244 results
NERC CIP-004: personnel & training for BES cyber systems, explained
What NERC Reliability Standard CIP-004-7 requires — security awareness, the nine-topic cyber security training program, seven-year personnel risk assessments, access management and the 24-hour/next-day/30-day access revocation timelines — plus the FERC-approved CIP-004-8 virtualization revision coming in 2028.
7 min read Updated
NERC CIP-005: Electronic Security Perimeter(s), and the CIP-005-8 revision already on the way
What NERC Reliability Standard CIP-005-7 requires for Electronic Security Perimeters, Remote Access Management and vendor remote access — plus FERC Order No. 919 (March 2026), which already approved the CIP-005-8 virtualization revision for a 2028 compliance date.
5 min read Updated
NERC CIP-006: physical security for BES cyber systems, explained
What NERC Reliability Standard CIP-006-6 requires — the Physical Security Plan's ten requirement parts, the Visitor Control Program, PACS maintenance and testing, 90-day log and three-year evidence retention — plus the FERC-approved CIP-006-7.1 virtualization revision effective 2028.
7 min read Updated
NERC CIP-007: system security management requirements, explained
What NERC Reliability Standard CIP-007-6 actually requires — ports/services, patch management, malicious code prevention, security event monitoring, system access control — and the FERC-approved CIP-007-7.1 revision coming in 2028.
7 min read Updated
NERC CIP-008: cyber security incident reporting and response planning, explained
What NERC Reliability Standard CIP-008-6 requires — documented incident response plans, the 15-month test cadence, lessons-learned updates and the 1-hour/next-day E-ISAC and NCCIC reporting timelines — plus the FERC-approved CIP-008-7.1 virtualization revision coming in 2028.
7 min read Updated
NERC CIP-009: recovery plans for BES cyber systems, explained
What NERC Reliability Standard CIP-009-6 requires — backup and recovery plan specifications, the 15-month and 36-month testing cadences for high-impact systems, and lessons-learned updates — plus the FERC-approved CIP-009-7.1 virtualization revision coming in 2028.
7 min read Updated
NERC CIP-010: configuration change management and vulnerability assessments, explained
What NERC Reliability Standard CIP-010-4 requires — baseline configuration, change authorization, configuration monitoring, periodic vulnerability assessments and Transient Cyber Asset/Removable Media control — plus the FERC-approved CIP-010-5 virtualization revision coming in 2028.
8 min read Updated
NERC CIP-011: information protection for BES cyber systems, explained
What NERC Reliability Standard CIP-011-3 requires — the two-part information protection program, BES Cyber System Information (BCSI) identification and handling, Cyber Asset reuse and disposal sanitization, three-year evidence retention — plus the FERC-approved CIP-011-4.1 virtualization revision coming in 2028.
6 min read Updated
NERC CIP-012 (communications between Control Centers), explained
NERC CIP-012-2 — the currently enforceable standard protecting confidentiality, integrity and availability of Real-time Assessment/Real-time monitoring data between Control Centers. Requirement R1's five-part plan, the FERC Order No. 866 availability gap that drove the 2024 revision, and the 1 July 2026 effective date that retired CIP-012-1.
5 min read Updated
NERC CIP-013-2 (Cyber Security — Supply Chain Risk Management), explained
What NERC Reliability Standard CIP-013-2 actually requires: the six security concepts every supply chain plan must address, the R1-R3 requirements verbatim, and the FERC Order 829/850 history behind it.
7 min read Updated
NERC CIP-014 (physical security of transmission stations), explained
NERC CIP-014-3 — the risk assessment, third-party verification, physical security plan and third-party review cycle protecting critical Transmission stations, substations and primary control centers from physical attack — plus the FERC-approved CIP-014-4 successor's 1,500-foot proximate-facility rule and 1 October 2028 compliance date.
7 min read Updated
NERC CIP-015-1 (internal network security monitoring), explained
What NERC CIP-015-1 actually requires: FERC Order No. 907's approval, the three-requirement text (data feeds, detection, evaluation, retention, protection), the staggered 1 October 2028 / 2030 compliance dates, and the CIP-015-2 expansion already underway.
6 min read Updated
NIS2 Directive: what it covers, who it applies to, and how incident reporting works
The EU NIS2 Directive: essential vs important entities, sectors in scope, the transposition deadline, and the 24h/72h/1-month incident reporting timeline.
4 min read Updated
NIS2 Implementing Regulation (EU) 2024/2690, explained
Commission Implementing Regulation (EU) 2024/2690: which NIS2 digital infrastructure and service providers it covers, how its Annex turns Article 21(2)'s measures into granular technical requirements, and how it differs from the NIS2 Directive itself.
5 min read Updated
NIST AI 100-2e2025: the adversarial machine learning taxonomy, explained
NIST's taxonomy and terminology for adversarial machine learning (NIST AI 100-2e2025, published 24 March 2025): how it classifies attacks on predictive AI and generative AI, what changed from the 2023 edition, and why it matters for on-device models and embedded AI assistants.
6 min read Updated
NIST AI 600-1: the Generative AI Profile, explained
NIST AI 600-1 names 12 risks generative AI creates or makes worse and maps 212 suggested actions to the AI RMF's four functions. What the Profile actually covers, why it was written, and what changed after the executive order that mandated it was revoked.
6 min read Updated
NIST AI Risk Management Framework (AI RMF 1.0), explained
NIST's voluntary AI Risk Management Framework (NIST AI 100-1): the four core functions — Govern, Map, Measure, Manage — the seven characteristics of trustworthy AI, and how Profiles and the Generative AI Profile fit in.
4 min read Updated
NIST Cybersecurity Framework (CSF) 2.0, explained
NIST CSWP 29's CSF 2.0: the six Functions incl. new GOVERN, the 22 Categories, Tiers and Organizational Profiles, and who the framework is for.
5 min read Updated
NIST IoT device cybersecurity requirements: NISTIR 8259 and SP 800-213
NIST's IoT Cybersecurity Program explained: the IoT Cybersecurity Improvement Act of 2020 mandate, NISTIR 8259 series baselines, SP 800-213/800-213A for federal buyers, and the 2026 shift from "devices" to "products".
5 min read Updated
NIST SP 1800-32: securing distributed energy resources, explained
What NIST SP 1800-32's reference architecture actually protects in DER and grid-edge IIoT communications, its three volumes, the command register concept, and what it does not cover.
3 min read Updated
NIST SP 800-115: technical security testing and assessment, explained
NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment: review vs. target identification/analysis vs. target vulnerability validation techniques, the four-phase penetration testing methodology, and overt vs. covert testing.
6 min read Updated
NIST SP 800-121 Rev. 2 (Guide to Bluetooth Security), explained
NIST SP 800-121 Revision 2 (May 2017, updated January 2022) — the BR/EDR and low energy Bluetooth security modes, named threats like bluesnarfing and bluejacking, and the piconet security checklist for devices and firmware.
5 min read Updated
NIST SP 800-128 (security-focused configuration management), explained
NIST SP 800-128 (August 2011, updated October 2019) — the four SecCM phases, the Configuration Item and baseline-configuration concepts, the SP 800-53 CM-family control link, and where SCAP fits into automated configuration monitoring.
6 min read Updated
NIST SP 800-137: Information Security Continuous Monitoring (ISCM), explained
NIST SP 800-137's definition of Information Security Continuous Monitoring (ISCM), the six-step ISCM process, the three organizational tiers, and how ISCM maps to RMF Step 6 Monitor.
5 min read Updated
Questions about this page?