← Frameworks / NERC CIP / Control Mappings

NERC Critical Infrastructure Protection Standards

Mandatory reliability standards for the Bulk Electric System (BES) in North America. 14 CIP standards (CIP-002 through CIP-015) covering BES Cyber System categorization, security management controls, personnel and training, electronic security perimeters, physical security, system security management, incident reporting, recovery plans, configuration and vulnerability management, information protection, control center communications, supply chain risk management, transmission station physical security, and internal network security monitoring (INSM). Enforced by NERC with mandatory compliance, violations, and penalties.

Controls: 157

Total Mappings: 328

Publisher: North American Electric Reliability Corporation (NERC) Version: v5-7 (2024)

NERC CIP → SP 800-53 SP 800-53 → NERC CIP Coverage Analysis

AC (10) AT (5) AU (9) CA (7) CM (11) CP (8) IA (8) IR (8) MA (6) MP (7) PE (9) PL (3) PM (18) PS (7) RA (7) SA (6) SC (11) SI (8) SR (9)

AC Access Control

Control	Name	NERC CIP References
AC-01	Policy and Procedures	CIP-003-9CIP-004-7CIP-005-7CIP-007-6CIP-013-2
AC-02	Account Management	CIP-004-7CIP-007-6CIP-015-1
AC-03	Access Enforcement	CIP-003-9CIP-004-7CIP-005-7CIP-007-6CIP-011-3CIP-012-2
AC-04	Information Flow Enforcement	CIP-003-9CIP-005-7CIP-010-4CIP-011-3CIP-012-2
AC-06	Least Privilege	CIP-004-7CIP-005-7
AC-07	Unsuccessful Logon Attempts	CIP-007-6
AC-11	Device Lock	CIP-007-6
AC-16	Security and Privacy Attributes	CIP-011-3
AC-17	Remote Access	CIP-003-9CIP-005-7CIP-011-3CIP-012-2
AC-20	Use of External Systems	CIP-003-9CIP-004-7CIP-005-7CIP-010-4CIP-011-3CIP-013-2

AT Awareness and Training

Control	Name	NERC CIP References
AT-01	Policy and Procedures	CIP-003-9CIP-004-7
AT-02	Literacy Training and Awareness	CIP-003-9CIP-004-7CIP-008-6CIP-009-6
AT-03	Role-based Training	CIP-004-7
AT-04	Training Records	CIP-004-7
AT-06	Training Feedback	CIP-004-7

AU Audit and Accountability

Control	Name	NERC CIP References
AU-01	Policy and Procedures	CIP-003-9
AU-02	Event Logging	CIP-006-6CIP-007-6
AU-03	Content of Audit Records	CIP-006-6CIP-007-6CIP-008-6
AU-05	Response to Audit Logging Process Failures	CIP-007-6
AU-06	Audit Record Review, Analysis, and Reporting	CIP-004-7CIP-006-6CIP-007-6CIP-015-1
AU-07	Audit Record Reduction and Report Generation	CIP-005-7CIP-007-6
AU-09	Protection of Audit Information	CIP-004-7
AU-11	Audit Record Retention	CIP-007-6CIP-008-6
AU-12	Audit Record Generation	CIP-006-6CIP-007-6

CA Security Assessment and Authorization

Control	Name	NERC CIP References
CA-01	Policy and Procedures	CIP-003-9
CA-02	Control Assessments	CIP-010-4CIP-014-3
CA-03	Information Exchange	CIP-004-7CIP-011-3CIP-012-2
CA-05	Plan of Action and Milestones	CIP-010-4
CA-06	Authorization	CIP-003-9
CA-07	Continuous Monitoring	CIP-010-4CIP-014-3CIP-015-1
CA-08	Penetration Testing	CIP-010-4

CM Configuration Management

Control	Name	NERC CIP References
CM-01	Policy and Procedures	CIP-003-9CIP-010-4
CM-02	Baseline Configuration	CIP-010-4
CM-03	Configuration Change Control	CIP-010-4
CM-04	Impact Analyses	CIP-010-4
CM-05	Access Restrictions for Change	CIP-004-7CIP-010-4
CM-06	Configuration Settings	CIP-007-6CIP-010-4
CM-07	Least Functionality	CIP-003-9CIP-005-7CIP-007-6CIP-010-4
CM-08	System Component Inventory	CIP-002-5.1aCIP-010-4
CM-09	Configuration Management Plan	CIP-003-9CIP-010-4
CM-12	Information Location	CIP-004-7CIP-011-3
CM-14	Signed Components	CIP-010-4CIP-013-2

CP Contingency Planning

Control	Name	NERC CIP References
CP-01	Policy and Procedures	CIP-003-9CIP-009-6CIP-012-2
CP-02	Contingency Plan	CIP-002-5.1aCIP-009-6CIP-012-2
CP-03	Contingency Training	CIP-004-7CIP-009-6
CP-04	Contingency Plan Testing	CIP-009-6
CP-06	Alternate Storage Site	CIP-009-6
CP-08	Telecommunications Services	CIP-012-2
CP-09	System Backup	CIP-009-6
CP-10	System Recovery and Reconstitution	CIP-009-6

IA Identification and Authentication

Control	Name	NERC CIP References
IA-01	Policy and Procedures	CIP-003-9
IA-02	Identification and Authentication (Organizational Users)	CIP-004-7CIP-005-7CIP-007-6
IA-03	Device Identification and Authentication	CIP-005-7
IA-04	Identifier Management	CIP-007-6
IA-05	Authenticator Management	CIP-005-7CIP-006-6CIP-007-6CIP-011-3
IA-08	Identification and Authentication (Non-organizational Users)	CIP-005-7CIP-007-6
IA-09	Service Identification and Authentication	CIP-007-6CIP-011-3CIP-012-2
IA-12	Identity Proofing	CIP-004-7

IR Incident Response

Control	Name	NERC CIP References
IR-01	Policy and Procedures	CIP-003-9CIP-008-6
IR-02	Incident Response Training	CIP-003-9CIP-004-7CIP-008-6
IR-03	Incident Response Testing	CIP-008-6
IR-04	Incident Handling	CIP-003-9CIP-004-7CIP-005-7CIP-006-6CIP-007-6CIP-008-6CIP-009-6CIP-010-4CIP-012-2CIP-013-2CIP-015-1
IR-05	Incident Monitoring	CIP-008-6
IR-06	Incident Reporting	CIP-008-6
IR-07	Incident Response Assistance	CIP-008-6
IR-08	Incident Response Plan	CIP-008-6

MA Maintenance

Control	Name	NERC CIP References
MA-01	Policy and Procedures	CIP-006-6
MA-02	Controlled Maintenance	CIP-006-6CIP-011-3
MA-03	Maintenance Tools	CIP-003-9CIP-007-6CIP-010-4CIP-011-3
MA-04	Nonlocal Maintenance	CIP-003-9CIP-005-7CIP-006-6CIP-007-6
MA-05	Maintenance Personnel	CIP-004-7CIP-006-6CIP-011-3
MA-06	Timely Maintenance	CIP-006-6CIP-007-6

MP Media Protection

Control	Name	NERC CIP References
MP-01	Policy and Procedures	CIP-003-9CIP-011-3
MP-02	Media Access	CIP-004-7CIP-011-3
MP-03	Media Marking	CIP-011-3
MP-04	Media Storage	CIP-011-3
MP-05	Media Transport	CIP-011-3
MP-06	Media Sanitization	CIP-003-9CIP-010-4CIP-011-3
MP-07	Media Use	CIP-010-4

PE Physical and Environmental Protection

Control	Name	NERC CIP References
PE-01	Policy and Procedures	CIP-003-9CIP-006-6CIP-014-3
PE-02	Physical Access Authorizations	CIP-004-7CIP-006-6
PE-03	Physical Access Control	CIP-003-9CIP-006-6CIP-007-6CIP-014-3
PE-04	Access Control for Transmission	CIP-006-6CIP-012-2
PE-05	Access Control for Output Devices	CIP-006-6
PE-06	Monitoring Physical Access	CIP-006-6CIP-008-6CIP-014-3
PE-08	Visitor Access Records	CIP-006-6
PE-16	Delivery and Removal	CIP-006-6
PE-18	Location of System Components	CIP-006-6

PL Planning

Control	Name	NERC CIP References
PL-01	Policy and Procedures	CIP-003-9
PL-02	System Security and Privacy Plans	CIP-003-9
PL-08	Security and Privacy Architectures	CIP-005-7

PM Program Management

Control	Name	NERC CIP References
PM-01	Information Security Program Plan	CIP-003-9CIP-011-3CIP-012-2CIP-013-2CIP-014-3
PM-02	Information Security Program Leadership Role	CIP-003-9
PM-03	Information Security and Privacy Resources	CIP-003-9
PM-04	Plan of Action and Milestones Process	CIP-007-6CIP-010-4CIP-011-3CIP-013-2
PM-05	System Inventory	CIP-002-5.1a
PM-07	Enterprise Architecture	CIP-002-5.1a
PM-08	Critical Infrastructure Plan	CIP-002-5.1aCIP-003-9
PM-09	Risk Management Strategy	CIP-003-9
PM-10	Authorization Process	CIP-002-5.1aCIP-003-9CIP-008-6CIP-009-6CIP-010-4
PM-11	Mission and Business Process Definition	CIP-002-5.1a
PM-12	Insider Threat Program	CIP-004-7CIP-008-6CIP-014-3
PM-13	Security and Privacy Workforce	CIP-004-7
PM-14	Testing, Training, and Monitoring	CIP-002-5.1aCIP-004-7CIP-005-7CIP-006-6CIP-007-6CIP-010-4
PM-16	Threat Awareness Program	CIP-008-6
PM-28	Risk Framing	CIP-002-5.1aCIP-014-3
PM-30	Supply Chain Risk Management Strategy	CIP-013-2
PM-31	Continuous Monitoring Strategy	CIP-006-6CIP-007-6
PM-32	Purposing	CIP-005-7CIP-007-6

PS Personnel Security

Control	Name	NERC CIP References
PS-01	Policy and Procedures	CIP-003-9CIP-004-7
PS-02	Position Risk Designation	CIP-004-7
PS-03	Personnel Screening	CIP-004-7
PS-04	Personnel Termination	CIP-004-7
PS-05	Personnel Transfer	CIP-004-7
PS-06	Access Agreements	CIP-004-7
PS-07	External Personnel Security	CIP-004-7

RA Risk Assessment

Control	Name	NERC CIP References
RA-01	Policy and Procedures	CIP-002-5.1aCIP-003-9CIP-008-6CIP-013-2CIP-014-3
RA-02	Security Categorization	CIP-002-5.1a
RA-03	Risk Assessment	CIP-002-5.1aCIP-012-2CIP-013-2CIP-014-3
RA-05	Vulnerability Monitoring and Scanning	CIP-007-6CIP-008-6CIP-010-4CIP-014-3
RA-07	Risk Response	CIP-010-4CIP-014-3CIP-015-1
RA-09	Criticality Analysis	CIP-002-5.1aCIP-013-2
RA-10	Threat Hunting	CIP-015-1

SA System and Services Acquisition

Control	Name	NERC CIP References
SA-01	Policy and Procedures	CIP-013-2
SA-04	Acquisition Process	CIP-013-2
SA-09	External System Services	CIP-013-2
SA-10	Developer Configuration Management	CIP-013-2
SA-15	Development Process, Standards, and Tools	CIP-013-2
SA-22	Unsupported System Components	CIP-013-2

SC System and Communications Protection

Control	Name	NERC CIP References
SC-01	Policy and Procedures	CIP-003-9CIP-005-7CIP-012-2
SC-05	Denial-of-service Protection	CIP-003-9CIP-005-7CIP-007-6CIP-015-1
SC-07	Boundary Protection	CIP-002-5.1aCIP-003-9CIP-005-7CIP-007-6CIP-010-4CIP-012-2CIP-015-1
SC-08	Transmission Confidentiality and Integrity	CIP-005-7CIP-011-3CIP-012-2
SC-12	Cryptographic Key Establishment and Management	CIP-012-2
SC-13	Cryptographic Protection	CIP-012-2
SC-23	Session Authenticity	CIP-012-2
SC-25	Thin Nodes	CIP-007-6CIP-010-4
SC-28	Protection of Information at Rest	CIP-010-4CIP-011-3
SC-41	Port and I/O Device Access	CIP-007-6
SC-48	Sensor Relocation	CIP-015-1

SI System and Information Integrity

Control	Name	NERC CIP References
SI-01	Policy and Procedures	CIP-003-9
SI-02	Flaw Remediation	CIP-007-6CIP-010-4
SI-03	Malicious Code Protection	CIP-003-9CIP-007-6CIP-010-4
SI-04	System Monitoring	CIP-004-7CIP-005-7CIP-007-6CIP-008-6CIP-010-4CIP-015-1
SI-07	Software, Firmware, and Information Integrity	CIP-003-9CIP-007-6CIP-010-4CIP-012-2CIP-013-2
SI-12	Information Management and Retention	CIP-006-6CIP-007-6CIP-008-6CIP-011-3
SI-13	Predictable Failure Prevention	CIP-009-6
SI-14	Non-persistence	CIP-010-4CIP-011-3

SR Supply Chain Risk Management

Control	Name	NERC CIP References
SR-01	Policy and Procedures	CIP-013-2
SR-02	Supply Chain Risk Management Plan	CIP-013-2
SR-03	Supply Chain Controls and Processes	CIP-010-4CIP-013-2
SR-04	Provenance	CIP-010-4CIP-013-2
SR-05	Acquisition Strategies, Tools, and Methods	CIP-010-4CIP-013-2
SR-06	Supplier Assessments and Reviews	CIP-013-2
SR-08	Notification Agreements	CIP-013-2
SR-09	Tamper Resistance and Detection	CIP-010-4
SR-11	Component Authenticity	CIP-013-2