk management, physical security of key transmission stations and substations |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (3)
In the order of the framework itself.