CIP-003-9 for low-impact sites: the plan and the evidence

Who this applies to

Sites with low-impact BES Cyber Systems — including many inverter-based resources newly brought into scope by revised NERC registration criteria — must have documented cyber security plans under CIP-003-9 R2 and implement them.

A CIP Senior Manager must approve the policies (R1) and be identified (R3); delegations must be documented (R4).

What the plan must cover (Attachment 1)

• Cyber security awareness — reinforcing good practice with staff at least once every 15 calendar months.
• Physical security controls — controlling physical access to low-impact BES Cyber Systems and their access points.
• Electronic access controls — permitting only necessary inbound and outbound routable access, and authenticating dial-up access.
• Cyber Security Incident response — identifying, classifying and responding to incidents, with roles, reporting and testing.
• Transient Cyber Assets and removable media — mitigating malicious-code risk from laptops and USB media brought on site.
• Vendor electronic remote access — determining, and being able to disable, vendor remote access (added in CIP-003-9).

Evidence auditors look for

• Approved, dated policies and the plan itself.
• Awareness materials and the dates they were delivered.
• Access-control configurations at each site's boundary devices and the reasons for permitted access.
• The incident response plan and records of its tests.
• Records of transient-device and removable-media checks.
• How vendor remote access is controlled and how it can be shut off.

Making it repeatable across many sites

Fleets of similar sites benefit from one plan applied consistently, with site-specific evidence collected the same way everywhere. Standardise the boundary configuration, collect it automatically, and keep each site's records in one place so a sample audit is easy to answer.