← Resources
Reference

NERC CIP glossary

Plain-language definitions of the terms that come up most in NERC CIP work.

  • BES — Bulk Electric System: the transmission elements and generation resources NERC's reliability standards apply to.
  • BES Cyber Asset (BCA) — a cyber asset whose loss or misuse would affect the reliable operation of the BES within 15 minutes.
  • BES Cyber System (BCS) — one or more BES Cyber Assets grouped to perform a reliability function; categorized high, medium or low impact under CIP-002.
  • CIP Senior Manager — the single senior person with authority and responsibility for the entity's CIP program (CIP-003).
  • EACMS — Electronic Access Control or Monitoring Systems, such as firewalls and authentication servers that control or log access to an ESP.
  • EAP — Electronic Access Point: an interface on an ESP boundary that controls routable communication.
  • ERC — External Routable Connectivity: the ability to reach a BES Cyber System from outside its ESP over a routable protocol.
  • ESP — Electronic Security Perimeter: the logical border around a network to which BES Cyber Systems are connected.
  • IBR — Inverter-Based Resource: solar, wind and battery storage connected through inverters; revised registration criteria bring more of them into NERC registration (Category 2 sites are not yet subject to CIP).
  • INSM — Internal Network Security Monitoring, required by CIP-015-1 inside the ESP of high-impact and medium-impact-with-ERC systems (U.S.: Control Centers from October 1, 2028, other medium-impact systems by October 1, 2030).
  • PACS — Physical Access Control Systems that control or log physical access to Physical Security Perimeters.
  • PCA — Protected Cyber Asset: a cyber asset inside an ESP that is not itself a BES Cyber Asset.
  • RSAW — Reliability Standard Audit Worksheet: the worksheet auditors use to assess compliance with each standard.
  • Transient Cyber Asset — a laptop or similar device connected for 30 days or less, e.g. for maintenance.

General guidance, not legal or compliance advice. Your obligations depend on your registration and assets — confirm them with your compliance team and Regional Entity.

Not sure if a site is Category 2 or under CIP? Run the free registration check: two numbers, 30 seconds.

From the blog

More from Resources

Guide
Segmenting an OT network around electronic security perimeters

9 min read

Guide
Hardening baselines for firewalls, switches and Windows hosts in OT

10 min read

Guide
CIP-003-9 for low-impact sites: the plan and the evidence

8 min read