NERC CIP

North America (United States under FERC; Canadian provinces by adoption)

vCIP Reliability Standards in force 2026-09-25 (CIP-002-5.1a, CIP-003-9, CIP-004-7, CIP-005-7, CIP-006-6, CIP-007-6, CIP-008-6, CIP-009-6, CIP-010-4, CIP-011-3, CIP-012-2, CIP-013-2, CIP-014-3)

13 domains

162 controls

The mandatory NERC Critical Infrastructure Protection Reliability Standards for the North American bulk electric system as in force on 25 September 2026, CIP-002-5.1a to CIP-014-3, modelled at the requirement parts NERC audits: categorization of BES Cyber Systems, policies and low impact plans, personnel and training, electronic security perimeters and remote access, physical security, system security management, incident response and reporting, recovery, configuration and vulnerability management with transient devices, information protection, Control Center communications, supply chain and transmission station physical security. Versions approved for 2028 and 2029 (virtualization, CIP-003-11, CIP-014-4, CIP-015 internal network security monitoring) are recorded on each affected requirement.

Verified

NERC CIP is a compliance framework from North America (United States under FERC; Canadian provinces by adoption) with 13 domains and 162 controls that map to 115 other frameworks. The largest domains are CIP-010: Configuration Change Management and Vulnerability Assessments – NERC CIP (21 controls), CIP-014: Physical Security – NERC CIP (21 controls), CIP-007: System Security Management – NERC CIP (20 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (13)

CIP-002: BES Cyber System Categorization – NERC CIP

5 controls

Controls in the CIP-002: BES Cyber System Categorization – NERC CIP domain of NERC CIP: 5 controls
Code	Title	Description
nerc-cip::CIP-002 R1.1	CIP-002-5.1a R1.1: Identify high impact BES Cyber Systems	Under a process that considers each Control Center and backup Control Center, transmission station and substation, gener...
nerc-cip::CIP-002 R1.2	CIP-002-5.1a R1.2: Identify medium impact BES Cyber Systems	Identify each medium impact BES Cyber System at each asset by applying Attachment 1, Section 2: generation of 1,500 MW o...
nerc-cip::CIP-002 R1.3	CIP-002-5.1a R1.3: Identify assets containing low impact BES Cyber Systems	Identify each asset that contains a low impact BES Cyber System under Attachment 1, Section 3 (Control Centers, transmis...
nerc-cip::CIP-002 R2.1	CIP-002-5.1a R2.1: Review the identifications at least every 15 calendar months	Review the R1 identifications and update them where changes are found at least once every 15 calendar months, including...
nerc-cip::CIP-002 R2.2	CIP-002-5.1a R2.2: CIP Senior Manager approval of the identifications every 15 calendar months	Have the CIP Senior Manager or a delegate approve the R1 identifications at least once every 15 calendar months, includi...

CIP-003: Security Management Controls – NERC CIP

10 controls

Controls in the CIP-003: Security Management Controls – NERC CIP domain of NERC CIP: 10 controls
Code	Title	Description
nerc-cip::CIP-003 R1.1	CIP-003-9 R1.1: Cyber security policies for high and medium impact systems	Review and obtain CIP Senior Manager approval at least every 15 calendar months of documented cyber security policies th...
nerc-cip::CIP-003 R1.2	CIP-003-9 R1.2: Cyber security policies for assets containing low impact systems	Review and obtain CIP Senior Manager approval at least every 15 calendar months of documented policies that together cov...
nerc-cip::CIP-003 R2 Att1 S1	CIP-003-9 R2 Att1 S1: Low impact plan Section 1: cyber security awareness	In the low impact cyber security plan, reinforce cyber security practices, which may include associated physical securit...
nerc-cip::CIP-003 R2 Att1 S2	CIP-003-9 R2 Att1 S2: Low impact plan Section 2: physical security controls	Control physical access, based on need as the entity determines, to the asset or to the locations of low impact BES Cybe...
nerc-cip::CIP-003 R2 Att1 S3	CIP-003-9 R2 Att1 S3: Low impact plan Section 3: electronic access controls	For each asset containing low impact BES Cyber Systems, permit only the inbound and outbound electronic access the entit...
nerc-cip::CIP-003 R2 Att1 S4	CIP-003-9 R2 Att1 S4: Low impact plan Section 4: Cyber Security Incident response	Maintain Cyber Security Incident response plans by asset or group covering: identification, classification and response;...
nerc-cip::CIP-003 R2 Att1 S5	CIP-003-9 R2 Att1 S5: Low impact plan Section 5: Transient Cyber Asset and Removable Media malicious code mitigation	Except under CIP Exceptional Circumstances, implement plans to mitigate the introduction of malicious code to low impact...
nerc-cip::CIP-003 R2 Att1 S6	CIP-003-9 R2 Att1 S6: Low impact plan Section 6: vendor electronic remote access security controls	For assets containing low impact BES Cyber Systems that allow vendor electronic remote access established under Section...
nerc-cip::CIP-003 R3	CIP-003-9 R3: Identify the CIP Senior Manager by name	Identify a CIP Senior Manager by name and document any change within 30 calendar days of the change.
nerc-cip::CIP-003 R4	CIP-003-9 R4: Documented delegation of CIP Senior Manager authority	Unless no delegations are used, implement a documented process to delegate authority where the CIP Standards allow, reco...

CIP-004: Personnel and Training – NERC CIP

19 controls

Controls in the CIP-004: Personnel and Training – NERC CIP domain of NERC CIP: 19 controls
Code	Title	Description
nerc-cip::CIP-004 R1.1	CIP-004-7 R1.1: Quarterly security awareness reinforcement	Security awareness that reinforces cyber security practices, which may include associated physical security practices, a...
nerc-cip::CIP-004 R2.1	CIP-004-7 R2.1: Cyber security training content	A role-appropriate training program whose content covers cyber security policies, physical access controls, electronic a...
nerc-cip::CIP-004 R2.2	CIP-004-7 R2.2: Training before access is granted	Require completion of the Part 2.1 training before granting authorized electronic access and authorized unescorted physi...
nerc-cip::CIP-004 R2.3	CIP-004-7 R2.3: Training at least every 15 calendar months	Require completion of the Part 2.1 training at least once every 15 calendar months.
nerc-cip::CIP-004 R3.1	CIP-004-7 R3.1: Personnel risk assessment: confirm identity	A process to confirm identity as part of the personnel risk assessment program used to attain and retain authorized elec...
nerc-cip::CIP-004 R3.2	CIP-004-7 R3.2: Personnel risk assessment: seven-year criminal history records check	A process to perform a seven-year criminal history records check covering the current residence regardless of duration a...
nerc-cip::CIP-004 R3.3	CIP-004-7 R3.3: Criteria to evaluate criminal history records checks	Criteria or a process for evaluating criminal history records checks when authorizing access.
nerc-cip::CIP-004 R3.4	CIP-004-7 R3.4: Verify contractor and vendor personnel risk assessments	Criteria or a process to verify that personnel risk assessments performed for contractors or service vendors meet Parts...
nerc-cip::CIP-004 R3.5	CIP-004-7 R3.5: Personnel risk assessment within the last seven years	A process to ensure that individuals with authorized electronic or authorized unescorted physical access have had a pers...
nerc-cip::CIP-004 R4.1	CIP-004-7 R4.1: Authorize access based on need	A process to authorize, based on need as the entity determines and except for CIP Exceptional Circumstances, electronic...
nerc-cip::CIP-004 R4.2	CIP-004-7 R4.2: Quarterly verification of access against authorization	Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical access...
nerc-cip::CIP-004 R4.3	CIP-004-7 R4.3: Verify user accounts and privileges every 15 calendar months	For electronic access, verify at least once every 15 calendar months that all user accounts, account groups or role cate...
nerc-cip::CIP-004 R5.1	CIP-004-7 R5.1: Remove access within 24 hours of a termination action	A process to initiate removal of an individual's ability for unescorted physical access and Interactive Remote Access up...
nerc-cip::CIP-004 R5.2	CIP-004-7 R5.2: Revoke unneeded access on reassignment or transfer	For reassignments or transfers, revoke authorized electronic access to individual accounts and authorized unescorted phy...
nerc-cip::CIP-004 R5.3	CIP-004-7 R5.3: Revoke non-shared accounts within 30 days of termination	For termination actions, revoke the individual's non-shared user accounts, unless already revoked under Part 5.1, within...
nerc-cip::CIP-004 R5.4	CIP-004-7 R5.4: Change shared account passwords after termination or transfer	For termination actions, change passwords for shared accounts known to the user within 30 calendar days; for reassignmen...
nerc-cip::CIP-004 R6.1	CIP-004-7 R6.1: Authorize provisioned access to BCSI	Before provisioning, and unless already authorized under Part 4.1, authorize based on need, except for CIP Exceptional C...
nerc-cip::CIP-004 R6.2	CIP-004-7 R6.2: Verify provisioned BCSI access every 15 calendar months	Verify at least once every 15 calendar months that every individual with provisioned access to BCSI has an authorization...
nerc-cip::CIP-004 R6.3	CIP-004-7 R6.3: Remove BCSI access by the next calendar day after termination	For termination actions, remove the individual's ability to use provisioned access to BCSI, unless already revoked under...

CIP-005: Electronic Security Perimeter(s) – NERC CIP

12 controls

Controls in the CIP-005: Electronic Security Perimeter(s) – NERC CIP domain of NERC CIP: 12 controls
Code	Title	Description
nerc-cip::CIP-005 R1.1	CIP-005-7 R1.1: All routable Cyber Assets inside a defined ESP	All applicable Cyber Assets connected to a network by a routable protocol reside within a defined Electronic Security Pe...
nerc-cip::CIP-005 R1.2	CIP-005-7 R1.2: External Routable Connectivity through an identified EAP	All External Routable Connectivity passes through an identified Electronic Access Point.
nerc-cip::CIP-005 R1.3	CIP-005-7 R1.3: Inbound and outbound permissions with reasons, deny by default	Require inbound and outbound access permissions at each EAP, including the reason for granting access, and deny all othe...
nerc-cip::CIP-005 R1.4	CIP-005-7 R1.4: Authenticate Dial-up Connectivity	Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets.
nerc-cip::CIP-005 R1.5	CIP-005-7 R1.5: Detect malicious communications at EAPs	Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound communi...
nerc-cip::CIP-005 R2.1	CIP-005-7 R2.1: Interactive Remote Access through an Intermediate System	For all Interactive Remote Access, use an Intermediate System so that the Cyber Asset initiating the access does not dir...
nerc-cip::CIP-005 R2.2	CIP-005-7 R2.2: Encryption of Interactive Remote Access terminating at the Intermediate System	For all Interactive Remote Access sessions, use encryption that terminates at an Intermediate System.
nerc-cip::CIP-005 R2.3	CIP-005-7 R2.3: Multi-factor authentication for Interactive Remote Access	Require multi-factor authentication for all Interactive Remote Access sessions (two of something known, held or inherent...
nerc-cip::CIP-005 R2.4	CIP-005-7 R2.4: Determine active vendor remote access sessions	Have one or more methods for determining active vendor remote access sessions, including Interactive Remote Access and s...
nerc-cip::CIP-005 R2.5	CIP-005-7 R2.5: Disable active vendor remote access	Have one or more methods to disable active vendor remote access, including Interactive Remote Access and system-to-syste...
nerc-cip::CIP-005 R3.1	CIP-005-7 R3.1: Determine authenticated vendor-initiated connections to EACMS and PACS	Have one or more methods to determine authenticated vendor-initiated remote connections.
nerc-cip::CIP-005 R3.2	CIP-005-7 R3.2: Terminate vendor-initiated connections to EACMS and PACS and control reconnection	Have one or more methods to terminate authenticated vendor-initiated remote connections and control the ability to recon...

CIP-006: Physical Security of BES Cyber Systems – NERC CIP

14 controls

Controls in the CIP-006: Physical Security of BES Cyber Systems – NERC CIP domain of NERC CIP: 14 controls
Code	Title	Description
nerc-cip::CIP-006 R1.1	CIP-006-6 R1.1: Operational or procedural controls to restrict physical access	Define operational or procedural controls to restrict physical access.
nerc-cip::CIP-006 R1.10	CIP-006-6 R1.10: Protect cabling outside a PSP within the same ESP	Restrict physical access to cabling and other nonprogrammable communication components connecting applicable Cyber Asset...
nerc-cip::CIP-006 R1.2	CIP-006-6 R1.2: At least one physical access control into each PSP	Use at least one physical access control to allow unescorted physical access into each applicable Physical Security Peri...
nerc-cip::CIP-006 R1.3	CIP-006-6 R1.3: Two or more physical access controls for high impact PSPs	Where technically feasible, use two or more different physical access controls (not necessarily two independent systems)...
nerc-cip::CIP-006 R1.4	CIP-006-6 R1.4: Monitor for unauthorized physical access into PSPs	Monitor for unauthorized access through a physical access point into a Physical Security Perimeter.
nerc-cip::CIP-006 R1.5	CIP-006-6 R1.5: Alarm within 15 minutes of detected unauthorized PSP access	Issue an alarm or alert in response to detected unauthorized access through a physical access point into a PSP to the pe...
nerc-cip::CIP-006 R1.6	CIP-006-6 R1.6: Monitor PACS for unauthorized physical access	Monitor each Physical Access Control System for unauthorized physical access to it.
nerc-cip::CIP-006 R1.7	CIP-006-6 R1.7: Alarm within 15 minutes of unauthorized PACS access	Issue an alarm or alert in response to detected unauthorized physical access to a PACS to the personnel identified in th...
nerc-cip::CIP-006 R1.8	CIP-006-6 R1.8: Log entry of each authorized individual into each PSP	Log, automatically or by the personnel controlling entry, the entry of each individual with authorized unescorted physic...
nerc-cip::CIP-006 R1.9	CIP-006-6 R1.9: Retain physical access logs for 90 days	Retain physical access logs of entry of individuals with authorized unescorted physical access into each PSP for at leas...
nerc-cip::CIP-006 R2.1	CIP-006-6 R2.1: Continuous escort of visitors within PSPs	Require continuous escorted access of visitors (individuals provided access but not authorized for unescorted physical a...
nerc-cip::CIP-006 R2.2	CIP-006-6 R2.2: Log visitor entry and exit	Require manual or automated logging of visitor entry into and exit from the PSP including the date and time of initial e...
nerc-cip::CIP-006 R2.3	CIP-006-6 R2.3: Retain visitor logs for 90 days	Retain visitor logs for at least ninety calendar days.
nerc-cip::CIP-006 R3.1	CIP-006-6 R3.1: Maintain and test PACS and PSP devices every 24 months	Maintain and test each Physical Access Control System and the locally mounted hardware or devices at the PSP at least on...

CIP-007: System Security Management – NERC CIP

20 controls

Controls in the CIP-007: System Security Management – NERC CIP domain of NERC CIP: 20 controls
Code	Title	Description
nerc-cip::CIP-007 R1.1	CIP-007-6 R1.1: Enable only needed logical network ports	Where technically feasible, enable only the logical network accessible ports the entity has determined are needed, inclu...
nerc-cip::CIP-007 R1.2	CIP-007-6 R1.2: Protect unnecessary physical input/output ports	Protect against the use of unnecessary physical input/output ports used for network connectivity, console commands or Re...
nerc-cip::CIP-007 R2.1	CIP-007-6 R2.1: Patch management process with tracked sources	A patch management process for tracking, evaluating and installing cyber security patches for applicable Cyber Assets, w...
nerc-cip::CIP-007 R2.2	CIP-007-6 R2.2: Evaluate security patches at least every 35 days	At least once every 35 calendar days, evaluate security patches released since the last evaluation from the identified s...
nerc-cip::CIP-007 R2.3	CIP-007-6 R2.3: Apply patches or create or revise a mitigation plan within 35 days	Within 35 calendar days of completing the evaluation, apply each applicable patch, create a dated mitigation plan or rev...
nerc-cip::CIP-007 R2.4	CIP-007-6 R2.4: Implement mitigation plans on time	Implement each mitigation plan created or revised under Part 2.3 within its timeframe unless a revision or extension is...
nerc-cip::CIP-007 R3.1	CIP-007-6 R3.1: Deploy methods to deter, detect or prevent malicious code	Deploy methods to deter, detect or prevent malicious code.
nerc-cip::CIP-007 R3.2	CIP-007-6 R3.2: Mitigate detected malicious code	Mitigate the threat of detected malicious code.
nerc-cip::CIP-007 R3.3	CIP-007-6 R3.3: Update signatures or patterns with testing	For methods using signatures or patterns, have an update process that addresses testing and installing them.
nerc-cip::CIP-007 R4.1	CIP-007-6 R4.1: Log security events	Log events at the BES Cyber System level or Cyber Asset level, per capability, for identifying and investigating Cyber S...
nerc-cip::CIP-007 R4.2	CIP-007-6 R4.2: Alert on security events	Generate alerts for security events the entity determines need an alert, including at minimum detected malicious code fr...
nerc-cip::CIP-007 R4.3	CIP-007-6 R4.3: Retain event logs for 90 days	Where technically feasible, retain the Part 4.1 event logs for at least the last 90 consecutive calendar days except und...
nerc-cip::CIP-007 R4.4	CIP-007-6 R4.4: Review logged events every 15 days	Review a summarization or sampling of logged events, as the entity determines, at intervals no greater than 15 calendar...
nerc-cip::CIP-007 R5.1	CIP-007-6 R5.1: Enforce authentication of interactive user access	Have methods to enforce authentication of interactive user access, where technically feasible.
nerc-cip::CIP-007 R5.2	CIP-007-6 R5.2: Inventory default and generic account types	Identify and inventory all known enabled default or other generic account types, by system, group of systems, location o...
nerc-cip::CIP-007 R5.3	CIP-007-6 R5.3: Identify individuals with access to shared accounts	Identify individuals who have authorized access to shared accounts.
nerc-cip::CIP-007 R5.4	CIP-007-6 R5.4: Change known default passwords	Change known default passwords, per Cyber Asset capability.
nerc-cip::CIP-007 R5.5	CIP-007-6 R5.5: Password length and complexity for password-only authentication	For password-only authentication of interactive user access, technically or procedurally enforce a length of at least th...
nerc-cip::CIP-007 R5.6	CIP-007-6 R5.6: Password change at least every 15 months	Where technically feasible, for password-only authentication of interactive user access, technically or procedurally enf...
nerc-cip::CIP-007 R5.7	CIP-007-6 R5.7: Limit or alert on unsuccessful authentication attempts	Where technically feasible, either limit the number of unsuccessful authentication attempts or generate alerts after a t...

CIP-008: Incident Reporting and Response Planning – NERC CIP

12 controls

Controls in the CIP-008: Incident Reporting and Response Planning – NERC CIP domain of NERC CIP: 12 controls
Code	Title	Description
nerc-cip::CIP-008 R1.1	CIP-008-6 R1.1: Processes to identify, classify and respond to Cyber Security Incidents	A documented Cyber Security Incident response plan with one or more processes to identify, classify and respond to Cyber...
nerc-cip::CIP-008 R1.2	CIP-008-6 R1.2: Criteria for attempts to compromise and reportability	Processes that include criteria to evaluate and define attempts to compromise; determine whether an identified Cyber Sec...
nerc-cip::CIP-008 R1.3	CIP-008-6 R1.3: Roles and responsibilities of response groups	The roles and responsibilities of Cyber Security Incident response groups or individuals.
nerc-cip::CIP-008 R1.4	CIP-008-6 R1.4: Incident handling procedures	Incident handling procedures for Cyber Security Incidents.
nerc-cip::CIP-008 R2.1	CIP-008-6 R2.1: Test response plans every 15 calendar months	Test each Cyber Security Incident response plan at least once every 15 calendar months by responding to an actual Report...
nerc-cip::CIP-008 R2.2	CIP-008-6 R2.2: Use the plan and document deviations	Use the plans when responding to a Reportable Cyber Security Incident, to an incident that attempted to compromise an ap...
nerc-cip::CIP-008 R2.3	CIP-008-6 R2.3: Retain incident records	Retain records related to Reportable Cyber Security Incidents and to incidents that attempted to compromise an applicabl...
nerc-cip::CIP-008 R3.1	CIP-008-6 R3.1: Lessons learned and plan update within 90 days	No later than 90 calendar days after a plan test or actual Reportable Cyber Security Incident response, document any les...
nerc-cip::CIP-008 R3.2	CIP-008-6 R3.2: Update the plan within 60 days of role or technology changes	No later than 60 calendar days after a change to roles or responsibilities, response groups or individuals, or technolog...
nerc-cip::CIP-008 R4.1	CIP-008-6 R4.1: Notification content: functional impact, attack vector, level of intrusion	Notify the E-ISAC and, for entities under United States jurisdiction, the National Cybersecurity and Communications Inte...
nerc-cip::CIP-008 R4.2	CIP-008-6 R4.2: Notification timelines: one hour and next calendar day	After the determination under R1 Part 1.2, give initial notification within one hour of determining a Reportable Cyber S...
nerc-cip::CIP-008 R4.3	CIP-008-6 R4.3: Updates within 7 days of new attribute information	Provide updates, if any, within 7 calendar days of determining new or changed attribute information required by Part 4.1...

CIP-009: Recovery Plans for BES Cyber Systems – NERC CIP

10 controls

Controls in the CIP-009: Recovery Plans for BES Cyber Systems – NERC CIP domain of NERC CIP: 10 controls
Code	Title	Description
nerc-cip::CIP-009 R1.1	CIP-009-6 R1.1: Conditions for activating recovery plans	Documented recovery plans include the conditions for activating them.
nerc-cip::CIP-009 R1.2	CIP-009-6 R1.2: Roles and responsibilities of responders	Recovery plans include the roles and responsibilities of responders.
nerc-cip::CIP-009 R1.3	CIP-009-6 R1.3: Backup and storage of recovery information	One or more processes for backing up and storing the information required to recover BES Cyber System functionality.
nerc-cip::CIP-009 R1.4	CIP-009-6 R1.4: Verify backups and address failures	One or more processes to verify that the Part 1.3 backups completed successfully and to address any backup failures.
nerc-cip::CIP-009 R1.5	CIP-009-6 R1.5: Preserve data for determining incident cause	One or more processes to preserve data, per Cyber Asset capability, for determining the cause of a Cyber Security Incide...
nerc-cip::CIP-009 R2.1	CIP-009-6 R2.1: Test recovery plans every 15 calendar months	Test each recovery plan at least once every 15 calendar months by recovering from an actual incident, a paper drill or t...
nerc-cip::CIP-009 R2.2	CIP-009-6 R2.2: Test a representative sample of backup information	Test a representative sample of the information used to recover BES Cyber System functionality at least once every 15 ca...
nerc-cip::CIP-009 R2.3	CIP-009-6 R2.3: Operational exercise every 36 months for high impact	Test each recovery plan at least once every 36 calendar months through an operational exercise in an environment represe...
nerc-cip::CIP-009 R3.1	CIP-009-6 R3.1: Lessons learned and plan update within 90 days of a test or recovery	No later than 90 calendar days after a recovery plan test or actual recovery, document any lessons learned or their abse...
nerc-cip::CIP-009 R3.2	CIP-009-6 R3.2: Update recovery plans within 60 days of changes	No later than 60 calendar days after a change to roles or responsibilities, responders or technology that the entity det...

CIP-010: Configuration Change Management and Vulnerability Assessments – NERC CIP

21 controls

Controls in the CIP-010: Configuration Change Management and Vulnerability Assessments – NERC CIP domain of NERC CIP: 21 controls
Code	Title	Description
nerc-cip::CIP-010 R1.1	CIP-010-4 R1.1: Baseline configuration	Develop a baseline configuration, individually or by group, including the operating system or firmware (with version), i...
nerc-cip::CIP-010 R1.2	CIP-010-4 R1.2: Authorize and document baseline changes	Authorize and document changes that deviate from the existing baseline configuration.
nerc-cip::CIP-010 R1.3	CIP-010-4 R1.3: Update the baseline within 30 days of a change	For a change that deviates from the baseline, update the baseline configuration as necessary within 30 calendar days of...
nerc-cip::CIP-010 R1.4	CIP-010-4 R1.4: Verify CIP-005 and CIP-007 controls are unaffected by changes	For a change that deviates from the baseline, determine beforehand the CIP-005 and CIP-007 controls that could be affect...
nerc-cip::CIP-010 R1.5	CIP-010-4 R1.5: Test changes in a test environment for high impact systems	Where technically feasible, before implementing a baseline-deviating change in production, test it in a test environment...
nerc-cip::CIP-010 R1.6	CIP-010-4 R1.6: Verify software source identity and integrity before changes	Before a baseline-deviating change to the operating system or firmware, commercial or open-source software, or security...
nerc-cip::CIP-010 R2.1	CIP-010-4 R2.1: Monitor for baseline changes every 35 days	Monitor at least once every 35 calendar days for changes to the baseline configuration, and document and investigate det...
nerc-cip::CIP-010 R3.1	CIP-010-4 R3.1: Vulnerability assessment every 15 calendar months	At least once every 15 calendar months, conduct a paper or active vulnerability assessment.
nerc-cip::CIP-010 R3.2	CIP-010-4 R3.2: Active vulnerability assessment every 36 months for high impact	Where technically feasible, at least once every 36 calendar months, perform an active vulnerability assessment in a test...
nerc-cip::CIP-010 R3.3	CIP-010-4 R3.3: Active vulnerability assessment before adding new Cyber Assets	Before adding a new applicable Cyber Asset to production, perform an active vulnerability assessment of it, except for C...
nerc-cip::CIP-010 R3.4	CIP-010-4 R3.4: Document assessment results and remediation action plans	Document the results of the Part 3.1 to 3.3 assessments and the action plan to remediate or mitigate identified vulnerab...
nerc-cip::CIP-010 R4 Att1 1.1	CIP-010-4 R4 Att1 1.1: Transient Cyber Assets managed by the entity: management approach	Under the R4 plan for Transient Cyber Assets and Removable Media (implemented except under CIP Exceptional Circumstances...
nerc-cip::CIP-010 R4 Att1 1.2	CIP-010-4 R4 Att1 1.2: Transient Cyber Assets managed by the entity: authorization	For each entity-managed Transient Cyber Asset or group, authorize the users (individually or by group or role), the loca...
nerc-cip::CIP-010 R4 Att1 1.3	CIP-010-4 R4 Att1 1.3: Transient Cyber Assets managed by the entity: software vulnerability mitigation	Mitigate the risk of vulnerabilities from unpatched software on entity-managed Transient Cyber Assets, per capability, b...
nerc-cip::CIP-010 R4 Att1 1.4	CIP-010-4 R4 Att1 1.4: Transient Cyber Assets managed by the entity: malicious code mitigation	Mitigate the introduction of malicious code from entity-managed Transient Cyber Assets, per capability, by antivirus wit...
nerc-cip::CIP-010 R4 Att1 1.5	CIP-010-4 R4 Att1 1.5: Transient Cyber Assets managed by the entity: unauthorized use mitigation	Mitigate the risk of unauthorized use of entity-managed Transient Cyber Assets by restricting physical access, full-disk...
nerc-cip::CIP-010 R4 Att1 2.1	CIP-010-4 R4 Att1 2.1: Third-party Transient Cyber Assets: software vulnerability mitigation	For Transient Cyber Assets managed by another party, mitigate the risk of unpatched software, per capability, by reviewi...
nerc-cip::CIP-010 R4 Att1 2.2	CIP-010-4 R4 Att1 2.2: Third-party Transient Cyber Assets: malicious code mitigation	For Transient Cyber Assets managed by another party, mitigate malicious code, per capability, by reviewing the antivirus...
nerc-cip::CIP-010 R4 Att1 2.3	CIP-010-4 R4 Att1 2.3: Third-party Transient Cyber Assets: additional mitigation before connection	For any method used under Sections 2.1 and 2.2, determine whether additional mitigation is necessary and implement it be...
nerc-cip::CIP-010 R4 Att1 3.1	CIP-010-4 R4 Att1 3.1: Removable Media: authorization of users and locations	For each Removable Media or group, authorize the users (individually or by group or role) and the locations (individuall...
nerc-cip::CIP-010 R4 Att1 3.2	CIP-010-4 R4 Att1 3.2: Removable Media: detect and mitigate malicious code before connection	Detect malicious code on Removable Media using a Cyber Asset other than a BES Cyber System or PCA, and mitigate the thre...

CIP-011: Information Protection – NERC CIP

4 controls

Controls in the CIP-011: Information Protection – NERC CIP domain of NERC CIP: 4 controls
Code	Title	Description
nerc-cip::CIP-011 R1.1	CIP-011-3 R1.1: Methods to identify BCSI	An information protection program for BES Cyber System Information with methods to identify BCSI.
nerc-cip::CIP-011 R1.2	CIP-011-3 R1.2: Methods to protect and securely handle BCSI	Methods to protect and securely handle BCSI to mitigate the risk of compromising its confidentiality, on premises and of...
nerc-cip::CIP-011 R2.1	CIP-011-3 R2.1: Prevent BCSI retrieval before reuse of Cyber Assets	Before releasing applicable Cyber Assets containing BCSI for reuse (other than within other applicable systems), take ac...
nerc-cip::CIP-011 R2.2	CIP-011-3 R2.2: Prevent BCSI retrieval or destroy media before disposal	Before disposal of applicable Cyber Assets containing BCSI, take action to prevent unauthorized retrieval of BCSI or des...

CIP-012: Communications between Control Centers – NERC CIP

5 controls

Controls in the CIP-012: Communications between Control Centers – NERC CIP domain of NERC CIP: 5 controls
Code	Title	Description
nerc-cip::CIP-012 R1.1	CIP-012-2 R1.1: Mitigate unauthorized disclosure and modification of real-time data between Control Centers	Under a documented plan implemented except under CIP Exceptional Circumstances (oral communications excluded), identify...
nerc-cip::CIP-012 R1.2	CIP-012-2 R1.2: Mitigate loss of the ability to communicate real-time data	Identify the methods used to mitigate the risks from loss of the ability to communicate Real-time Assessment and Real-ti...
nerc-cip::CIP-012 R1.3	CIP-012-2 R1.3: Initiate recovery of communication links	Identify the methods used to initiate recovery of the communication links used to transmit Real-time Assessment and Real...
nerc-cip::CIP-012 R1.4	CIP-012-2 R1.4: Identify where the mitigation methods are implemented	Identify where the entity implemented the methods required by Parts 1.1 and 1.2.
nerc-cip::CIP-012 R1.5	CIP-012-2 R1.5: Allocate responsibilities between Control Center owners	Where the Control Centers are owned or operated by different Responsible Entities, identify each entity's responsibiliti...

CIP-013: Supply Chain Risk Management – NERC CIP

9 controls

Controls in the CIP-013: Supply Chain Risk Management – NERC CIP domain of NERC CIP: 9 controls
Code	Title	Description
nerc-cip::CIP-013 R1.1	CIP-013-2 R1.1: Identify and assess supply chain cyber risks in procurement planning	A documented supply chain cyber security risk management plan for high and medium impact BES Cyber Systems and their EAC...
nerc-cip::CIP-013 R1.2.1	CIP-013-2 R1.2.1: Vendor notification of vendor-identified incidents	Procurement processes that address, as applicable, notification by the vendor of vendor-identified incidents related to...
nerc-cip::CIP-013 R1.2.2	CIP-013-2 R1.2.2: Coordination of responses to vendor-identified incidents	Procurement processes that address coordination of responses to vendor-identified incidents related to the products or s...
nerc-cip::CIP-013 R1.2.3	CIP-013-2 R1.2.3: Vendor notification when access should end	Procurement processes that address notification by vendors when remote or onsite access should no longer be granted to v...
nerc-cip::CIP-013 R1.2.4	CIP-013-2 R1.2.4: Vendor disclosure of known vulnerabilities	Procurement processes that address disclosure by vendors of known vulnerabilities related to the products or services pr...
nerc-cip::CIP-013 R1.2.5	CIP-013-2 R1.2.5: Verify integrity and authenticity of vendor software and patches	Procurement processes that address verification of software integrity and authenticity of all software and patches the v...
nerc-cip::CIP-013 R1.2.6	CIP-013-2 R1.2.6: Coordinate controls for vendor-initiated remote access	Procurement processes that address coordination of controls for vendor-initiated remote access, including interactive an...
nerc-cip::CIP-013 R2	CIP-013-2 R2: Implement the supply chain risk management plan	Implement the R1 supply chain cyber security risk management plans; this does not require renegotiating or abrogating ex...
nerc-cip::CIP-013 R3	CIP-013-2 R3: Review and approve the plan every 15 calendar months	Review and obtain CIP Senior Manager or delegate approval of the supply chain cyber security risk management plans at le...

CIP-014: Physical Security – NERC CIP

21 controls

Controls in the CIP-014: Physical Security – NERC CIP domain of NERC CIP: 21 controls
Code	Title	Description
nerc-cip::CIP-014 R1	CIP-014-3 R1: Transmission risk assessment of qualifying stations and substations	Each Transmission Owner performs an initial and subsequent risk assessments of its Transmission stations and substations...
nerc-cip::CIP-014 R1.1	CIP-014-3 R1.1: Frequency of subsequent risk assessments	Perform subsequent risk assessments at least once every 30 calendar months if the previous verified assessment identifie...
nerc-cip::CIP-014 R1.2	CIP-014-3 R1.2: Identify primary control centers	Identify the primary control center that operationally controls each Transmission station or substation identified in th...
nerc-cip::CIP-014 R2	CIP-014-3 R2: Unaffiliated third-party verification of the risk assessment	Have an unaffiliated third party verify the R1 risk assessment, concurrently with it or afterwards.
nerc-cip::CIP-014 R2.1	CIP-014-3 R2.1: Qualified verifying entity	Select an unaffiliated verifier that is a registered Planning Coordinator, Transmission Planner or Reliability Coordinat...
nerc-cip::CIP-014 R2.2	CIP-014-3 R2.2: Verification completed within 90 days	The verification, which may recommend adding or deleting stations or substations, is completed within 90 calendar days a...
nerc-cip::CIP-014 R2.3	CIP-014-3 R2.3: Act on verifier recommendations within 60 days	Within 60 calendar days of completing the verification, for each recommended addition or removal, either modify the R1 i...
nerc-cip::CIP-014 R2.4	CIP-014-3 R2.4: Protect sensitive information shared with the verifier	Implement procedures, such as non-disclosure agreements, to protect sensitive or confidential information given to the v...
nerc-cip::CIP-014 R3	CIP-014-3 R3: Notify the Transmission Operator of identified primary control centers	For an identified primary control center that operationally controls a verified station or substation and is not under t...
nerc-cip::CIP-014 R3.1	CIP-014-3 R3.1: Notify the Transmission Operator of removals	If a previously identified and verified station or substation is removed in a later assessment or verification, notify t...
nerc-cip::CIP-014 R4	CIP-014-3 R4: Evaluate physical threats and vulnerabilities	Each Transmission Owner with identified and verified facilities, and each notified Transmission Operator, evaluates the...
nerc-cip::CIP-014 R5	CIP-014-3 R5: Develop and implement physical security plans	Develop within 120 calendar days after completing R2, and execute according to its own timeline, a documented physical s...
nerc-cip::CIP-014 R5.1	CIP-014-3 R5.1: Plan attribute: deter, detect, delay, assess, communicate and respond	The plan includes resiliency or security measures designed collectively to deter, detect, delay, assess, communicate and...
nerc-cip::CIP-014 R5.2	CIP-014-3 R5.2: Plan attribute: law enforcement contact and coordination	The plan includes law enforcement contact and coordination information.
nerc-cip::CIP-014 R5.3	CIP-014-3 R5.3: Plan attribute: timeline for enhancements	The plan includes a timeline for executing the physical security enhancements and modifications it specifies.
nerc-cip::CIP-014 R5.4	CIP-014-3 R5.4: Plan attribute: evaluating evolving threats	The plan includes provisions to evaluate evolving physical threats and their corresponding security measures for the cov...
nerc-cip::CIP-014 R6	CIP-014-3 R6: Unaffiliated third-party review of the evaluation and plan	Have an unaffiliated third party review the R4 evaluation and the R5 security plans, concurrently with or after their co...
nerc-cip::CIP-014 R6.1	CIP-014-3 R6.1: Qualified third-party reviewer	Select the reviewer from: an entity with electric industry physical security experience whose review staff includes a Ce...
nerc-cip::CIP-014 R6.2	CIP-014-3 R6.2: Review completed within 90 days	Ensure the third-party review is completed within 90 calendar days of completing the R5 security plans; it may include r...
nerc-cip::CIP-014 R6.3	CIP-014-3 R6.3: Act on reviewer recommendations within 60 days	Within 60 calendar days of completing the review, for each recommendation either modify the evaluation or plan according...
nerc-cip::CIP-014 R6.4	CIP-014-3 R6.4: Protect sensitive information shared with the reviewer	Implement procedures, such as non-disclosure agreements, to protect sensitive or confidential information given to the r...

Your Compliance Coverage

If you comply with NERC CIP, you already cover:

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

3 controls mapped

Compare →

ISO 28001:2007 Supply Chain Security Management

3 controls mapped

Compare →

APRA CPS 230 Operational Risk Management

3 controls mapped

Compare →

+ 112 more: FFIEC Cybersecurity Assessment Tool (CAT) (2%), FFIEC IT Examination Handbook (2%)

See all 115 mapped frameworks ↓

Maps to 115 other frameworks

170 total controls

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

3 source controls mapped|4 target controls covered

ISO 28001:2007 Supply Chain Security Management

3 source controls mapped|4 target controls covered

APRA CPS 230 Operational Risk Management

3 source controls mapped|7 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

3 source controls mapped|6 target controls covered

FFIEC IT Examination Handbook

3 source controls mapped|9 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

3 source controls mapped|4 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

3 source controls mapped|6 target controls covered

IEC 62443

3 source controls mapped|12 target controls covered

Annex 11 to EU GMP - Computerised Systems

3 source controls mapped|4 target controls covered

South Korea ISMS-P

3 source controls mapped|9 target controls covered

EASA Part-IS - Information Security in Aviation

3 source controls mapped|8 target controls covered

IAIS Insurance Core Principles (ICPs)

3 source controls mapped|4 target controls covered

ISO/IEC 27019:2024

3 source controls mapped|11 target controls covered

API 1164

3 source controls mapped|11 target controls covered

Protective Security Policy Framework (PSPF) Release 2026

2 source controls mapped|1 target controls covered

NIST Privacy Framework

2 source controls mapped|2 target controls covered

Kuwait National Cybersecurity Framework

2 source controls mapped|1 target controls covered

AS9100D - Aerospace Quality Management System

2 source controls mapped|2 target controls covered

ISO/IEC 27003:2017

2 source controls mapped|4 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

2 source controls mapped|5 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

2 source controls mapped|3 target controls covered

ISO/IEC 23894:2023

2 source controls mapped|7 target controls covered

APRA CPS 234

2 source controls mapped|4 target controls covered

FBI CJIS Security Policy

2 source controls mapped|4 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

2 source controls mapped|7 target controls covered

ISO 22320:2018

2 source controls mapped|4 target controls covered

ICH Q10 - Pharmaceutical Quality System

2 source controls mapped|3 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

2 source controls mapped|2 target controls covered

ISO 20400:2017 - Sustainable Procurement

2 source controls mapped|4 target controls covered

AML/CTF Act 2006 (Australia)

2 source controls mapped|2 target controls covered

Vietnam Law on Cybersecurity (No. 116/2025/QH15)

2 source controls mapped|2 target controls covered

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

2 source controls mapped|3 target controls covered

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements

2 source controls mapped|1 target controls covered

Turkey KVKK

2 source controls mapped|2 target controls covered

TEFCA - Trusted Exchange Framework and Common Agreement

2 source controls mapped|1 target controls covered

Privacy Act 1988 (Australia)

2 source controls mapped|2 target controls covered

OWASP Top 10:2025

2 source controls mapped|3 target controls covered

OWASP MASVS

2 source controls mapped|3 target controls covered

OWASP DevSecOps Maturity Model (DSOMM)

2 source controls mapped|4 target controls covered

OWASP ASVS

2 source controls mapped|3 target controls covered

Nigeria Data Protection Regulation (NDPR)

2 source controls mapped|1 target controls covered

Nevada Gaming Control Board Cybersecurity Requirements

2 source controls mapped|4 target controls covered

ASD Strategies to Mitigate Cyber Security Incidents

2 source controls mapped|16 target controls covered

ISO/IEC 27010:2015

2 source controls mapped|4 target controls covered

ISO/SAE 21434

2 source controls mapped|3 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

2 source controls mapped|4 target controls covered

ISO/IEC 27400:2022

2 source controls mapped|2 target controls covered

ISO/IEC 27011:2024

2 source controls mapped|5 target controls covered

ISO/IEC 27043:2015

2 source controls mapped|3 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

2 source controls mapped|4 target controls covered

BSI IT-Grundschutz

2 source controls mapped|9 target controls covered

FedRAMP Rev 5

2 source controls mapped|3 target controls covered

Canada ITSG-33 - IT Security Risk Management

2 source controls mapped|1 target controls covered

ISO/IEC 20000-1:2018

2 source controls mapped|3 target controls covered

ITIL 4

2 source controls mapped|3 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

2 source controls mapped|2 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

2 source controls mapped|5 target controls covered

ISO/IEC 27031:2011

2 source controls mapped|4 target controls covered

ISO/TS 22317:2021

2 source controls mapped|3 target controls covered

ISO 22316

2 source controls mapped|3 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

2 source controls mapped|3 target controls covered

Bahrain PDPL

2 source controls mapped|3 target controls covered

ISO/TS 22318:2021

2 source controls mapped|3 target controls covered

South Korea PIPA

2 source controls mapped|2 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

2 source controls mapped|2 target controls covered

Barbados Data Protection Act 2019

2 source controls mapped|2 target controls covered

BS 65000:2014 - Guidance on Organizational Resilience

1 source controls mapped|2 target controls covered

OCC Heightened Standards (12 CFR Part 30, Appendix D)

1 source controls mapped|2 target controls covered

Aged Care Quality Standards 2019 (repealed edition)

1 source controls mapped|1 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

1 source controls mapped|3 target controls covered

Singapore AI Governance Framework

1 source controls mapped|1 target controls covered

French Sapin II Law (Law No. 2016-1691)

1 source controls mapped|2 target controls covered

Vermont Data Privacy and Online Surveillance Act

1 source controls mapped|1 target controls covered

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)

1 source controls mapped|1 target controls covered

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)

1 source controls mapped|2 target controls covered

OWASP Top 10 for LLM Applications 2025

1 source controls mapped|1 target controls covered

OWASP API Security Top 10 - 2023

1 source controls mapped|1 target controls covered

Ontario Accessibility for Ontarians with Disabilities Act (AODA) - IASR Web Standard

1 source controls mapped|1 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

1 source controls mapped|4 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

1 source controls mapped|1 target controls covered

ISO/IEC 27006-1:2024

1 source controls mapped|1 target controls covered

FedRAMP High

1 source controls mapped|2 target controls covered

FedRAMP Moderate

1 source controls mapped|2 target controls covered

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties

1 source controls mapped|2 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

1 source controls mapped|4 target controls covered

Florida Digital Bill of Rights (FDBR)

1 source controls mapped|1 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

1 source controls mapped|3 target controls covered

ISO 9001:2015

1 source controls mapped|1 target controls covered

ISO 30401

1 source controls mapped|1 target controls covered

BREEAM - Building Research Establishment Environmental Assessment Method

1 source controls mapped|1 target controls covered

21 CFR Part 211 - Current Good Manufacturing Practice

1 source controls mapped|1 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

1 source controls mapped|1 target controls covered

SQF Code Edition 9 - Safe Quality Food

1 source controls mapped|2 target controls covered

ISO/IEC 29134:2023

1 source controls mapped|3 target controls covered

Space ISAC (Information Sharing and Analysis Center) - Threat Framework

1 source controls mapped|1 target controls covered

ISO 41001:2018 - Facility Management Systems

1 source controls mapped|1 target controls covered

GDPR

1 source controls mapped|1 target controls covered

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model

1 source controls mapped|1 target controls covered

ISO/IEC 29147:2018

1 source controls mapped|1 target controls covered

ISO 26000:2010

1 source controls mapped|1 target controls covered

ISO 27799:2025

1 source controls mapped|1 target controls covered

ISO 50001:2018 - Energy Management Systems

1 source controls mapped|1 target controls covered

ISO 22000:2018

1 source controls mapped|1 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

1 source controls mapped|2 target controls covered

Voluntary Principles on Security and Human Rights (VPs)

1 source controls mapped|1 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

1 source controls mapped|2 target controls covered

Singapore Cybersecurity Act 2018

1 source controls mapped|1 target controls covered

Pakistan Personal Data Protection Bill 2023

1 source controls mapped|1 target controls covered

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems

1 source controls mapped|2 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

1 source controls mapped|1 target controls covered

Nebraska Data Privacy Act

1 source controls mapped|1 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

1 source controls mapped|1 target controls covered

APPI

1 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

1 source controls mapped|2 target controls covered

COSO Internal Control - Integrated Framework (2013)

1 source controls mapped|1 target controls covered

Compare NERC CIP with UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

Coverage is not the same as your position

This page shows what NERC CIP overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is NERC CIP and who does it apply to?

NERC CIP is a compliance framework from North America (United States under FERC; Canadian provinces by adoption) with 13 domains and 162 controls. The mandatory NERC Critical Infrastructure Protection Reliability Standards for the North American bulk electric system as in force on 25 September 2026, CIP-002-5.1a to CIP-014-3, modelled at the requirement parts NERC audits: categorization of BES Cyber Systems, policies and low impact plans, personnel and training, electronic security perimeters and remote access, physical security, system security management, incident response and reporting, recovery, configuration and vulnerability management with transient devices, information protection, Control Center communications, supply chain and transmission station physical security. Versions approved for 2028 and 2029 (virtualization, CIP-003-11, CIP-014-4, CIP-015 internal network security monitoring) are recorded on each affected requirement. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NERC CIP actually require?

NERC CIP has 162 controls organised across 13 domains. The largest domains are CIP-010: Configuration Change Management and Vulnerability Assessments – NERC CIP (21 controls), CIP-014: Physical Security – NERC CIP (21 controls), CIP-007: System Security Management – NERC CIP (20 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NERC CIP do I already cover?

NERC CIP maps to 115 other compliance frameworks. The top mapping partners are UK Defence Standard 05-138 - Cyber Security for Defence Suppliers (2% coverage), ISO 28001:2007 Supply Chain Security Management (2% coverage), APRA CPS 230 Operational Risk Management (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NERC CIP?

Start your NERC CIP compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NERC CIP requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 162 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required