Originating from the US Energy Policy Act 2005, NERC-CIP provides guidelines, requirements, and procedures to ensure the reliability and security of the bulk power system. It addresses cyber-attack risks, system protection, and vulnerability management. The standards aim to secure confidential information and system integrity, and the software platform includes features and tools to help organizations comply with NERC-CIP security requirements.
On this page:
NERC-CIP Requirements References
NERC Standards CIP-002 through CIP-009 provide a cybersecurity framework for identifying and protecting Critical Cyber Assets to support the reliable operation of the Bulk Electric System. There are eight different CIP standards, each defining specific requirements:
NERC-CIP Standard | Requirement | Description |
CIP-002-1: Critical Cyber Asset IdentificationRequires identifying and documenting Critical Cyber Assets essential for the Bulk Electric System's operation. | R1. Critical Asset Identification Method | Develop and document a methodology based on risk assessment to identify Critical Assets. |
R2. Critical Asset Identification | Create and annually update a list of Critical Assets, derived using the risk assessment method from R1, with regular reviews and necessary updates. | |
R3. Critical Cyber Asset Identification | Based on the Critical Assets list from R2, compile a list of Critical Cyber Assets for the functioning of each Critical Asset. | |
CIP-003-1: Security Management ControlsRequires Responsible Entities to implement security controls to protect Critical Cyber Assets. | R1. Cyber Security Policy | Create and enforce a cyber security policy that reflects the organization's commitment to securing Critical Cyber Assets. |
R2. Leadership | Appoint a senior manager to oversee and ensure compliance with Standards CIP-002 to CIP-009. | |
R3. Exceptions | Record any deviations from the cyber security policy as exceptions, with authorization from a senior manager or their delegate. | |
R4. Information Protection | Establish a program to identify, categorize, and safeguard information linked to Critical Cyber Assets. | |
R5. Access Control | Develop and implement a program to control access to information associated with Critical Cyber Assets. | |
R6. Change Control and Configuration Management | Set up and document a process for change control and configuration management, addressing all changes to hardware and software of Critical Cyber Assets, in line with the established change control procedures. | |
CIP-004-1: Personnel and TrainingRequires personnel with access to Critical Cyber Assets, including contractors, to undergo risk assessment, training, and security awareness. | R1. Awareness | Develop, document, and maintain a program to continually enhance the security awareness of personnel with authorized access to Critical Cyber Assets. |
R2. Training | Implement and document an annual training program on cyber security for staff with authorized access to Critical Cyber Assets, reviewing and updating it as needed. | |
R3. Personnel Risk Assessment | Maintain a documented program to assess the risk posed by personnel with authorized access, in compliance with relevant legal and union agreements. | |
R4. Access | Keep updated lists of individuals with authorized access to Critical Cyber Assets, including details of their specific electronic and physical access privileges. | |
CIP-005-1: Electronic Security PerimeterRequires protecting Electronic Security Perimeters and their access points where Critical Cyber Assets are located. | R1. Electronic Security Perimeter | The Responsible Entity shall ensure that every Critical Cyber Asset resides within an Electronic Security Perimeter. |
R2. Electronic Access Controls | The Responsible Entity shall implement and document the organizational processes and technical and procedural mechanisms for control of electronic access at all electronic access points to the Electronic Security Perimeter(s). | |
R3. Monitoring Electronic Access | The Responsible Entity shall implement and document an electronic or manual process(es) for monitoring and logging access at access points to the Electronic Security Perimeter(s) twenty-four hours a day, seven days a week. | |
R4. Cyber Vulnerability Assessment | The Responsible Entity shall perform a cyber vulnerability assessment of the electronic access points to the Electronic Security Perimeter(s) at least annually. | |
R5. Documentation Review and Maintenance | The Responsible Entity shall review, update, and maintain all documentation to support compliance with the requirements of Standard CIP-005. | |
CIP-006-1: Physical Security of Critical Cyber AssetsRequires establishing a physical security program for Critical Cyber Assets. | R1. Physical Security Plan | Create and regularly update a physical security plan, ensuring senior management approval and addressing key security aspects. |
R2. Physical Access Controls | Document and enforce operational controls to manage physical access at every entry point to secure areas, ensuring 24/7 operation. | |
R3. Monitoring Physical Access | Monitor all access points to secure areas round the clock, promptly reviewing and managing any unauthorized access attempts. | |
R4. Logging Physical Access | Log every instance of physical access, including unauthorized attempts, and monitor them consistently, following specified breach protocols. | |
R5. Access Log Retention | Retain all physical access logs for at least 90 days, and preserve logs concerning major incidents as per Standard CIP-008 requirements. | |
R6. Maintenance and Testing | Conduct regular maintenance and testing of all physical security systems, especially those related to access control, monitoring, and logging, to ensure their functionality. | |
CIP-007-1: Systems Security ManagementRequires defining security procedures for Critical and non-critical Cyber Assets within Electronic Security Perimeters. | R1. Test Procedures | Ensure new and modified Cyber Assets within the Electronic Security Perimeter don't compromise existing cybersecurity controls. |
R2. Ports and Services | Develop and maintain a process to enable only essential ports and services for normal and emergency operations. | |
R3. Security Patch Management | Establish a program for managing cybersecurity software patches, covering tracking, evaluating, testing, and installing patches for all Cyber Assets. | |
R4. Malicious Software Prevention | Implement anti-virus and malware prevention tools to protect all Cyber Assets within the Electronic Security Perimeter, where possible. | |
R5. Account Management | Set up technical and procedural controls for user access authentication and accountability, minimizing unauthorized access risks. | |
R6. Security Status Monitoring | Utilize automated tools or organizational processes to monitor cybersecurity-related system events for all Cyber Assets. | |
R7. Disposal or Redeployment | Define formal methods for the disposal or redeployment of Cyber Assets within the Electronic Security Perimeter, as per CIP-005 standards. | |
R8. Cyber Vulnerability Assessment | Conduct an annual cyber vulnerability assessment for all Cyber Assets within the Electronic Security Perimeter. | |
R9. Documentation Review and Maintenance | Regularly review and update cybersecurity documentation annually, documenting any system or control modifications within 90 days. | |
CIP-008-1: Incident Reporting and Response PlanningRequires managing Cyber Security Incidents involving Critical Cyber Assets, including identification, classification, response, and reporting. | R1. Cyber Security Incident Response Plan | Create and regularly update a plan to respond to cyber security incidents, ensuring it covers essential response strategies and procedures. |
R2. Cyber Security Incident Documentation | Maintain detailed records of all cyber security incidents for a period of three years. | |
CIP-009-1: Recovery Plans for Critical Cyber AssetsRequires recovery plans for Critical Cyber Assets aligned with business continuity and disaster recovery practices. | R1. Recovery Plans | Develop and conduct annual reviews of recovery plans for Critical Cyber Assets, ensuring they address key recovery strategies. |
R2. Exercises | Perform at least one exercise each year to test the recovery plans, ranging from simple drills to full operational tests or actual incident recoveries. | |
R3. Change Control | Revise recovery plans to reflect any new changes or insights gained from exercises or actual incident recoveries, and communicate these updates to relevant personnel within 90 days. | |
R4. Backup and Restore | Ensure recovery plans contain detailed processes for backing up and storing information critical for restoring Critical Cyber Assets, including spare parts, configuration settings, and tape backups. | |
R5. Testing Backup Media | Annually test backup media containing essential recovery information to verify its availability and effectiveness, with the option to perform tests offsite. |
NERC-CIP Measures References
NERC Standard | Measures |
CIP-002-1 | Document the risk-based assessment methodology, compile and maintain a list of Critical Assets, create a list of Critical Cyber Assets, and keep records of annual approvals for Standard CIP-002-1 compliance. Regular updates to this documentation ensure adherence to the standard. |
CIP-003-1 | Document the cyber security policy, assign and record leadership roles, detail exceptions to the cyber security policy, implement and document an information protection program, manage and record access control processes, and maintain change control and configuration management documentation for Standard CIP-003-1 compliance. |
CIP-004-1 | Maintain documentation of security awareness programs, keep records of cyber security training programs, document personnel risk assessment procedures, and update lists of personnel with authorized access for Standard CIP-004-1 compliance. |
CIP-005-1 | Document Electronic Security Perimeters, implement and record electronic access controls, monitor and log electronic access, conduct and document annual vulnerability assessments, and maintain access logs for Standard CIP-005-1 compliance. |
CIP-006-1 | Document the physical security plan, control physical access methods, monitor and log physical access, retain access logs, and maintain documentation for physical security measure testing for Standard CIP-006-1 compliance. |
CIP-007-1 | Document security test procedures, record port and service management, maintain a security patch management program, document malware prevention efforts, manage user accounts, monitor security status, and handle disposal or redeployment of Cyber Assets for Standard CIP-007-1 compliance. |
CIP-008-1 | Maintain a Cyber Security Incident response plan and document the plan's reviews, updates, and testing processes for Standard CIP-008-1 compliance. Regular management of this plan is key to preparedness and effective response to cyber security incidents. |
CIP-009-1 | Document recovery plans, record recovery exercises, update and document changes to recovery plans, document backup and storage processes, and test and document backup media for Standard CIP-009-1 compliance. |
Native Security Support
The platform offers native features, advanced tools, and support for third-party integration, which helps to implement NERC-CIP security requirements.
NERC-CIP Standard Reference | Requirements | Native security support |
---|---|---|
CIP-003 CIP-004 CIP-005 CIP-006 CIP-007 | Access Control Access Electronic Access Controls Monitoring Electronic Access Account Management Security Status Monitoring | User Administration features; User rights are revocable by the Administrator or through Microsoft Active Directory; Internal control and assignment of permissions (Displays, Alarms, Scripts) Electronic Signatures (E-Sign); Native features for solution management like Runtime Users and Policy Orchestrator. Integration with Microsoft Active Directory
|
CIP-003 CIP-007 | Electronic Security Perimeter Ports and Services | Port data paths configurable; |
CIP-003 CIP-005 CIP-006 CIP-007 CIP-008 | Change Control and Configuration Management | Native Tracking and Event Monitoring; Native Audit Trail Database; Custom Log Entries; Native tool for versioning solution; |
CIP-005 CIP-007 CIP-008 | Alerts and Notifications | Send notifications using different methods and ways: SMS, Email, SNMP, WebServices, other protocol messages, etc. |
CIP-009 | Backup and Restore | Auto-Native feature for Auto-Backup; |
In this section: