Transient Cyber Assets and removable media at low impact sites (CIP-003-9 Section 5)

Most of the people who plug a computer into the control network at a solar, wind or battery site do not work for the owner. Commissioning engineers bring laptops loaded with configuration tools. Inverter, turbine and battery OEM technicians arrive with their own service laptops. Firmware updates come on USB drives. Each of these is a way for malicious code to reach equipment that may have no other path to the outside world.

For assets containing low impact BES Cyber Systems, CIP-003-9 deals with this in Attachment 1, Section 5. This post walks through what Section 5 says, part by part, and what a workable process looks like at a remote plant.

First: does Section 5 apply to the site?

Section 5 is one of the sections of the cyber security plan that CIP-003-9 Requirement R2 asks for at each asset containing low impact BES Cyber Systems. Two checks come first.

• Is the plant a BES facility? Plants that are BES facilities, which for these resources means more than 75 MVA in aggregate connected at 100 kV or higher, are under the CIP standards, usually at low impact.
• Is it a Category 2 inverter-based resource? Category 2 IBRs, registered with NERC since May 15, 2026, are not BES facilities and are not subject to the CIP standards. Checking laptops and USB drives is still sensible practice there, but it is not a CIP requirement.

If a system is rated medium or high impact, for example at a fleet control center, the transient device rules come from CIP-010-4 Requirement R4 and its own Attachment 1 instead.

Two terms

• Transient Cyber Asset (TCA): in the NERC Glossary, a laptop or similar device connected for 30 days or less, for example for maintenance.
• Removable Media: portable storage such as USB flash drives and external hard drives, connected to move files, software or firmware.

What Section 5 asks for

Section 5 starts with its objective. Each Responsible Entity implements, except under CIP Exceptional Circumstances, one or more plans "to achieve the objective of mitigating the risk of the introduction of malicious code to low impact BES Cyber Systems through the use of Transient Cyber Assets or Removable Media." CIP-003-9 also lists Transient Cyber Assets and Removable Media malicious code risk mitigation as one of the low impact policy topics in Requirement R1, so it belongs in the policy the CIP Senior Manager approves at least once every 15 calendar months.

The plan has three parts, and they cover three different situations.

5.1: laptops you manage

For Transient Cyber Assets managed by the Responsible Entity, if any, the plan uses one or a combination of the following, in an ongoing or on-demand manner, per Transient Cyber Asset capability:

• antivirus software, including manual or managed updates of signatures or patterns;
• application whitelisting; or
• other methods to mitigate the introduction of malicious code.

This is your O&M team's own engineering laptops. "Ongoing or on-demand" means the protection can run all the time or be run before each use. "Per capability" matters for devices that cannot run antivirus or whitelisting; for those, the "other methods" option is where you write down what you do instead.

5.2: laptops someone else manages

This is the commissioning engineer's laptop and the OEM technician's service laptop. Under Part 5.2.1, you use one or a combination of the following before the Transient Cyber Asset connects to a low impact BES Cyber System, per Transient Cyber Asset capability:

• review of antivirus update level;
• review of the antivirus update process used by the party;
• review of application whitelisting used by the party;
• review of the use of a live operating system and software executable only from read-only media;
• review of system hardening used by the party; or
• other methods to mitigate the introduction of malicious code.

Then Part 5.2.2: for whichever method you used, determine whether any additional mitigation actions are necessary, and implement them before connecting the Transient Cyber Asset.

Notice the word "review". You are not asked to manage the vendor's laptop, but you are asked to look at it, or at the vendor's process for it, before it connects, and to decide whether that is enough. Two practical consequences follow:

• The review has to happen before the connection, so it has to fit the site visit. A check that can only be done from head office tends to be skipped on the day.
• The 5.2.2 decision is worth writing down even when the answer is "no additional action needed". That record is what shows the review happened.

Reviewing a party's process need not all happen at the gate: a service agreement or pre-visit questionnaire can ask how the vendor keeps its laptops' antivirus current and how they are hardened.

5.3: removable media

For Removable Media, the plan uses each of the following, so both are required:

• 5.3.1: methods to detect malicious code on Removable Media using a Cyber Asset other than a BES Cyber System; and
• 5.3.2: mitigation of the threat of detected malicious code on the Removable Media prior to connecting it to a low impact BES Cyber System.

Three details are easy to miss. The scan has to run on something other than a BES Cyber System, so the HMI or plant controller cannot be the thing that checks its own USB drive. Unlike 5.1 and 5.2, Part 5.3 has no "per capability" wording and no "other method" option: detection and mitigation are both needed. And 5.3 does not distinguish between your media and a vendor's, so a drive an OEM technician hands over is covered the same way as one from your own store room.

Firmware on USB drives

Firmware for inverters, battery management systems, turbine controllers and relays often arrives on a USB drive, or is copied to one from a vendor portal. Part 5.3 covers the drive: it is scanned, and anything found is dealt with, before it is connected.

A clean scan does not tell you the firmware file came from the manufacturer unchanged. Section 5 is about malicious code, not about the authenticity of the file, so that question has to be settled separately. Ask the vendor how to verify its firmware, for example against a published hash or a signature. At medium and high impact, CIP-013-2 Part 1.2.5 makes software integrity a procurement topic; at low impact it is simply good practice.

A workable process for a remote site

• Decide where scanning happens: a dedicated scanning laptop or kiosk that is not a BES Cyber System, kept at the site or carried by the O&M technician, with its signatures kept current.
• Keep your own laptops in a known state: antivirus or whitelisting in place, and updated before a trip to a site with poor connectivity.
• Brief vendors before they travel: what you will check, and that unscanned media will not be connected.
• Use one short record per visit: who, which laptop, whose it is (yours or theirs), which 5.1 or 5.2.1 method was used, the 5.2.2 decision, which media were scanned and the result, and when the connection was made.
• Cover the edge cases in the plan: what happens when a scan finds something, and what happens when the scanning device itself is not available on the day.

What an auditor will want to see

Expect to show the plan and then evidence that it was followed: records of laptop and removable media checks before each site visit, including the 5.2.2 decision for third-party laptops and the result of each media scan. CIP-003-9 asks you to keep evidence for three calendar years unless your Compliance Enforcement Authority asks for longer.

Where automated collection helps

Section 5 checks happen at the door, and they are mostly a person's job. Automated read-only collection helps on the other side of the visit. If each collection is compared with the device's baseline, a firmware, software, port or account change made while a technician was connected shows up for someone to review, and can be matched against the visit record. That does not replace the Section 5 checks. It tells you whether the visit changed more than it was meant to.

CIP-003-9 is the version audited today. CIP-003-10 (July 1, 2028) and CIP-003-11 (July 1, 2029) are approved; we will update this post as those dates approach.