NERC CIP effective dates: what applies now and what changes from 2028 to 2031

In effect today

CIP-003-9 has applied since April 1, 2026; it added vendor electronic remote access controls (Section 6) to the low impact plan. For every standard below, the version in effect today stays the one you are audited against until its new date arrives.

July 1, 2028: the virtualization revisions

FERC Order No. 919 (March 2026) approved NERC's virtualization revisions. They take effect together on July 1, 2028:

• CIP-002-8, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1
• CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1
• CIP-013-3 (supply chain risk management)

October 1, 2028

• CIP-014-4 (physical security of transmission stations and substations).
• CIP-015-1 (internal network security monitoring) for high impact BES Cyber Systems, and medium impact systems at Control Centers and backup Control Centers.

July 1, 2029: CIP-003-11

CIP-003-11 (FERC Order No. 918) moves the vendor remote access methods into Section 3, widens detection of malicious communications beyond vendor access, and adds authentication of users and protection of authentication information in transit. See the CIP-003-9 low impact guide for what applies today.

October 2029 to October 2031: CIP-015 widens step by step

• October 1, 2029: CIP-015-2 takes effect, adding the EACMS and PACS of high impact systems and of medium impact systems at Control Centers.
• October 1, 2030: CIP-015-1 reaches the remaining medium impact BES Cyber Systems with External Routable Connectivity.
• October 1, 2031: CIP-015-2 reaches the EACMS and PACS of those remaining medium impact systems.

Sources

NERC Weekly Regulatory Update of October 26, 2026; NERC's list of standards subject to future enforcement; the NERC Project 2025-02 FAQ for CIP-015-2; FERC Order No. 918; FERC Order No. 919; the FERC letter order of August 10, 2026 in Docket No. RD26-6-000. Dates are for the United States; Canadian provinces set their own.