NERC CIP Compliance for OT Networks: A Checklist for Energy Operators

By Dustin Guttadauro, Product Line Manager - Telecom & Fiber, Infinite Electronics  

For electric utilities and other organizations responsible for Bulk Electric System (BES) assets, NERC Critical Infrastructure Protection (CIP) compliance is an ongoing operational responsibility—not a one-time project. Maintaining compliance requires documenting security controls, validating configurations, managing physical and electronic access, and demonstrating that required safeguards remain effective as networks evolve. Even well-designed OT environments can fall out of compliance if documentation, asset inventories, or change management processes fail to keep pace with system changes.  

Among the NERC CIP standards, CIP-005, CIP-006, and CIP-007 have the greatest impact on industrial network infrastructure. Together, they establish requirements for securing Electronic Security Perimeters (ESPs), protecting Physical Security Perimeters (PSPs), and managing the ongoing security of critical cyber assets. This guide explains the purpose of each standard, highlights common compliance gaps, and provides practical checklists to help utilities strengthen both security and audit readiness. 

Key Takeaways 

•   NERC CIP violations carry financial penalties up to $1 million per violation per day — and the three standards most directly tied to OT network infrastructure (CIP-005, CIP-006, CIP-007) account for a disproportionate share of enforcement actions because they require documented evidence of physical and network controls that many utilities haven't formalized. 

•   CIP-005 (Electronic Security Perimeters) requires documented network segmentation with deny-by-default access controls, MFA on all remote access, and monitored ESP boundaries — requirements that map directly to managed firewall and switch deployment with comprehensive logging. 

•   CIP-006 (Physical Security) requires a defined Physical Security Perimeter, individual access credentials, 90-day access log retention, and tamper detection for High-impact BES Cyber Systems. Locked industrial enclosures with tamper switches are the physical implementation of these requirements — not optional upgrades. 

•   CIP-007 (Systems Security Management) requires documented port and service baselines, patch management within defined timelines, malicious code prevention on all applicable systems, and 90-day security event log retention — controls that require specific configuration steps for each BCS.  

What is NERC CIP and which standards apply to OT network infrastructure? 

NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) is a set of mandatory reliability standards for the bulk electric system in North America. Compliance is legally required under FERC Order 791 for registered entities — utilities, grid operators, and energy companies that own or operate BES (Bulk Electric System) Cyber Systems. Violations carry civil penalties up to $1 million per violation per day per the current NERC Sanction Guidelines. 

The standards cover a broad range of security controls. Nine are directly relevant to OT network infrastructure; three are most cited in enforcement actions against OT-related controls: 

• CIP-005: Electronic Security Perimeters — network boundary definition, access controls, remote access security 
• CIP-006: Physical Security of BES Cyber Systems — physical access controls, monitoring, tamper detection 
• CIP-007: Systems Security Management — port management, patch management, malicious code prevention, logging 

The table below maps all nine OT-relevant CIP standards to their scope and most common violation area.  

CIP-002 (asset categorization) is the prerequisite for everything else: if a BES Cyber System isn't correctly categorized as high or medium impact, the specific technical requirements of CIP-005, CIP-006, and CIP-007 don't apply to it — which means it's unprotected. Scope errors at CIP-002 are a common root cause of apparent CIP-005/006/007 gaps: the assets simply weren't included in the compliance program. 

CIP-005: Electronic Security Perimeters — what it requires and where utilities fail 

CIP-005 requires that high- and medium-impact BES cyber systems be placed inside defined electronic security perimeters (ESPs) — logical network boundaries that separate BCS from other networks — with controlled, monitored, and logged access points. The practical architecture: every connection between the ESP and any other network must cross an Electronic Access Point (EAP) — typically a firewall — with a deny-by-default policy and explicit allow rules for documented communication requirements. Interactive Remote Access into the ESP must use multi-factor authentication and encryption. The ESP boundary must be monitored for inbound and outbound communications. 

Three CIP-005 requirements account for most enforcement findings: 

• Incomplete ESP documentation: the ESP is defined, but assets added after the initial implementation haven't been added to the scope. A substation communication device installed during a grid upgrade that's not in the ESP documentation is both a compliance gap and a network security gap. 
• Missing MFA on remote access: vendor remote access, operator VPN connections, and jump server sessions that don't require a second authentication factor. CIP-005 R2.1 is unambiguous: all Interactive Remote Access into the ESP requires MFA. 
• Unmonitored ESP boundaries: ESP boundary devices that don't forward logs to a central collector, or that generate logs, but whose logs aren't reviewed. Logging that produces records nobody reads doesn't satisfy R3. 

CIP-005 Compliance Checklist 

1.  Define and Document the Electronic Security Perimeter (ESP) (R1): Establish and document the Electronic Security Perimeter (ESP) for all High and Medium Bulk Electric System (BCS) Cyber Systems. Identify every entry and exit point to the ESP and ensure all boundary connections are secured and regularly reviewed whenever the network changes. 

1. Identify and Document All Electronic Access Points (EAPs) (R1.1): Maintain an up-to-date inventory of every Electronic Access Point, including firewalls, routers, VPN gateways, and other devices that control access across the ESP boundary. Update documentation whenever new network connections are added, or existing ones are modified. 

1. Enforce a Deny-by-Default Security Policy (R1.2): Configure all Electronic Access Points to block traffic by default. Only explicitly approved communications should be permitted, and every firewall rule should be documented, justified, and reviewed regularly to eliminate unnecessary access. 

1. Secure Any Dial-Up Connectivity (R1.3): Identify all legacy dial-up or modem connections to the ESP and protect them with strong authentication. Remove unused dial-up connections wherever possible, as unsecured modem access remains a significant security risk. 

1. Require Multi-Factor Authentication for Interactive Remote Access (R2.1): Enforce multi-factor authentication (MFA) for every interactive remote session entering the ESP, including VPN, Remote Desktop (RDP), and web-based management interfaces. This requirement applies equally to employees, contractors, and third-party vendors. 

1. Encrypt All Interactive Remote Access Sessions (R2.2): Ensure that all remote management sessions use encrypted communication protocols such as TLS 1.2 or later, or secure VPN connections. Disable unencrypted protocols such as HTTP or other legacy management interfaces that expose sensitive communications. 

1. Control Third-Party Access Through Intermediate Systems (R2.4): Route all vendor and third-party remote access through a documented intermediate system, such as a jump server or bastion host. Avoid direct connections to Bulk Electric System Cyber Assets, and ensure all intermediate systems provide comprehensive session logging and access control. 

1. Automatically Terminate Inactive Remote Sessions (R2.6): Configure remote management sessions to disconnect automatically after a defined period of inactivity, with 15 minutes or less being a commonly recommended timeout. Verify that this policy applies consistently across VPNs, SSH, Remote Desktop, and web management interfaces. 

1. Monitor Electronic Security Perimeter Boundary Devices (R3): Enable continuous monitoring and logging on all ESP boundary devices, including firewalls, VPN gateways, and routers. Forward security logs to a centralized syslog server or SIEM platform and retain them in accordance with CIP-007 R5 logging requirements. 

1. Maintain an Accurate and Current Network Topology (R1): Keep network topology diagrams current and ensure they accurately reflect the Electronic Security Perimeter. Review the documentation at least quarterly and update it immediately after any network modification that affects the ESP or its Electronic Access Points.  

CIP-006: Physical Security — what it requires and why enclosures are compliance items 

CIP-006 requires that High and Medium impact BES Cyber Systems have a defined Physical Security Perimeter (PSP) — a physical boundary that limits unauthorized physical access — with monitored entry points, individual access credentials, and retention of access logs for 90 days minimum. For High impact BCS, additional requirements include tamper detection that generates alerts on unauthorized access. 

The PSP can be a room, a cage, a locked cabinet, or any defined physical boundary — the standard doesn't prescribe the form, only the function. What it requires is that the boundary is documented, all entry and exit points are identified and controlled, and access is individual (no shared codes or keys) and logged. 

Why locked industrial enclosures are a CIP-006 requirement, not an option 

For BES Cyber Systems that are network hardware — switches, firewalls, servers, communication equipment — the Physical Security Perimeter is most commonly implemented as a locked equipment cabinet or enclosure. The enclosure must: 

• Secure industrial enclosures require a key or tool to open — a screwdriver-accessible latch doesn't constitute a controlled access point under CIP-006 R1.2 

•       Be documented as a defined PSP with all access points identified — the cabinet door is the entry point; all other openings (cable knockouts, ventilation) must be sealed 

•       Generate a log of access — electronic access controls with badge readers satisfy this; for simpler installations, a physical visitor log with mandatory signatures is acceptable 

•       For High impact BCS: generate an alert on unauthorized access — a tamper switch wired to an alarm system or SCADA input satisfies CIP-006 R1.6 

The tamper detection requirement for High impact systems is frequently cited as a gap in utility assessments. A locked cabinet without a tamper switch meets the access control requirement but not the tamper detection requirement. A cabinet with a tamper switch that generates an alert nobody monitors doesn't meet the intent of R1.6 either — the alert must reach someone who can respond. 

Cable management as a CIP-006 physical security control 

CIP-006 requires that cables carrying BCS communications be within the PSP or otherwise protected. Network cables running outside the defined PSP boundary — through unprotected cable trays, through adjacent rooms, or exposed on the exterior of a secured cabinet — are a physical security gap that an auditor will flag. All cable runs that carry BCS traffic should be within the PSP, in conduit, or explicitly addressed in the Physical Security Plan with compensating controls documented.Ethernet surge protectors on Ethernet ports at PSP entry points protect equipment from the electrical transients that follow cable paths from outdoor or less-controlled areas into the secured perimeter — a physical protection that also supports the cable management requirements of CIP-006. 

CIP-006 Compliance Checklist 

1.  Document and Implement a Physical Security Plan (R1): Develop and maintain a documented physical security plan for all High and Medium Bulk Electric System (BCS) Cyber Systems. The plan should clearly define the Physical Security Perimeter (PSP), including all entry and exit points, and outline the controls used to protect critical assets. 

1. Define the Physical Security Perimeter (PSP) (R1.1): Establish a clearly documented Physical Security Perimeter for every applicable Cyber Asset. The PSP may consist of a secured room, equipment cage, or locked industrial enclosure, but its boundaries must be explicitly identified and documented. 

1. Monitor and Control All Physical Access Points (R1.2): Ensure that every entry point into the Physical Security Perimeter—including doors, hatches, and maintenance access points—is protected with appropriate access controls and continuously monitored. Prevent situations such as propped-open doors or unsecured emergency exits. 

1. Restrict Physical Access to Authorized Personnel Only (R1.3): Limit access to the Physical Security Perimeter to authorized personnel using individual credentials such as access badges or keys. Eliminate shared access codes, prevent tailgating, require visitor escorts when necessary, and maintain a visitor log for all non-authorized personnel. 

1. Retain Physical Access Logs for at Least 90 Days (R1.5): Maintain records of all physical access events for a minimum of 90 days. Electronic access control systems are preferred but signed manual visitor logs are acceptable where electronic systems are unavailable. 

1. Detect, Log, and Report Unauthorized Access Attempts (R1.6): Configure physical security systems to detect failed or unauthorized access attempts. Generate alerts for security personnel, investigate every incident, and consider CCTV surveillance for high-impact Physical Security Perimeter entry points. 

1. Protect Network Equipment and Cabling Within the Physical Security Perimeter: Keep all critical network equipment and communication cabling inside the secured perimeter. Avoid exposed cable runs outside the PSP unless they are physically protected against tampering or unauthorized access. 

1. Control the Use of Removable Media (R2): Establish procedures for managing removable media within the Physical Security Perimeter. Track every USB drive or removable storage device, scan media for malware before use, and prohibit personal or unauthorized storage devices. 

1. Document Physical Security Maintenance and Testing (R3): Perform and document routine testing of physical security controls, including locks, access control systems, CCTV cameras, alarms, and monitoring equipment. Conduct these tests at least annually and retain maintenance records for compliance purposes. 

1. Implement Tamper Detection for High-Impact BCS (R1.6): Install tamper switches or other tamper-detection mechanisms on cabinets and enclosures housing High-Impact BCS equipment. Configure these devices to generate alerts whenever unauthorized access or enclosure opening is detected, and ensure all protected enclosures are included within the documented Physical Security Perimeter. 

CIP-007: Systems Security Management — ports, patches, malware, and logging 

CIP-007 governs the configuration and operational security of BES Cyber Systems. It has five requirement areas that directly affect OT network operations: port and service management, security patching, malicious code prevention, security event logging, and account management. Each requirement area has specific timelines that create compliance exposure when not tracked. 

Ports and services (R1) 

R1 requires a documented baseline of all ports and services on each applicable BCS, with only those necessary for the system function enabled. The compliance evidence is a port baseline document per system and the configuration showing that undocumented ports are disabled. The common gap is that the baseline was created at initial installation and hasn't been updated as systems have changed — the document says 22 ports are enabled; the actual device has 30. 

Physical I/O ports — USB, serial console, auxiliary — must also be managed under R1.2. A USB port on a substation communication server that can accept removable media is an R1.2 gap if it hasn't been disabled or the risk addressed with a compensating control. 

Security patching (R2) 

CIP-007 R2 requires that security patches be evaluated within 35 days of their release and applied within a documented timeframe — or that compensating controls be documented if the patch can't be applied. The 35-day evaluation clock starts when the vendor makes a patch available, not when NERC announces it. Utilities that don't have automated monitoring of vendor security bulletins for all their BCS frequently miss the 35-day evaluation deadline without knowing they've done so. 

The patch management process must cover firmware updates for network hardware (switches, firewalls, communication gateways) as well as software patches for servers and workstations. Firmware updates for industrial network hardware are frequently omitted from patch programs designed for IT systems — a gap that CIP-007 auditors now routinely check. 

Malicious code prevention (R3) and logging (R4/R5) 

R3 requires that malicious code prevention be deployed on applicable BCS — which means antivirus software or application whitelisting on HMIs, engineering workstations, and servers within the ESP. Signature updates must be current per vendor recommendation. The OT-specific challenge is that real-time antivirus scanning on some OT platforms causes latency that affects control system performance — application whitelisting (allowing only known-good processes to run) is a more operationally compatible approach. 

R4 (security event logging) and R5 (account management) together create the audit trail that demonstrates the other requirements are being met. Logging that isn't reviewed and accounts that aren't periodically audited produce compliance evidence that looks complete but provides no actual security benefit — distinction auditors now test by looking for evidence that logs are being reviewed and that account audits are producing action, not just documentation. 

CIP-007 Compliance Checklist 

•  Document Required Ports and Services (R1): Ensure that all ports and services running on the Bulk Electric System (BCS) are documented and that only required services are enabled. Perform a port scan and compare the results against the documented baseline. Disable any undocumented services, including insecure protocols such as Telnet or HTTP.  

• Disable or Secure Unused Physical I/O Ports (R1.2): Disable unused USB, serial, console, and other physical interfaces through the BIOS or firmware whenever possible. Where software controls are unavailable, use physical port blockers to prevent unauthorized access.  

• Implement a Security Patch Management Process (R2): Maintain a documented process for managing security patches. Keep a complete firmware inventory, evaluate newly released patches against known CVEs, and define timelines for testing and deployment.  

• Evaluate and Apply Security Patches Within Defined Timelines (R2.2): Track available patches for every asset and ensure they are applied within the organization's required timeframe. If a patch cannot be deployed immediately, document compensating controls and the reason for the delay.  

• Deploy Malicious Code Protection (R3): Install malware protection on all applicable systems, including HMI and engineering workstations. Where possible, use application whitelisting, which is generally preferred for OT environments. If antivirus software is used, configure OT-aware exclusions to avoid disrupting industrial processes.  

• Keep Malware Protection Signatures Updated (R3.2): Update antivirus signatures according to the vendor's recommendations. Automate updates where possible or verify them manually on a weekly basis. Record the date of the last successful signature update for auditing purposes.  

• Enable Security Event Logging (R4): Configure all OT devices to log authentication events, configuration changes, and other security-related activities. Forward logs to a centralized syslog server or log management platform rather than storing them only on the device.  

• Retain Security Logs for at Least 90 Days (R4.3): Store security logs in an off-device logging platform or SIEM with a minimum retention period of 90 days. Regularly verify retention settings to ensure logs are not overwritten prematurely.  

• Review User Accounts Regularly (R5): Conduct quarterly account reviews to ensure all accounts belong to authorized users. Disable inactive accounts after 30 days of inactivity, remove accounts belonging to former employees or contractors, and document account ownership.  

• Implement Strong Password Management (R5.5): Enforce strong password policies across all systems. Require passwords to be at least 15 characters long, enable complexity requirements, and eliminate all default or shared credentials. Replace factory-default passwords immediately after deployment. 

Compliance Tracking Worksheet — CIP-005, CIP-006, CIP-007 

Use this worksheet to track compliance status across the three standards. The Evidence Document column should reference the specific document, configuration file, or system record that demonstrates compliance — policy document v2.3, switch configuration backup 2025-03-01, access log export Q1-2025. Auditors look for specific evidence, not general assertions. 

How do physical infrastructure products implement CIP-006 requirements? 

CIP-006 compliance is frequently treated as an access badge and visitor log program. The physical infrastructure that protects BCS hardware — enclosures, cable management, and surge protection — is part of the CIP-006 implementation, not a separate facilities concern. 

Enclosures as Physical Security Perimeter elements 

Secure industrial enclosures serve three CIP-006 functions simultaneously: they define the physical security perimeter for the equipment inside (R1); they provide the access control mechanism at the PSP boundary (R1.2 — keyed access that is individual and logged); and when fitted with tamper switches, they provide the unauthorized access detection required for high-impact BCS (R1.6). 

The enclosure specification matters for CIP-006 compliance in ways that are sometimes overlooked: 

• Keyway uniqueness: enclosures keyed to a common key series that gives one key access to multiple sites create an individual access control gap — a lost key exposes multiple PSPs. Use site-specific or zone-specific key series 
• Tamper switch wiring: the tamper switch must connect to a monitored alarm or SCADA input — a tamper switch that generates no alert doesn't satisfy R1.6 
• Cable entry sealing: all cable knockouts not in use must be sealed; active cable entries must have cable glands — an open knockout is an uncontrolled PSP entry point 
• Environmental rating: enclosures in outdoor or wet locations must be rated for the environment — NEMA 4X or IP66 minimum for outdoor installations; an enclosure that fails due to weather damage creates a PSP breach 

Surge protection as a physical layer protection under CIP-006 

CIP-006 requires that cables carrying BCS communications be within the PSP or otherwise protected. Where cable runs originate outside the PSP — from outdoor RTU connections, from public-facing infrastructure, or from adjacent non-secured areas — the electrical path those cables carry can introduce transient events that damage equipment inside the PSP.Ethernet surge protectors installed at PSP entry points on copper cable runs absorb transient voltage events before they reach the network equipment inside the enclosure. This protects the hardware whose integrity the physical security perimeter is designed to ensure. 

What are the most common NERC CIP compliance failures for OT networks? 

Scope errors at CIP-002 

The most consequential CIP compliance failures start with categorization. A BES Cyber System that should be Medium impact but is categorized as low (or not categorized at all) receives no CIP-005, CIP-006, or CIP-007 requirements. When an auditor discovers the miscategorization, the finding is not just the missing category assignment — it's all the CIP requirements that applied to the asset and weren't implemented. Scope reviews should be triggered by any topology change, new asset addition, or ownership transfer. 

Documentation that doesn't match the deployed configuration 

CIP compliance is evidence-based. A utility that has correctly configured ESP boundaries, locked enclosures, and comprehensive logging but whose documentation doesn't match the deployed configuration will receive findings. The firewall rule documentation says deny-by-default; the device configuration shows a legacy permit-all rule that wasn't removed. The Physical Security Plan identifies three entry points to the PSP; the auditor finds a fourth. Documentation and deployed configuration must match, and the review process that keeps them aligned is as important as the initial implementation. 

Remote access not fully covered by MFA 

CIP-005 R2.1 requires MFA on all interactive remote access into the ESP. Utilities often implement MFA on primary VPN connections and miss secondary access paths: a backup VPN account used by a vendor, a jump server accessible via a legacy protocol, and a management interface reachable through a monitoring network that's not counted as an ESP entry. Every remote access path into the ESP must use MFA — discovering an uncovered path during an audit is a violation; discovering it internally and remediating it is documented compliance activity. 

Physical security documentation does not match physical reality 

CIP-006 Physical Security Plans describe the PSP, access points, access control mechanisms, and monitoring. In practice, physical environments change: a wall is moved, a door is added for operational convenience, and a cable is run outside the original PSP boundary. If the Physical Security Plan isn't updated to reflect these changes, the documentation describes a PSP that doesn't exist as documented. Physical site walks to verify PSP documentation accuracy should be part of the annual review cycle, not just a pre-audit activity. 

CIP-006 physical compliance starts with the enclosure 

NERC CIP physical security requirements are not satisfied by a locked room and a visitor log. The network and control hardware inside that room — switches, firewalls, communication gateways — needs its own physical security layer: locked, rated enclosures with documented access control, tamper detection wired to monitored alarms, cable entries sealed, and surge protection on all copper cable paths entering from outside the PSP. 

L-com's secure industrial enclosures provide the keyed access, tamper detection, mounting provisions, and environmental ratings that CIP-006 implementation requires. Ethernet surge protectors protect the hardware inside the PSP from the electrical transients that follow cable paths from outside the secured perimeter. Both belong in a CIP-006 compliance program as documented physical controls — not as equipment purchases separate from the compliance effort. 

Frequently Asked Questions 

Q1: Who must comply with NERC CIP? 

A: NERC CIP compliance is mandatory for registered entities that own or operate assets connected to the Bulk Electric System in the United States, Canada (in provinces under NERC's jurisdiction), and parts of Mexico. Registered entity categories include transmission owners and operators, generation owners and operators, distribution providers (above defined thresholds), and reliability coordinators.  

Q2: What is an electronic security perimeter in NERC CIP? 

A: An Electronic Security Perimeter (ESP) under NERC CIP is a logical network boundary that surrounds high- or medium-impact BES cyber systems and their associated communication networks. It's defined by Electronic Access Points (EAPs) — the network devices that control traffic flowing into or out of the ESP boundary. EAPs are typically firewalls or managed routers configured with deny-by-default access policies.  

Q3: What is a physical security perimeter under NERC CIP? 

A: A Physical Security Perimeter (PSP) under NERC CIP-006 is a physical boundary that limits unauthorized physical access to high- or medium-impact BES Cyber Systems. The PSP can be a room, a fenced area, a cage, or a locked cabinet — the standard defines the functional requirements, not the physical form.    

Q4: What are the penalties for NERC CIP violations? 

A: NERC CIP penalties are assessed per violation, per day, per applicable requirement. The maximum penalty under the current NERC Sanction Guidelines is $1 million per violation per day. In practice, penalty amounts depend on the violation's risk to the bulk electric system, the entity's compliance history, and its cooperation with the enforcement process.