CIP-003-9

R1 · Cyber security policies

What it means. At least once every 15 calendar months, each Responsible Entity reviews, and obtains CIP Senior Manager approval for, documented cyber security policies. For assets containing low impact BES Cyber Systems, the policies collectively address cyber security awareness, physical security controls, electronic access controls, Cyber Security Incident response, Transient Cyber Asset and Removable Media malicious code risk mitigation, vendor electronic remote access security controls, and declaring and responding to CIP Exceptional Circumstances. High and medium impact BES Cyber Systems have their own topic list tied to CIP-004 through CIP-011.

Evidence an auditor expects. Policy documents, revision history, records of review or document management workflow showing review at least once every 15 calendar months, and documented CIP Senior Manager approval of each policy.

R2, Section 1 · Cyber security awareness

What it means. Each Responsible Entity with at least one asset containing low impact BES Cyber Systems implements documented cyber security plans that include the six sections of Attachment 1. An inventory or discrete list of low impact BES Cyber Systems or their BES Cyber Assets is not required, and neither are lists of authorized users. Section 1 requires reinforcing cyber security practices, which may include associated physical security practices, at least once every 15 calendar months.

Evidence an auditor expects. The plan, plus records of reinforcement at least every 15 calendar months through direct communications such as emails or computer-based training, indirect communications such as posters or intranet, or management presentations or meetings.

R2, Section 2 · Physical security controls

What it means. Control physical access, based on need as the entity determines, to the asset or the locations of the low impact BES Cyber Systems within it, and to the Cyber Assets the entity specifies that provide the Section 3.1 electronic access controls, if any.

Evidence an auditor expects. Documentation of the selected access controls (such as card keys, locks or perimeter controls), monitoring controls (such as alarm systems or human observation), or other operational, procedural or technical physical security controls covering both.

R2, Section 3 · Electronic access controls

What it means. For each asset containing low impact BES Cyber Systems, permit only necessary inbound and outbound electronic access, as the entity determines, for communications that are between a low impact BES Cyber System and a Cyber Asset outside the asset, use a routable protocol when entering or leaving the asset, and are not used for time-sensitive protection or control functions between intelligent electronic devices (for example IEC TR-61850-90-5 R-GOOSE). Authenticate all Dial-up Connectivity, if any, that provides access to low impact BES Cyber Systems, per Cyber Asset capability.

Evidence an auditor expects. Documentation, such as representative diagrams or lists of implemented controls (access control lists restricting IP addresses, ports or services, or unidirectional gateways), showing routable communication across the asset boundary is restricted to what the entity deems necessary, and documentation of dial-up authentication.

R2, Section 4 · Cyber Security Incident response

What it means. Have one or more Cyber Security Incident response plans, by asset or group of assets, covering identification, classification and response; determining whether an incident is a Reportable Cyber Security Incident and notifying the E-ISAC, unless prohibited by law; roles and responsibilities; and incident handling. Test the plan at least once every 36 calendar months through an actual Reportable Cyber Security Incident, a drill or tabletop exercise, or an operational exercise, and update it if needed within 180 calendar days after a test or actual Reportable Cyber Security Incident.

Evidence an auditor expects. Dated plan documents covering each process, dated documentation of a test at least every 36 calendar months, and updates made within 180 calendar days.

R2, Section 5 · Transient Cyber Assets and Removable Media

What it means. Except under CIP Exceptional Circumstances, implement plans to mitigate the risk of malicious code reaching low impact BES Cyber Systems through Transient Cyber Assets or Removable Media. For Transient Cyber Assets the entity manages, use antivirus software, application whitelisting or other methods, per capability. For Transient Cyber Assets managed by another party, such as a vendor laptop, review that party's antivirus, whitelisting, read-only media or hardening practices or use other methods before connecting, and decide whether additional mitigation is needed. For Removable Media, detect malicious code using a Cyber Asset other than a BES Cyber System and mitigate any threat found before connecting.

Evidence an auditor expects. Documented methods and processes, records of reviews of third-party practices and of any additional mitigation, scan logs or confirmation that Removable Media was free of malicious code, and, where a Transient Cyber Asset lacks the capability, documentation saying so.

R2, Section 6 · Vendor electronic remote access

What it means. For assets containing low impact BES Cyber Systems that allow vendor electronic remote access, where that access has been established under Section 3.1, implement a process to mitigate its risks that includes methods for determining vendor electronic remote access, methods for disabling it, and methods for detecting known or suspected inbound and outbound malicious communications for it.

Evidence an auditor expects. Documentation showing, for determining access, steps such as preauthorization, logon alerts, session monitoring or recording, or system logs; for disabling access, steps such as disabling accounts, ports, services or protocols, or removing physical connectivity; and for detection, anti-malware, IDS or IPS, log reviews or alerting.

R3 and R4 · CIP Senior Manager and delegations

What it means. Identify a CIP Senior Manager by name and document any change within 30 calendar days. Implement a documented process to delegate authority, unless no delegations are used; each delegation records the delegate's name or title, the specific actions delegated and the date, is approved by the CIP Senior Manager, and is updated within 30 days of any change.

Evidence an auditor expects. A dated and approved document from a high level official naming the CIP Senior Manager, and a dated document approved by the CIP Senior Manager listing delegates by name or title and what each may approve or authorize.

For inverter-based plants

If an inverter or turbine OEM can reach a low impact inverter-based plant's BES Cyber Systems remotely over a routable connection, that access must be access the entity permits under Section 3.1, and from April 1, 2026 Section 6 requires methods to determine it, disable it and detect known or suspected malicious communications on it.