Plain-language definitions of the terms that come up most in NERC CIP work.
6 min read
CIP-002 – CIP-015
BES — Bulk Electric System: the transmission elements and generation resources NERC's reliability standards apply to.
BES Cyber Asset (BCA) — a cyber asset whose loss or misuse would affect the reliable operation of the BES within 15 minutes.
BES Cyber System (BCS) — one or more BES Cyber Assets grouped to perform a reliability function; categorized high, medium or low impact under CIP-002.
CIP Senior Manager — the single senior person with authority and responsibility for the entity's CIP program (CIP-003).
EACMS — Electronic Access Control or Monitoring Systems, such as firewalls and authentication servers that control or log access to an ESP.
EAP — Electronic Access Point: an interface on an ESP boundary that controls routable communication.
ERC — External Routable Connectivity: the ability to reach a BES Cyber System from outside its ESP over a routable protocol.
ESP — Electronic Security Perimeter: the logical border around a network to which BES Cyber Systems are connected.
IBR — Inverter-Based Resource: solar, wind and battery storage connected through inverters; revised registration criteria bring more of them into scope.
INSM — Internal Network Security Monitoring, required by CIP-015-1 inside the ESP of high-impact and medium-impact-with-ERC systems (U.S.: Control Centers from October 1, 2028, other medium-impact systems by October 1, 2030).
PACS — Physical Access Control Systems that control or log physical access to Physical Security Perimeters.
PCA — Protected Cyber Asset: a cyber asset inside an ESP that is not itself a BES Cyber Asset.
RSAW — Reliability Standard Audit Worksheet: the worksheet auditors use to assess compliance with each standard.
Transient Cyber Asset — a laptop or similar device connected for 30 days or less, e.g. for maintenance.
General guidance, not legal or compliance advice. Your obligations depend on your registration and assets — confirm them with your compliance team and Regional Entity.