NERC CIP (Critical Infrastructure Protection standards)

NERC CIP is a family of mandatory, federally enforceable cybersecurity and physical security standards for the Bulk Electric System in North America. Unlike most of the standards in this glossary, NERC CIP compliance isn't optional for the utilities, generators, and grid operators it covers. It requires the sort of things a checklist starting point looks like: identifying and classifying critical cyber assets, maintaining documented security policies, training personnel, protecting electronic and physical access to control systems, reporting security incidents, and planning for recovery. A designated senior manager is required to be formally accountable for an organization's compliance.

The family also includes CIP-002 on asset identification, CIP-005 on electronic security perimeters, CIP-006 on physical security, CIP-008 on incident reporting, and CIP-009 on recovery planning.