NERC CIP Compliance

NERC CIP (Critical Infrastructure Protection) is a mandatory cybersecurity standard for the Bulk Electric System (BES) developed by the North American Electric Reliability Corporation (NERC). The standard is developed by NERC and approved by the U.S. Federal Energy Regulatory Commission (FERC). It is legally binding for grid operators, load-serving entities, and generation entities in North America (including the United States, Canada, and parts of Mexico). Violators can be fined up to $1 million per day.

EnerOS provides out-of-the-box compliance capabilities for CIP-002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 013, and 014, covering core requirements such as critical asset identification, secure operations, electronic security perimeters, system security management, incident response, and configuration change management.

Standard Family Details

The NERC CIP standard family consists of multiple independent but interrelated standards, grouped by topic:

Coverage Scope

EnerOS focuses on covering the mandatory requirements of the following standards:

Critical Asset Identification

BES Cyber Asset Classification (CIP-002)

CIP-002 requires classifying BES cyber assets into three impact tiers:

EnerOS automatically completes impact rating through the asset registry:

[asset_registry]
enabled = true
auto_classify = true

[asset_registry.impact_rules]
high_threshold_mw = 3000
medium_threshold_mw = 1000

[asset_registry.bes_zones]
zone_a = "control-center"
zone_b = "substation-500kv"
zone_c = "distribution-10kv"

# Scan and identify BES assets
eneros-cli asset scan --bes --output bes-assets.json

# Auto-classify
eneros-cli asset classify --input bes-assets.json --standard nerc-cip

# Output asset inventory
eneros-cli asset list --standard nerc-cip --output cip-002-assets.csv

Asset Impact Assessment Logic

use eneros_asset_registry::{Asset, ImpactLevel};

let asset = Asset::builder()
    .id("scada-master-01")
    .name("Dispatch Center Master Station")
    .zone("control-center")
    .function("dispatch")
    .connected_load_mw(5000)
    .build();

let impact = asset.evaluate_impact(&rules).await?;
match impact.level {
    ImpactLevel::High => println!("High-impact asset, requires full CIP-005/007 protection"),
    ImpactLevel::Medium => println!("Medium-impact asset, requires basic CIP-005/007 protection"),
    ImpactLevel::Low => println!("Low-impact asset, requires CIP-007 logging"),
}

Security Requirements

Electronic Security Perimeter (CIP-005)

CIP-005 requires establishing an Electronic Security Perimeter (ESP) to protect BES cyber assets. Key implementation points of EnerOS:

System Security Management (CIP-007)

CIP-007 covers system lifecycle security management requirements:

[cip_007]
enabled = true

[cip_007.port_management]
default_ports = [443, 853, 9090]   # HTTPS, mDNS-TLS, gRPC
disable_unused = true              # Auto-disable unused ports
audit_frequency_days = 30          # Port audit cycle

[cip_007.patch_management]
auto_scan = true                   # Auto-scan available patches
test_before_deploy = true          # Gray testing
rollback_window_hours = 24         # Rollback window
max_deploy_time_minutes = 30       # Deployment time window

[cip_007.vulnerability]
scan_frequency_days = 30           # Monthly scan
sbom_auto_update = true            # SBOM auto-update
critical_sla_days = 35             # Critical vulnerability fix SLA
high_sla_days = 60
medium_sla_days = 120

Port and Service Management

# Export port inventory
eneros-cli audit ports --output port-inventory.csv

# Detect anomalous ports
eneros-cli audit ports --diff baseline.toml --output port-anomalies.json

# Disable unauthorized ports
eneros-cli ports disable --range 23,21,161

EnerOS Compliance Implementation

1. Configuration Baseline and Change Management (CIP-010)

CIP-010 requires establishing configuration baselines and version-controlling all changes. EnerOS implements this through a GitOps pipeline:

# .eneros/baseline.yaml - Configuration baseline
apiVersion: eneros.io/v1
kind: ConfigBaseline
metadata:
  name: cip-baseline-v1.2.3
  signed-by: security-officer@eneros.io
spec:
  standard: nerc-cip
  components:
    - name: eneros-gateway
      version: 0.47.0
      config_hash: sha256:abc123...
    - name: eneros-trust
      version: 0.47.0
      config_hash: sha256:def456...
  signed_at: "2026-07-01T00:00:00Z"

# Create change request
eneros-cli change request --baseline cip-baseline-v1.2.3 \
  --reason "Upgrade eneros-gateway to 0.48.0" \
  --approver ccb-chair@eneros.io

# Apply change (auto-signed and archived)
eneros-cli change apply --request-id cr-2026-007 \
  --signed-by ccb-chair@eneros.io

# Rollback change
eneros-cli change rollback --request-id cr-2026-007

2. Software Integrity Verification (CIP-010 R2)

# Image signature verification
eneros-cli image verify eneros/gateway:0.47.0 \
  --public-key /etc/eneros/signing.pub

# Boot measurement
eneros-cli tpm measure --component eneros-gateway \
  --expected-hash sha256:abc123...

use eneros_trust::integrity::{ImageVerifier, TpmAttestor};

let verifier = ImageVerifier::new("/etc/eneros/signing.pub");
let verified = verifier.verify("eneros/gateway:0.47.0").await?;
if !verified {
    return Err("Image signature verification failed, refusing to start".into());
}

let attestor = TpmAttestor::new();
let measurement = attestor.measure_component("eneros-gateway").await?;
assert_eq!(measurement.hash, expected_hash);

3. Incident Response (CIP-008)

[cip_008]
incident_classes = ["probe", "dos", "unauthorized-access", "malware"]
notification_sla_hours = 24
escalation_chain = ["soc-l1", "soc-l2", "incident-commander"]

[cip_008.reporting]
authority_email = "nerc-alerts@eneros.io"
format = "nerc-cip-008-r1"
retention_years = 7

Configuration Example

Complete NERC CIP Configuration in eneros.toml

[compliance]
standard = "nerc-cip"
version = "CIP-007-7"
enforce = true

[nerc_cip]
enabled = true
bes_zone = "control-center"
asset_impact_level = "high"

# CIP-005 Electronic Security Perimeter
[nerc_cip.esp]
trust_domain = "eneros.bes"
allow_plaintext = false
mtls_required = true
ids_enabled = true

# CIP-007 System Security Management
[nerc_cip.system]
image_signature_required = true
min_password_length = 15
password_rotation_days = 90
session_timeout_minutes = 15

# CIP-007 Logging
[nerc_cip.logging]
hmac_chain = true
worm_store = "/var/eneros/audit"
retention_event_days = 90
retention_incident_years = 7

# CIP-010 Configuration Change
[nerc_cip.change_management]
gitops_required = true
baseline_signed = true
ccb_approval_required = true
rollback_window_hours = 24

# CIP-011 Information Protection
[nerc_cip.info_protection]
data_classification = true
field_encryption = "AES-256-GCM"
key_rotation_days = 365

# CIP-013 Supply Chain
[nerc_cip.supply_chain]
sbom_required = true
supplier_risk_score_min = 70
vulnerability_scan_days = 30

Audit Requirements

Forensics and Report Export

# Export quarterly compliance report
eneros-cli audit export --standard nerc-cip --range "2026-Q2" \
  --output nerc-cip-2026Q2.jsonl

# Generate standard-specific report
eneros-cli audit report --standard cip-005 --range "2026-Q2" \
  --output cip-005-2026Q2.pdf

eneros-cli audit report --standard cip-007 --range "2026-Q2" \
  --output cip-007-2026Q2.pdf

# Port inventory
eneros-cli audit ports --output cip-007-r4-ports.csv

# Vulnerability scan report
eneros-cli audit vulnerabilities --output cip-007-r3-vulns.csv

Exports include complete records of authentication, authorization, configuration changes, and vulnerability scans, and can be delivered directly to auditors.

Audit Report Contents

Each audit report contains the following sections:

1. Asset Inventory: BES cyber asset classification and impact rating
2. Electronic Security Perimeter: ESP configuration, access control policies
3. Intrusion Detection: IDS events, alerts, and disposition records
4. Ports and Services: Port inventory, change history
5. Patch Management: Patch deployment records, gray test results
6. Vulnerability Management: Scan results, fix SLA achievement status
7. Configuration Changes: Change requests, CCB approvals, signature verification
8. Logging: HMAC chain verification, WORM integrity
9. Incident Response: Incident classification, response times, reporting records
10. Supply Chain: SBOM, supplier risk scores

Compliance Checklist

Confirm each item before deployment:

• All BES cyber assets are within the mTLS boundary, with no plaintext channels
• IDS deployed with power OT signature database configured (see Zero Trust & Security Enhancement)
• Audit logs retained for ≥ 90 days (event type) / 7 years (incident type)
• Quarterly vulnerability scans, critical vulnerabilities fixed within 35 days
• All configuration changes go through GitOps pipeline, direct login modifications prohibited
• Image signature verification failure refuses startup
• Port inventory exportable via eneros-cli audit ports
• Incident response process documented, including 24×7 on-call contact information
• BES asset impact rating reviewed annually
• Key personnel background checks and annual security training records archived
• Configuration baseline signed and approved by CCB (Change Control Board)
• Backup and recovery drills conducted semi-annually
• Supply chain risk assessment conducted annually
• Control center physical security assessment conducted every three years
• NERC EIRSS (Event Incident Reporting System) integration configured correctly

Related Documentation

• IEC 62443 Compliance
• Zero Trust Architecture & mTLS
• Zero Trust & Security Enhancement
• Multi-region and Disaster Recovery