skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-nerc-cip-compliance-controls

Implements NERC CIP compliance controls for BES cyber systems including categorization, ESPs, and monitoring.

954|172|Updated Mar 13, 2026
Search Tags:#audit#power grid#NERC CIP#OT security#Compliance#bes cyber systems#electronic security perimeter
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-nerc-cip-compliance-controls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-nerc-cip-compliance-controls
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/implementing-nerc-cip-compliance-controls
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-nerc-cip-compliance-controls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Registered entities operating Bulk Electric System (BES) cyber systems must achieve and maintain NERC CIP compliance, but categorizing assets, configuring Electronic Security Perimeters, and meeting audit evidence requirements across CIP-002 through CIP-014 is complex and error-prone.

Core Features & Use Cases

  • BES Cyber System Categorization: Applies CIP-002-5.1a Attachment 1 criteria via a Python tool to classify systems as high, medium, or low impact and export audit-ready JSON evidence.
  • ESP and Remote Access Configuration: Provides firewall rule templates for Electronic Security Perimeters, Electronic Access Points, Intermediate Systems, and the 2025 MFA requirement (CIP-005-7 R2.4).
  • System Security Management: Delivers a CIP-007-6 checklist covering port management, patch tracking, malicious code prevention, and 90-day log retention with 15-day review cycles.
  • Use Case: A utility preparing for a Regional Entity audit uses this Skill to re-categorize its BES cyber systems after commissioning a new 500 MW wind farm, reconcile firewall rules against the ESP diagram, and generate a compliance status report.

Quick Start

Ask the AI to categorize your BES cyber systems under CIP-002 and produce a NERC CIP compliance assessment report for your registered entity.

Frequently Asked Questions about implementing-nerc-cip-compliance-controls

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I categorize BES cyber systems under CIP-002?▼

Apply CIP-002-5.1a Attachment 1 criteria based on control center function, connected MW, transmission kV, cranking paths, blackstart resources, and SPS/RAS components. The included Python categorizer classifies each system as high, medium, or low impact and documents the basis for each rating.

What changed in the 2025 NERC CIP updates?▼

The 2025 updates include CIP-003-9, CIP-005-7, CIP-010-4, and CIP-013-2, with mandatory multi-factor authentication for remote access under CIP-005-7 R2.4 and expanded requirements for low-impact assets. Verify no path reaches a BES Cyber Asset without transiting the Intermediate System.

How do I verify CIP compliance without disrupting BES operations?▼

Validate through configuration and log review plus a maintenance-window connectivity test from outside the ESP, which must be denied. Never run intrusive scans against in-service BES Cyber Assets; collect evidence passively instead.

What are the log retention requirements for CIP-007?▼

CIP-007-6 R4 requires security event logs retained for a minimum of 90 days online and reviewed at least every 15 days. Confirm retention and review are actually occurring, not merely configured, and archive logs for up to 3 years.

When should I not use NERC CIP compliance controls?▼

Do not apply NERC CIP to non-BES industrial systems, where IEC 62443 security zones are appropriate, or to general IT compliance covered by frameworks like CIS Benchmarks. It also does not address physical security of substations without cyber components.

Related Skills

Explore More Legal & Compliance Skills→
shekerkammashekerkamma

network

Generate network topology diagrams in PlantUML with mxgraph icons.

Community
Intermediate
All-The-VibesAll-The-Vibes
50

triage

Triage findings into ready-to-work todos with YAML frontmatter updates.

Official
Intermediate
riparinoriparino
1

defensive-mitigations

Audits Windows security mitigations and monitors registry tamper events for SOC workflows.

Community
Advanced
drupadsachaniadrupadsachania

operational-technology

Automate OT/ICS risk assessment, asset discovery, and security governance.

Community
Advanced