The NERC CIP standards: all of them, what each covers, and which apply to solar, wind and battery sites

Start with CIP-002

Which CIP standards apply depends on how CIP-002 rates your BES Cyber Systems: high, medium or low impact. Most solar, wind and battery plants are low impact, which means CIP-003 is the program that applies to them. Category 2 inverter-based resources, registered with NERC since May 15, 2026, are not BES facilities and are not under CIP at all.

• Low or medium impact? Where NERC CIP ratings go wrong
• Category 2 IBR registration: which NERC standards apply

The standards in force in the U.S. (November 2026)

• CIP-002-5.1a — BES Cyber System Categorization: identify and rate BES Cyber Systems as high, medium or low impact.
• CIP-003-9 — Security Management Controls: policies, a CIP Senior Manager, and the low impact plan (in effect since April 1, 2026).
• CIP-004-7 — Personnel and Training: awareness, training, personnel risk assessments and access management.
• CIP-005-7 — Electronic Security Perimeters: perimeters, access points, Interactive Remote Access and vendor remote access.
• CIP-006-6 — Physical Security of BES Cyber Systems: physical security plans and visitor control.
• CIP-007-6 — System Security Management: ports and services, patches, malicious code, logging, access control.
• CIP-008-6 — Incident Reporting and Response Planning.
• CIP-009-6 — Recovery Plans for BES Cyber Systems.
• CIP-010-4 — Configuration Change Management and Vulnerability Assessments: baselines and change control.
• CIP-011-3 — Information Protection: BES Cyber System Information.
• CIP-012-2 — Communications between Control Centers.
• CIP-013-2 — Supply Chain Risk Management.
• CIP-014-3 — Physical Security of transmission stations and substations.

Approved, not yet in force

CIP-015-1 (internal network security monitoring) starts on October 1, 2028. The virtualization revisions of most standards take effect together on July 1, 2028, and CIP-003-11 on July 1, 2029.

• NERC CIP effective dates, 2026 to 2031
• CIP-015 INSM: preparing for CIP-015-1 and CIP-015-2

Our guides, standard by standard

• CIP-003-9 for low impact sites: the plan and the evidence
• NERC CIP firewall requirements (CIP-005 and CIP-003)
• Segmenting an OT network around electronic security perimeters (CIP-005)
• CIP-007 requirements for generator owners
• Backup and recovery for OT (CIP-009)
• Hardening baselines for firewalls, switches and Windows (CIP-007, CIP-010)
• BESS cybersecurity and NERC CIP
• NERC glossary of terms for CIP, in plain language

Sources

Versions in force per NERC's Standards, Compliance and Enforcement Bulletins of March 9 and June 29, 2026 and NERC's U.S. Effective Dates table. Canadian provinces set their own dates.