NERC CIP Standards: What They Mean for Your Organization

The CIP standards are part of NERC’s mandatory Reliability Standards. They cover how registered entities identify, protect, monitor and recover the cyber systems that support the Bulk Electric System (BES).

NERC defines the BES as: “Unless modified by the lists shown below, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy.”

The definition then lists inclusions, such as Blackstart Resources and certain generating resources at 100 kV or above, and exclusions, such as certain radial systems and local networks. NERC adds: “Elements may be included or excluded on a case-by-case basis through the Rules of Procedure exception process.”

NERC registers entities by function. CIP-002-5.1a applies to these registered functions:

• Balancing Authority
• Distribution Provider (only those with certain UFLS/UVLS, SPS/RAS, Protection Systems or Cranking Paths)
• Generator Operator and Generator Owner
• Interchange Coordinator or Interchange Authority
• Reliability Coordinator
• Transmission Operator and Transmission Owner

Inverter-based resources. Since May 15, 2026, NERC requires registration for entities that own and operate certain non-BES inverter-based resources with an aggregate nameplate capacity of 20 MVA or more, connected at 60 kV or more. NERC has not yet set CIP compliance dates for these newly registered resources.

Whether your facilities are part of the BES, and how they are registered, is a decision for your compliance team and NERC.

CIP-002 is the starting point. Each registered entity must categorize its BES Cyber Systems as high, medium or low impact, and review those identifications with CIP Senior Manager approval at least once every 15 calendar months.

• High impact: Control Centers that perform Reliability Coordinator functions, plus certain large Balancing Authority, Transmission Operator and Generator Operator Control Centers.
• Medium impact: examples include generation of 1,500 MW or more at a single plant and Transmission Facilities at 500 kV or higher.
• Low impact: every other covered asset that contains BES Cyber Systems.

The full criteria are in CIP-002-5.1a, Attachment 1.

The CIP standards and the versions in force

• Low impact vendor remote access, in force now. CIP-003-9 took effect April 1, 2026. For low impact assets that “allow vendor electronic remote access,” entities need methods for determining it, disabling it and “detecting known or suspected inbound and outbound malicious communications for vendor electronic remote access.”
• Control Center communications, in force now. CIP-012-2 took effect July 1, 2026.
• Virtualization. FERC Order No. 919 (issued March 19, 2026) approves 11 modified CIP standards and new definitions, including Virtual Cyber Asset and Shared Cyber Infrastructure. CIP-002-8, approved the same day, refines the Control Center criteria. NERC lists July 1, 2028 as the effective date for CIP-002-8 and for CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3. See the table above.
• Internal network security monitoring. FERC Order No. 907 approved CIP-015-1 for high impact systems and medium impact systems with External Routable Connectivity, effective October 1, 2028. CIP-015-2, NERC’s response to FERC’s directive to extend internal network security monitoring to EACMS and PACS outside the electronic security perimeter, takes effect October 1, 2029.
• Low impact remote users. CIP-003-11 (FERC Order No. 918) adds controls to “authenticate remote users, protecting authentication information in transit, and detecting malicious communications” for low impact assets, effective July 1, 2029.
• Supply chain. FERC Order No. 912 directs NERC to develop changes to CIP-013 on supply chain risk management plans, with a filing due within 18 months of the order. No new CIP-013 version from that order is approved yet.
• Jointly owned transmission stations. CIP-014-4 adds requirements for jointly owned transmission stations and substations, effective October 1, 2028.
• BES Cyber System Information and third parties. CIP-004-7 and CIP-011-3 (in force since January 1, 2024) clarified how entities manage access to BES Cyber System Information, including information stored with third parties.

NERC is the Electric Reliability Organization. It runs its Compliance Monitoring and Enforcement Program with the Regional Entities. For the ERCOT region, the Regional Entity is Texas RE.

Monitoring methods include Compliance Audits, Self-Certifications, Spot Checks, Compliance Investigations, Self-Reports, Self-Logging, Periodic Data Submittals and Complaints. NERC says “Self-Reports are encouraged at the time a Registered Entity becomes aware that it has, or may have, violated a Reliability Standard.”

Penalties are assessed under the NERC Sanction Guidelines and filed with FERC. The federal maximum is currently $1,584,648 per violation, per day (18 CFR 385.1602), and FERC adjusts it for inflation.

You keep the compliance decisions. ALCON DTS supports the IT and security side of your CIP program, working alongside your compliance team. Work on assets inside an electronic security perimeter, and on operational technology, stays with your operations and compliance staff.

Our Security Monitoring (SIEM) service and our Backup and Disaster Recovery service are each quoted on their own. The exact controls in your environment depend on your ALCON DTS plan and any project work, and our expert team will show you which controls are in place today and which would add coverage. Your organization keeps control of its compliance program, and ALCON DTS supports the IT and security side. ALCON DTS does not audit, certify or validate CIP compliance.

• Texas grid rules. In ERCOT, PUCT and ERCOT rules apply alongside NERC CIP, including the Emergency Operations Plan cyber security annex and ERCOT incident notice. See our Texas grid guide.
• DOE-417. Electric emergency incident reporting to DOE has its own criteria and timelines. See the DOE-417 Form Instructions.
• CIRCIA. Federal critical infrastructure incident reporting is not required yet. The final rule is under review.
• NIST Cybersecurity Framework. See our NIST Cybersecurity Framework guide.

• CIP Reliability Standards (NERC)
• CIP-002-5.1a, BES Cyber System Categorization (NERC)
• BES Reference Document, Version 3, April 30, 2026 (NERC)
• Glossary of Terms (NERC)
• Application of the Registration Criteria for Category 2 Inverter-Based Resources (NERC)
• Reliability Standards Compliance Dates for Category 2 GOs and GOPs (NERC)
• Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (NERC)
• FERC Orders and Rules, 2026 (NERC)
• Order No. 919, Virtualization Reliability Standards (Federal Register)
• 18 CFR 385.1602, Civil monetary penalty inflation adjustments (eCFR)
• About Texas RE (Texas RE)
• Key Players: Regional Entities (NERC)

Last reviewed: October 27, 2026

This page is general information about the NERC CIP Reliability Standards, not legal or compliance advice for your situation.