Key takeaways
- Cyber Security Awareness — reinforce cyber security practices at least once every 15 calendar months.
- CIP-003-9 is the standard enforced today, but a successor is already locked in — and it has an unusually tangled version history.
- Separate the R1 policy-review calendar from the R2 Attachment 1 implementation work.
NERC CIP-003-9, "Cyber Security — Security Management Controls," is the mandatory, FERC-approved Reliability Standard that requires utilities and grid operators to maintain documented cyber security governance for BES Cyber Systems — the standard that, per its Purpose clause, exists "to specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems against compromise that could lead to misoperation or instability in the Bulk Electric System (BES)." Unlike most other CIP standards, CIP-003 reaches beyond the high and medium impact systems governed by CIP-002 through CIP-011: its Requirement R2 and Attachment 1 impose a separate, lighter-weight set of controls directly on low impact BES Cyber Systems, which most other CIP standards do not individually address. CIP-003-9 was adopted by the NERC Board of Trustees on 16 November 2022 and approved by FERC on 16 March 2023 (Docket No. RD23-3-000); per NERC's implementation plan it became effective and enforceable on 1 April 2026, and remains the enforceable version today even though a successor, CIP-003-11, is already FERC-approved for a 2029 compliance date (see below).
Who must comply
CIP-003 applies to Balancing Authorities, Distribution Providers that own certain underfrequency/undervoltage load-shedding systems, Remedial Action Schemes, Protection Systems, or Cranking Path facilities subject to a NERC or Regional Reliability Standard, Generator Operators and Owners, Reliability Coordinators, and Transmission Operators and Owners — collectively "Responsible Entities." Exemptions include Cyber Assets at facilities regulated by the Canadian Nuclear Safety Commission, communication networks and links between discrete Electronic Security Perimeters, and systems regulated by the U.S. Nuclear Regulatory Commission under 10 C.F.R. § 73.54.
R1: the 15-month cyber security policy review
Requirement R1 requires each Responsible Entity to "review and obtain CIP Senior Manager approval at least once every 15 calendar months for one or more documented cyber security policies" that collectively address two distinct topic sets, scaled by impact rating:
| Part | Scope | Topics the policy must address |
|---|---|---|
| 1.1 | High and medium impact BES Cyber Systems, if any | Personnel and training (CIP-004); Electronic Security Perimeters including Interactive Remote Access (CIP-005); physical security (CIP-006); system security management (CIP-007); incident reporting and response planning (CIP-008); recovery plans (CIP-009); configuration change management and vulnerability assessments (CIP-010); information protection (CIP-011); and declaring/responding to CIP Exceptional Circumstances |
| 1.2 | Assets with low impact BES Cyber Systems, if any | Cyber security awareness; physical security controls; electronic access controls; Cyber Security Incident response; Transient Cyber Asset and Removable Media malicious code risk mitigation; vendor electronic remote access security controls; and declaring/responding to CIP Exceptional Circumstances |
Violation Risk Factor is Medium, and the standard's own measures note that evidence "may include, but are not limited to, policy documents; revision history, records of review, or workflow evidence from a document management system."
R2 and Attachment 1: the six-section low impact cyber security plan
Requirement R2 requires every Responsible Entity with at least one low impact BES Cyber System to implement one or more documented cyber security plan(s) covering all six sections of Attachment 1:
Cyber Security Awareness— reinforce cyber security practices at least once every 15 calendar months. Physical Security Controls— control physical access, based on need, to the asset (or the low impact systems' locations within it) and to the Cyber Asset(s) providing the Section 3.1 electronic access controls. Electronic Access Controls— Part 3.1 permits "only necessary inbound and outbound electronic access" for routable-protocol communications crossing the asset boundary, except time-sensitive protection/control traffic between intelligent electronic devices; Part 3.1.2 requires the Responsible Entity to "detect known or suspected malicious communications for both inbound and outbound electronic access"; Part 3.2 requires authenticating all Dial-up Connectivity, per Cyber Asset capability. Cyber Security Incident Response— one or more response plan(s) covering identification/classification/response, determining whether an incident is Reportable and notifying the Electricity Information Sharing and Analysis Center (E-ISAC) unless prohibited by law, roles and responsibilities, incident handling, testing "at least once every 36 calendar months," and updating the plan within 180 calendar days of a test or actual Reportable Cyber Security Incident. Transient Cyber Asset and Removable Media Malicious Code Risk Mitigation— differentiated controls depending on whether a Transient Cyber Asset is managed by the Responsible Entity (antivirus, application whitelisting, or another mitigation method) or by another party (review of the other party's practices, plus a determination of whether additional mitigation is needed); for Removable Media, detection of malicious code using a separate Cyber Asset and mitigation before connecting the media to a low impact BES Cyber System. Vendor Electronic Remote Access Security Controls— for assets allowing vendor electronic remote access established under Section 3.1, one or more methods each to determine vendor remote access, disable it, and detect known or suspected inbound/outbound malicious communications.
The standard explicitly relieves entities of an inventory burden: "An inventory, list, or discrete identification of low impact BES Cyber Systems or their BES Cyber Assets is not required. Lists of authorized users are not required." Entities with multiple-impact-rating systems may reuse their high/medium impact policies, procedures and processes to satisfy the low impact Attachment 1 sections.
R3 and R4: the CIP Senior Manager and delegation
Requirement R3 requires each Responsible Entity to "identify a CIP Senior Manager by name and document any change within 30 calendar days of the change." Requirement R4 requires a documented process to delegate authority — where the CIP Standards allow delegation, each delegation must record the delegate's name or title, the specific actions delegated, and the date, be approved by the CIP Senior Manager, and be updated within 30 days of any change; delegation changes "do not need to be reinstated with a change to the delegator." Per CIP-003-9's Compliance section, "each Responsible Entity shall retain evidence of each requirement in this standard for three calendar years" — the same retention window used across the CIP suite (see CIP-006 and CIP-010).
CIP-003-11 is already approved — the 2029 compliance clock is running
CIP-003-9 is the standard enforced today, but a successor is already locked in — and it has an unusually tangled version history. NERC's Project 2023-04 drafting team built CIP-003-11 directly on top of CIP-003-10, a virtualization-only revision that FERC approved on 19 March 2026 as part of Order No. 919's 11-standard virtualization package (Docket No. RM24-8-000, 91 FR 13956). CIP-003-10 was never meant to become mandatory on its own: per NERC's own Project 2023-04 implementation plan, "Reliability Standard CIP-003-10, or the version of Reliability Standard CIP-003 then in effect, shall be retired immediately prior to the effective date of CIP-003-11" — meaning CIP-003-9 retires directly into CIP-003-11 once CIP-003-11 takes effect.
FERC approved CIP-003-11 the same day, in a separate Order No. 918 (Docket No. RM25-8-000, 91 FR 13952, effective 26 May 2026). The order describes the standard's purpose plainly: NERC submitted CIP-003-11 "to mitigate risks posed by a coordinated cyberattack on low-impact facilities, the aggregate impact of which could be much greater" than any single low impact compromise, by "adding controls to authenticate remote users, protecting authentication information in transit, and detecting malicious communications to or between assets containing low impact BES Cyber Systems with external routable connectivity." Concretely, this expands Attachment 1 Section 3.1.2's detection requirement from vendor-based electronic access only (as in CIP-003-9) to all inbound and outbound electronic access.
Per NERC's implementation plan, "where approval by an applicable governmental authority is required, the standard shall become effective on the first day of the first calendar quarter that is thirty-six (36) months after the effective date of the applicable governmental authority's order approving the standard" — 26 May 2026 plus 36 months lands in late May 2029, so the first subsequent calendar-quarter start is 1 July 2029. The same implementation plan separately caps compliance with the expanded Section 3.1.2 detection scope at "the later of: (1) April 1, 2029; or (2) the effective date of Reliability Standard CIP-003-11" — which, since 1 July 2029 is later, means entities have until CIP-003-11's effective date either way. NERC's drafting team explained the extended timeline directly: entities "may have already invested significant resources to implement system architecture to monitor vendor remote access in compliance with Reliability Standard CIP-003-9," so the plan "ensures that entities will have at least three years from the effective date of Reliability Standard CIP-003-9 to implement the additional controls contemplated by CIP-003-11."
A workable starting point
Separate the R1 policy-review calendar from the R2 Attachment 1 implementation workR1's 15-month CIP Senior Manager approval cycle is a governance checkpoint; Attachment 1's six sections are the substantive controls it must describe — missing either one independently fails compliance even if the other is solid. Build Attachment 1 Section 3.1.2's detection capability for all inbound/outbound traffic now, not just vendor accessCIP-003-9 only requires detecting malicious communications in vendor electronic remote access; CIP-003-11 extends that to all inbound and outbound electronic access to low impact systems with external routable connectivity. Entities that scope their current detection tooling narrowly to vendor sessions will need a broader buildout well before the 2029 compliance date. Don't treat the CIP Senior Manager as a title aloneR3 requires identifying the individual "by name," and any change must be documented within 30 calendar days — a stale or unnamed designation is a straightforward audit finding. Track CIP-003-10 and CIP-003-11 as a package, not two separate projectsCIP-003-10's virtualization-only changes never become independently mandatory; they're absorbed into CIP-003-11, which retires CIP-003-9 directly. Planning for "CIP-003-10 compliance" as a distinct milestone would be wasted effort. Confirm your low impact asset inventory practices don't overcorrectThe standard explicitly does not require an inventory, list, or discrete identification of low impact BES Cyber Systems or their BES Cyber Assets — building one anyway is not wrong, but it is not itself evidence of Attachment 1 compliance.
SoftWSP's OT asset assessments can help document the cyber security policy, CIP Senior Manager, and low impact Attachment 1 evidence CIP-003 requires: see OT Snapshot.
This guide quotes NERC's own published text of CIP-003-9 and the Federal Register text of FERC Order Nos. 918 and 919; it is not a substitute for the full standard, NERC's Implementation Plan, or compliance/legal advice. CIP-003-9 remains the enforceable standard as of this guide's publication — CIP-003-10 and CIP-003-11 are approved but not yet mandatory.
Sources
- NERC: CIP-003-9 — Cyber Security – Security Management Controls (currently effective standard, full text: Purpose, Applicability, Requirements R1-R4 with Attachments 1-2, Compliance, Version History)
- Federal Register: Order No. 918; Critical Infrastructure Protection Reliability Standard CIP-003-11 — Cyber Security — Security Management Controls, 91 FR 13952 (FERC, Docket No. RM25-8-000, issued 2026-03-19, published 2026-03-24, effective 2026-05-26) — approves CIP-003-11, which supersedes CIP-003-10
- NERC: Implementation Plan, Project 2023-04 Modifications to CIP-003, Reliability Standard CIP-003-11 (September 2024) — effective-date formula, CIP-003-9's 1 April 2026 effective date, and the retirement clause for CIP-003-10/CIP-003-9
- Federal Register: Order No. 919; Virtualization Reliability Standards, 91 FR 13956 (FERC, Docket No. RM24-8-000, issued 2026-03-19, published 2026-03-24, effective 2026-05-26) — approves CIP-003-10 among 11 virtualization-revision CIP standards
Frequently asked questions
What is NERC CIP-003-9, and who must comply?
CIP-003, "Cyber Security — Security Management Controls," is the mandatory, FERC-approved NERC Reliability Standard that requires utilities and grid operators to maintain documented cyber security policies and governance for BES Cyber Systems. Per its own Purpose clause, it exists "to specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems against compromise that could lead to misoperation or instability in the Bulk Electric System (BES)." The currently enforceable version, CIP-003-9, was adopted by the NERC Board of Trustees on 16 November 2022 and approved by FERC on 16 March 2023 (Docket No. RD23-3-000); per NERC's implementation plan it became effective and enforceable on 1 April 2026. It applies to Balancing Authorities, certain Distribution Providers, Generator Operators and Owners, Reliability Coordinators, and Transmission Operators and Owners — collectively "Responsible Entities" — covering both the high/medium impact BES Cyber Systems categorized under [CIP-002](/guides/nerc-cip-002-bes-cyber-system-categorization/) and, through a separate set of requirements, low impact BES Cyber Systems.
What does Requirement R1's cyber security policy review actually require?
R1 requires each Responsible Entity to "review and obtain CIP Senior Manager approval at least once every 15 calendar months for one or more documented cyber security policies" covering two distinct topic sets. For high and medium impact BES Cyber Systems (Part 1.1), the policies must collectively address nine topics mirroring the other CIP standards: personnel and training (CIP-004), electronic security perimeters including interactive remote access (CIP-005), physical security (CIP-006), system security management (CIP-007), incident reporting and response planning (CIP-008), recovery plans (CIP-009), configuration change management and vulnerability assessments (CIP-010), information protection (CIP-011), and declaring/responding to CIP Exceptional Circumstances. For assets with low impact BES Cyber Systems (Part 1.2), the policies must instead address seven topics: cyber security awareness, physical security controls, electronic access controls, Cyber Security Incident response, Transient Cyber Asset and Removable Media malicious code risk mitigation, vendor electronic remote access security controls, and declaring/responding to CIP Exceptional Circumstances.
What does Attachment 1 require for low impact BES Cyber Systems under Requirement R2?
R2 requires each Responsible Entity with low impact BES Cyber Systems to implement one or more documented cyber security plan(s) covering all six sections of Attachment 1: Section 1 (reinforce cyber security practices at least once every 15 calendar months); Section 2 (control physical access to the asset and to the electronic-access-control Cyber Assets, based on need); Section 3 (electronic access controls — Part 3.1 permits only necessary inbound and outbound electronic access using a routable protocol, and Part 3.1.2 requires detecting "known or suspected malicious communications for both inbound and outbound electronic access"; Part 3.2 requires authenticating all Dial-up Connectivity); Section 4 (a Cyber Security Incident response plan covering identification/classification/response, E-ISAC notification of Reportable Cyber Security Incidents, roles and responsibilities, incident handling, testing at least once every 36 calendar months, and updates within 180 calendar days of a test or actual incident); Section 5 (malicious code risk mitigation for Transient Cyber Assets and Removable Media, differentiated by whether the asset is managed by the Responsible Entity or a third party); and Section 6 (vendor electronic remote access security controls — methods to determine, disable, and detect malicious communications in vendor remote access). The standard explicitly notes that "an inventory, list, or discrete identification of low impact BES Cyber Systems or their BES Cyber Assets is not required."
What do Requirements R3 and R4 require, and is CIP-003-9 already being replaced?
R3 requires each Responsible Entity to "identify a CIP Senior Manager by name and document any change within 30 calendar days of the change." R4 requires a documented delegation process: if the CIP Senior Manager delegates authority for specific actions, the delegation must be documented by name or title, the specific actions delegated, and the date, approved by the CIP Senior Manager, and updated within 30 days of any change. Evidence for all four requirements must be retained for three calendar years. A successor is already FERC-approved: on 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 918 (Docket No. RM25-8-000, published in the Federal Register on 24 March 2026 at 91 FR 13952), approving Reliability Standard CIP-003-11, which adds controls to authenticate remote users, protect authentication information in transit, and detect malicious communications across all inbound/outbound electronic access to low impact BES Cyber Systems with external routable connectivity — expanding the vendor-only detection scope of CIP-003-9's Attachment 1 Section 3.1.2. Per NERC's implementation plan, CIP-003-11 becomes effective "the first day of the first calendar quarter that is thirty-six (36) months after" the FERC order's 26 May 2026 effective date — 1 July 2029 — at which point CIP-003-9 (or CIP-003-10, its never-mandatory virtualization-only interim version) retires.
In this cluster
