implementing-nerc-cip-compliance-controls

name	implementing-nerc-cip-compliance-controls
description	Use when this skill covers implementing North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) compliance controls for Bulk Electric System (BES) cyber systems. It addresses asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), supply chain risk management (CIP-013), and the 2025 updates including mandatory MFA for remote access and expanded low-impact asset req...
domain	cybersecurity
tags	["ot-security","ics","scada","industrial-control","iec62443","nerc-cip","power-grid","compliance"]
subdomain	ot-ics-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Implementing Nerc Cip Compliance Controls

Overview

Cybersecurity skill for implementing nerc cip compliance controls. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing nerc cip compliance controls"

• "This skill covers implementing North American Electric Reliability Corporation C"

• When a registered entity must achieve or maintain NERC CIP compliance for BES cyber systems

• When preparing for a NERC CIP compliance audit by the Regional Entity

• When implementing the 2025 CIP standard updates (CIP-003-9, CIP-005-7, CIP-010-4, CIP-013-2)

• When categorizing BES cyber systems after commissioning new generation, transmission, or control center assets

• When developing a compliance monitoring and evidence collection program

Do not use for non-BES industrial systems (see implementing-iec-62443-security-zones), for general IT compliance frameworks (see auditing-cloud-with-cis-benchmarks), or for physical security of substations without cyber components.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Understanding of NERC CIP standards (CIP-002 through CIP-014)
• BES cyber system inventory with impact ratings (high, medium, low)
• Access to Electronic Security Perimeter (ESP) network diagrams and firewall configurations
• Compliance management system for evidence collection and audit documentation
• Familiarity with NERC Glossary of Terms (BES Cyber Asset, BES Cyber System, Electronic Access Point)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}