CIP-002 categorization for solar, wind and battery sites, step by step

Every NERC CIP program starts with CIP-002. Before you can say which controls apply, you have to answer two questions: which systems need protecting, and how critical is each one. CIP-002-5.1a, the version in force in the US, answers them with a process and a set of bright-line criteria in its Attachment 1.

This post walks through that process for solar, wind and battery storage sites, in the order it is usually done. It is not a substitute for the standard itself. Read the text, and confirm your applicable standards with your Regional Entity.

Step 1: Confirm the site is in CIP scope at all

CIP obligations follow NERC registration and the Bulk Electric System (BES) definition. A Generator Owner or Generator Operator whose plant is a BES facility has CIP obligations for the BES Cyber Systems at that facility. For solar, wind and storage, that usually means more than 75 MVA in aggregate, connected at 100 kV or higher.

Registration alone does not put a site under CIP. Category 2 inverter-based resources, registering with NERC since May 15, 2026, are not BES facilities, and the CIP standards do not apply to them today. If your fleet mixes BES and Category 2 sites, write down which sites are which and why. That record saves an argument later.

Step 2: List the assets the process has to consider

Requirement R1 asks you to implement a process that considers each of your assets. For a renewable fleet, the list usually includes each BES generating plant, any Control Center or backup Control Center that operates those plants, and any other facility you own that the standard names.

Do not stop at the plants. The operations center that dispatches the fleet is a separate asset, and it is the one most likely to be rated higher than the sites it runs.

Step 3: Find the BES Cyber Assets

A BES Cyber Asset is a programmable electronic device that, if rendered unavailable, degraded or misused, would adversely impact the reliable operation of the BES within 15 minutes of its required operation, misoperation or non-operation. The 15-minute test is what separates a BES Cyber Asset from other equipment on the same network.

At a solar, wind or battery site, the devices to evaluate against that test typically include the plant controller, SCADA servers and HMIs, RTACs and RTUs, protective relays, inverter and turbine controllers, and battery management and power conversion controls. Write down your reasoning for each, including the ones you decide are not BES Cyber Assets, such as a corporate laptop with no reliability function.

Step 4: Group them into BES Cyber Systems

A BES Cyber System is one or more BES Cyber Assets logically grouped by the Responsible Entity to perform one or more reliability tasks. The grouping is your choice. Many generation entities group by plant and function, for example the plant control system at one site. Whatever you choose, keep it consistent, because later standards apply to the systems you define here.

Step 5: Apply the Attachment 1 criteria

Attachment 1 has three sections. Section 1 sets the high impact criteria and Section 2 the medium impact criteria; Section 3 covers the assets that contain low impact BES Cyber Systems. A system that meets a high impact criterion is high impact. One that meets no high but at least one medium criterion is medium impact. BES Cyber Systems at the listed assets that meet neither are low impact.

Two medium impact criteria matter most for renewables. Criterion 2.1 rates a generating plant medium impact only when its units add up to 1,500 MW or more at a single plant location in one Interconnection, so almost every individual solar, wind or battery site rates low impact. Criterion 2.11 rates a Control Center or backup Control Center medium impact when it performs Generator Operator functions for 1,500 MW or more in a single Interconnection. A fleet of low impact sites can therefore be run from a medium impact control room.

Re-check criterion 2.11 every time capacity is added to the fleet. The sites can all stay low impact while the control room crosses the line.

Step 6: Record the result the way R1 asks

Requirement R1 has three parts. Part 1.1 asks you to identify each high impact BES Cyber System, if any, at each asset. Part 1.2 asks the same for medium impact BES Cyber Systems. Part 1.3 asks you to identify each asset that contains a low impact BES Cyber System, if any.

For low impact, the standard says a discrete list of low impact BES Cyber Systems is not required. You identify the plant, not every device in it. An inventory is still good practice, but it should not hold up the obligations that follow.

Step 7: Approve it, then keep it current

Requirement R2 has two parts, both on a 15-month cycle. Part 2.1: review the R1 identifications, and update them if there are changes, at least once every 15 calendar months. Part 2.2: have your CIP Senior Manager or delegate approve the identifications at least once every 15 calendar months. Both apply even if you have no identified items in R1.

Repowering, a new phase reaching commercial operation, a new backup Control Center or a change of operator can all change the answer. Put the next review date on the calendar when you approve the current one.

What the result sets in motion

Low impact BES Cyber Systems are covered by CIP-003-9, in effect since April 1, 2026: documented policies, a CIP Senior Manager, and a cyber security plan covering the six sections of Attachment 1. Medium and high impact systems add the requirements of CIP-004 through CIP-011 and CIP-013 that apply at their level.

CIP-002-8, part of the virtualization revisions, takes effect on July 1, 2028. Until then, CIP-002-5.1a is the version you are measured against.

Where collected evidence helps

Categorization is an engineering judgment, and a person should own it. What automated, read-only collection can do is keep the inventory behind that judgment current. Reading identity from the devices themselves (make, model and firmware from firewalls, SEL relays, SunSpec inverters, Windows hosts, and RTACs that report it over DNP3) shows when a device has been added or replaced since the last review. Some devices, such as meters and PLCs, do not report identity this way, so the inventory still needs a walkdown.

Checklist

• Confirm each site is a BES facility, and record why any site is not.
• List every plant, Control Center and backup Control Center, with the MW each Control Center operates per Interconnection.
• Apply the 15-minute test to each programmable device and record the reasoning.
• Apply Attachment 1 and record which criterion each result rests on.
• Get CIP Senior Manager or delegate approval, and set the next review inside 15 calendar months.