NERC CIP

NERC CIP
Name	NERC Critical Infrastructure Protection
Caption	North American electric grid
Established	2006
Jurisdiction	North America
Administered by	North American Electric Reliability Corporation
Related	Federal Energy Regulatory Commission, Canadian Standards Association

NERC CIP

The NERC Critical Infrastructure Protection standards are a suite of mandatory reliability standards for the bulk electric system in North America, developed to protect assets and cyber systems against threats to electricity reliability. Originating after major outages and security incidents, the standards interface with regulatory bodies, regional entities, utilities, vendors, and standards organizations to govern physical and cyber security, change management, and incident response. They affect operators of transmission, generation, and control systems, and interact with cross-border regulators, industry consortia, and emergency response frameworks.

Overview and history

The program emerged in the aftermath of high-profile blackouts and evolving cyber threats, influenced by events such as the Northeast Blackout of 2003 and regulatory responses including rulings by the Federal Energy Regulatory Commission, policy discussions at the North American Leaders' Summit, and standards work by the Institute of Electrical and Electronics Engineers and International Electrotechnical Commission. Development involved stakeholders including the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, Canadian provincial regulators like the Ontario Energy Board, and regional entities such as Texas Reliability Entity and Midcontinent Independent System Operator. Revisions and expansions over time reflect input from utilities like Exelon Corporation, Duke Energy, Southern Company, vendors such as Schneider Electric, and security researchers from institutions including Sandia National Laboratories and Carnegie Mellon University.

Scope and applicability

The standards apply to owners and operators identified as responsible for elements of the bulk electric system, including entities certified by regional transmission organizations and independent system operators such as PJM Interconnection, California Independent System Operator, New York Independent System Operator, and Electric Reliability Council of Texas. Applicability hinges on asset categorization, critical cyber asset designations, and threshold criteria developed with input from national bodies like the Canadian Electricity Association and the United States Department of Energy. Compliance boundaries intersect with international frameworks such as the North American Free Trade Agreement era cross-border coordination and consultative relationships with bodies like the International Atomic Energy Agency when nuclear-linked systems are involved.

Reliability standards and key requirements

The suite comprises standards covering asset identification, electronic and physical access controls, change management, incident reporting, recovery planning, and personnel training. Requirements align with best practices from National Institute of Standards and Technology publications, cryptographic guidance from Internet Engineering Task Force standards, and supply chain considerations raised by firms such as Siemens AG and General Electric. Specific mandates address control center protection for organizations similar to Hydro-Québec, outage and disturbance reporting in coordination with regional reliability coordinators like ReliabilityFirst Corporation, and audit trails consistent with financial standards used by institutions such as The World Bank when assessing infrastructure risk.

Compliance and enforcement

Enforcement mechanisms involve mandatory audits, penalties, and mitigation requirements administered via the North American Electric Reliability Corporation and delegated regional entities including Western Electricity Coordinating Council and SERC Reliability Corporation. Regulators such as the Federal Energy Regulatory Commission and provincial authorities may issue orders, negotiate settlements with utilities such as American Electric Power and Consolidated Edison, and coordinate cross-jurisdictional enforcement with agencies like Public Utilities Commission of Texas and the Ontario Energy Board. Noncompliance can trigger financial sanctions, corrective action plans, and public reporting obligations akin to regulatory actions seen in cases involving major utilities and market operators.

Implementation and best practices

Practitioners adopt layered defense strategies drawing on frameworks from National Institute of Standards and Technology, incident response techniques used by teams at Sandia National Laboratories and Argonne National Laboratory, and supply-chain risk management approaches advocated by International Organization for Standardization guidance. Utilities implement asset inventories modeled after large operators such as Bonneville Power Administration and Pacific Gas and Electric Company, deploy segmentation like practices used by Los Angeles Department of Water and Power, and engage third-party auditors, consultants from firms like Deloitte and Ernst & Young, and training partnerships with universities such as Massachusetts Institute of Technology and University of California, Berkeley. Cybersecurity investments often reference threat intelligence from Department of Homeland Security fusion centers and coordination with emergency management agencies including Federal Emergency Management Agency.

Criticisms and controversies

Critiques focus on scope, cost, and effectiveness, with industry groups such as American Public Power Association and researchers at University of Cambridge questioning asset categorization, potential overreach cited by some state regulators, and the balance between transparency and security highlighted by privacy advocates and organizations like the Electronic Frontier Foundation. High-profile incident analyses by reporters and watchdogs have compared enforcement outcomes to actions taken in sectors overseen by the Securities and Exchange Commission and Department of Justice, prompting debates about civil penalties, the role of voluntary standards promoted by IEEE Standards Association, and coordination with international partners like the European Network of Transmission System Operators for Electricity.

Category:Electric power in North America