New Low Impact NERC CIP-003-9 Regulations: Vendor Supply Chain Security

Policy Pulse
Written By Patrick Miller

By Patrick Miller

On March 16 2023, FERC issued a new Order approving NERC CIP-003-9 introducing new requirements for vendor electronic remote access security controls to low impact BES Cyber Systems. These new security controls are intended to allow detection and the ability to disable vendor remote access in the event of a known or suspected malicious communication.

Ampere hosed a webinar/webpanel featuring a former CIP regulator and three former asset owners, where they will discuss what is in scope, when it be applicable, how it will impact your utility, and what you should be doing.

Panelists

Show Links

FERC Order Approving Reliability Standard CIP-003-9 - Docket No. RD23-3-00

CIP-003-9 Reliability Standard, NERC

NERC Project 2020-03 Page for all documents related to the drafting and adoption process for CIP-003-09

  • All draft versions

  • Redlines to last posted/approved

  • Technical Rationale

  • VRF/VSL Justifications

  • Reliability Standard Audit Worksheet (RSAW)

  • Ballot results

Supply Chain Risk Assessment Report

Safety Sign Generator

Slides from this webinar/webpanel

Featured Posts

Featured
Beyond the Checklist: The Place of Internal Controls in NERC CIP Compliance Programs
NERC CIP, NERC, CMEP, Internal Controls, Internal Controls Program, Internal Controls Evaluation, Preventive Controls, Detective Controls, Corrective Controls, Controls Testing, COSO, ICDCT, WECC, Compliance, Compliance Oversight Plan, COP, Audit Prep, ERO, Yellow Book, Self-reporting, Find Fix Track, Compliance Exceptions, CIP-004, CIP-007, Risk Management, Program Maturity, Registered Entity, Electric Sector
Beyond the Checklist: The Place of Internal Controls in NERC CIP Compliance Programs
NERC CIP, NERC, CMEP, Internal Controls, Internal Controls Program, Internal Controls Evaluation, Preventive Controls, Detective Controls, Corrective Controls, Controls Testing, COSO, ICDCT, WECC, Compliance, Compliance Oversight Plan, COP, Audit Prep, ERO, Yellow Book, Self-reporting, Find Fix Track, Compliance Exceptions, CIP-004, CIP-007, Risk Management, Program Maturity, Registered Entity, Electric Sector

NERC CIP compliance is no longer a checklist exercise. Internal controls are now how the ERO Enterprise measures whether an entity can sustain compliance over time. This post breaks down what internal controls are, the preventive, detective, and corrective types, how entities test and evidence them, and how WECC's ICDCT and the December 2025 ERO Guide put controls at the center of audit scoping.

Read more →
NERC CIP, NERC, CMEP, Internal Controls, Internal Controls Program, Internal Controls Evaluation, Preventive Controls, Detective Controls, Corrective Controls, Controls Testing, COSO, ICDCT, WECC, Compliance, Compliance Oversight Plan, COP, Audit Prep, ERO, Yellow Book, Self-reporting, Find Fix Track, Compliance Exceptions, CIP-004, CIP-007, Risk Management, Program Maturity, Registered Entity, Electric Sector
ANCHOR-CI: The Partnership Framework Returns, the Liability Shield Does Not
ANCHOR-CI, CIPAC, CISA, Critical Infrastructure, Grid Security, OT Cybersecurity, Information Sharing, FACA, NERC CIP, NIS2, E-ISAC, Department of Energy, DOE, Energy Threat Analysis Center, ETAC, CRISP, Sector Risk Management Agency, SRMA, ISAC, ISAO, CIRCIA, Incident Reporting
ANCHOR-CI: The Partnership Framework Returns, the Liability Shield Does Not
ANCHOR-CI, CIPAC, CISA, Critical Infrastructure, Grid Security, OT Cybersecurity, Information Sharing, FACA, NERC CIP, NIS2, E-ISAC, Department of Energy, DOE, Energy Threat Analysis Center, ETAC, CRISP, Sector Risk Management Agency, SRMA, ISAC, ISAO, CIRCIA, Incident Reporting

DHS just reopened the closed-door forum where critical infrastructure operators and federal agencies compare notes on cyber threats in private. The legal protection that once made those conversations safe did not come back with it. ANCHOR-CI restores the room and leaves the shield behind, and here is what that changes for anyone who plans to speak in it.

Read more →
ANCHOR-CI, CIPAC, CISA, Critical Infrastructure, Grid Security, OT Cybersecurity, Information Sharing, FACA, NERC CIP, NIS2, E-ISAC, Department of Energy, DOE, Energy Threat Analysis Center, ETAC, CRISP, Sector Risk Management Agency, SRMA, ISAC, ISAO, CIRCIA, Incident Reporting
Using the Work of Others in NERC CIP and O&P Compliance
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Work of Others, FERC, CIP-003, CIP-004, CIP-006, CIP-010, CIP-011, CIP-013, BCSI, BES Cyber System Information, Cloud, SOC 2, FedRAMP, Supply Chain, Vendor Management, Third Party, Internal Controls, Independent Assessment, CMEP, ERO, NATF, Global Internal Audit Standards
Using the Work of Others in NERC CIP and O&P Compliance
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Work of Others, FERC, CIP-003, CIP-004, CIP-006, CIP-010, CIP-011, CIP-013, BCSI, BES Cyber System Information, Cloud, SOC 2, FedRAMP, Supply Chain, Vendor Management, Third Party, Internal Controls, Independent Assessment, CMEP, ERO, NATF, Global Internal Audit Standards

The work of others lets you lean on someone else's assessment as compliance evidence. It does not transfer accountability. This breakdown maps the ERO guidance stack, the two-part test auditors apply, worked examples for CIP-013 vendor assessments and BCSI in the cloud, the FERC FY2025 findings on delegation gone wrong, and the audit prep questions to answer first.

Read more →
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Work of Others, FERC, CIP-003, CIP-004, CIP-006, CIP-010, CIP-011, CIP-013, BCSI, BES Cyber System Information, Cloud, SOC 2, FedRAMP, Supply Chain, Vendor Management, Third Party, Internal Controls, Independent Assessment, CMEP, ERO, NATF, Global Internal Audit Standards
NERC CIP Audit Readiness: A Strategic Compliance Guide 2026
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Asset Inventory, BES, BES Cyber System, RSAW, CIP Compliance, BES Cyber Asset
NERC CIP Audit Readiness: A Strategic Compliance Guide 2026
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Asset Inventory, BES, BES Cyber System, RSAW, CIP Compliance, BES Cyber Asset

Stop treating NERC CIP audits as fire drills. Learn the proactive timelines, documentation discipline, and live audit approach that separate prepared utilities from panicked ones. Here’s a strategic guide to compliance sanity from a former CIP auditor.

Read more →
NERC, Electric Sector, NERC CIP, Audit, Audit Prep, Compliance, Asset Inventory, BES, BES Cyber System, RSAW, CIP Compliance, BES Cyber Asset
NERC MSPP Rules of Procedure: Standards Committee Retired in May 2026 Draft
NERC, MSPPTF, MSPP, Standards Development, Rules of Procedure, Standards Committee, Reliability Standards Body, RBB, Registered Ballot Body, RISC, Ballot Pool, Term Sheet, NERC CIP, FERC, Compliance, Standard Processes Manual
NERC MSPP Rules of Procedure: Standards Committee Retired in May 2026 Draft
NERC, MSPPTF, MSPP, Standards Development, Rules of Procedure, Standards Committee, Reliability Standards Body, RBB, Registered Ballot Body, RISC, Ballot Pool, Term Sheet, NERC CIP, FERC, Compliance, Standard Processes Manual

NERC's May 2026 draft Rules of Procedure revisions retire the Standards Committee, eliminate ballot pools, restructure the Registered Ballot Body, and create a new Reliability Standards Body under the RISC. The MSPP Task Force implementation package is the most consequential governance change to NERC standards development since the ERO model was certified in 2006.

Read more →
NERC, MSPPTF, MSPP, Standards Development, Rules of Procedure, Standards Committee, Reliability Standards Body, RBB, Registered Ballot Body, RISC, Ballot Pool, Term Sheet, NERC CIP, FERC, Compliance, Standard Processes Manual
Patrick Miller https://www.patrickcmiller.com
Previous

NERC Initiates Data Collection on INSM for Low Impact CIP Assets
Next

New cybersecurity controls for vendor access to low impact NERC CIP assets