NERC CIP-002: BES Cyber System categorization, and the CIP-002-8 revision already on the way

Last updated: 2026-10-30

Key takeaways

NERC CIP-002-5.1a, "Cyber Security — BES Cyber System Categorization," is the mandatory, FERC-approved Reliability Standard that decides which systems the rest of the NERC CIP suite even applies to.
Evidence for both requirements must be retained for three calendar years, per the standard's Compliance section — the same retention period used across the rest of the CIP suite (see NERC CIP-010).
CIP-002's version history has a gap most of the CIP suite doesn't: there's no enforceable CIP-002-6.
That same day, in a separate proceeding (Docket No.

NERC CIP-002-5.1a, "Cyber Security — BES Cyber System Categorization," is the mandatory, FERC-approved Reliability Standard that decides which systems the rest of the NERC CIP suite even applies to. Per its own Purpose clause it exists "to identify and categorize BES Cyber Systems and their associated BES Cyber Assets for the application of cyber security requirements commensurate with the adverse impact that loss, compromise, or misuse of those BES Cyber Systems could have on the reliable operation of the BES." CIP-002-5.1a was adopted by the NERC Board of Trustees on 11/2/2016 and approved by FERC on 12/14/2016 — and it remains the enforceable version today, even though two successors, CIP-002-7 and CIP-002-8, are already FERC-approved for a 2028 compliance date (see below).

Who must comply

Section 4.1 names the same set of "Responsible Entity" functional types used across the CIP suite: Balancing Authority, a Distribution Provider that owns specific load-shedding, Special Protection System/Remedial Action Scheme or protection facilities, Generator Operator, Generator Owner, Interchange Coordinator or Interchange Authority, Reliability Coordinator, Transmission Operator and Transmission Owner. Unlike CIP-005, CIP-007 or CIP-010 — which apply only to systems CIP-002 has already categorized — CIP-002 itself applies to the broader universe of Control Centers, Transmission stations and substations, generation resources, system-restoration facilities, Special Protection Systems/Remedial Action Schemes, and (for Distribution Providers) specified Protection Systems, so that Requirement R1 can sort them into high, medium or low impact in the first place.

Four exemption categories (Section 4.2.3) take Cyber Assets out of scope entirely: assets at facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters; systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; and, for Distribution Providers, systems and equipment outside the standard's Section 4.2.1 scope.

R1 and R2: identify, then keep it current

Requirement	Violation Risk Factor	Core obligation
R1	High	Implement a process that identifies, for each in-scope asset: high-impact BCS per Attachment 1 Section 1 (Part 1.1); medium-impact BCS per Section 2 (Part 1.2); and any asset containing a low-impact BCS per Section 3, with no discrete list required (Part 1.3)
R2	Lower	Review the R1 identifications and update them if anything changed, "at least once every 15 calendar months, even if it has no identified items in Requirement R1" (Part 2.1); have the CIP Senior Manager or delegate approve those identifications on the same 15-month cadence (Part 2.2)

Evidence for both requirements must be retained for three calendar years, per the standard's Compliance section — the same retention period used across the rest of the CIP suite (see NERC CIP-010).

Attachment 1: how high, medium and low impact get decided

Attachment 1 itself warns that its criteria "do not constitute stand-alone compliance requirements, but are criteria characterizing the level of impact and are referenced by requirements" elsewhere in the CIP suite — CIP-005, CIP-007, CIP-010 and others all key their own scope off the impact rating CIP-002 assigns.

Impact tier	Representative criteria (not exhaustive)
High (Section 1, 4 criteria)	Control Centers performing Reliability Coordinator functions; Balancing Authority Control Centers for ≥3,000 MW aggregate generation in a single Interconnection (or meeting certain medium-impact criteria); Transmission Operator or Generator Operator Control Centers meeting specified medium-impact criteria
Medium (Section 2, 13 criteria)	Generation with an aggregate highest rated net Real Power capability ≥1,500 MW; Transmission Facilities operated at 500 kV or higher; BES reactive resources ≥1,000 MVAR; Remedial Action Schemes or automated switching systems whose loss could cause an Interconnection Reliability Operating Limit (IROL) violation; Control Centers below the high-impact thresholds
Low (Section 3)	The catch-all: any in-scope Control Center, Transmission station/substation, generation resource, system-restoration facility or qualifying Protection System not meeting a high or medium criterion — a discrete list is explicitly not required

The CIP-002-6 standard that never was

CIP-002's version history has a gap most of the CIP suite doesn't: there's no enforceable CIP-002-6. NERC's Board of Trustees adopted a CIP-002-6 draft on 5/14/2020 — modifying Attachment 1 Criterion 2.12 — and NERC petitioned FERC for approval on 6/12/2020 (Docket No. RM20-17-000). FERC never acted on it. At its 2/4/2021 meeting the NERC Board instead approved a resolution to withdraw the proposal, and NERC's 2/5/2021 Notice of Withdrawal gave its own reasoning directly: "In light of recent cybersecurity events and the evolving threat landscape, NERC asserts that additional caution is warranted regarding any criteria that may permit more entities to categorize Bulk Electric System ('BES') Cyber Systems as low impact, such as the revisions proposed in CIP-002-6, and recommends further study." CIP-002-5.1a stayed in force, and the version sequence simply skips from 5.1a to 7.

Two successors, approved the same day, one retiring the other

The Criterion 2.12 problem that sank CIP-002-6 didn't go away — it resurfaced as a separate project, and it's now tangled together with an unrelated virtualization revision in a way worth understanding before either takes effect. On 3/19/2026, FERC issued Order No. 919 (Docket No. RM24-8-000), approving CIP-002-7 as one of 11 modified CIP standards in NERC's Project 2016-02 virtualization package (alongside CIP-005-8, CIP-010-5 and others — see NERC CIP-005 and NERC CIP-010). The order itself is explicit that this revision is narrow: "the revisions in Reliability Standard CIP-002-7 are minor, mostly aligning the standard with updates to" NERC Glossary terms needed for virtualized and Shared Cyber Infrastructure environments.

That same day, in a separate proceeding (Docket No. RD25-8-000), FERC approved CIP-002-8 — NERC's Project 2021-03 Transmission Owner Control Center (TOCC) fix, submitted as its own petition on 12/20/2024. CIP-002-8 revises the NERC Glossary's "control center" definition so that "a Transmission Owner is considered to have a Control Center if it has the capability to control transmission Facilities at two or more locations using SCADA," and reworks Attachment 1 Criterion 2.12 around a new aggregated-weighted-value threshold for the transmission lines a control center monitors — the same categorization problem CIP-002-6 tried and failed to solve in 2020-21, now built on top of CIP-002-7 rather than CIP-002-5.1a. The order is explicit about the sequencing: FERC "approve[s] the retirement of Reliability Standard CIP-002-7 immediately prior to the effective date of proposed Reliability Standard CIP-002-8," with CIP-002-8 effective on "the later of" CIP-002-7's own effective date or three months after FERC's approval of CIP-002-8. Since CIP-002-7's effective date — per NERC's Project 2016-02 implementation plan, which computes from Order No. 919's 26 May 2026 effective date — lands on 1 July 2028, that later date governs for CIP-002-8 too: in practice, CIP-002-7 is scheduled to exist for a matter of moments before CIP-002-8 supersedes it on the same compliance date.

A workable starting point

Treat CIP-002 as the gate, not a formalityEvery other CIP standard's scope — EACMS, PACS, PCA, which requirements apply at all — flows from the high/medium/low impact rating R1 assigns; a categorization error here understates obligations everywhere else in the suite.
Re-run the Attachment 1 analysis on a real 15-month cadence, not just when something obviously changes — R2's review-and-approval requirement applies "even if it has no identified items in Requirement R1," so a "nothing to report" outcome still needs to be documented and approved on schedule.
Watch Criterion 2.12 specifically if you're a Transmission Owner or Operator with Control Center functionsIt's the criterion CIP-002-6 tried to change in 2020, that NERC withdrew over low-impact-categorization concerns, and that CIP-002-8 now revises with a new aggregated-weighted-value threshold — a part of the standard with an unusually contested recent history.
Track CIP-002-7 and CIP-002-8 as a pair, not two separate projectsCIP-002-8 is built on top of CIP-002-7 and is designed to retire it "immediately prior to" its own effective date — reviewing only the virtualization redline (CIP-002-7) without the control-center-definition and Criterion 2.12 changes in CIP-002-8 would miss the version that actually governs from 1 July 2028.
Start evaluating the new "control center" definition nowCIP-002-8's SCADA-based Control Center definition extends to Transmission Owners that previously may not have considered themselves in scope — categorization decisions treated as settled under CIP-002-5.1a may not hold once the new definition applies.

SoftWSP's OT asset assessments can help document the BES Cyber System inventory and Attachment 1 impact-rating evidence CIP-002 requires, and flag assets whose categorization may shift under the incoming "control center" definition: see OT Snapshot.

This guide quotes NERC's own published text of CIP-002-5.1a, CIP-002-7 and NERC's Notice of Withdrawal of CIP-002-6, and the Federal Register text of FERC Order No. 919 and the CIP-002-8 approval order; it is not a substitute for the full standards or compliance/legal advice. CIP-002-5.1a remains the enforceable standard as of this guide's publication — CIP-002-7 and CIP-002-8 are approved but not yet mandatory.

Sources

Frequently asked questions

What is NERC CIP-002-5.1a, and what does it require?

CIP-002, "Cyber Security — BES Cyber System Categorization," is the mandatory, FERC-approved NERC Reliability Standard that tells utilities and grid operators which of their systems are even in scope for the rest of the CIP suite. Per its own Purpose statement, the currently effective version, CIP-002-5.1a, exists "to identify and categorize BES Cyber Systems and their associated BES Cyber Assets for the application of cyber security requirements commensurate with the adverse impact that loss, compromise, or misuse of those BES Cyber Systems could have on the reliable operation of the BES." CIP-002-5.1a was adopted by the NERC Board of Trustees on 11/2/2016 and approved by FERC on 12/14/2016 (Docket No. RD17-2-000). Requirement R1 requires a documented process that identifies high-impact BES Cyber Systems (BCS) per Attachment 1 Section 1, medium-impact BCS per Section 2, and assets containing low-impact BCS per Section 3 (no discrete low-impact list is required); Requirement R2 requires reviewing and CIP Senior Manager approval of those identifications "at least once every 15 calendar months."

How do Attachment 1's high, medium and low impact criteria work?

Attachment 1's own framing note states its criteria "do not constitute stand-alone compliance requirements, but are criteria characterizing the level of impact and are referenced by requirements." Section 1 (high impact) lists four Control-Center-only criteria tied to Reliability Coordinator functions, Balancing Authority functions above 3,000 MW aggregate generation, and Transmission Operator/Generator Operator Control Centers meeting other medium-impact thresholds. Section 2 (medium impact) lists 13 bright-line criteria covering things like generation plants with an aggregate highest rated net Real Power capability of 1,500 MW or more, Transmission Facilities operated at 500 kV or higher, reactive resources of 1,000 MVAR or more, Remedial Action Schemes or automated switching systems whose loss could violate an Interconnection Reliability Operating Limit (IROL), and Control Centers below the high-impact thresholds. Section 3 (low impact) is the catch-all: any in-scope BCS at a Control Center, Transmission station/substation, generation resource, system restoration facility or qualifying Protection System that doesn't meet a high or medium criterion defaults to low impact, with no requirement to individually list them.

What happened to CIP-002-6 — why does the version sequence jump from 5.1a to 7?

NERC submitted CIP-002-6 to FERC for approval on 6/12/2020 (Docket No. RM20-17-000), after the NERC Board of Trustees had adopted it on 5/14/2020 to modify Attachment 1 Criterion 2.12. FERC never acted on it: at its 2/4/2021 meeting the NERC Board approved a resolution to withdraw the standard, and on 2/5/2021 NERC filed a Notice of Withdrawal stating, in its own words, "In light of recent cybersecurity events and the evolving threat landscape, NERC asserts that additional caution is warranted regarding any criteria that may permit more entities to categorize Bulk Electric System ('BES') Cyber Systems as low impact, such as the revisions proposed in CIP-002-6, and recommends further study." CIP-002-5.1a therefore stayed in force, and NERC's next Criterion 2.12 attempt resurfaced years later as part of CIP-002-8 (see below).

What replaces CIP-002-5.1a, and when do entities have to comply?

Two successors are already FERC-approved, on the same day, for the same 2028 compliance date — and one is designed to retire the other before it ever takes effect. On 3/19/2026 FERC issued Order No. 919 (Docket No. RM24-8-000), approving CIP-002-7 as one of 11 modified CIP standards in NERC's Project 2016-02 virtualization package; the order itself notes "the revisions in Reliability Standard CIP-002-7 are minor, mostly aligning the standard with updates to [the NERC Glossary]." Separately, that same day, FERC issued a standalone order in Docket No. RD25-8-000 approving CIP-002-8 — NERC's Project 2021-03 fix for Transmission Owner Control Center (TOCC) categorization, which revises the NERC Glossary's "control center" definition to cover Transmission Owners with SCADA control of two or more locations, and reworks Attachment 1 Criterion 2.12 around a new aggregated-weighted-value threshold. That order states FERC "approve[s] the retirement of Reliability Standard CIP-002-7 immediately prior to the effective date of proposed Reliability Standard CIP-002-8," and ties CIP-002-8's effective date to "the later of" CIP-002-7's effective date or three months after its own approval — which, per NERC's Project 2016-02 implementation plan (quoted in the Order No. 919 docket), computes to 1 July 2028.