What Is NERC CIP?

NERC CIP (Critical Infrastructure Protection) is a family of mandatory reliability standards developed by the North American Electric Reliability Corporation and approved by FERC. The standards, currently spanning CIP-002 through CIP-015, address asset identification and categorization, security management controls, personnel and training, electronic security perimeters, physical security, system security management, incident reporting, recovery plans, configuration change management, information protection, supply chain risk management, and internal network security monitoring.

The standards apply to registered entities that own or operate bulk electric system assets, including generation, transmission, and control centers, across the United States, Canada, and part of Mexico. Requirements scale with impact rating: high and medium impact BES Cyber Systems carry the full weight of the standards, while low impact assets have a narrower set of obligations under CIP-003.

The practical implication is that the compliance perimeter keeps expanding. CIP-003-9 vendor electronic remote access requirements for low impact assets became enforceable on April 1, 2026, and CIP-015-1 internal network security monitoring deadlines arrive in September 2028 and September 2030. Utilities that treat CIP as a static checklist fall behind the standard's own drafting cycle. See NERC CIP requirements explained and Z Cyber's work with utilities for how the standards translate into an operating program.