CIP-003-9 for low-impact sites: the plan and the evidence

Who this applies to

Sites with low-impact BES Cyber Systems — including most solar, wind and battery plants that are BES facilities — must have documented cyber security plans under CIP-003-9 R2 and implement them. Category 2 inverter-based resources registered under NERC's revised criteria are not BES facilities and, as of 2026, are not subject to the current CIP standards (NERC Security Guideline for Inverter-Based Resources).

A CIP Senior Manager must approve the policies (R1) and be identified (R3); delegations must be documented (R4).

What the plan must cover (Attachment 1)

• Cyber security awareness — reinforcing good practice with staff at least once every 15 calendar months.
• Physical security controls — controlling physical access to low-impact BES Cyber Systems and their access points.
• Electronic access controls — permitting only necessary inbound and outbound routable access, and authenticating dial-up access.
• Cyber Security Incident response — identifying, classifying and responding to incidents, with roles, reporting and testing.
• Transient Cyber Assets and removable media — mitigating malicious-code risk from laptops and USB media brought on site.
• Vendor electronic remote access — methods to determine vendor electronic remote access, to disable it, and to detect known or suspected inbound and outbound malicious communications for vendor electronic remote access (Section 6, added in CIP-003-9).

Evidence auditors look for

• Approved, dated policies and the plan itself.
• Awareness materials and the dates they were delivered.
• Access-control configurations at each site's boundary devices and the reasons for permitted access.
• The incident response plan and records of its tests.
• Records of transient-device and removable-media checks.
• How vendor remote access is identified, how it can be shut off, and how malicious communications on it are detected.

What comes next: CIP-003-11

CIP-003-9 is the version in effect today. CIP-003-11, approved by FERC in Order No. 918, moves the vendor remote access methods into Section 3, widens detection of malicious communications beyond vendor access, and adds two new expectations: authenticating users and protecting authentication information in transit. NERC lists its U.S. effective date as July 1, 2029. We will update this guide as that date approaches.

Making it repeatable across many sites

Fleets of similar sites benefit from one plan applied consistently, with site-specific evidence collected the same way everywhere. Standardise the boundary configuration, collect it automatically, and keep each site's records in one place so a sample audit is easy to answer.