NERC CIP compliance for solar operators: where to start

Most solar operators meet NERC CIP the same way: a registration letter, a deadline, and a set of standards written with substations and large control centers in mind. The work is manageable if you do it in the right order. This is that order.

1. Confirm what you are registered as

CIP obligations follow registration. A Generator Owner (GO) or Generator Operator (GOP) on the NERC Compliance Registry has CIP obligations for the BES Cyber Systems at its facilities; an entity that is not registered does not.

NERC's revised registration criteria for inverter-based resources bring many solar, wind and battery storage owners onto the registry for the first time. Which standards apply to a newly registered category, and from when, is set out in NERC's implementation plan — confirm your list with your Regional Entity rather than assuming the full CIP family applies on day one. NERC's own Security Guideline for Inverter-Based Resources notes that newly registered Category 2 IBRs are not individually BES facilities and so, as of early 2026, are not subject to the existing CIP standards.

2. Rate impact with CIP-002

CIP-002-5.1a sorts BES Cyber Systems into high, medium and low impact using bright-line criteria in its Attachment 1. A generating plant becomes medium impact under criterion 2.1 only when the units at a single plant location add up to 1,500 MW or more in one Interconnection, so almost every individual solar site rates low impact.

The place to look harder is the operations center. Criterion 2.11 rates a Control Center medium impact when it performs Generator Operator functions for 1,500 MW or more in a single Interconnection. A fleet of low-impact sites can therefore be run from a medium-impact control room.

For low impact, CIP-002 asks you to identify each asset that contains a low impact BES Cyber System. A device-by-device list of low impact BES Cyber Systems is not required.

3. Write the CIP-003 policy and low-impact plan

Low impact does not mean no obligations. CIP-003-9 requires documented cyber security policies (R1), a CIP Senior Manager who approves them (R3), and one or more cyber security plans for your low impact BES Cyber Systems that cover the sections of Attachment 1 (R2):

• Section 1 — cyber security awareness, reinforced at least once every 15 calendar months.
• Section 2 — physical security controls for the asset and its low impact BES Cyber Systems.
• Section 3 — electronic access controls: permit only the routable communication that is needed, inbound and outbound, and authenticate dial-up.
• Section 4 — cyber security incident response, including testing the plan at least once every 36 calendar months.
• Section 5 — transient cyber assets and removable media, which at a solar site usually means O&M and vendor laptops and USB drives.
• Section 6 — vendor electronic remote access security controls, added in CIP-003-9.

4. Look for the paths nobody drew

The gaps that surface at solar sites tend to be connections added for operations rather than designed in: a cellular modem an inverter or tracker vendor uses for remote support, a second internet circuit for the monitoring portal, a contractor laptop moved between sites. Each is a routable path or a transient device that Sections 3, 5 and 6 expect you to control and document.

Walk each site's communications with the people who installed them, and write down every path in and out with the reason it exists. That list becomes your electronic access rules.

5. Plan for evidence, not just documents

An auditor reads the plan and then asks to see it working: current firewall or router configurations that match the documented rules, awareness records, the incident-response test, the transient-device process in use, vendor remote-access records. Collecting that continuously is far less work than reconstructing a year of it before an audit.