Skip to main content
> NERC CIP

North American Electric Reliability Corporation Critical Infrastructure Protection

Mandatory cybersecurity standards protecting the North American power grid

Governing Body: North American Electric Reliability Corporation (NERC) / FERC
Established: 2008 (mandatory) Last Updated: 2026 (FERC Order 919 virtualization; CIP-015 INSM) Scope: North American Bulk Electric System
$1.58M
Max Daily Penalty

What are the current NERC CIP requirements?

NERC CIP sets mandatory cybersecurity standards for entities operating the North American bulk electric system, enforced by FERC with penalties up to $1 million per violation per day. The framework runs from CIP-002 (asset categorization) through CIP-014 (physical security), with controls scaled to each facility's High, Medium, or Low impact rating. Two major additions are now in effect. CIP-015-1, approved by FERC Order 907 (Federal Register July 2, 2025; Doc 2025-12309), requires Internal Network Security Monitoring (INSM) for applicable Control Centers by October 1, 2028 and other medium impact systems with External Routable Connectivity by October 1, 2030. FERC Order 919 (Federal Register March 24, 2026; Doc 2026-05716) approved 11 updated CIP standards (CIP-002-7 through CIP-013-3) covering virtualized environments, effective May 26, 2026, with mandatory compliance by July 1, 2028.

// What is NERC CIP?

NERC CIP standards are mandatory cybersecurity requirements for entities operating the North American bulk electric system. Unlike voluntary frameworks, CIP compliance is legally required, enforced by NERC under authority delegated by the Federal Energy Regulatory Commission (FERC) in the US and equivalent authorities in Canada.

The standards apply to Bulk Electric System (BES) Cyber Systems based on impact ratings (High, Medium, Low) that determine the rigor of required controls. High and Medium impact systems face the most stringent requirements, including personnel training, physical security, and layered access controls.

CIP standards have expanded significantly in 2025 and 2026. CIP-015-1, covering Internal Network Security Monitoring (INSM), was approved by FERC Order 907 (Federal Register July 2, 2025; Doc 2025-12309). Control Centers and backup Control Centers must comply by October 1, 2028; other medium impact systems with External Routable Connectivity by October 1, 2030. FERC Order 919 (Federal Register March 24, 2026; Doc 2026-05716) approved 11 updated CIP standards (CIP-002-7 through CIP-013-3) plus four new glossary terms addressing virtualization. Order 919 standards take effect May 26, 2026, with mandatory compliance by July 1, 2028.

// Inside NERC CIP

NERC CIP comprises multiple standards (CIP-002 through CIP-015), each addressing specific security domains. Entities must comply with requirements based on their BES Cyber System impact categorization.

1

BES Cyber System Categorization

CIP-002-5.1a

The foundation of CIP compliance: categorizing systems based on their impact on reliable grid operation.

High Impact Rating

Control centers controlling 3,000 MW+ generation or operating the integrity of interconnections. Most stringent requirements apply.

Medium Impact Rating

Transmission stations 500kV+, generation resources 1,500 MW+, and control centers not meeting High criteria.

Low Impact Rating

BES Cyber Systems not meeting High or Medium criteria. Reduced but still mandatory requirements.

BES Cyber Asset Identification

Identify all Cyber Assets essential to reliable operation of categorized BES Cyber Systems.

2

Security Management Controls

CIP-003-8 through CIP-006-6

Foundational security management, personnel, and physical security requirements.

Security Management Controls (CIP-003)

Documented cybersecurity policies, assign security responsibility, and establish security awareness programs.

Personnel and Training (CIP-004)

Personnel risk assessment, cybersecurity training, and access management. Background checks for personnel with cyber or physical access.

Electronic Security Perimeter (CIP-005)

Define Electronic Security Perimeters, control access points, monitor unauthorized access, and manage remote access securely.

Physical Security (CIP-006)

Physical Security Plans for locations housing High/Medium impact BES Cyber Systems including access controls and monitoring.

3

Systems Security Management

CIP-007-6 through CIP-010-4

Technical controls for system hardening, incident response, recovery, and configuration management.

System Security Management (CIP-007)

Ports and services management, security patch management, malicious code prevention, security event monitoring.

Incident Reporting and Response (CIP-008)

Cyber Security Incident response plan, testing, and reporting requirements. Incidents reported to E-ISAC within timeframes.

Recovery Plans (CIP-009)

Recovery plans for BES Cyber Systems, backup/recovery procedures, and annual testing of recovery plans.

Configuration and Vulnerability (CIP-010)

Baseline configurations, configuration change management, and vulnerability assessments at least once every 15 calendar months, plus an active vulnerability assessment every 36 calendar months for High impact systems.

4

Supply Chain, Physical Security, and Emerging Standards

CIP-013-3, CIP-014-3, CIP-015-1

Standards addressing supply chain risk, physical security, internal network monitoring, and virtualization (Order 919).

Supply Chain Risk Management (CIP-013)

Develop plans addressing supply chain risks for High/Medium impact BES Cyber Systems. CIP-013-3 (Order 919) effective May 26, 2026; mandatory July 1, 2028.

Physical Security (CIP-014)

Risk assessment and security plans for transmission stations and control centers critical to grid reliability.

Internal Network Security Monitoring (CIP-015-1)

FERC Order 907 (Federal Register July 2, 2025; Doc 2025-12309) approved CIP-015-1 requiring INSM for applicable BES Cyber Systems. Control Centers and backup Control Centers must comply by October 1, 2028; other medium impact systems with External Routable Connectivity by October 1, 2030.

Virtualization Package (Order 919)

FERC Order 919 (Federal Register March 24, 2026; Doc 2026-05716) approved 11 updated CIP standards (CIP-002-7 through CIP-013-3) and four new glossary terms covering virtualized environments. Standards effective May 26, 2026; mandatory compliance July 1, 2028.

Note: CIP compliance is verified through NERC Regional Entity audits. Self-reports and periodic data submittals are required. The CIP enforcement process includes compliance monitoring, violation investigation, and penalty determination with FERC oversight.

// Who Must Comply

  • 1 Balancing Authorities managing electric grid balance
  • 2 Generation Owners and Operators above thresholds
  • 3 Transmission Owners and Operators
  • 4 Reliability Coordinators
  • 5 Distribution Providers with certain facilities
  • 6 Regional Transmission Organizations and Independent System Operators

// Key Requirements

Asset Categorization

Identify and categorize all BES Cyber Systems by impact rating (High, Medium, Low)

Electronic Security Perimeter

Define and protect electronic access points to BES Cyber Systems

Personnel Training

Conduct cybersecurity training and background checks for personnel with access

Configuration Management

Maintain baseline configurations and manage changes through documented processes

Incident Response

Maintain and test incident response plans with required reporting to E-ISAC

Recovery Planning

Develop, maintain, and annually test recovery plans for BES Cyber Systems

// Enforcement & Penalties

NERC CIP violations carry civil penalties assessed per violation per day. FERC's January 2025 inflation adjustment sets the ceiling under Section 316A of the Federal Power Act at $1,584,648 per violation per day, up from $1,544,521. Actual penalties land well below the ceiling and scale with risk to grid reliability, duration, and compliance history.

Maximum Penalty

$1,584,648 per violation, per day

Examples:

  • Duke Energy - $10 million penalty for 127 violations across CIP standards (2019)
  • Unidentified entity - $2.7 million for electronic access control violations (2018)
  • Pacific Gas & Electric - $2.7 million for physical and electronic security violations (2017)
  • Multiple entities - Penalties for supply chain security and access management failures

// Cyber Insurance Impact

Cyber insurers for critical infrastructure operators require evidence of CIP compliance. Given the mandatory nature and significant penalties, coverage often depends on demonstrated compliance status. Policies may include specific exclusions for penalties arising from willful CIP violations.

// How Breach Craft Helps

We help organizations achieve NERC CIP compliance through genuine security improvements, not checkbox exercises. Our services address the specific requirements and challenges of NERC CIP.

Gap Assessment

Measure your security against industry standards.

Learn more

Penetration Testing

Find the gaps before attackers do.

Learn more

Virtual CISO

Executive security leadership on demand.

Learn more

Tabletop Exercises

Practice your incident response.

Learn more

// Common Questions

Who has to comply with NERC CIP?
NERC CIP binds users, owners, and operators of the North American Bulk Electric System that are registered with NERC: Balancing Authorities, Reliability Coordinators, Transmission Owners and Operators, Generator Owners and Operators, and Distribution Providers that own specified BES protection or restoration facilities. Compliance is mandatory, and Regional Entities audit it under authority FERC delegates to NERC. Canadian provinces adopt the standards through their own regulators. What you owe follows your NERC functional registration and the impact rating of your BES Cyber Systems rather than your headcount or revenue, so a single-plant generator operator can carry real CIP obligations. We work with utility and energy operators across that range.

How do CIP-002 impact ratings decide what applies to us?
CIP-002 requires you to identify your BES Cyber Systems and rate each one high, medium, or low impact, and that rating sets the scope of every other standard. High impact is effectively the large Control Centers performing Reliability Coordinator, Balancing Authority, Transmission Operator, and Generator Operator functions above defined thresholds. Medium impact covers Transmission Facilities at 500 kV and above, larger generation resources, and Control Centers that miss the high criteria. Everything else at a BES asset is low impact, which still carries mandatory requirements through CIP-003. Categorization errors propagate into findings on every standard downstream, so a gap assessment is worth running before an audit. Operators with heavy OT estates often pair CIP with IEC 62443.

What is CIP-015 and when do we have to comply?
CIP-015-1 requires Internal Network Security Monitoring. You need documented processes that implement network data feeds inside the Electronic Security Perimeter of high impact BES Cyber Systems and medium impact systems with External Routable Connectivity, then detect anomalous network activity, evaluate it, and retain the data until the response is complete. FERC approved the standard in Order No. 907, issued June 26, 2025 and effective September 2, 2025. NERC's implementation plan makes the standard effective the first day of the first calendar quarter 36 months later, October 1, 2028, which is the compliance date for Control Centers and backup Control Centers. Other medium impact systems with External Routable Connectivity get 24 more months, to October 1, 2030.

What changed in NERC CIP in 2026?
FERC issued two orders on March 19, 2026, both effective May 26, 2026. Order No. 919 approved 11 revised CIP standards (CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1, and CIP-013-3) plus four new glossary terms: Cyber System, Management Interface, Shared Cyber Infrastructure, and Virtual Cyber Asset. Together they let registered entities run virtualized and shared infrastructure inside the CIP environment under defined controls, with mandatory compliance on July 1, 2028. Order No. 918 approved CIP-003-11, which adds baseline controls for low impact BES Cyber Systems: remote user authentication, protection of authentication credentials in transit, and detection of malicious communications. NERC's board also adopted CIP-015-2 in June 2026 to extend internal network monitoring to EACMS and PACS outside the perimeter, and that standard is pending at FERC.

Does NERC CIP require penetration testing?
CIP never uses that term. CIP-010 Requirement R3 is where technical testing lands. It requires a paper or active vulnerability assessment at least once every 15 calendar months for high and medium impact BES Cyber Systems and their associated EACMS, PACS, and Protected Cyber Assets, plus an active vulnerability assessment at least once every 36 calendar months for high impact systems, run in a test environment that models the production baseline or in production where that can be done without adverse effects. New Cyber Assets get an active assessment before they reach production. Most entities satisfy the 36-month requirement with hands-on testing, which is how we scope penetration testing and vulnerability assessment work for BES environments.

What are the penalties for a NERC CIP violation?
FERC can assess up to **$1,584,648 per violation, per day** under Section 316A of the Federal Power Act, the authority behind NERC's reliability standards. That ceiling comes from FERC's January 2025 inflation adjustment, which raised it from $1,544,521. Real penalties land well below the ceiling and scale with risk to reliability, duration, and compliance history, and lower-risk issues are often resolved through self-reporting rather than a fine. The high end is real, though: one 2019 settlement reached $10 million across 127 violations. A gap assessment costs a great deal less than an audit finding.

// Related Frameworks

NIST CSF ISO 27001

// Industries That Need NERC CIP

These industries commonly require NERC CIP compliance as part of their regulatory obligations.

Utilities

Guide last reviewed: September 21, 2026

Ready to Strengthen Your Defenses?

Schedule a free consultation with our security experts to discuss your organization's needs.

Schedule Consultation Call Us

Or call us directly at (445) 273-2873