CIP-002 is a North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection standard. It requires applicable entities to identify and categorize Bulk Electric System (BES) Cyber Systems according to their potential impact on the reliable operation of the bulk electric system. The resulting categorization helps determine which cybersecurity requirements apply.
Accurate identification matters because assets that are missed or assigned the wrong impact category may receive inadequate protection or oversight. In practice, operators assess system functions and connections, document their decisions, and revisit them when resources, responsibilities, or system configurations change. For example, delayed generator registration or incomplete asset mapping can complicate the process of identifying and categorizing relevant cyber systems. CIP-002 is a risk-management and compliance control, not evidence that an attack has occurred.