NERC CIP firewall requirements: what CIP-005 and CIP-003 actually ask

The standards never say "firewall"

NERC CIP sets outcomes, not products. A firewall is simply the most common way to meet them. Which outcome applies depends on how CIP-002 rates the BES Cyber Systems behind it: CIP-005 for high and medium impact, CIP-003 Attachment 1 Section 3 for low impact.

Medium and high impact: CIP-005-7 Requirement R1

R1 asks for an Electronic Security Perimeter (ESP) and controlled Electronic Access Points (EAPs). An EAP is the Cyber Asset that controls electronic access at the ESP: in practice, usually a firewall. The parts, as the standard words them:

• 1.1: all applicable Cyber Assets connected to a network via a routable protocol reside within a defined ESP.
• 1.2: all External Routable Connectivity goes through an identified EAP.
• 1.3: inbound and outbound access permissions, including the reason for granting access, and deny all other access by default.
• 1.4: where technically feasible, authentication when establishing Dial-up Connectivity.
• 1.5: one or more methods for detecting known or suspected malicious communications, inbound and outbound.

Remote access through the firewall: CIP-005-7 R2

• Interactive Remote Access goes through an Intermediate System, so the remote computer never reaches the BES Cyber System directly (2.1).
• Encryption terminates at the Intermediate System (2.2), and every Interactive Remote Access session uses multi-factor authentication (2.3).
• For vendor remote access, including system-to-system: methods to determine active sessions (2.4) and to disable them (2.5).

Low impact: CIP-003-9 Attachment 1, Section 3

Low impact sites have no ESP and no EAP. Section 3.1 asks you to "permit only necessary inbound and outbound electronic access" for communication that is between a low impact BES Cyber System and a Cyber Asset outside the asset, uses a routable protocol when entering or leaving the asset, and is not used for time-sensitive protection or control functions between intelligent electronic devices. Section 3.2 adds authentication for dial-up connectivity.

Attachment 2 lists the kind of evidence that fits: diagrams of inbound and outbound communication, or lists of access controls such as ACLs restricting IP addresses, ports or services, or unidirectional gateways.

At medium and high impact, the firewall is in scope too

An EAP is an Electronic Access Control or Monitoring System (EACMS). CIP-007 (ports and services, patching, logging) and CIP-010 (baselines and change management) apply to EACMS associated with high and medium impact BES Cyber Systems, so the firewall needs a baseline, reviewed patches and logs like the systems it protects.

What an auditor asks to see

• The current rule set at each access point, with the documented reason for every permitted inbound and outbound rule.
• Proof of deny by default: the final rule, and no broad "any" rules left without a reason.
• How a rule change is approved and recorded; at medium and high impact, that is CIP-010 change management for the firewall.
• Dated copies of the configuration over the audit period, not a screenshot taken the week before.
• At low impact: the list or diagram of every routable flow that crosses the site boundary, and why each one is needed.

Where firewalls usually fail the test

• Rules opened wide during commissioning and never closed.
• Permitted rules with no reason recorded.
• Outbound traffic left open because only inbound was reviewed.
• A path that never touches the firewall: an OEM's cellular modem for warranty support, or a vendor VPN appliance added later.

Coming versions

CIP-005-8 takes effect on July 1, 2028 with the virtualization revisions, and CIP-003-11 on July 1, 2029 moves the vendor remote access methods into Section 3. See NERC CIP effective dates for the full calendar. Until those dates, CIP-005-7 and CIP-003-9 are the versions audited.