A substation control network does not get a maintenance window because an auditor is coming. That tension sits underneath every conversation about NERC CIP compliance in the energy sector. The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are mandatory cybersecurity rules for the bulk power system, backed by civil penalties reaching $1,584,648 per violation, per day. The equipment they govern is the same set of programmable logic controllers (PLCs), relays and human machine interfaces (HMIs) that has to keep delivering power while you comply.
Most published guidance stopped being current in 2024. A fourteenth CIP standard entered the enforcement queue in 2025, and it requires utilities to watch traffic inside their trusted network rather than only at its edge. Here is what NERC CIP compliance requires today, and what the 2028 deadline means for operational technology (OT) architecture.
What NERC CIP Compliance Means, and Who Has to Meet It
NERC CIP compliance means meeting mandatory reliability standards that protect the cyber systems supporting the North American bulk electric system (BES). NERC writes the standards, the Federal Energy Regulatory Commission (FERC) approves them, and Regional Entities audit them. Once approved, a standard carries the force of federal regulation, so a failed audit is a regulatory finding rather than an internal action item.
Who NERC CIP Applies To
Federal regulation places users, owners and operators of the bulk-power system under FERC jurisdiction for reliability standards. That covers generation and transmission owners and operators, balancing authorities, reliability coordinators, transmission operators and distribution providers registered with NERC. The obligation follows the registered function, not the size of the utility.
The reach surprises engineering teams. These standards do not stop at the corporate firewall. They land in OT cybersecurity territory, on the control networks and field devices in substations and generation plants.
How Impact Classification Sets Your Obligations
Not every asset carries the same NERC CIP compliance burden. CIP-002-5.1a exists to categorize BES Cyber Systems so that security requirements match the harm that losing, compromising or misusing them would do to the reliable operation of the BES.
Categorization produces three tiers – high, medium and low impact – and the tier decides how much of the CIP body applies. Control centers generally rate high, larger generation and transmission facilities rate medium, and everything else in scope falls to low. Low is not exempt. CIP-003-9, the security management standard covering low-impact assets, became enforceable on April 1, 2026.
Classification errors cost you both ways. Over-classify and you inherit controls your maintenance staff cannot sustain. Under-classify and a finding waits on the next audit.
The NERC CIP Standards List, With Current Versions and Enforcement Dates
Published lists go stale quickly, because each standard carries a version number that increments as revisions are approved. The table below holds the versions enforceable now, with NERC’s official titles.
| Standard | Official title | Enforceable since |
|---|---|---|
| CIP-002-5.1a | BES Cyber System Categorization | Dec 27, 2016 |
| CIP-003-9 | Security Management Controls | Apr 1, 2026 |
| CIP-004-7 | Personnel & Training | Jan 1, 2024 |
| CIP-005-7 | Electronic Security Perimeter(s) | Oct 1, 2022 |
| CIP-006-6 | Physical Security of BES Cyber Systems | Jul 1, 2016 |
| CIP-007-6 | System Security Management | Jul 1, 2016 |
| CIP-008-6 | Incident Reporting and Response Planning | Jan 1, 2021 |
| CIP-009-6 | Recovery Plans for BES Cyber Systems | Jul 1, 2016 |
| CIP-010-4 | Configuration Change Management and Vulnerability Assessments | Oct 1, 2022 |
| CIP-011-3 | Information Protection | Jan 1, 2024 |
| CIP-012-2 | Communications between Control Centers | Jul 1, 2026 |
| CIP-013-2 | Supply Chain Risk Management | Oct 1, 2022 |
| CIP-014-3 | Physical Security | Jun 16, 2022 |
| CIP-015-1 | Internal Network Security Monitoring | Enforceable Oct 1, 2028 |
Revised versions of ten of those standards are already approved, and all of them become enforceable on July 1, 2028. Test architecture decisions against those revisions too.
The Four Standards That Decide Your OT Network Architecture
Ten of the fourteen standards are governance, personnel and process work. Four dictate how the network gets built, and those four are where hardware and tooling choices become NERC CIP compliance decisions.
CIP-005 – Electronic Security Perimeter(s)
You draw a defined boundary around your BES Cyber Systems, route every external routable connection through a controlled access point, and manage vendor remote access with the ability to identify active sessions and cut them.
The hard part is that industrial control system (ICS) protocols assume a trusted network. Modbus, DNP3 and EtherNet/IP carry no native authentication, so a boundary device reading only addresses and ports cannot separate a legitimate control command from a malicious one on the same port.
CIP-007 – System Security Management
CIP-007 covers ports and services, patch management, malicious code prevention, security event logging and account access. Its patch cycle is the requirement teams cite most often as painful, because a control system that cannot restart outside an outage window does not fit a fixed evaluation schedule.
Guidance built for corporate endpoints assumes a machine can be rebooted. A turbine controller cannot, which is why compensating controls and documented mitigation plans exist.
CIP-010 – Configuration Change Management and Vulnerability Assessments
You hold a baseline configuration for every in-scope system, authorize and document changes against it, verify the change did not defeat a security control, and run vulnerability assessments on a set cadence.
Active scanning is the risk here, because probing a live PLC can hang it. Most utilities meet the requirement passively on production systems, reserving active testing for a mirrored environment.
CIP-015 – Internal Network Security Monitoring
CIP-015-1 is the newest standard and the one missing from nearly every published NERC CIP guide. NERC states its purpose as raising the probability of detecting anomalous or unauthorized network activity, so that response and recovery after an attack improve.
The shift matters. CIP-005 protects the boundary. CIP-015 assumes the boundary will eventually be crossed and requires you to see east-west traffic inside the trust zone – a PLC talking to an HMI, devices that have always communicated without anyone watching.
The CIP-015-1 timeline, on the record
- NERC adopted the standard on May 9, 2024 and filed it with FERC on June 24, 2024.
- FERC approved it on June 26, 2025 through Order No. 907, Docket No. RM24-7-000, published at 90 FR 28889.
- The rule took effect September 2, 2025.
- Enforcement begins October 1, 2028.
- A wider version follows. FERC directed NERC to extend internal network security monitoring to electronic access control or monitoring systems (EACMS) and physical access control systems (PACS) outside the electronic security perimeter. That becomes CIP-015-2, enforceable October 1, 2029.
Two years reads like runway until you price the work. Internal monitoring means instrumentation where most utilities have none, and a substation retrofit moves at the speed of outage scheduling. Our earlier analysis of what NERC CIP-015-1 requires covers why passive traffic mirroring alone tends to fall short.
What NERC CIP Compliance Looks Like Day to Day
The standards give you the obligations. Operating under them gives a different picture.
- Evidence is the deliverable. Auditors assess documented proof, not intentions. A control that works but generates no record is a finding.
- Asset inventory drifts constantly. An integrator swaps a failed switch, a contractor adds a laptop, a spare relay goes in during storm response. Each is a CIP-010 baseline event.
- Production continuity outranks speed. A security action that trips a generating unit causes the outcome the standards exist to prevent.
- Vendor access is a standing exposure. CIP-005 requires you to know which vendor sessions are live and to cut them. Many utilities find out mid-audit that they cannot answer the first half.
- Low impact is not no impact. With CIP-003-9 enforceable since April 2026, low-impact sites carry real duties for access control and incident response.
How OT-Native Tools Map to NERC CIP Requirements
For NERC CIP compliance, the tooling question comes down to one thing. Does the product understand industrial protocols and production constraints, or was it built for a corporate network and pointed at a substation afterward?
| Standard | What the network has to do | Where IT-first tooling struggles |
|---|---|---|
| CIP-005 | Enforce a controlled perimeter and inspect what crosses it | Port and address filtering cannot read Modbus or DNP3 function codes |
| CIP-007 | Limit ports and services, log security events, control accounts | Agent-based controls have nowhere to run on a relay or a PLC |
| CIP-010 | Hold a configuration baseline and detect drift from it | Active scanning can hang the very devices being assessed |
| CIP-015 | See and act on east-west traffic inside the trust zone | Mirrored traffic reports what happened but changes nothing |
Three capabilities carry most of the weight. Deep packet inspection (DPI) lets a boundary device judge a control command rather than a port number. Explicit communication policy turns segmentation from a diagram into an enforced rule. Continuous internal visibility is the CIP-015 requirement in one phrase.
DYNICS builds toward all three. ICS360.Defender, the company’s industrial security platform, provides real-time visibility, DPI firewalling and secure remote access on rugged hardware built for substation environments. The OT SDN Controller handles the policy side. Switches pass no traffic unless a rule permits it, and rules reach down to one PLC talking to one HMI over DNP3 – deny-by-default segmentation with an audit trail attached.
Why an OT Manufacturer Reads These Standards Differently
DYNICS has designed, fabricated and assembled industrial computing hardware in Ann Arbor, Michigan for more than 30 years, in a 37,500+ sq. ft. facility where over 75% of staff work in product development, design, assembly and service. Its products support environments requiring compliance with NERC CIP, IEC 62443 and NIST CSF, on Buy American Act (BAA) compliant hardware.
That background shapes the posture. Jeff Smith, who represents Dynics on OT cybersecurity at the S4 Conference and the Level Zero OT Cyber Security Conference, argues consistently that security which disrupts production is not security. The same thinking showed up at the Alabama Water OT/IT Cyber Summit, where the advice to budget-constrained critical infrastructure operators was to start with an assessment and build in modules. Water utilities sit outside NERC CIP jurisdiction, but the operational math is identical.
For generation and transmission operators, that shows up as hardware and security designed together for the same environment, across energy sector operations.
Frequently Asked Questions
What is NERC CIP?
NERC CIP is a family of mandatory cybersecurity reliability standards written by the North American Electric Reliability Corporation and approved by FERC. They protect the cyber systems supporting the bulk electric system, covering asset categorization, access control, system hardening, incident response, recovery, supply chain and network monitoring.
Does NERC CIP apply to industrial control systems?
Yes. NERC CIP compliance obligations land directly on the industrial control systems operating the bulk electric system, including PLCs, relays, remote terminal units and HMIs in generation plants, substations and control centers. CIP-005, CIP-007, CIP-010 and CIP-015 all set requirements on ICS networks rather than corporate IT.
Who does NERC CIP apply to?
Users, owners and operators of the bulk-power system, as defined in federal regulation. That means generation and transmission owners and operators, balancing authorities, reliability coordinators, transmission operators and distribution providers registered with NERC.
Is NERC CIP mandatory?
Yes. Once FERC approves a reliability standard it becomes federally enforceable, and registered entities are audited against it. NERC CIP compliance is not a voluntary framework.
How many NERC CIP standards are there?
Fourteen, running from CIP-002 through CIP-015, either in force or approved and pending enforcement. Each carries a version number that changes as revisions are approved, so check the version before an audit.
What is NERC CIP-015-1?
CIP-015-1 is the internal network security monitoring standard. FERC approved it on June 26, 2025 through Order No. 907, it took effect September 2, 2025, and enforcement begins October 1, 2028. It requires visibility into network activity inside the trusted zone, not at the perimeter alone. CIP-015-2 extends that monitoring to EACMS and PACS outside the perimeter from October 1, 2029.
What tools help meet NERC CIP requirements?
Tools that understand industrial protocols and respect production windows. OT firewalls with deep packet inspection for Modbus, DNP3 and EtherNet/IP, network controllers that enforce explicit communication policy, passive monitoring that will not hang a live PLC, and logging that produces audit evidence without an agent on every device.
What are the penalties for NERC CIP non-compliance?
Under the Federal Power Act, as adjusted for inflation in 18 CFR 385.1602(d), the maximum civil penalty reaches $1,584,648 per violation, per day. Actual penalties are set against the severity of the violation and the entity’s compliance history.
Where to Start
Three questions decide your next move. Is your impact classification current and defensible. Can you produce evidence for the controls you claim. And do you know where the instrumentation gaps sit inside your trust zone before October 2028. The third is where most NERC CIP compliance programs still have work to do.
Talk to a Dynics Energy Sector Specialist
Get a straight read on how your OT network maps to NERC CIP compliance requirements, and what CIP-015-1 changes for your architecture.
Sources
- NERC – CIP Reliability Standards – standard numbers, titles and effective dates
- Federal Register – FERC Order No. 907 approving Reliability Standard CIP-015-1 – 90 FR 28889, Docket No. RM24-7-000
- 18 CFR 385.1602 – Civil penalties, as adjusted – current maximum under the Federal Power Act
