NERC CIP, for people who have to live with it.

NERC CIP is the set of Critical Infrastructure Protection standards covering cyber security for the North American Bulk Electric System. If you operate BES assets, it is not advisory.

This page is orientation, not compliance guidance. The standards are versioned, enforced through regional entities, and change. Anything that matters should be checked against the current text and your own compliance function rather than against a vendor's website, including this one.

15 min

the impact test inside the BES Cyber Asset definition

12

standards in the CIP family, from CIP-002 to CIP-014

3

impact ratings, and the obligations differ substantially

The vocabulary everything hangs off

Most confusion about CIP is really confusion about scope. Three terms carry most of it.

BES Cyber Asset.

A cyber asset that, if rendered unavailable, degraded or misused, would within 15 minutes adversely affect the reliable operation of the Bulk Electric System. The 15 minutes matter.

BES Cyber System.

One or more BES Cyber Assets grouped together. Most requirements attach to systems rather than to individual assets, which is why grouping decisions matter so much.

Impact rating.

High, Medium or Low, determined by criteria in CIP-002. The rating decides which requirements apply, and the difference in obligation between the tiers is substantial.

Two further terms come up constantly in monitoring conversations: the Electronic Security Perimeter, the logical border around a BES Cyber System, and the Electronic Access Point, any interface through that border. A monitoring vendor asking for connectivity is, whether or not they use the words, asking about your EAPs.

What the standards cover

For anyone evaluating a monitoring platform, four of those do most of the work: CIP-005 because you are adding a path, CIP-007 because you are adding a system that needs patching and logging, CIP-010 because installing it is a configuration change, and CIP-013 because you are taking on a vendor.

Where monitoring vendors create work

A monitoring deployment can be nearly invisible to your compliance program or it can expand its scope. The difference is architectural and is decided before anything is installed.

• A vendor requiring inbound connectivity is asking you to create or widen an Electronic Access Point, which is a CIP-005 conversation with evidence obligations attached.
• A platform that can write to control systems invites the question of whether it belongs inside the ESP. If it does, it inherits the requirements that apply there.
• Equipment installed inside the perimeter falls under configuration management and patching, so every vendor update becomes your change record.
• Remote support access by a vendor is interactive remote access, with everything CIP-005 has to say about it.
• Any of this creates supply chain obligations under CIP-013 regardless of how the connection is built.

None of that makes monitoring incompatible with CIP. It means the architecture determines how much compliance work the tool costs you, and that cost is worth pricing before selection rather than after.

Questions to put to any vendor

These are useful whoever you buy from, and they are the questions your compliance function will ask you after you have signed.

• Does anything you install sit inside the Electronic Security Perimeter, or outside it?
• Does the connection create a new Electronic Access Point, or use an existing egress path we already control?
• Can your platform write to, or command, anything?
• Who patches the device you install, on what cadence, and how do we evidence that?
• What does your update process do to our configuration change records?
• Do your people need interactive remote access, and through what?

Where 42Hz sits

42Hz is not a compliance product and holds no CIP certification. No such certification exists for a vendor to hold. Whether any given asset is in scope, and how it is categorized, is your determination as the registered entity.

What we can state is architectural, and it is checkable during a pilot. The edge is designed to sit in the industrial DMZ rather than inside the ESP. It opens one outbound connection through an egress rule your team writes and owns, so it does not ask you to create an inbound access point. It reads and does not write, because there is no write path, so it cannot be used to operate anything. And it is revocable by closing that one rule, without our involvement.

Take those to your compliance team as claims to verify.

Common questions

Does CIP apply to us?

It applies to registered entities with BES assets, and the categorization criteria in CIP-002 decide the rest. Distribution-level and behind-the-meter assets are frequently outside BES scope while sitting on the same site as assets that are inside it, which is why the inventory work is where programs succeed or fail.

Is a low-impact rating a light obligation?

Lighter, not absent. Low-impact systems carry real requirements, and the volume of low-impact assets often makes them harder to manage in practice than a small number of high-impact ones.

Does adding condition monitoring put us out of compliance?

Not inherently. It adds a system and possibly a path, both of which have to be documented and controlled. A deployment that uses an existing egress path, has no write path, and sits outside the ESP is a smaller compliance event than one that asks for inbound access, but it is still an event, and your compliance function should see the architecture before procurement closes.

Can a vendor be CIP-certified?

No. Compliance belongs to the registered entity, not to a product. A vendor can supply evidence, documentation and an architecture that makes your obligations easier to meet. Any vendor describing itself as CIP-certified is describing something that does not exist.