Key takeaways
- R2's vendor-session parts (2.4 and 2.5) and all of R3 were added specifically "to address directives in FERC Order No.
- CIP-005-7 is the standard enforced today, but it will not be the last word for long.
- Confirm which BES Cyber Systems are in scope today by starting from the separate CIP-002 categorization — CIP-005 only reaches high- and medium-impact systems and their associated PCA/EAP/PACS/EACMS.
NERC CIP-005-7, "Cyber Security — Electronic Security Perimeter(s)," is the mandatory, FERC-approved Reliability Standard that tells utilities and grid operators how to control electronic access to Bulk Electric System (BES) Cyber Systems. Per its own Purpose clause it exists "to manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security Perimeter in support of protecting BES Cyber Systems against compromise that could lead to misoperation or instability in the BES." CIP-005-7 became effective 10/1/2022 and is still the enforceable version today — but a virtualization-focused successor, CIP-005-8, is already FERC-approved for a 2028 compliance date (see below).
Who must comply
Section 4.1 names seven "Responsible Entity" functional types: Balancing Authority, a Distribution Provider that owns specific load-shedding, Remedial Action Scheme, protection or blackstart facilities, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner. The requirements apply to each entity's BES Cyber Systems that CIP-002's separate identification process categorizes as high or medium impact, together with their associated Protected Cyber Assets (PCA), Electronic Access Points (EAP), Physical Access Control Systems (PACS) and Electronic Access Control or Monitoring Systems (EACMS) — the standard gives EACMS examples including "firewalls, authentication servers, and log monitoring and alerting systems."
Five exemption categories (Section 4.2.3) take Cyber Assets out of scope entirely: facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters; systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; Distribution Provider systems outside the standard's Section 4.2.1 scope; and any Responsible Entity that identifies it has no high- or medium-impact BES Cyber Systems under CIP-002 at all.
What R1, R2 and R3 each require
| Requirement | Scope (Violation Risk Factor: Medium) | Core obligation |
|---|---|---|
| R1 — Electronic Security Perimeter (5 parts) | Routable-protocol Cyber Assets, EAPs, dial-up connectivity | Reside inside a defined ESP; route all external connectivity through an identified EAP; "require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default"; authenticate dial-up where technically feasible; detect malicious inbound/outbound communications |
| R2 — Remote Access Management (5 parts) | Interactive Remote Access (IRA) sessions | Route all IRA through an Intermediate System rather than touching a BES Cyber Asset directly; encrypt sessions, terminating at the Intermediate System; require multi-factor authentication; maintain methods to both determine and disable active vendor remote access (interactive or system-to-system) |
| R3 — Vendor Remote Access Management for EACMS and PACS (2 parts, new in v7) | EACMS and PACS tied to high/medium impact systems | Maintain a method to determine authenticated vendor-initiated remote connections to EACMS/PACS, and a method to terminate those connections and control the ability to reconnect |
R2's vendor-session parts (2.4 and 2.5) and all of R3 were added specifically "to address directives in FERC Order No. 850," per the standard's own version history — closing a gap where a Responsible Entity could satisfy the rest of CIP-005 without ever being able to see or kill an active third-party remote session. Each applicable entity must retain evidence of every requirement for three calendar years, and the standard carries no Regional Variances.
CIP-005-8 is already approved — the 2028 compliance clock is running
CIP-005-7 is the standard enforced today, but it will not be the last word for long. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), approving 11 revised CIP standards including CIP-005-8 as part of NERC's broader virtualization package — published in the Federal Register on 24 March 2026 at 91 FR 13957, with the order itself stating "this action is effective May 26, 2026." CIP-005-8 introduces Parts that did not exist in CIP-005-7: protecting ESP and Shared Cyber Infrastructure (SCI) configurations by limiting network accessibility to Management Interfaces, protecting the confidentiality and integrity of data traversing links that span a single ESP between Physical Security Perimeters, and preventing an Intermediate System from sharing CPU or memory resources with a high- or medium-impact BES Cyber System. It also replaces most "where technically feasible" language with a new "per system capability" standard — a change FERC's order approved but paired with a directive that NERC build reporting and documentation guardrails around it.
Per NERC's own implementation plan, quoted directly in the FERC order, the revised standards "will become effective on the later of April 1, 2026, or the first day of the first calendar quarter that is 24 months after the effective date of the applicable governmental authority's order" — which, from the 26 May 2026 order effective date, computes to 1 July 2028. Responsible entities may elect early adoption at 6, 12 or 18 months after the order's effective date instead of waiting for the mandatory date. Until then, CIP-005-7 — not CIP-005-8 — is what an auditor will test against.
A workable starting point
Confirm which BES Cyber Systems are in scope todayby starting from the separate CIP-002 categorization — CIP-005 only reaches high- and medium-impact systems and their associated PCA/EAP/PACS/EACMS. Map every Electronic Access Point and confirm default-denyR1.3 requires documenting the reason for every permitted inbound and outbound rule, not just blocking the rest. Verify vendor remote access visibility exists today, separate from employee Interactive Remote Access — R2.4/2.5 and R3 require the ability to both see and kill an active vendor session, which many access-logging setups built for employees don't cover by default. Start tracking CIP-005-8 even though it isn't enforceable yetWith a FERC-approved 1 July 2028 compliance date already on the calendar, entities adopting virtualized or shared infrastructure for BES Cyber Systems should evaluate the new SCI and Management Interface requirements now rather than retrofitting after the fact. Keep the evidence trail for three calendar years, per the standard's own Compliance section — including the documented reasons behind EAP rules, not just the rule list itself.
SoftWSP's OT asset and remote-access assessments can map Electronic Access Points, Intermediate Systems and vendor remote-access paths against CIP-005 evidence requirements as part of a broader OT security review: see OT Snapshot.
This guide quotes NERC's own published text of CIP-005-7 and the CIP-005-8 final draft, and the Federal Register text of FERC Order No. 919; it is not a substitute for the full standards, NERC's Implementation Plan, or compliance/legal advice. CIP-005-7 remains the enforceable standard as of this guide's publication — CIP-005-8 is approved but not yet mandatory.
Sources
- NERC: CIP-005-7 — Cyber Security – Electronic Security Perimeter(s) (currently effective standard, full text: Purpose, Applicability, Requirements R1-R3, Compliance, Version History)
- NERC: CIP-005-8 — Final Draft (April 2024), Cyber Security – Electronic Security Perimeter(s) (virtualization revision text, Standard Development Timeline, redline vs. CIP-005-7)
- Federal Register: Order No. 919; Virtualization Reliability Standards, 91 FR 13957-13965 (FERC, Docket No. RM24-8-000, issued 2026-03-19, published 2026-03-24, effective 2026-05-26)
Frequently asked questions
What is NERC CIP-005-7, and what is it trying to achieve?
CIP-005, "Cyber Security — Electronic Security Perimeter(s)," is a mandatory, FERC-approved Reliability Standard from the North American Electric Reliability Corporation (NERC). Per its own Purpose statement, the currently effective version, CIP-005-7, exists "to manage electronic access to BES Cyber Systems by specifying a controlled Electronic Security Perimeter in support of protecting BES Cyber Systems against compromise that could lead to misoperation or instability in the BES." CIP-005-7 was adopted by the NERC Board of Trustees on 11/05/2020, approved by FERC on 3/18/2021 (Docket No. RD21-2-000), and — per its own version-history table — became effective 10/1/2022, which is still its current status as of this guide.
Who has to comply with CIP-005-7, and are there exemptions?
Section 4.1 names seven "Responsible Entity" functional types: Balancing Authority, a Distribution Provider that owns specific load-shedding/protection/blackstart facilities, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner. The standard applies to a Responsible Entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 identification process, plus their associated Protected Cyber Assets, Electronic Access Points, Physical Access Control Systems and Electronic Access Control or Monitoring Systems (EACMS). Section 4.2.3 lists five exemption categories: Cyber Assets at facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters; systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; Distribution Provider systems outside the standard's defined scope; and any Responsible Entity that identifies it has no high- or medium-impact BES Cyber Systems at all under CIP-002.
What do Requirements R1, R2 and R3 each require?
R1 (Electronic Security Perimeter, 5 parts, Violation Risk Factor Medium) requires every applicable Cyber Asset connected via a routable protocol to sit inside a defined Electronic Security Perimeter (ESP); all external routable connectivity to route through an identified Electronic Access Point (EAP); EAPs to "require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default"; authentication on dial-up connectivity where technically feasible; and detection methods for malicious inbound/outbound communications. R2 (Remote Access Management, 5 parts, also Medium VRF) requires all Interactive Remote Access to route through an Intermediate System rather than touching a BES Cyber Asset directly, encryption terminating at that Intermediate System, multi-factor authentication for Interactive Remote Access sessions, and — added to address FERC Order No. 850 — one or more methods to both determine and disable active vendor remote access sessions, interactive or system-to-system. R3 (Vendor Remote Access Management for EACMS and PACS, 2 parts, Medium VRF) is new in CIP-005-7 and requires methods to determine authenticated vendor-initiated remote connections to Electronic Access Control or Monitoring Systems and Physical Access Control Systems, and methods to terminate those connections and control reconnection.
Is CIP-005-7 already being replaced, and by when do entities need to comply with the next version?
Yes — a successor, CIP-005-8, is already FERC-approved, though CIP-005-7 remains the enforceable standard today. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), approving 11 revised CIP standards including "CIP-005-8 (Cyber Security — Electronic Security Perimeter(s))" as part of NERC's virtualization package — published in the Federal Register on 24 March 2026 (91 FR 13957) with the order "effective May 26, 2026." CIP-005-8 adds new Parts covering Shared Cyber Infrastructure (SCI) and Management Interfaces, replaces most "where technically feasible" language with "per system capability," and adds requirements to protect data traversing links that span a single ESP between Physical Security Perimeters and to prevent an Intermediate System from sharing CPU/memory resources with a BES Cyber System. Per NERC's own implementation plan (quoted in the order), the new standards become effective "on the later of April 1, 2026, or the first day of the first calendar quarter that is 24 months after the effective date of the applicable governmental authority's order" — which computes to 1 July 2028 given the 26 May 2026 order effective date, with early-adoption windows at 6, 12 or 18 months after that date for entities that opt in.
In this cluster
