BESS cybersecurity and NERC CIP: what battery storage owners should check

Battery energy storage sites are being built fast, and many of them sit on the same interconnections as solar plants. Their security questions are a little different from a solar or wind site, because a battery does not only produce power. It charges and discharges on command, and the commands arrive over a network.

This post covers how to tell whether a battery site is under NERC CIP, what the low impact requirements ask of it, and where battery sites tend to have the most vendor access to account for.

First: is the battery site under CIP at all?

Two questions decide this.

• Is it a BES facility? Plants that are BES facilities, which for these resources means more than 75 MVA in aggregate connected at 100 kV or higher, are under the CIP standards. NERC's registration reference on applying the BES definition to battery storage and hybrid resources (Version 2, April 30, 2026) treats batteries as dispersed power producing resources under Inclusion I4. On a hybrid site, the solar and battery capacity count together: its example of 50 MVA of solar plus 20 MVA of storage comes to 70 MVA, below the threshold. Read it for your configuration and confirm the answer with your Regional Entity rather than assuming.
• Is it newly registered as Category 2? Since May 15, 2026, owners and operators of smaller inverter-based resources register with NERC as Category 2 Generator Owners and Operators. Category 2 IBRs are not BES facilities and are not subject to the CIP standards today. They follow a set of operating and planning standards instead. Registration alone does not bring CIP with it.

If the site is a BES facility, CIP-002 rates its BES Cyber Systems. Most generation sites, battery sites included, come out at low impact. A control center that dispatches a fleet may be rated differently, and that is a separate assessment.

What a low impact battery site is asked to do

For low impact BES Cyber Systems, the program lives in CIP-003-9. Requirement R1.2 sets the policy topics, and Requirement R2 requires a documented cyber security plan that includes the sections in Attachment 1:

• Section 1: security awareness, reinforced at least once every 15 calendar months.
• Section 2: physical security controls for the asset (or the locations of the low impact systems within it) and for the Cyber Assets that provide the electronic access controls.
• Section 3: electronic access controls that permit only necessary inbound and outbound electronic access, for routable communication between a low impact BES Cyber System and Cyber Assets outside the asset.
• Section 4: a cyber security incident response plan, tested at least once every 36 calendar months.
• Section 5: controls for Transient Cyber Assets (laptops) and Removable Media.
• Section 6: vendor electronic remote access: methods to determine it, to disable it, and to detect known or suspected malicious communications on it.

The standard also notes that an inventory of low impact BES Cyber Systems is not required. Evidence is organized by asset, meaning the site, not by device.

CIP-003-9 is the version in effect today. NERC's list of approved future versions has CIP-003-10 taking effect on July 1, 2028 and CIP-003-11 on July 1, 2029, so the low impact program will keep changing; we will update this post when they apply.

Why battery sites need extra care on Sections 3 and 6

A typical battery site has several layers of control equipment, often from different suppliers:

• a battery management system for each rack or container;
• power conversion systems (the inverters);
• a site or plant controller and an energy management system that decide when to charge and discharge;
• auxiliary systems: HVAC, fire detection and suppression, and metering.

The dispatch signal may come from a utility, an ISO or a market operator. The integrator may watch performance from its own monitoring service. A long-term service agreement may give the battery maker, the inverter maker and the O&M contractor their own paths in.

Each of those is a routable flow crossing the site boundary, which is exactly what Section 3 asks you to justify, and several of them are vendor electronic remote access, which is what Section 6 covers. On a solar site there may be one or two vendors with remote access. On a battery site there can easily be more, and each one needs to be determined, able to be disabled, and watched.

Questions to ask your integrator and service providers

These are worth asking before the contract is signed, and again at commissioning:

• Which parties have remote access to the site, through which path, and to which systems?
• Is any of that access always on, or is it enabled per session?
• How do we switch a given vendor's access off quickly, and who on our side can do it?
• What logs exist for vendor sessions, where are they kept, and can we get them without asking the vendor?
• Does the battery or inverter maker's monitoring service connect out from the site, and what can it send in?
• Which laptops and USB media will technicians bring for commissioning, firmware updates and augmentation, and how will we check them before they connect (Sections 5.1 to 5.3: your own laptops, vendors' laptops, and removable media)?
• What security changes, if any, does the equipment maker support on its controllers? Avoid installing software that the maker does not support.

Records worth keeping from day one

Low impact audits are about showing the plan works over time. For a battery site, that usually means:

• a current diagram of every routable flow in and out of the site, with the business reason for each;
• the firewall or access-control rules that enforce it, with dated copies when they change;
• a log of vendor remote access: who, when, to what, and when it was switched off;
• records of laptop and removable media checks before each site visit;
• physical access records for containers and control buildings;
• the dated incident response test, and any plan update that followed it.

CIP-003-9 asks you to keep evidence for three calendar years unless your Compliance Enforcement Authority asks for longer. Records collected as the work happens are much easier to defend than ones rebuilt before an audit.