Identity for Energy and Utilities: NERC CIP, OT Access, and NIS2

Energy and utility identity is critical-infrastructure identity. The systems behind a login include substations, pipelines, water treatment, and grid control, so the question is not only who can see data but who can change physical processes. The center of gravity is privileged and remote access to operational technology (OT): who can reach control systems, through which path, with what rights, and whether that access is monitored, time-bound, and recoverable. See the energy and utilities vertical page for the wider view.

Why identity is the front door to OT

Utilities have spent decades segmenting control networks, but convergence with IT, remote operations, and vendor support have created paths from corporate accounts to control systems. Attackers use them. CISA's February 2024 advisory on Volt Typhoon (AA24-038A) described state-sponsored actors pre-positioning in US critical infrastructure, including energy, and relying on valid accounts rather than malware to persist. When the attacker logs in, perimeter tools see a normal user. Identity controls and identity threat detection are what remain.

What NERC CIP requires

In North America, the NERC Critical Infrastructure Protection standards make identity controls auditable for the bulk electric system. Three standards carry most of the identity load (requirements quoted from the versions published on nerc.com, reviewed 16 October 2026). Applicability depends on the impact rating (High, Medium, Low) of each BES Cyber System.

CIP-004-7, Personnel and Training. R4 requires an access management program: authorization of access, and verification at least once every 15 calendar months that user accounts, groups, or roles and their privileges are correct and necessary. R5 governs revocation: on a termination action, removal of the ability for unescorted physical access and Interactive Remote Access must complete within 24 hours; for reassignments or transfers, access no longer needed must be revoked by the end of the next calendar day.

CIP-005-7, Electronic Security Perimeters. R2 requires that all Interactive Remote Access use an Intermediate System so the initiating device never directly reaches the protected asset, use encryption that terminates at that Intermediate System, and require multi-factor authentication for all Interactive Remote Access sessions. R3 requires methods to determine and terminate authenticated vendor-initiated remote connections to EACMS and PACS.

CIP-007-6, System Security Management. R5 (System Access Control) requires methods to enforce authentication of interactive user access where technically feasible, an inventory of default and generic account types, identification of who can use shared accounts, changing known default passwords, minimum password length and complexity for password-only authentication, password change at least every 15 calendar months where feasible, and either limits on or alerts after unsuccessful login attempts.

Notice how much of this is identity governance: quarterly and 15-month verifications, 24-hour revocation, shared-account accountability. Utilities that run these as manual spreadsheet exercises struggle at audit time; tying HR events to automated deprovisioning and recording access reviews makes the evidence a by-product.

What NIS2 requires

In the EU, NIS2 (Directive (EU) 2022/2555) lists energy in Annex I as a sector of high criticality, covering electricity, district heating and cooling, oil, gas, and hydrogen. Article 21(2) requires risk-management measures including supply chain security, access control policies and asset management, and the use of multi-factor or continuous authentication solutions where appropriate. Significant incidents require an early warning within 24 hours. See the NIS2 regulation page and the identity controls for NIS2 guide. Utilities with industrial control systems also use the ISA/IEC 62443 series for OT security requirements.

What good looks like

• Brokered remote access. Every remote and vendor session goes through a PAM gateway acting as the Intermediate System, with MFA, encryption, recording, and the ability to terminate sessions.
• Phishing-resistant MFA for engineers and operators wherever the system supports it (compare options in the best phishing-resistant MFA ranking).
• Named accounts over shared ones. Where control-room shared accounts cannot be eliminated, vault them, know who used them, and rotate their passwords when someone leaves.
• Just-in-time access for privileged and vendor work, so standing rights do not accumulate between audits.
• Identity threat detection across IT and OT, tuned for lateral movement from corporate accounts toward control networks.
• Tested break-glass and recovery, rehearsed with an incident response runbook, because an identity outage during a grid event is an operational emergency.

Vendors and fit

Privileged access is the core purchase. CyberArk, acquired by Palo Alto Networks in February 2026 and rebranded Idira in May 2026, covers enterprise PAM; WALLIX has a notable OT and industrial focus with EU data residency, per its profile. Silverfort targets coverage gaps on legacy systems, Active Directory authentication, and service accounts that agents cannot reach. Compare the categories in the best PAM tools, best compliant PAM platforms, and best ITDR tools rankings, and track obligations by country on the regulations hub.

The test for a utility identity program is not whether it passes the audit, though it must. It is whether an attacker holding a valid corporate password can reach a control system. If the answer is no, and you can prove it, the program is doing its job.