Category 2 IBR security baseline checklist

Why a checklist, if CIP doesn't apply

Since May 15, 2026, owners and operators of inverter-based resources with 20 MVA or more in aggregate, connected at 60 kV or higher, register with NERC as Category 2 Generator Owners and Operators. Their obligations are BAL-001-TRE, IRO-010-5, MOD-032-2, PRC-012-2, PRC-017-1, TOP-003-6.1, VAR-001-5 and VAR-002-4.1. None of these is a CIP standard.

That is because Category 2 IBRs are not BES facilities, and the CIP standards protect BES Cyber Systems. NERC's Security Guideline for Inverter-Based Resources says so directly, and then recommends a practical cyber security baseline for these sites anyway: they run the same inverters, plant controllers, SCADA and vendor remote access as larger plants.

This checklist turns the guideline's baseline practices into 30 checks you can work through site by site. It is advisory, like the guideline. If part of your fleet is BES (more than 75 MVA in aggregate at 100 kV or higher), those sites are under CIP today, usually at low impact; see the CIP-003-9 guide.

1. Assets and configuration (guideline chapter 6)

• Every site has a current inventory: inverters, plant controllers, HMIs, protection and automation devices, network and communications equipment, servers.
• Each inventory entry records device type, model, firmware or software version, network location, criticality and responsible owner or vendor.
• The inventory is updated when equipment is installed, removed, replaced or updated, including changes made during commissioning and troubleshooting.
• Devices that support control, protection, communications or remote access have an approved baseline configuration (services, network settings, access controls, firmware).
• Configuration changes are reviewed and recorded; temporary troubleshooting changes are reverted or added to the baseline.
• Configurations are compared with the baseline on a schedule, manually or automatically, and deviations are reviewed.
• There is a process to evaluate and apply firmware and security updates, with compensating measures (monitoring, isolation) where patching must wait.

2. Identity and access (chapter 3)

• Every person and service account has its own identity; shared or generic accounts are not used.
• Interactive access, and remote access in particular, needs multi-factor authentication.
• Access is limited to what each role needs, using role-based access where the equipment supports it.
• Default credentials are removed or disabled before commissioning.
• Vendor and contractor accounts are individual, time-bound where possible, and removed when the work or contract ends.
• Authentication events, access attempts and privilege changes are logged and reviewed.
• User, service and privileged access is recertified periodically.

3. Remote access and vendors (chapters 2 and 4)

• There is a list of every remote access path per site: who connects, how, and through which device.
• Remote access is encrypted and strongly authenticated; no device is exposed directly to the internet.
• Interactive remote sessions go through an owner-controlled gateway or jump host that logs them.
• Vendor and OEM access uses approved methods only; always-on vendor connections are avoided unless explicitly approved.
• Active remote sessions can be seen and ended, and someone knows how to switch a vendor's access off.
• Vendor tools and the cloud services behind them are reviewed before use, including where access originates.

4. Network segmentation (chapter 5)

• Networks for inverter control, plant controllers, HMIs and protection are not reachable from the internet, and reach the corporate network only through controlled boundary devices.
• Control functions, operations support and external communications are on separate segments (VLANs, ACLs or firewalls).
• Boundary rules allow only the required protocols, endpoints and directions; everything else is denied.
• Traffic over carrier, wireless or third-party networks is encrypted and authenticated (site-to-site VPN or mutual TLS).
• Protocol converters, data concentrators and gateways are treated as high-risk: hardened, updated, restricted and monitored where feasible.

5. Incident response and recovery (chapter 9)

• Site-specific procedures say who may disable remote access, isolate a site or curtail output, and when.
• Escalation triggers are defined: unexplained loss of telemetry, repeated inverter trips, unexpected mode changes, unauthorized account activity, configuration or firmware changes.
• Vendor access can be disabled and credentials revoked without anyone driving to site.
• Playbooks exist for the common cases: remote intrusion, setpoint or mode manipulation, gateway compromise, ransomware on support systems, compromise of a cloud or third-party platform.
• Contacts for operations, cyber response, field support, vendors and telecom providers are current, with an out-of-band way to reach them.

How to use it

Score each site: done, partly, not started. Three gaps come up again and again: remote access paths nobody wrote down, an inventory that stopped at commissioning, and logs that never leave the device. Fix those first; they are also the foundation of CIP-003-9 and CIP-010 for any BES sites you run.

Keep the evidence as you go: the inventory export, the access-path list, the review dates. If cyber security obligations are later extended to Category 2 resources, the owners with records will have the smallest step to take.

Source: NERC Security Guideline for Inverter-Based Resources (final draft); applicable Category 2 standards per NERC's 2026 State of Reliability. This checklist summarises recommended practices and is not a compliance requirement.