NERC CIP is the set of mandatory cybersecurity and physical security standards for the North American power system. It ranks cyber systems by impact (high, medium or low) and applies more controls to higher-impact systems: perimeter and remote access, ports, patching, accounts, logs, change management, incident response, recovery and supply chain. It is not mandatory outside North America, but many national guidelines were built on it, and it appears in tenders from multinational utilities.
What NERC CIP is
NERC (North American Electric Reliability Corporation) publishes the reliability standards of the North American power system, and FERC approves them for the United States. The Critical Infrastructure Protection (CIP) standards cover cybersecurity and physical security. They are mandatory for entities registered with NERC, and compliance is audited.
The logic is risk-based. First, each cyber system is ranked by the impact its compromise would have on the power system. Then controls proportional to that impact are applied. How CIP-002 ranks a substation, and the specific requirements for remote access, patching, logs and baselines, are in electrical cybersecurity: NERC CIP and Latin America. This guide puts the whole set in order and reviews what is new.
The standards, by topic
The versions in the table are the ones cited as a reference by the CNO cybersecurity guide (Agreement 1960 of 2025, Colombia). NERC revises its standards often, so confirm the current version at nerc.com before citing one in a contract.
| Standard | Topic | What it means in the substation |
|---|---|---|
| CIP-002-5.1a | Categorizing systems by impact | Knowing which substations and systems are high, medium or low impact |
| CIP-003-9 | Security management controls | Policies and, for low impact, minimum controls for access and transient devices |
| CIP-004-7 | Personnel and training | Who has access, with what screening and training, and how access is removed |
| CIP-005-7 | Electronic security perimeter | Controlled access points and remote access through an intermediate system, encrypted and with multifactor authentication |
| CIP-006-6 | Physical security of cyber systems | Physical access control to control and communications rooms |
| CIP-007-6 | System security management | Required ports, patches, malware protection, logs and passwords |
| CIP-008-6 | Incident reporting and response | Response plan and reporting |
| CIP-009-6 | Recovery plans | Backups and tested recovery |
| CIP-010-4 | Configuration, changes and vulnerabilities | Baseline of firmware, ports and patches, and vulnerability assessment |
| CIP-011-3 | Information protection | Protecting system information |
| CIP-012-1 | Communications between control centers | Protecting data between control centers |
| CIP-013-2 | Supply chain | Vendor risks, including their remote access |
| CIP-014-3 | Physical security of transmission substations | Assessing and physically protecting critical substations |
| CIP-015-1 | Internal network security monitoring | Watching traffic inside the perimeter |
What was approved in 2025 and 2026
CIP-015-1, internal network monitoring (INSM). FERC approved it on June 26, 2025 with Order 907. It requires internal network security monitoring for high-impact systems, with or without external routable connectivity, and for medium-impact systems with external routable connectivity. The same order asked NERC to extend monitoring to electronic access control or monitoring systems and physical access control systems located outside the perimeter. NERC filed CIP-015-2 in 2026 for that purpose. It is the same idea as intrusion detection in substation networks: learn the normal traffic and alert on anything different.
CIP-003-11, low impact. FERC approved it in an action published on March 24, 2026 and effective May 26, 2026. It retires the previous version once in force. Its goal is to reduce the risk of a coordinated attack on many low-impact sites, whose combined effect can be far larger than that of a single one. It adds three kinds of control for low-impact assets with external routable connectivity: authenticating remote users, protecting authentication data in transit, and detecting malicious communications to or between those assets. It also includes the virtualization revisions.
Virtualization (Order 919). On the same date, FERC approved eleven modified CIP standards and four new definitions in the NERC glossary to allow the secure use of virtualization and other new technologies. It asked NERC for clear criteria for the “per system capability” exception that appears in several requirements.
The trend is clear. Controls once asked only of large facilities are moving down to low-impact sites, which are the majority by number, and remote access by users and vendors is at the center.
What to reuse outside North America
Outside North America, NERC CIP is not mandatory, but it carries weight in three ways:
- National guidelines are built on it. Colombia’s CNO guide, for example, states that it took CIP-002 to CIP-014 as its main reference, selecting and adapting what applies locally. Concepts such as critical cyber asset, electronic security perimeter, intermediate system for remote access, removable media and transient cyber assets come from there.
- Regulation is following. Governments are asking their regulators to set cybersecurity rules for transmission and regional grids aligned with international standards such as NERC and IEC. Colombia did so in 2026, giving its regulator 24 months.
- Tenders. Companies with North American operations often ask contractors for practices aligned with CIP-005, CIP-007, CIP-010 and CIP-013.
What helps a substation anywhere is not copying NERC’s compliance structure, but taking its technical requirements as a list of measurable good practices. These are:
- remote access only through an intermediate system with multifactor authentication;
- minimum ports and services;
- a firmware and configuration baseline that is compared periodically with what is installed;
- patch assessment with defined deadlines;
- retained logs;
- internal traffic monitoring.
The technical standards that put those controls into practice are IEC 62443, IEC 62351 and IEEE 1686. What an IED backup must include, how it is verified and how recovery is tested is covered in IED Settings Backup and Recovery.
- Reference CIP requirement
- Equivalent in the national guideline. Section of the guideline annex
- Technical control. Firewall, intermediate system, accounts, baseline, log
- Evidence. Procedure, saved configuration, logs
- Requirement covered with its evidence
What not to do
- Cite a version without checking it. CIP standards change version and effective date often.
- Confuse approval with enforceability. A standard approved by FERC takes effect under its implementation plan, which can give months or years.
- Use the CIP-002 classification in place of the local one. Outside North America, critical assets are identified with the criteria of the local rule or guideline.
We configure your equipment with measurable criteria
At Tiza Group we configure relays, controllers, gateways and switches with individual accounts, minimum ports and services, event logging and configuration backup, in substations and industry, as part of our substation and plant cybersecurity service. We handle engineering access to relays with remote relay configuration, which works through the intermediate system and in the windows you authorize. Write to us. How to put the plan together, with roles, escalation and annual tests, is covered in OT Incident Response Plan for a Substation.
Related guides
- Electrical cybersecurity: NERC CIP and Latin America
- Secure remote access to relays and substations
- Intrusion detection (IDS) in substation networks
- Configuration management: settings and SCD versions
- IEC 62443 in substations: zones, conduits and SL levels
- Substation and plant cybersecurity: standards and map
- CNO Agreement 1960: cybersecurity guide for Colombia’s grid
- Remote access to solar plants: rules around the world
- IED Settings Backup and Recovery: What to Keep and Test
- OT Incident Response Plan for a Substation
References
- NERC, reliability standards CIP-002 to CIP-015 (current version at nerc.com).
- FERC, Order 907 (June 26, 2025), approval of CIP-015-1, Internal Network Security Monitoring, docket RM24-7-000.
- FERC, final action on CIP-003-11, Cyber Security – Security Management Controls, Federal Register, document 2026-05711 (March 24, 2026).
- FERC, Order 919, Virtualization Reliability Standards, docket RM24-8-000, Federal Register, document 2026-05716 (March 24, 2026).
Frequently asked questions
Does a company outside North America have to comply with NERC CIP?
No. NERC CIP is mandatory for entities registered with NERC in North America. Elsewhere, national rules or guidelines apply; several of them, such as Colombia's CNO cybersecurity guide, were written using the CIP standards as their main reference. NERC CIP can still appear as a contract requirement in tenders from companies with North American operations.
What changed with CIP-003-11?
FERC approved it in an action effective May 26, 2026. It strengthens the controls for low-impact systems with external routable connectivity: authenticating remote users, protecting authentication data in transit, and detecting malicious communications to or between those assets. When each entity must comply follows the approved implementation plan.
What is CIP-015?
It is the internal network security monitoring (INSM) standard. It requires watching the traffic inside the perimeter of high-impact systems, and of medium-impact systems with external routable connectivity, to detect abnormal activity. FERC approved it in 2025 with Order 907 and asked NERC to extend it to other systems.