Purpose-built for NERC CIP

See every OT asset.
Evidence for every CIP standard.
Continuously.

GridShield collects read-only evidence from your OT and IT devices, hash-chains every record and keeps RSAW worksheets current for all 14 FERC-approved CIP standards — entirely inside your network.

Request a DemoExplore the Platform
GridShield Evidence Vault: millions of hash-chained evidence records, chain verified
The real GridShield Evidence Vault — every record SHA-256 hash-chained and verified.
14FERC-approved CIP standards
42Supported device types
Read-onlyCollection
SHA-256Evidence chain
  • Modbus TCP · read-only
  • DNP3 · read-only
  • IEC 61850 GOOSE · passive
  • EtherNet/IP · passive
  • SNMP v2c / v3
  • Syslog
  • SNMP traps
  • NetFlow / IPFIX
  • SSH
  • WinRM over HTTPS
  • NETCONF
  • REST APIs
  • BACnet/IP
  • SEL ASCII
  • OSIsoft PI
  • SPAN / mirror port
The problem

CIP evidence shouldn’t live in screenshots and spreadsheets

Configuration screenshots captured by hand, access reviews in spreadsheets and evidence gathered in the weeks before an audit are slow to produce and hard to trust. Generic IT tools rarely speak the protocols your OT devices use, and active scanning is not welcome near protection systems.

GridShield collects that evidence continuously and read-only, from the devices themselves, and keeps it in a tamper-evident chain your auditors can verify.

Generating plant control room
By the numbers

What GridShield covers today

Counted from the product itself — including what is partial and what is still planned.

14
FERC-approved CIP standards with RSAW worksheets
42
Device types in the supported-device catalog
16
Collection protocols, read-only or passive
7.48M
Evidence records chain-verified on our lab instance (Oct 2026)
5 min
Default collection interval; push sources real-time
Device coverage

Shown honestly, per vendor

42device types
10 full27 partial5 planned
CIP coverage

All 14 approved standards

CIP-002CIP-003CIP-004CIP-005CIP-006CIP-007CIP-008CIP-009CIP-010CIP-011CIP-012CIP-013CIP-014CIP-015

RSAW worksheets fill in from collected evidence, with an assessor verdict and review step.

Evidence integrity

Every record hash-chained

Each record is SHA-256 chained per asset; the Evidence Vault verifies the chain.

Products

One family of tools for CIP, operations and reporting

Use them together or on their own.

Continuous NERC CIP evidence

GridShield

Read-only collection from OT and IT devices, a hash-chained Evidence Vault and RSAW worksheets — inside your network.

Learn more →
Run your CIP program

CIPStart

Impact categorization, policies, the CIP-003 low-impact plan, records for every standard and RSAW building.

Learn more →
Local AI drafting

DocPilot

Drafts and gap-checks CIP-003 and CIP-013 documents on a local model, with mandatory human review.

Learn more →
Generation performance

GridWatch

Performance ratio, capacity factor and alarms for solar, battery storage and wind.

Learn more →
Reporting

GridReport

Scheduled investor, O&M and CIP audit reports from your performance and compliance data.

Learn more →
How GridShield works

From device to audit-ready evidence

  1. 1

    Collect, read-only

    Site Nodes poll devices with read functions only, receive syslog, SNMP traps and NetFlow, and watch SPAN traffic passively.

  2. 2

    Chain the evidence

    Every record is SHA-256 hash-chained per asset in the Evidence Vault, so any alteration is detectable.

  3. 3

    Keep RSAWs current

    Worksheets for all 14 FERC-approved CIP standards fill in from collected evidence, ready for your team to review.

Inside GridShield

Real screens from a running Command Center

IP addresses are blurred.

Site asset inventory with BES Cyber System impact ratings and CIP roles
Asset inventory with BCS impact and CIP roles.
Supported devices catalog showing what GridShield collects per vendor
What GridShield collects, per vendor.
Built around your sites

Generation, storage and transmission

Aerial view of a utility-scale solar farm

Solar

SunSpec and Sungrow inverters over read-only Modbus TCP.

Battery storage containers beside a solar array

Battery storage

Read-only battery readings with state-of-charge plausibility checks.

Offshore wind farm

Wind

Turbine controllers over Modbus TCP and passive IEC 61850 GOOSE monitoring.

See all site types

Read-only by design

Watches every device.
Commands none.

Modbus write function codes and DNP3 select/operate are blocked at the Node, so GridShield can sit beside protection systems without ever issuing a control command.

Security design

Built for the constraints of OT

Read-only by design

Modbus write codes and DNP3 select/operate are blocked. Nothing issues a control command.

Air-gapped ready

Installs from a bootable ISO as a hardened Linux appliance and runs entirely on-premises.

Signed updates

Updates install only after their GridSafe Ed25519 signature verifies — nothing unsigned or altered is accepted.

Mutual TLS everywhere

A built-in certificate authority issues the certificates Nodes and Agents use.

Regulatory context

What is changing in NERC CIP

CIP-015-1 · effective October 1, 2028

Internal network security monitoring

In the U.S., monitoring inside the electronic security perimeter: Control Centers from October 1, 2028, other medium-impact systems with ERC by October 1, 2030 — time to plan the sensors now.

Inverter-based resources

More sites entering registration

Revised NERC registration criteria bring many solar, wind and BESS sites into scope — mostly at low impact.

CIP-003-9

Low-impact obligations

Documented plans for awareness, access, incident response and transient devices still need evidence.

Compliance by region

Wherever you operate, the same platform

NERC CIP is built in. In the EU, UK, Australia, Saudi Arabia and India the same evidence lines up with your rules — choose your region to see what applies and what GridSafe does for you.

United States & CanadaNERC CIPEuropean UnionNIS2United KingdomNIS + CAFAustraliaSOCI + AESCSFSaudi ArabiaNCA OTCCIndiaCEAAnywhere — international standardsIEC 62443 · NIST CSF

See GridShield on your own assets

A walkthrough configured for your sites, device types and CIP obligations.

Request a DemoExplore all products