NERC CIP Reliability Standards (North America, Bulk Electric System)
Status: Multiple standards in force; several revisions subject to future enforcement
Mandatory cyber and physical security standards (CIP-002 through CIP-015) for registered entities owning or operating Bulk Electric System assets. Recent changes add low-impact vendor remote-access controls (CIP-003-9, enforceable 1 Apr 2026) and internal network security monitoring (CIP-015-1 effective 1 Oct 2028; CIP-015-2 approved by FERC 10 Aug 2026, effective 1 Oct 2029).
Who it applies to
- NERC-registered entities with high, medium or low impact BES Cyber Systems (utilities, generators, transmission operators, balancing authorities)
Why it matters for OT
Directly governs control-centre, substation and generation OT in North America.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| CIP-002 BES Cyber System categorisation | IEC 62443-3-2 (asset inventory, zones, risk-based security level targets) |
| CIP-005 Electronic Security Perimeters & remote access; CIP-003-9 low-impact vendor remote access | IEC 62443-3-3 SR 5 (restricted data flow, zones/conduits), SR 1.13 (untrusted network access) |
| CIP-007 system security management; CIP-010 configuration change & vulnerability assessment | IEC 62443-2-3 (patch management), 62443-3-3 SR 3/SR 7 |
| CIP-013 supply chain risk management | IEC 62443-2-4 (service providers), 62443-4-1 (supplier SDL) |
| CIP-015 internal network security monitoring | IEC 62443-3-3 SR 6.2 (continuous monitoring) |
IEC 62443 mappings are editorial and indicative.
Recent changes
CIP-003-9 now enforceable
Low-impact entities must have methods to determine and disable vendor remote access.
Sources
- NERC – CIP standards list nerc.com
- NERC – CIP-003-9 nerc.com
- NERC – CIP-015-1 nerc.com
- NERC – CIP-015-2 nerc.com
- Federal Register – CIP-015-1 final action (2025) federalregister.gov
Monitored for changes: nerc.com. Data file: data/regulations/nerc-cip.yaml. Not legal advice.
Get NERC CIP changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.