implementing-nerc-cip-compliance-controls

name	implementing-nerc-cip-compliance-controls
description	Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize newly commissioned BES cyber systems.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","scada","industrial-control","iec62443","nerc-cip","power-grid","compliance"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]
mitre_attack	["T1078","T1190","T1059","T1195","T1554"]

Implementing NERC CIP Compliance Controls

When to Use

• When a registered entity must achieve or maintain NERC CIP compliance for BES cyber systems
• When preparing for a NERC CIP compliance audit by the Regional Entity
• When implementing the 2025 CIP standard updates (CIP-003-9, CIP-005-7, CIP-010-4, CIP-013-2)
• When categorizing BES cyber systems after commissioning new generation, transmission, or control center assets
• When developing a compliance monitoring and evidence collection program

Do not use for non-BES industrial systems (see implementing-iec-62443-security-zones), for general IT compliance frameworks (see auditing-cloud-with-cis-benchmarks), or for physical security of substations without cyber components.

Prerequisites

• Understanding of NERC CIP standards (CIP-002 through CIP-014)
• BES cyber system inventory with impact ratings (high, medium, low)
• Access to Electronic Security Perimeter (ESP) network diagrams and firewall configurations
• Compliance management system for evidence collection and audit documentation
• Familiarity with NERC Glossary of Terms (BES Cyber Asset, BES Cyber System, Electronic Access Point)

Workflow

Step 1: Categorize BES Cyber Systems (CIP-002-5.1a)

Identify and categorize all BES cyber systems based on their impact to the reliable operation of the Bulk Electric System.

#!/usr/bin/env python3
"""NERC CIP BES Cyber System Categorization Tool.

Implements CIP-002-5.1a categorization criteria to classify
BES cyber systems as high, medium, or low impact.
"""

import json
import sys
from dataclasses import dataclass, field, asdict
from datetime import datetime


@dataclass
class BESCyberSystem:
    """Represents a BES Cyber System for CIP-002 categorization."""
    system_id: str
    name: str
    description: str
    location: str
    asset_type: str  # control_center, generation, transmission, distribution
    connected_mw:  = 
    transmission_kv:  = 
    is_control_center:  = 
    is_backup_control_center:  = 
    has_cranking_path:  = 
    has_blackstart:  = 
    is_sps_ras:  =   
    impact_rating:  =   
    categorization_basis:  = 
    cyber_assets:  = field(default_factory=)


 :
    

     ():
        .systems = []
        .categorization_date = datetime.now().isoformat()

     ():
        .systems.append(system)

     ():
        
         system  .systems:
            ._categorize_system(system)

     ():
        

        
         sys.is_control_center  sys.asset_type == :
            
            
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

         sys.is_backup_control_center  sys.asset_type == :
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

         sys.connected_mw >= :
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

        
         sys.connected_mw >=   sys.asset_type == :
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

         sys.transmission_kv >= :
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

         sys.has_cranking_path:
            sys.impact_rating = 
            sys.categorization_basis = (
                
            )
            

         sys.has_blackstart:
            sys.impact_rating = 
            sys.categorization_basis = (
                
            )
            

         sys.is_sps_ras:
            sys.impact_rating = 
            sys.categorization_basis = (
                
            )
            

         sys.is_control_center  sys.asset_type == :
            sys.impact_rating = 
            sys.categorization_basis = (
                
                
            )
            

        
        sys.impact_rating = 
        sys.categorization_basis = (
            
            
        )

     ():
        
        high = [s  s  .systems  s.impact_rating == ]
        medium = [s  s  .systems  s.impact_rating == ]
        low = [s  s  .systems  s.impact_rating == ]

        report = []
        report.append( * )
        report.append()
        report.append()
        report.append( * )
        report.append()
        report.append()
        report.append()
        report.append()

         category, systems  [(, high), (, medium), (, low)]:
             systems:
                report.append()
                 s  systems:
                    report.append()
                    report.append()
                    report.append()
                    report.append()
                    report.append()

         .join(report)

     ():
        
        data = {
            : .categorization_date,
            : ,
            : [asdict(s)  s  .systems],
        }
         (output_file, )  f:
            json.dump(data, f, indent=)


 __name__ == :
    categorizer = CIP002Categorizer()

    
    categorizer.add_system(BESCyberSystem(
        system_id=, name=,
        description=,
        location=, asset_type=,
        is_control_center=))

    categorizer.add_system(BESCyberSystem(
        system_id=, name=,
        description=,
        location=, asset_type=,
        connected_mw=))

    categorizer.add_system(BESCyberSystem(
        system_id=, name=,
        description=,
        location=, asset_type=,
        transmission_kv=))

    categorizer.categorize_all()
    (categorizer.generate_report())