NERC CIP audit preparation: a checklist for renewable operators

A NERC CIP audit does not test whether you have a plan. It tests whether you can show, with dated records, that the plan ran the whole time. This checklist is for compliance and operations teams at solar, wind and battery sites who want to find the gaps before an auditor does.

It assumes you know your impact rating. Plants that are BES facilities (more than 75 MVA in aggregate at 100 kV or higher) are under CIP, usually at low impact. Category 2 inverter-based resources, registered with NERC since May 15, 2026, are not BES facilities and are not subject to CIP. If you own both kinds, keep the lists apart.

How an audit runs

Your Regional Entity conducts the audit. Start from the audit notice: write down the standards, sites and period it covers, and work only from that list. Audits typically include:

• document review: policies, procedures and evidence;
• data requests: log samples, access lists, training records;
• facility walkdowns, for physical security;
• interviews with key people, such as the CIP Senior Manager and compliance staff;
• spot checks of specific evidence items across a sample period.

Auditors do not review every event. They select a sample, and if the sampled evidence fails, they may expand it. One missing record from one quarter matters because it can be the one they pick.

RSAWs: answer the questions before they are asked

A Reliability Standard Audit Worksheet (RSAW) is the worksheet auditors use to assess compliance with each standard. For each requirement it asks how you comply and what evidence shows it. Writing those answers is the most useful preparation there is, because it makes you name three things for every requirement:

• the policy or procedure that documents the control;
• the system or tool that implements it;
• the evidence that shows it worked, with file names or record references an auditor can open.

Use the RSAW that matches the version in force for each standard (CIP-003-9, CIP-005-7 and so on). Where an answer relies on a technical feasibility exception or a CIP Exceptional Circumstance, say so in the worksheet and point to the record.

What auditors look for in the evidence

• Dated: every record shows when it was made, and the dates fall inside the audit period.
• Continuous: evidence across the whole period, not a burst in the weeks before the audit. For a 15-month cycle, keep the previous approval as well as the latest, so the interval can be measured.
• Consistent with the plan: if a procedure says quarterly, the records are quarterly.
• Traceable: each record points to a requirement and to an asset. At low impact, organize by asset (the site), since CIP-002 does not require a discrete list of low impact BES Cyber Systems.
• Reproducible: a configuration export or log taken from the system is easier to defend than a summary typed afterwards.

On retention, CIP-003-9 and CIP-007-6 ask you to keep evidence for three calendar years unless your Compliance Enforcement Authority directs a longer period. CIP-007-6 adds that where that period is shorter than the time since the last audit, the Compliance Enforcement Authority may ask for other evidence covering the full period.

Low impact checklist: CIP-002 and CIP-003-9

• CIP-002-5.1a R2: the identifications reviewed, and approved by the CIP Senior Manager or delegate, at least once every 15 calendar months, even if nothing is identified.
• CIP-003-9 R1: the low impact policy topics reviewed and approved by the CIP Senior Manager at least once every 15 calendar months.
• CIP-003-9 R3 and R4: the CIP Senior Manager identified by name, with any change documented within 30 calendar days, and any delegations documented and approved.
• Section 1, cyber security awareness: materials and the dates they were delivered, at least once every 15 calendar months.
• Section 2, physical security: how physical access to the low impact BES Cyber Systems and their access points is controlled, and records showing it.
• Section 3, electronic access: current boundary device configurations, the reason for each permitted inbound and outbound access, and a diagram or list of every routable flow crossing the site boundary; authentication for any dial-up connectivity.
• Section 4, incident response: the plan, and a test at least once every 36 calendar months.
• Section 5, Transient Cyber Assets and removable media: records of the checks for your own laptops, vendors' laptops, and removable media.
• Section 6, vendor electronic remote access: how vendor access is determined, how it is disabled, and how known or suspected malicious communications on it are detected, with records of each.

Medium impact checklist: by standard

At medium impact the requirements are device-level and many run on fixed intervals. The Applicable Systems column of each part decides which systems it reaches, so check every item below against your CIP-002 list before you go looking for the records.

• CIP-004-7: security awareness at least once each calendar quarter (1.1); training before access is granted and at least once every 15 calendar months (2.2, 2.3); quarterly verification that people with access have authorization records (4.2); verification of accounts and privileges at least once every 15 calendar months (4.3); removals completed within 24 hours of a termination action (5.1).
• CIP-005-7: Electronic Security Perimeter and Electronic Access Point records; inbound and outbound permissions with a reason for each, and deny by default (1.3); Interactive Remote Access through an Intermediate System, with encryption and multi-factor authentication (2.1 to 2.3); methods to determine and disable active vendor remote access (2.4, 2.5).
• CIP-006-6: physical access logs and visitor logs retained for at least ninety calendar days (1.9, 2.3).
• CIP-007-6: patch evaluations at least once every 35 calendar days (2.2), and within 35 calendar days of each evaluation, the patch applied or a dated mitigation plan created or revised (2.3); event logs retained for at least the last 90 consecutive calendar days where technically feasible (4.3).
• CIP-008-6: each incident response plan tested at least once every 15 calendar months (2.1).
• CIP-009-6: each recovery plan tested at least once every 15 calendar months (2.1), and a representative sample of backup information tested on the same interval (2.2).
• CIP-010-4: baseline configurations (1.1); changes that deviate from the baseline authorized and documented (1.2), with the baseline updated within 30 calendar days (1.3); a paper or active vulnerability assessment at least once every 15 calendar months (3.1).
• CIP-013-2: the supply chain cyber security risk management plan, reviewed and approved by the CIP Senior Manager or delegate at least once every 15 calendar months (R3).

Six things to do before the notice arrives

• Draft each RSAW answer now, and keep it with the evidence it cites.
• List every interval requirement with its last completion date and the next due date.
• Pull one sample month from the middle of the last audit period and see whether every record exists for it.
• Check that dates on records are the dates the work was done, not the dates the files were copied.
• Prepare the people who will be interviewed: the CIP Senior Manager, the compliance lead and site operations.
• Fix gaps you find through your own process rather than rebuilding old records after the fact.

Where automated evidence collection helps

Much of an audit is people and decisions: approvals, tests, interviews. Collected evidence is different: firewall and router configurations, syslog and configuration baselines can be gathered read-only on a schedule, so each record carries the date it was taken and a gap in the period shows up as a gap, not as a surprise during sampling. Keeping those records hash-chained lets you show they have not been altered since collection.