Critical Infrastructure Protection Reliability Standards

What it is

The Federal Power Act (16 U.S.C. § 824o) defines the "Electric Reliability Organization" (ERO) as "the organization certified by the Commission under subsection (c) the purpose of which is to establish and enforce reliability standards for the bulk-power system, subject to Commission review" — NERC holds this certification. A "reliability standard" is "a requirement, approved by the Commission under this section, to provide for reliable operation of the bulk-power system ... includes requirements for the operation of existing bulk-power system facilities, including cybersecurity protection..."

The statute sets out a two-step process: "The Electric Reliability Organization shall file each reliability standard or modification ... with the Commission. The Commission may approve, by rule or order, a proposed reliability standard or modification to a reliability standard if it determines that the standard is just, reasonable, not unduly discriminatory or preferential, and in the public interest." NERC develops and files; FERC ("the Commission") approves or rejects — FERC does not write the standards itself, and the statute directs it to "give due weight to the technical expertise of the Electric Reliability Organization."

"Bulk-power system" is defined as "(A) facilities and control systems necessary for operating an interconnected electric energy transmission network (or any portion thereof); and (B) electric energy from generation facilities needed to maintain transmission system reliability. The term does not include facilities used in the local distribution of electric energy." NERC's own glossary defines the related but distinct term "Bulk Electric System" (BES): "Unless modified by the lists shown below, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher. This does not include facilities used in the local distribution of electric energy." BES (NERC's own technical term) and "bulk-power system" (the statute's term) are related but not identical, and are not conflated on this page.

Who owns it

NERC develops the CIP standards in its role as the Electric Reliability Organization (ERO), a role the Federal Power Act ties to Commission certification; FERC approves each standard or modification before it takes effect.

Who assesses it

NERC's own enforcement page states: "Enforcement assesses the risk and root cause(s) of reported noncompliance with mandatory and enforceable NERC and regional Reliability Standards... which in some cases involves the assessment of monetary penalties and/or non-monetary sanctions." The statute allows NERC (the ERO) to impose a penalty on notice to FERC, subject to FERC review, and separately allows FERC to impose penalties directly on its own initiative or on complaint. The statutory civil penalty ceiling (16 U.S.C. § 825o-1) is "not more than $1,000,000 for each day that such violation continues" — a 1992 baseline figure; a more current, inflation-adjusted figure was not confirmed from a primary source as of 31 August 2026.

CIP standard family (current and pending)

• CIP-002 to CIP-014 (in force) — The current CIP standard family, from CIP-002-8 through CIP-014-4 (with versions verified on NERC's own "All Standards" table as of 31 August 2026: CIP-002-8, CIP-003-11, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1, CIP-012-2, CIP-013-3, CIP-014-4).
• CIP-015-1 and CIP-015-2 (Internal Network Security Monitoring — approved, not yet enforceable) — Both are FERC-approved and on NERC's official "Important Dates" timeline, but neither is enforceable yet: CIP-015-1 (FERC order issued 26 June 2025) becomes "Subject to Future Enforcement" on 1 October 2028; CIP-015-2 (FERC order issued 10 August 2026) becomes enforceable on 1 October 2029.

Who asks for it

Statutory (scoped). Statutory under the U.S. Federal Power Act §215 (16 U.S.C. § 824o): "All users, owners and operators of the bulk-power system shall comply with reliability standards that take effect under this section." The statute expressly excludes Alaska and Hawaii (§824o(k)). "Bulk-power system" excludes facilities used in local distribution of electric energy. Canadian adoption runs through separate provincial/international arrangements, not this U.S. statute directly — the statute itself "urges" the President to negotiate international agreements with Canada and Mexico rather than binding them.

The statute states it directly: "All users, owners and operators of the bulk-power system shall comply with reliability standards that take effect under this section." The statute does not apply in Alaska or Hawaii: "The provisions of this section do not apply to Alaska or Hawaii."