NERC CIP isn't a framework you adopt.
It's a standard you're held to.

NERC CIP is mandatory for entities that own or operate the Bulk Electric System (BES) in North America — not a voluntary framework you can opt out of if it applies. The BES generally includes generation above certain capacity thresholds, transmission facilities at 100 kV and above, and the control centers operating them. If you own or operate that infrastructure, compliance is legally required, enforced by NERC under authority delegated by FERC in the U.S. and equivalent regulators in Canada, through six Regional Entities.

There's an important boundary: distribution-only utilities below the BES threshold are generally not subject to mandatory CIP compliance, though many adopt the standards voluntarily as a baseline. So the practical first question isn't how to comply, but precisely which of your assets are in scope — because miscategorizing what counts as a BES Cyber System is one of the most consequential mistakes you can make.

Because CIP-002 (BES Cyber System Categorization) determines the scope and rigor of everything else — it's the foundation of the entire program. Under CIP-002 you identify your BES Cyber Systems and classify them as High, Medium, or Low impact, and that rating drives which requirements across the other standards apply and how stringent they are. High and Medium impact systems face the most demanding controls — layered access management, physical security, personnel training — while Low impact systems carry a lighter but real and growing set of obligations.

Get categorization wrong and every downstream decision inherits the error: you over-invest in controls for systems that don't need them, or — far more dangerously — under-protect systems you misclassified as lower impact and end up with serious audit findings. That's why categorization is where we start. An accurate, defensible, well-documented categorization both scopes your work sensibly and is the thing an auditor scrutinizes first.

Not necessarily — this is the single most common trap in NERC CIP. The condition assessors encounter most often isn't willful non-compliance but partial compliance: an organization has addressed the visible requirements and genuinely believes it's meeting the standard, while gaps remain in asset categorization, access management, or evidence collection that would produce findings in a formal audit.

NERC CIP is unusually demanding about documentation — it's not enough to have implemented a control; you must prove, with retained evidence, that it operated as required throughout the audit period. Many utilities have strong operational security but can't produce the cyber asset inventories, configuration baselines, access reviews, and change records an auditor expects, and that evidentiary gap is what turns into penalties. Because penalties are assessed per-violation, per-day and can reach up to $1 million per day for the most serious violations, the distance between feeling compliant and being demonstrably compliant is expensive. We focus on closing exactly that gap.

The most significant recent change for smaller operators is CIP-003-9, the Supply Chain Low-Impact Revisions, which became enforceable on April 1, 2026. Historically, low-impact BES cyber systems had comparatively light oversight, and many municipally owned utilities and rural cooperatives operated comfortably in that tier. CIP-003-9 changes that by extending specific supply-chain risk requirements down to low-impact assets — reflecting that attackers increasingly target the supply chain, and that low-impact doesn't mean no-impact.

For a smaller utility this can be a jarring shift: requirements and an evidentiary burden that previously seemed to belong only to larger High and Medium impact operators now apply to you, and the timeline isn't generous. If your utility has low-impact BES cyber systems and hasn't worked through what CIP-003-9 requires of your vendor and supply-chain practices, that's live exposure now, not a future planning item. We help low-impact operators interpret the requirements realistically for their size and build the supply-chain controls and documentation the standard now expects.