← Frameworks / Energy Regulation

NERC Critical Infrastructure Protection Standards

Mandatory reliability standards for the Bulk Electric System (BES) in North America. 14 CIP standards (CIP-002 through CIP-015) covering BES Cyber System categorization, security management controls, personnel and training, electronic security perimeters, physical security, system security management, incident reporting, recovery plans, configuration and vulnerability management, information protection, control center communications, supply chain risk management, transmission station physical security, and internal network security monitoring (INSM). Enforced by NERC with mandatory compliance, violations, and penalties.

Clauses: 14
Avg Coverage: 78.1%
Publisher: North American Electric Reliability Corporation (NERC) Version: v5-7 (2024)
NERC CIP → SP 800-53 SP 800-53 → NERC CIP Coverage Analysis
Clause Title SP 800-53 Controls
CIP-002-7 BES Cyber System Categorization
RA-02 RA-03 PM-07 PM-11 SC-07
CIP-003-9 Security Management Controls
PL-01 PL-02 PM-01 PM-02 PM-03 PM-09 AC-01 AT-01
CIP-004-7 Personnel & Training
AT-01 AT-02 AT-03 AT-04 PS-01 PS-02 PS-03 PS-04 PS-05 PS-06 PS-07 AC-02
CIP-005-7 Electronic Security Perimeter
SC-07 AC-04 AC-17 AC-20 IA-02 IA-08 CM-07
CIP-006-6 Physical Security of BES Cyber Systems
PE-01 PE-02 PE-03 PE-04 PE-05 PE-06 PE-08 PE-16 PE-18
CIP-007-6 System Security Management
CM-07 SI-02 SI-03 SI-04 AU-02 AU-06 AC-02 AC-03 IA-05
CIP-008-6 Incident Reporting and Response Planning
IR-01 IR-02 IR-04 IR-05 IR-06 IR-08
CIP-009-6 Recovery Plans for BES Cyber Systems
CP-01 CP-02 CP-04 CP-09 CP-10 IR-04
CIP-010-4 Configuration Change Management and Vulnerability Assessments
CM-02 CM-03 CM-04 CM-06 CM-08 RA-05 CA-08
CIP-011-3 Information Protection
MP-01 MP-02 MP-04 MP-06 SC-28 AC-03
CIP-012-1 Communications between Control Centers
SC-08 SC-12 SC-13 SC-23
CIP-013-2 Supply Chain Risk Management
SR-01 SR-02 SR-03 SR-05 SR-06 SR-11 SA-04 SA-09 SA-22 CM-14
CIP-014-3 Physical Security
PE-01 PE-03 PE-06 RA-03 RA-05 PM-12
CIP-015-1 Internal Network Security Monitoring (INSM)
SI-04 SC-07 CA-07 IR-04 SC-48 AU-06