NERC CIP CIP-003 R2 Att1 S1: CIP-003-9 R2 Att1 S1: Low impact plan Section 1: cyber security awareness

In the low impact cyber security plan, reinforce cyber security practices, which may include associated physical security practices, at least once every 15 calendar months.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in CIP-003: Security Management Controls – NERC CIP

CIP-003 R1.1 CIP-003-9 R1.1: Cyber security policies for high and medium impact systems
CIP-003 R1.2 CIP-003-9 R1.2: Cyber security policies for assets containing low impact systems
CIP-003 R2 Att1 S2 CIP-003-9 R2 Att1 S2: Low impact plan Section 2: physical security controls
CIP-003 R2 Att1 S3 CIP-003-9 R2 Att1 S3: Low impact plan Section 3: electronic access controls
CIP-003 R2 Att1 S4 CIP-003-9 R2 Att1 S4: Low impact plan Section 4: Cyber Security Incident response
CIP-003 R2 Att1 S5 CIP-003-9 R2 Att1 S5: Low impact plan Section 5: Transient Cyber Asset and Removable Media malicious code mitigation
CIP-003 R2 Att1 S6 CIP-003-9 R2 Att1 S6: Low impact plan Section 6: vendor electronic remote access security controls
CIP-003 R3 CIP-003-9 R3: Identify the CIP Senior Manager by name

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NERC CIP controls