NERC CIP
NERC Critical Infrastructure Protection (CIP) Cyber Security Reliability Standards
The CIP standards are NERC's mandatory cybersecurity requirements for entities that operate the bulk electric system (BES), approved by FERC. Four standards carry most identity controls: CIP-004 (personnel risk assessment, training and access management), CIP-005 (electronic security perimeters and remote access, including multi-factor authentication for all Interactive Remote Access), CIP-007 (system access control, shared and default accounts, passwords) and CIP-003 (security management controls, where CIP-003-9 added vendor electronic remote access controls for low impact systems from April 1, 2026). FERC Order No. 919, effective May 26, 2026, approved virtualization revisions to 11 CIP standards, including CIP-003-10, CIP-004-8, CIP-005-8 and CIP-007-7.1, which take effect on July 1, 2028.
Who it applies to
Registered Responsible Entities named in each standard: Balancing Authorities, certain Distribution Providers, Generator Operators, Generator Owners, Reliability Coordinators, Transmission Operators and Transmission Owners. Most CIP-004, CIP-005 and CIP-007 requirements apply to high impact and medium impact BES Cyber Systems as categorized under CIP-002, together with their associated access control and monitoring systems (EACMS), physical access control systems (PACS) and protected cyber assets (PCA); CIP-003 sets the controls for low impact systems.
Identity requirements
- Require multi-factor authentication for all Interactive Remote Access sessions, route that access through an Intermediate System, and encrypt the session to the Intermediate System (CIP-005-7 R2.1 to R2.3)
- Have methods to determine and to disable active vendor remote access sessions, including Interactive Remote Access and system-to-system remote access (CIP-005-7 R2.4 and R2.5)
- Verify at least once each calendar quarter that individuals with active electronic access or unescorted physical access have authorization records, and verify at least once every 15 calendar months that user accounts, groups and role privileges are correct and necessary (CIP-004-7 R4.2 and R4.3)
- On a termination action, remove the ability for unescorted physical access and Interactive Remote Access within 24 hours; for reassignments or transfers, revoke access that is no longer needed by the end of the next calendar day (CIP-004-7 R5.1 and R5.2)
- Inventory enabled default and generic account types, identify individuals with access to shared accounts, change known default passwords, and for password-only access enforce a minimum length (the lesser of eight characters or the system maximum), minimum complexity and a change at least every 15 calendar months (CIP-007-6 R5.2 to R5.6)
- Limit unsuccessful authentication attempts or alert after a threshold of failed attempts, where technically feasible (CIP-007-6 R5.7)
- For assets containing low impact BES Cyber Systems that allow vendor electronic remote access, have methods to determine and disable that access and to detect known or suspected malicious communications (CIP-003-9 Attachment 1, Section 6)
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | MFA is mandatory for all Interactive Remote Access to high impact and medium impact (with external routable connectivity) BES Cyber Systems, and password-only access must meet the CIP-007 length, complexity and change rules. |
| Privileged access (PAM) | Remote access must pass through an Intermediate System (a jump host), and shared and default accounts must be inventoried and tied to named individuals, which is the core of a PAM deployment in operational technology. |
| Identity governance (IGA) | Quarterly authorization checks, 15-month privilege reviews, 24-hour removal on termination and next-day revocation on transfer give utilities some of the tightest access review clocks in any regulation. |
| Audit, logging & accountability | Each requirement lists the evidence auditors expect, such as dated workflow records, account listings and logs showing access was removed, so identity systems must keep that evidence ready for Regional Entity audits. |
Upcoming deadlines
Penalties
NERC and its Regional Entities monitor and enforce compliance, with FERC oversight. Each requirement carries a Violation Risk Factor and Violation Severity Levels, which are used when penalties are set for a violation.
Status and dates last verified against primary sources on 2026-11-05.
NERC CIP: frequently asked questions
- Does NERC CIP require multi-factor authentication?
- Yes, for remote access. CIP-005-7 Requirement R2.3 requires multi-factor authentication for all Interactive Remote Access sessions to high impact BES Cyber Systems and to medium impact systems with external routable connectivity, along with their protected cyber assets. CIP-007-6 sets password rules for password-only interactive access inside the perimeter.
- How fast must access be removed under CIP-004?
- CIP-004-7 R5.1 requires removal of the ability for unescorted physical access and Interactive Remote Access within 24 hours of a termination action. For reassignments or transfers, R5.2 requires revoking access that is no longer needed by the end of the next calendar day after the entity determines it is not required.
- What changes with the CIP virtualization standards?
- FERC Order No. 919, published on March 24, 2026 and effective May 26, 2026, approved 11 modified CIP standards and new and revised glossary terms so entities can apply the CIP requirements to virtualized systems. Under NERC's implementation plan they take effect on the first day of the first calendar quarter 24 months after the order's effective date, which is July 1, 2028, with optional early adoption.