Organise NERC CIP evidence without the spreadsheet chase

NERC CIP is a set of mandatory Critical Infrastructure Protection reliability standards for the North American bulk electric system. Written by the North American Electric Reliability Corporation and approved by FERC in the US, the standards require registered entities to identify and categorise their BES Cyber Systems and then protect them through security management, personnel controls, electronic and physical perimeters, system hardening, incident response, recovery planning, configuration management, information protection and supply chain risk management.

Entities registered with NERC that own or operate parts of the bulk electric system must comply. This includes balancing authorities, generator owners and operators, transmission owners and operators, reliability coordinators and certain distribution providers. CIP-002 requires each entity to categorise its BES Cyber Systems as high, medium or low impact, and that rating decides which requirements apply. Suppliers are not directly regulated but are affected through CIP-013 supply chain obligations.

NERC CIP violations can lead to penalties of up to $1 million per violation per day under the Federal Power Act, a figure FERC adjusts annually for inflation. Actual penalties depend on the risk posed, the duration of the violation and the entity's compliance history. Regional Entities propose penalties through settlements or notices, and NERC files them with FERC. Many minor issues are handled as compliance exceptions without a fine.

You comply with NERC CIP by first categorising your BES Cyber Systems under CIP-002, then implementing every requirement that applies to each impact rating. That means documented policies, training, access management, perimeter and physical controls, patching, logging, incident response and recovery plans, configuration baselines and supplier risk management. You must keep evidence showing each requirement was met throughout the audit period, because Regional Entities test it during audits and spot checks.

NERC CIP audits are scheduled by the Regional Entity based on each entity's risk profile rather than on one fixed cycle. Higher risk entities, such as those with high impact control centres, are generally audited more often. Between audits, Regional Entities may also use self-certifications, spot checks and self-reports. Because evidence must cover the whole audit period, entities need to collect it continuously, not just before the audit.

NERC CIP is a mandatory regulatory standard for the electric sector, while ISO 27001 and SOC 2 are voluntary frameworks used across industries. They overlap on access control, patching, logging, incident response and supplier risk, so evidence can often be shared. However, holding ISO 27001 certification or a SOC 2 report does not demonstrate NERC CIP compliance, because CIP has specific technical requirements, timeframes and evidence expectations of its own.

CIP-013 requires responsible entities to develop, implement and periodically review a supply chain cyber security risk management plan for high and medium impact BES Cyber Systems and associated systems. The plan must cover procurement processes such as vendor incident notification, coordination of responses, revocation of vendor access, disclosure of known vulnerabilities, verification of software integrity and coordination of vendor remote access. The CIP Senior Manager must approve the plan at least every 15 calendar months.

NERC CIP is mapped in OneClickComply's control library and available on request, rather than a live framework you can activate today. On request, our team can map your controls and evidence to the CIP requirements, so work done for ISO 27001, SOC 2 or other frameworks counts where it overlaps. OneClickComply does not replace your Regional Entity audit or guarantee compliance, but helps you organise and monitor the evidence.