NERC CIP

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-05-26 FERC Orders No. 918 and 919 approving virtualization standards and CIP-003-11 take effect
2. 2025-11-24 FERC Order No. 912 takes effect, directing NERC to revise the supply chain risk management standards
3. 2025-09-02 FERC Order No. 907 approving CIP-015-1 takes effect
4. 2023-04-10 FERC Order No. 887 directing internal network security monitoring standards takes effect

1. 2026-03-24
   FERC Orders No. 918 and 919 (March 2026) RevisionCurrent

   FERC approved 11 modified CIP standards that allow virtualization, and CIP-003-11 on security controls for low impact BES Cyber Systems; both effective as orders on 26 May 2026. source

   More

   • Order No. 919 approved 11 modified CIP standards, four new and 18 revised NERC Glossary definitions, and retired the versions they replace.
   • Order No. 918 approved CIP-003-11, which builds on CIP-003-10 to reduce the risk of a coordinated attack on low impact facilities.
   • FERC directed NERC to set clear criteria for the "per system capability" exception used in the virtualization standards.
2. 2025-07-02
   CIP-015-1 internal network security monitoring (Order No. 907) Amendment

   FERC approved the new standard CIP-015-1 on internal network security monitoring and directed NERC to extend it to electronic access control or monitoring systems and physical access control systems outside the electronic security perimeter. source

3. 2020-02-13
   CIP-012-1 control center communications (Order No. 866) Amendment

   FERC approved CIP-012-1 on protecting communications between control centers. source

4. 2018-10-26
   Supply chain standards (Order No. 850) Amendment

   FERC approved CIP-013-1 on supply chain risk management, with CIP-005-6 and CIP-010-3. source

5. 2018-04-25
   CIP-003-7 (Order No. 843) Revision

   FERC approved CIP-003-7, clarifying electronic access controls and adding transient device controls for low impact BES Cyber Systems. source

Every user, owner and operator of the US Bulk-Power System must comply with the FERC-approved CIP standards that apply to it.

Mandatory

Each applicable user, owner or operator of the Bulk-Power System must comply with Commission-approved Reliability Standards developed by the Electric Reliability Organization. source

Who exactly

Each standard identifies the subset of users, owners and operators to which it applies. source

Effective versions

NERC must post the currently effective standards, as approved by FERC, with their effective dates. source

Implementation plans

FERC approves each standard together with its implementation plan and effective date, and retires the version it replaces. source

Compliance is checked through the ERO's compliance monitoring and enforcement process, of which audits are one part.

Monitoring

FERC described compliance audits as one aspect of the ERO's compliance monitoring and enforcement process, conducted after the fact. source

Substance over paperwork

Responsible entities must comply with the substance of each requirement, not just show that a document exists. source

NERC and the Regional Entities determine financial penalties for violations, weighted by each requirement's risk factor.

Risk factors

Violation Risk Factors delineate the relative risk each requirement poses to the Bulk-Power System and are used by NERC and the Regional Entities to determine financial penalties. source

Penalty factors approved

FERC approves the violation risk factors and violation severity levels with each standard. source

1. Law text 18 CFR part 40 – Mandatory Reliability Standards for the Bulk-Power System
2. Standard NERC CIP Reliability Standards
3. Law text FERC Order No. 919, Virtualization Reliability Standards (24 March 2026)
4. Law text FERC Order No. 918, CIP-003-11 (24 March 2026)
5. Law text FERC Order No. 907, CIP-015-1 internal network security monitoring (2 July 2025)

1. IEC 62443

   IEC 62443 is an international series on industrial automation and control system security; NERC CIP standards are mandatory once FERC approves them for the US Bulk-Power System.

2. NIST SP 800-82

   NIST SP 800-82 is guidance on operational technology security; NERC CIP standards are enforceable requirements for bulk power system entities.

3. TSA SD 1580/82

   TSA security directives bind rail operators; NERC CIP binds electric utilities and other bulk power system entities.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NERC CIP (RSS)