Low impact or medium impact? Where NERC CIP impact ratings go wrong
Five places operators of solar, wind and storage misread CIP-002 — and what each mistake costs in requirements you did or did not need to meet.
The impact rating decides almost everything else in a NERC CIP program: which requirements apply, how much evidence you keep and what an audit looks at. CIP-002-5.1a's bright-line criteria are short, but they are easy to misread. These are the mistakes that come up most for generation operators.
1. Rating the sites and forgetting the control room
A single solar or wind plant reaches medium impact under criterion 2.1 only at 1,500 MW or more at one plant location in one Interconnection. That threshold is rarely met, so operators conclude the whole program is low impact.
Criterion 2.11 is separate: a Control Center or backup Control Center that performs Generator Operator functions for 1,500 MW or more in a single Interconnection is medium impact. As a portfolio grows, the remote operations center can cross that line while every site stays low. Re-check it every time capacity is added.
2. Treating the rating as a one-time decision
CIP-002 R2 requires a review of the identifications at least once every 15 calendar months, with the CIP Senior Manager's approval. New plants, repowering, a backup control center and a change of operator all move the numbers. A rating that was right at registration can be wrong two years later.
3. Building a device list nobody asked for
For low impact, CIP-002 R1 asks you to identify each asset — the plant or facility — that contains a low impact BES Cyber System. The standard says a discrete list of low impact BES Cyber Systems is not required.
An inventory is still good practice and makes the CIP-003 plan easier to defend. But it should not delay the obligations that are required: the policy, the plan and the controls in CIP-003 Attachment 1.
4. Assuming low impact means little to do
Low impact sites still need the CIP-003-9 plan: awareness, physical security, electronic access controls, incident response with a test every 36 calendar months, transient cyber assets and removable media, and vendor electronic remote access controls. Each of these needs evidence that it is in place, not only a written procedure.
5. Ignoring External Routable Connectivity at medium impact
Once a system is medium impact, many requirements apply only when it has External Routable Connectivity (ERC) — for example the interactive remote access requirements in CIP-005. CIP-015-1, the internal network security monitoring standard, applies to high impact BES Cyber Systems and to medium impact BES Cyber Systems with ERC.
Whether a medium impact system has ERC therefore changes both today's requirements and the monitoring you will need when CIP-015-1 takes effect. Document the routable paths and the reasoning, because the answer is something an auditor will test.
What to do this quarter
- List every control center and backup control center and the MW each one operates, per Interconnection.
- Put the next CIP-002 review date on the calendar, inside 15 calendar months of the last one.
- For each medium impact system, record whether it has External Routable Connectivity and why.
- Check that every low impact asset is covered by a CIP-003-9 plan with all six Attachment 1 sections.