NERC CIP CIP-003 R1.2: CIP-003-9 R1.2: Cyber security policies for assets containing low impact systems

Review and obtain CIP Senior Manager approval at least every 15 calendar months of documented policies that together cover, for assets containing low impact BES Cyber Systems: cyber security awareness, physical security controls, electronic access controls, Cyber Security Incident response, Transient Cyber Asset and Removable Media malicious code risk mitigation, vendor electronic remote access security controls, and declaring and responding to CIP Exceptional Circumstances.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in CIP-003: Security Management Controls – NERC CIP

CIP-003 R1.1 CIP-003-9 R1.1: Cyber security policies for high and medium impact systems
CIP-003 R2 Att1 S1 CIP-003-9 R2 Att1 S1: Low impact plan Section 1: cyber security awareness
CIP-003 R2 Att1 S2 CIP-003-9 R2 Att1 S2: Low impact plan Section 2: physical security controls
CIP-003 R2 Att1 S3 CIP-003-9 R2 Att1 S3: Low impact plan Section 3: electronic access controls
CIP-003 R2 Att1 S4 CIP-003-9 R2 Att1 S4: Low impact plan Section 4: Cyber Security Incident response
CIP-003 R2 Att1 S5 CIP-003-9 R2 Att1 S5: Low impact plan Section 5: Transient Cyber Asset and Removable Media malicious code mitigation
CIP-003 R2 Att1 S6 CIP-003-9 R2 Att1 S6: Low impact plan Section 6: vendor electronic remote access security controls
CIP-003 R3 CIP-003-9 R3: Identify the CIP Senior Manager by name

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NERC CIP controls