Interactive Remote Access vs vendor remote access in NERC CIP: CIP-005 R2 and CIP-003-9 Section 6

Remote access is where many NERC CIP programs at generation sites get complicated. An inverter maker wants to pull fault logs, a turbine OEM watches its fleet, an O&M contractor connects to fix a plant controller at night. The CIP standards handle these connections differently depending on the impact rating, and they use different words: medium and high impact programs deal with Interactive Remote Access under CIP-005-7, while low impact programs deal with vendor electronic remote access under CIP-003-9 Attachment 1, Section 6.

This post puts the two side by side, so you can tell which obligations apply to which connection, and where solar and battery sites often have a path nobody wrote down.

Start with the impact rating

Which rules apply depends on how CIP-002-5.1a rates the BES Cyber Systems involved. Solar, wind and battery plants that are BES facilities (more than 75 MVA in aggregate at 100 kV or higher) are under CIP, usually at low impact, so CIP-003-9 is the program that applies to them. CIP-005-7 applies only if you have high or medium impact BES Cyber Systems.

Category 2 inverter-based resources, registered with NERC since May 15, 2026, are not BES facilities and are not subject to CIP. Neither set of requirements below applies to them, although NERC's Security Guideline for Inverter-Based Resources still recommends a practical security baseline that includes vendor remote access.

What Interactive Remote Access means

Interactive Remote Access (IRA) is user-initiated access by a person who uses a remote client to reach a BES Cyber System over a network outside the Electronic Security Perimeter. Two words do most of the work: user-initiated, and person. An engineer opening a remote desktop session from home is IRA. So is a vendor technician logging in through a support portal.

A vendor's server collecting data on a schedule is not a person, so it is not IRA. It is system-to-system remote access, and CIP-005-7 names it explicitly in the vendor parts of R2. Read the full definition in NERC's Glossary of Terms before you classify a borderline connection; it also says where the access may originate.

CIP-005-7 R2: the parts that apply to every IRA session

R2 asks for documented processes that include its parts "where technically feasible". For Interactive Remote Access, whether by an employee or a vendor, the first three parts are:

• 2.1: use an Intermediate System, so the Cyber Asset that starts the session does not directly access an applicable Cyber Asset.
• 2.2: use encryption that terminates at an Intermediate System.
• 2.3: require multi-factor authentication for all Interactive Remote Access sessions.

Which of your medium impact systems each part reaches is set by the Applicable Systems column in the standard, so check it against your CIP-002 list rather than assuming.

CIP-005-7 R2: the vendor parts

Parts 2.4 and 2.5 are narrower in who they cover and wider in what. They are about vendors only, and they explicitly include both Interactive Remote Access and system-to-system remote access:

• 2.4: one or more methods for determining active vendor remote access sessions.
• 2.5: one or more methods to disable active vendor remote access.

In practice you should be able to answer two questions at any moment: which vendors are connected right now, and how would we cut them off? A vendor's always-on data link counts, even though no person is logged in.

CIP-005-7 R3: vendor access to EACMS and PACS

R3 applies the same idea to Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS): the firewalls, authentication servers and badge systems that protect BES Cyber Systems. It asks for one or more methods to determine authenticated vendor-initiated remote connections (3.1), and one or more methods to terminate them and control the ability to reconnect (3.2).

A firewall management server or badge system that its vendor supports remotely belongs on the same list as the BES Cyber Systems themselves.

Low impact: CIP-003-9 Attachment 1, Section 6

Low impact sites have no Electronic Security Perimeter and no IRA requirement. What they do have, since CIP-003-9 took effect on April 1, 2026, is Section 6. Where a low impact asset allows vendor electronic remote access, the plan needs a process with:

• 6.1: one or more methods for determining vendor electronic remote access;
• 6.2: one or more methods for disabling vendor electronic remote access; and
• 6.3: one or more methods for detecting known or suspected inbound and outbound malicious communications for vendor electronic remote access.

Attachment 2 lists the kind of evidence that fits: steps to preauthorize access, alerts on vendor log-on, session monitoring or recording, and system logs; disabling accounts, ports or VPN access; and for 6.3, anti-malware, IDS/IPS, log reviews or alerting. CIP-003-9 R1 also lists vendor electronic remote access security controls as a low impact policy topic (1.2.6), so the policy your CIP Senior Manager approves has to cover it too.

Note what Section 6 does not ask for: an Intermediate System, encryption that terminates at it, or multi-factor authentication. Those are CIP-005 obligations for higher impact systems.

Side by side

• Who is covered: CIP-005-7 parts 2.1 to 2.3 cover every person using Interactive Remote Access, employees included. CIP-005-7 parts 2.4 and 2.5, R3, and CIP-003-9 Section 6 are about vendors.
• System-to-system access: CIP-005-7 parts 2.4 and 2.5 include it by name, alongside Interactive Remote Access.
• Controls on the path: at medium and high impact, an Intermediate System, encryption terminating at it, and multi-factor authentication. At low impact, methods to determine, disable and detect.
• Detecting malicious communications: at low impact, Section 6.3 asks for it on vendor electronic remote access. Under CIP-005-7, part 1.5 asks for it at Electronic Access Points, inbound and outbound, for the systems that part applies to.

The practical gap: the OEM's cellular modem

Inverter, battery and tracker vendors often supply a cellular modem or cloud gateway for warranty support and performance monitoring. It is easy to think of that as the vendor's equipment rather than your access path. It is still vendor electronic remote access, and if it does not pass through the site firewall, it will not show up in the list of permitted inbound and outbound access under Section 3 either.

A modem like that is not automatically a violation. It is a path the plan has to account for. At low impact it belongs in Sections 3 and 6. At medium impact, the same modem raises a CIP-005-7 R1 question as well, because part 1.2 requires all External Routable Connectivity to go through an identified Electronic Access Point. For each site, answer:

• Which vendors can connect, and by what path: VPN, cloud portal, cellular modem, remote desktop?
• Is any path always on, and did someone decide that it should be?
• Who on our side can switch each path off, and how quickly?
• Where are the session logs, and can we get them without asking the vendor?
• How would malicious traffic on that path be seen if it never crosses the device that does the inspecting?

What changes next

CIP-005-8 takes effect on July 1, 2028 with the virtualization revisions. CIP-003-11 takes effect on July 1, 2029; it moves the low impact vendor remote access methods into Section 3, widens detection of malicious communications beyond vendor access, and adds authentication of users and protection of authentication information in transit. Until those dates, CIP-005-7 and CIP-003-9 are the versions audited.

Where automated evidence collection helps

Most of this is process: deciding who may connect, approving access, switching it off. Read-only collection helps with the evidence around that process. Dated copies of firewall configurations show which vendor paths cross the boundary and when a rule changed, and VPN events can be collected and kept as CIP-005 evidence. The record of each vendor session and the act of disabling access stay with your own people and procedures.