NERC CIP

North American energy sector cybersecurity: BES Cyber System inventory and software integrity.


Region	Americas
Country or scope	United States
Sector	Energy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NERC CIP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for NERC CIP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for NERC CIP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NERC-CIP010-R1-INV` Baseline Software Inventory	Baseline configurations must include the installed software on BES Cyber Systems, i.e. a component inventory (NERC CIP-010 R1, baseline configuration)	Scan
`NERC-CIP010-R1-VER` Baseline Version Records	The baseline must record commercially available or open-source software including version, so nearly all components need versions (NERC CIP-010 R1 Part 1.1)	Scan
`NERC-CIP010-R1.6` Software Source and Integrity Verification	Before installing software, the identity of the source and the integrity of the software must be verified, requiring integrity hashes (NERC CIP-010 R1 Part 1.6; CIP-013 R1 Part 1.2.5)	Scan
`NERC-CIP013-R1` Supply Chain Risk Management Plan	Responsible entities must have plans addressing vendor risk for high/medium impact BES Cyber Systems, presupposing known suppliers for procured software (NERC CIP-013 R1)	Scan
`NERC-CIP007-R2` Security Patch Management	Patch sources must be tracked and applicable security patches evaluated per software item, requiring components identifiable against patch and vulnerability sources (NERC CIP-007 R2)	Scan
`NERC-CIP010-VERSPEC` Exact Baseline Versions	Deviations from baseline can only be detected when baseline entries carry specific versions rather than ranges or placeholders (NERC CIP-010 R1/R2, configuration monitoring)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CIP-002-5.1a`	Identify and categorize BES Cyber Systems
`CIP-003-8-R1`	Implement cybersecurity policies for BES Cyber Systems
`CIP-004-6-R1`	Implement security awareness program for BES personnel
`CIP-005-7-R1`	Define and protect the Electronic Security Perimeter
`CIP-006-6-R1`	Implement Physical Security Plan for BES Cyber Systems
`CIP-007-6-R1`	Enable only necessary ports and services on BES Cyber Systems
`CIP-007-6-R2`	Deploy security patches to BES Cyber Systems
`CIP-008-6-R1`	Implement a Cyber Security Incident Response Plan
`CIP-009-6-R1`	Implement Recovery Plans for BES Cyber Systems
`CIP-010-4-R1`	Establish baseline configurations for BES Cyber Systems
`CIP-011-3-R1`	Implement information protection program for BES Cyber System Information
`CIP-013-2-R1`	Develop supply chain cybersecurity risk management plan

Policy templates

Written for NERC CIP:

BES Cyber System Identification and Classification Policy
Physical Security of BES Cyber Systems Policy
NERC CIP Cyber Security Incident Reporting Policy
NERC CIP Supply Chain Risk Management Policy

And 22 from the standard set, adapted to NERC CIP.