Critical Infrastructure Protection, or CIP, is NERC’s framework of mandatory reliability standards for certain Bulk Electric System (BES) cyber systems. It applies to registered owners and operators of high-impact and medium-impact assets and sets baseline requirements for identifying critical systems, controlling access, managing patches, logging activity, and preparing for incidents and recovery.
CIP matters because power-grid cyber risk is not just about stopping intruders at the network edge. It is about proving that trusted personnel, authenticated updates, and protected remote access are in place across the full lifecycle of equipment and software. In real defenses, CIP drives asset inventories, electronic security perimeters, multi-factor access, change control, and recovery planning. In real attacks, those same controls are the barriers an adversary tries to bypass through stolen credentials, insecure vendor access, or compromised maintenance paths.