NERC CIP-012 (communications between Control Centers), explained

CIP-012, "Cyber Security — Communications between Control Centers," is the mandatory, FERC-approved NERC Reliability Standard protecting the data Control Centers exchange with each other. Per its own Purpose clause, the currently enforceable version, CIP-012-2, exists "to protect the confidentiality, integrity, and availability of Real-time Assessment and Real-time monitoring data transmitted between Control Centers." It applies to Balancing Authorities, Generator Operators, Generator Owners, Reliability Coordinators, Transmission Operators and Transmission Owners — collectively "Responsible Entities" — that own or operate a Control Center. Three exemptions apply: Cyber Assets at facilities regulated by the Canadian Nuclear Safety Commission; systems regulated by the U.S. Nuclear Regulatory Commission under 10 C.F.R. § 73.54; and a Control Center that transmits data pertaining only to a generation resource or Transmission station/substation co-located with it. CIP-012-2 was adopted by the NERC Board of Trustees on 12 December 2023 under Project 2020-04 and approved by FERC on 23 May 2024 (Docket No. RD24-3-000); per NERC's own implementation plan, it became effective 1 July 2026, at which point its predecessor, CIP-012-1, retired.

R1 requires each Responsible Entity to implement, except under CIP Exceptional Circumstances, "one or more documented plan(s) to mitigate the risks posed by unauthorized disclosure, unauthorized modification, and loss of availability, of data used in Real-time Assessment and Real-time monitoring while such data is being transmitted between any applicable Control Centers" — oral communications are explicitly excluded. The plan must include five parts: Part 1.1, identification of methods mitigating unauthorized disclosure and modification (the standard's own Measures cite examples such as "data masking, encryption/decryption" and physical access restrictions to unencrypted network segments); Part 1.2, identification of methods mitigating the risk of losing the ability to communicate the data at all — an availability control with no equivalent in the prior version; Part 1.3, identification of methods to "initiate the recovery of communication links," for which the standard's Measures explicitly point to applicable sections of a [CIP-009](/guides/nerc-cip-009-recovery-plans/) recovery plan as acceptable evidence; Part 1.4, identification of where the Part 1.1/1.2 methods are implemented; and Part 1.5, where Control Centers are owned or operated by different Responsible Entities, identification of each entity's responsibilities for Parts 1.1-1.3. Violation Risk Factor is Medium, and per the Compliance section, Responsible Entities "shall keep data or evidence of each Requirement in this Reliability Standard for three calendar years."

CIP-012-1's Purpose was narrower — "to protect the confidentiality and integrity" only — and its Requirement R1 had just three parts covering disclosure/modification protection, where it was applied, and cross-entity responsibilities, with no availability obligation. FERC itself created the gap that CIP-012-2 closes: in approving CIP-012-1 on 23 January 2020 (Order No. 866, Docket No. RM18-20-000), FERC found that the standard "did not address protections for the availability of communications links and data communicated between Control Centers" and, per NERC's own implementation plan, directed NERC to "develop modifications to the CIP Reliability Standards to require protections regarding the availability of communication links and data communicated between bulk electric system Control Centers." CIP-012-2 directly answers that directive by adding the word "availability" to the Purpose clause and adding Parts 1.2 and 1.3 (loss-of-communication mitigation and recovery-initiation methods) to Requirement R1. Per NERC's implementation plan, CIP-012-2 became effective "on the first day of the first calendar quarter that is twenty-four (24) calendar months after the effective date of the applicable governmental authority's order approving the standard" — 23 May 2024 plus 24 months lands in late May 2026, so the next calendar-quarter start is 1 July 2026, a date corroborated by multiple industry compliance trackers though this guide was unable to independently fetch FERC's approval order to confirm its own stated effective date. The same implementation plan retires CIP-012-1 "immediately prior to the effective date of CIP-012-2" in each jurisdiction.