CIP-002-5.1a

CIP-002-5.1a

Cyber Security - BES Cyber System Categorization

CIP-002-5.1a is the entry point to the CIP standards: each Responsible Entity identifies its high and medium impact BES Cyber Systems and each asset containing a low impact BES Cyber System using the bright-line criteria in Attachment 1. It then reviews and has its CIP Senior Manager or delegate approve those identifications at least every 15 calendar months, even if it has nothing to identify. The impact rating it reaches decides which requirements in CIP-003 through CIP-011 apply.

Who it applies to

Generator Owners and Generator Operators, for all BES Facilities. Category 2 Generator Owners and Generator Operators of non-BES inverter-based resources are not subject to CIP-002-5.1a unless a later revision of the standard includes them.
Also Balancing Authorities, Interchange Coordinators or Interchange Authorities, Reliability Coordinators, Transmission Operators, Transmission Owners, and Distribution Providers that own the protection or restoration systems listed in Section 4.1.2.
Exempt: Cyber Assets associated with communication networks and data communication links between discrete Electronic Security Perimeters, and the nuclear-regulated systems listed in Section 4.2.3.

Key dates

December 27, 2016: CIP-002-5.1a effective, replacing CIP-002-5.1.
July 1, 2028: CIP-002-8 takes effect and CIP-002-5.1a goes inactive, per NERC's standard pages. FERC approved CIP-002-7 (virtualization revisions) and CIP-002-8 (Transmission Owner Control Center revisions) on March 19, 2026; NERC lists CIP-002-7 as superseded by CIP-002-8.

What each requirement asks for, in plain English.

R1 · Identify and categorize

What it means. Each Responsible Entity implements a process that considers each of the following assets: Control Centers and backup Control Centers, transmission stations and substations, generation resources, systems and facilities critical to system restoration, and Special Protection Systems. With it, the entity identifies each high impact BES Cyber System under Attachment 1 Section 1, each medium impact BES Cyber System under Section 2, and each asset that contains a low impact BES Cyber System under Section 3. A discrete list of low impact BES Cyber Systems is not required. For a Generator Owner or Generator Operator, the relevant medium impact criteria include 2.1 (commissioned generation at a single plant location with an aggregate highest rated net Real Power capability over the preceding 12 calendar months of 1500 MW or more in a single Interconnection, limited to shared BES Cyber Systems that could affect units totaling 1500 MW within 15 minutes), 2.3 (a generation Facility its Planning Coordinator or Transmission Planner designates, and informs the Generator Owner or Generator Operator, as necessary to avoid an Adverse Reliability Impact in the planning horizon of more than one year), 2.6 (generation identified by the Reliability Coordinator, Planning Coordinator or Transmission Planner as critical to the derivation of IROLs), 2.8 (Transmission Facilities, including generation interconnection Facilities, whose loss would cause the loss of generation identified under 2.1 or 2.3) and 2.11 (a Generator Operator Control Center or backup Control Center, not already high impact, for an aggregate highest rated net Real Power capability of 1500 MW or more in a single Interconnection). A Generator Operator Control Center used for one or more assets that meet criterion 2.1, 2.3, 2.6 or 2.9 is high impact under criterion 1.4. BES Cyber Systems at generation resources that meet none of the high or medium criteria are low impact under criterion 3.3.

Evidence an auditor expects. Dated electronic or physical lists of the identifications required by R1.

R2 · Review and approve every 15 months

What it means. The Responsible Entity reviews the R1 identifications, updating them if there are changes, and has its CIP Senior Manager or delegate approve them, at least once every 15 calendar months, even if it has no identified items.

Evidence an auditor expects. Dated electronic or physical records showing the review, any updates, and the CIP Senior Manager or delegate approval within each 15 calendar month period.

For inverter-based plants

A BES inverter-based plant reaches medium impact under criterion 2.1 only at 1500 MW or more at a single plant location, so unless another Section 1 or 2 criterion applies (for example 2.3, 2.6 or 2.8) its BES Cyber Systems are low impact under criterion 3.3; a Generator Operator Control Center is rated on its own, as medium impact under 2.11 at 1500 MW or more in aggregate in one Interconnection, or high impact under 1.4 if it is used for an asset meeting 2.1, 2.3, 2.6 or 2.9.