Key takeaways
- Requirement R2 (Lower VRF) requires implementing the plan(s) across three table parts.
- Requirement R3 (Lower VRF) sets two independent triggers for keeping the plan current.
- Part 4.1 — initial notifications and updates must include, at minimum and to the extent known: the functional impact; the attack vector used; and the level of intrusion achieved or attempted.
- CIP-008-6 is the standard enforced today, but a successor is already locked in.
NERC CIP-008-6, "Cyber Security — Incident Reporting and Response Planning," is the mandatory, FERC-approved Reliability Standard that tells utilities and grid operators how to identify, respond to and report Cyber Security Incidents affecting Bulk Electric System (BES) Cyber Systems. Per its own Purpose clause it exists "to mitigate the risk to the reliable operation of the BES as the result of a Cyber Security Incident by specifying incident response requirements." CIP-008-6 was adopted by the NERC Board of Trustees on 7 February 2019 — addressing directives in FERC Order No. 848 — and approved by FERC on 20 June 2019. It remains the enforceable version today, even though a virtualization-focused successor, CIP-008-7.1, is already FERC-approved for a 2028 compliance date (see below).
Who must comply
Section 4.1 names seven "Responsible Entity" functional types: Balancing Authority, a Distribution Provider that owns specific load-shedding, Remedial Action Scheme, protection or blackstart facilities, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner. The standard applies to each entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 identification process, together with their associated Electronic Access Control or Monitoring Systems (EACMS) — unlike CIP-010, CIP-008 does not extend to Physical Access Control Systems (PACS) or Protected Cyber Assets (PCA).
Five exemption categories (Section 4.2.3) take Cyber Assets out of scope entirely: facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters; systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; for Distribution Providers, systems and equipment outside the standard's Section 4.2.1 scope; and any Responsible Entity that identifies it has no high- or medium-impact BES Cyber Systems under CIP-002 at all.
R1: the four-part incident response plan
Requirement R1 (Violation Risk Factor: Lower) requires one or more documented Cyber Security Incident response plans covering four table parts, all scoped to High and Medium Impact BES Cyber Systems and their associated EACMS:
| Part | Core obligation |
|---|---|
| 1.1 | One or more processes to identify, classify, and respond to Cyber Security Incidents |
| 1.2 | Processes with criteria to evaluate and define attempts to compromise; determine if an incident is a Reportable Cyber Security Incident or a qualifying attempt to compromise; and provide notification per Requirement R4 |
| 1.3 | The roles and responsibilities of Cyber Security Incident response groups or individuals |
| 1.4 | Incident handling procedures — the standard's own measures cite containment, eradication and recovery/incident resolution as examples |
R2: implementation and testing on a 15-month cadence
Requirement R2 (Lower VRF) requires implementing the plan(s) across three table parts. Part 2.1 requires testing each plan "at least once every 15 calendar months" — by responding to an actual Reportable Cyber Security Incident, with a paper drill or tabletop exercise, or with an operational exercise. Part 2.2 requires using the plan when responding to a real Reportable Cyber Security Incident, a qualifying attempt to compromise, or an exercise, and documenting any deviations taken during the response. Part 2.3 requires retaining records related to Reportable Cyber Security Incidents and qualifying attempts to compromise, as specified in the plan itself.
The standard's own Violation Severity Level table shows how tightly the 15-month test cadence is enforced: a test gap of 15 to 16 months is a Lower violation; 16-17 months is Moderate; 17-18 months is High; and beyond 18 months is Severe.
R3: review, update and communication after every test or incident
Requirement R3 (Lower VRF) sets two independent triggers for keeping the plan current. Part 3.1 requires that no later than 90 calendar days after completing a plan test or an actual Reportable Cyber Security Incident response, the entity documents any lessons learned (or documents their absence), updates the plan based on those lessons, and notifies every person or group with a defined plan role of the updates. Part 3.2 requires that no later than 60 calendar days after a change to roles, responders or technology that the entity determines would impact its ability to execute the plan, the entity updates the plan and notifies affected personnel. As with R2, the Violation Severity Levels escalate on fixed bands beyond each deadline — 90-120 days and beyond for Part 3.1, 60-90 days and beyond for Part 3.2.
R4: the 1-hour reporting clock
Requirement R4 (Lower VRF) is the part of CIP-008 most often cited on its own: it requires notifying the Electricity Information Sharing and Analysis Center (E-ISAC) and, if subject to US jurisdiction, the National Cybersecurity and Communications Integration Center (NCCIC) — the standard's own footnote identifies NCCIC as the successor organization to the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) and US-CERT — of a Reportable Cyber Security Incident or a qualifying attempt to compromise, unless prohibited by law.
- Part 4.1 — initial notifications and updates must include, at minimum and to the extent known: the functional impact; the attack vector used; and the level of intrusion achieved or attempted.
- Part 4.2 — initial notification timelines: "One hour after the determination of a Reportable Cyber Security Incident", or, for an incident determined to be an attempt to compromise, "by the end of the next calendar day after determination."
- Part 4.3 — updates, if any, must be provided "within 7 calendar days of determination of new or changed attribute information."
Evidence for every R1-R4 requirement must be retained for three calendar years, per the standard's Compliance section, and CIP-008 carries no Regional Variances.
CIP-008-7.1 is already approved — the 2028 compliance clock is running
CIP-008-6 is the standard enforced today, but a successor is already locked in. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), whose own summary states it "approves 11 modified Critical Infrastructure Protection (CIP) Reliability Standards" and explicitly lists "CIP-008-7.1 (Cyber Security — Incident Reporting and Response Planning)" alongside CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3 — published in the Federal Register on 24 March 2026 at 91 FR 13957, with the order stating "this final rule is effective May 26, 2026." The package also approves four new NERC Glossary definitions — Cyber System, Management Interface, Shared Cyber Infrastructure and Virtual Cyber Asset — plus 18 revised definitions, needed to let the CIP suite apply cleanly to virtualized infrastructure such as Shared Cyber Infrastructure (SCI) hosting virtual machines for multiple BES Cyber Systems (see NERC CIP-010 and NERC CIP-002). Order No. 919 also approved replacing most "technical feasibility exception" language across the CIP suite with a self-implementing "per system capability" standard, after NERC reported a significant decrease in submitted technical feasibility exceptions under the prior wording.
Per NERC's own implementation plan, quoted directly in the order, the revised standards "will become effective on the later of April 1, 2026, or the first day of the first calendar quarter that is 24 months after the effective date of the applicable governmental authority's order" — which, from the order's 26 May 2026 effective date, computes to 1 July 2028. Responsible entities may elect early adoption at six, 12 or 18 months after that date instead of waiting for the mandatory date. This guide has not independently reviewed every redlined Part of the final CIP-008-7.1 text, so treat the exact wording changes to R1-R4 as something to confirm against NERC's and FERC's own published CIP-008-7.1 text before compliance planning.
A workable starting point
Separate "identify and classify" from "report."R1 Part 1.2 is the decision process that determines whether something is a Reportable Cyber Security Incident or a qualifying attempt to compromise; R4 is the clock that starts only after that determination is made — an entity that conflates the two risks missing the one-hour window because it spent the time deciding instead of reporting. Build the 1-hour and next-calendar-day timelines into the plan itself, not into institutional memoryPart 4.2's "one hour after the determination" standard for Reportable Cyber Security Incidents is one of the tightest deadlines anywhere in the CIP suite — a plan that doesn't name who calls E-ISAC and NCCIC, and how, cannot realistically meet it. Treat the 15-month R2 test cadence and the 90/60-day R3 update deadlines as independent clocksA plan can pass its test on schedule and still be out of compliance months later if lessons learned from that same test aren't folded back in within 90 days. Keep E-ISAC/NCCIC report records distinct from the incident response records retained under Part 2.3— both are subject to the same three-year retention period, but R4's attribute-level reporting (functional impact, attack vector, intrusion level) is evidence of what was told to whom and when, not just that a response occurred. Start tracking CIP-008-7.1 even though it isn't enforceable yetWith a FERC-approved 1 July 2028 compliance date already set, entities planning virtualized infrastructure for BES Cyber Systems should evaluate how Shared Cyber Infrastructure and Virtual Cyber Asset concepts affect incident scoping now, rather than retrofitting response plans after the fact.
SoftWSP's OT asset and firmware assessments can help build and verify the incident response plan evidence and E-ISAC/NCCIC reporting timelines CIP-008 requires: see OT Snapshot.
This guide quotes NERC's own published text of CIP-008-6 and the Federal Register text of FERC Order No. 919; it is not a substitute for the full standard, NERC's Implementation Plan, or compliance/legal advice. CIP-008-6 remains the enforceable standard as of this guide's publication — CIP-008-7.1 is approved but not yet mandatory.
Sources
- NERC: CIP-008-6 — Cyber Security – Incident Reporting and Response Planning (currently effective standard, full text: Purpose, Applicability, Requirements R1-R4 with Tables, Compliance, Violation Severity Levels, Version History)
- Federal Register: Order No. 919; Virtualization Reliability Standards, 91 FR 13957-13965 (FERC, Docket No. RM24-8-000, issued 2026-03-19, published 2026-03-24, effective 2026-05-26) — lists CIP-008-7.1 among the 11 approved standards, with NERC's implementation plan formula
- NERC: CIP-008-7 — Project 2016-02 virtualization drafting redline (draft text circulated during standards development; not the final adopted CIP-008-7.1, cited for the project's scope and drafting history only)
Frequently asked questions
What is NERC CIP-008-6, and who must comply?
CIP-008, "Cyber Security — Incident Reporting and Response Planning," is the mandatory, FERC-approved NERC Reliability Standard that tells utilities and grid operators how to detect, classify, respond to and report Cyber Security Incidents affecting Bulk Electric System (BES) Cyber Systems. Per its own Purpose clause it exists "to mitigate the risk to the reliable operation of the BES as the result of a Cyber Security Incident by specifying incident response requirements." The currently enforceable version, CIP-008-6, was adopted by the NERC Board of Trustees on 7 February 2019 to address directives in FERC Order No. 848, and FERC approved it on 20 June 2019 (Docket No. RD19-3-000). Section 4.1 names seven "Responsible Entity" functional types — Balancing Authority, certain Distribution Providers, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner — and the requirements apply to each entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 process, together with their associated Electronic Access Control or Monitoring Systems (EACMS). Five exemption categories in Section 4.2.3 take Cyber Assets out of scope entirely, including facilities regulated by the Canadian Nuclear Safety Commission, communication links between discrete Electronic Security Perimeters, systems regulated under 10 C.F.R. § 73.54, certain out-of-scope Distribution Provider equipment, and entities with no high- or medium-impact BES Cyber Systems at all.
What does Requirement R1 (the incident response plan itself) require?
R1 (Table R1 — Cyber Security Incident Response Plan Specifications, Violation Risk Factor Lower) requires one or more documented Cyber Security Incident response plans covering four table parts, applicable to High and Medium Impact BES Cyber Systems and their associated EACMS. Part 1.1 requires "one or more processes to identify, classify, and respond to Cyber Security Incidents." Part 1.2 requires processes with criteria to evaluate and define attempts to compromise, to determine whether an identified incident is a Reportable Cyber Security Incident or an attempt to compromise an applicable system, and to provide notification per Requirement R4. Part 1.3 requires defining "the roles and responsibilities of Cyber Security Incident response groups or individuals." Part 1.4 requires "incident handling procedures for Cyber Security Incidents" — the standard's own measures point to containment, eradication and recovery/incident resolution as examples.
What do Requirements R2 and R3 (testing, review, update and communication) require?
R2 (Table R2 — Plan Implementation and Testing, Lower VRF) requires testing each incident response plan "at least once every 15 calendar months" — by responding to an actual Reportable Cyber Security Incident, with a paper drill or tabletop exercise, or with an operational exercise (Part 2.1); using the plan when responding to a real Reportable Cyber Security Incident or qualifying attempt to compromise, and documenting any deviations taken (Part 2.2); and retaining records related to those incidents per the plan (Part 2.3). R3 (Table R3 — Review, Update and Communication, Lower VRF) requires that no later than 90 calendar days after a plan test or actual Reportable Cyber Security Incident response, the entity documents lessons learned (or their absence), updates the plan accordingly, and notifies everyone with a defined plan role of the updates (Part 3.1); and that no later than 60 calendar days after a change to roles, responders or technology that would affect the ability to execute the plan, the entity updates the plan and notifies affected personnel (Part 3.2). The standard's own Violation Severity Levels escalate on these same 90-day and 120-day, and 60-day and 90-day, bands.
What does Requirement R4 (E-ISAC and NCCIC notification) require, and what are the reporting timelines?
R4 (Table R4 — Notifications and Reporting, Lower VRF) requires notifying the Electricity Information Sharing and Analysis Center (E-ISAC) and, if subject to US jurisdiction, the National Cybersecurity and Communications Integration Center (NCCIC) — the successor to ICS-CERT and US-CERT — of a Reportable Cyber Security Incident or a qualifying attempt to compromise, unless prohibited by law. Part 4.1 requires initial notifications and updates to include, at minimum and to the extent known, the functional impact, the attack vector used, and the level of intrusion achieved or attempted. Part 4.2 sets the reporting clock: "One hour after the determination of a Reportable Cyber Security Incident," or, for an attempt to compromise, "by the end of the next calendar day after determination." Part 4.3 requires providing updates, if any, "within 7 calendar days of determination of new or changed attribute information." Evidence for all R1-R4 requirements must be retained for three calendar years, per the standard's Compliance section.
Is CIP-008-6 already being replaced, and by when do entities need to comply?
Yes — a successor, CIP-008-7.1, is already FERC-approved, though CIP-008-6 remains the enforceable standard today. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), which the order's own summary states "approves 11 modified Critical Infrastructure Protection (CIP) Reliability Standards," explicitly listing "CIP-008-7.1 (Cyber Security — Incident Reporting and Response Planning)" alongside CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3 as part of NERC's Project 2016-02 virtualization package — published in the Federal Register on 24 March 2026 (91 FR 13957-13965) with the order stating "this final rule is effective May 26, 2026." Per NERC's own implementation plan, quoted directly in the order, the revised standards "will become effective on the later of April 1, 2026, or the first day of the first calendar quarter that is 24 months after the effective date of the applicable governmental authority's order" — which computes to **1 July 2028** from the order's 26 May 2026 effective date. Responsible entities may elect early adoption at six, 12 or 18 months after that date instead of waiting for the mandatory compliance date. This guide has not independently reviewed every redlined Part of the final CIP-008-7.1 text; treat any claim about exactly which R1-R4 Parts change wording as something to confirm against NERC's and FERC's own published CIP-008-7.1 text before relying on it for compliance planning.
In this cluster
