Why substation security tools fit badly at solar, wind and battery sites

Most OT security tooling sold to the power sector grew up around substations and control centers. That is where the high and medium impact BES Cyber Systems are, and where CIP-005, CIP-007 and CIP-010 apply in full. The tools are built for that world: a defined Electronic Security Perimeter, a list of every Cyber Asset inside it, baselines per device, and staff who can visit the site.

A solar plant, wind farm or battery site that falls under CIP usually looks different. If you bring a substation playbook to it, you can spend a lot of effort on the wrong things and still miss what an auditor will ask for.

First: which rules apply to the site?

Two checks come before any tool decision.

• Is the plant a BES facility at all? Category 2 inverter-based resources, newly registered with NERC in 2026, are not BES facilities and are not under the CIP standards today. Registration alone does not bring CIP with it.
• If it is BES, what is its CIP-002 rating? Plants that are BES facilities are under CIP, and usually at low impact. A fleet control center may be rated higher; that is a separate question with its own answer.

For a low impact site, the cyber program is CIP-003-9 (in effect since April 1, 2026): Requirement R1.2 (policy topics) and Requirement R2, which requires a documented cyber security plan that includes the six sections in Attachment 1. CIP-005, CIP-007 and CIP-010 are written for high and medium impact systems.

Where the substation model and a low impact site part ways

1. You are not asked for a device inventory

CIP-003-9 R2 carries a note that surprises people coming from medium impact work: "An inventory, list, or discrete identification of low impact BES Cyber Systems or their BES Cyber Assets is not required. Lists of authorized users are not required."

Knowing your devices is still good practice, and you cannot control access well without it. But a tool whose main value is a per-device CIP inventory and per-device baseline is solving a medium impact problem. At low impact, the evidence is organized by asset (the plant) or group of assets, not by device.

2. The boundary that matters is the plant fence, for routable traffic

Attachment 1, Section 3.1 asks you to "permit only necessary inbound and outbound electronic access" for communications that are all three of these:

• between a low impact BES Cyber System and a Cyber Asset outside the asset;
• using a routable protocol when entering or leaving the asset; and
• not used for time-sensitive protection or control functions between intelligent electronic devices (the standard gives IEC TR-61850-90-5 R-GOOSE as an example).

So the question an auditor works through is: what crosses the plant boundary over IP, and is each flow needed? Attachment 2 gives examples of evidence: diagrams of inbound and outbound communication, or lists of access controls such as ACLs restricting IP addresses, ports or services, or unidirectional gateways. Section 3.2 adds authentication for any dial-up connectivity, per Cyber Asset capability.

That is a firewall-rule and network-diagram question far more than a host question.

3. Vendor remote access is the center of the program

Generation sites often rely on equipment makers and O&M contractors for remote support of inverters, turbine controllers, battery management systems and plant controllers. CIP-003-9 added Section 6 for exactly this. Where a low impact asset allows vendor electronic remote access (established under Section 3.1), you need a process with:

• 6.1 one or more methods for determining vendor electronic remote access;
• 6.2 one or more methods for disabling vendor electronic remote access; and
• 6.3 one or more methods for detecting known or suspected inbound and outbound malicious communications for vendor electronic remote access.

Attachment 2 lists the kind of evidence that fits: steps to preauthorize access, alerts on vendor log-on, session monitoring or recording, system logs; disabling accounts, ports or VPN access; and for 6.3, anti-malware, IDS/IPS, log reviews or alerting. A tool built for substations may cover some of this. The test is whether it shows, per plant, who had vendor access, when it was on, how it gets switched off, and how malicious traffic on that path would be seen.

4. Laptops and USB sticks arrive with the vendor

Section 5 covers Transient Cyber Assets and Removable Media. It splits laptops into two cases:

• managed by you (5.1): antivirus, application whitelisting or another method, per device capability;
• managed by someone else (5.2), such as a technician's commissioning laptop: before it connects, review its antivirus update level or process, whitelisting, live read-only operating system, hardening, or another method, then decide whether extra mitigation is needed and do it.

For removable media (5.3), you need a way to detect malicious code using a Cyber Asset other than a BES Cyber System, and to mitigate what you find before the media is connected. At a remote plant, the practical question is where that scanning station is and who keeps the record.

5. The rest is program evidence, on a clock

• Section 1: reinforce cyber security practices at least once every 15 calendar months.
• Section 2: control physical access to the asset (or the locations of the low impact systems within it) and to the Cyber Assets that provide the Section 3.1 access controls.
• Section 4: an incident response plan covering identification, classification and response, whether an incident is reportable (with notification to the E-ISAC, unless prohibited by law), roles, incident handling, a test at least once every 36 calendar months, and any update within 180 calendar days of a test or a real reportable incident.
• R1: the CIP Senior Manager reviews and approves the policies at least once every 15 calendar months.

The standard's evidence retention is three calendar years for each requirement, unless the Compliance Enforcement Authority asks for longer.

What this means when you choose tools

A short checklist for a solar, wind or battery owner looking at security tooling:

• Does it organize evidence by plant (or group of plants), the way an Attachment 1 plan is written?
• Can it show every routable flow crossing the plant boundary and tie it to a documented business need?
• Does it record vendor remote access sessions and show how access is disabled, per Section 6?
• Does it work at an unstaffed, remote site without needing someone on site for every collection?
• Does it avoid installing software on controllers and inverters that the equipment maker does not support?
• Can it produce dated evidence for the 15-month and 36-month clocks without someone rebuilding it each year?

None of these are exotic. They are simply the questions CIP-003-9 asks, rather than the questions CIP-005, CIP-007 and CIP-010 ask.