01 · Scope002
System categorisation
Identify BES Cyber Systems and retain the context used to determine impact and applicable security obligations.
NERC CIP · Critical Infrastructure Protection
Keep grid-security evidence connected to the BES context.
Bring assets, dependencies, cyber risks, policies, personnel responsibilities, suppliers, vulnerabilities, incidents, recovery work and evidence into one governed operating record for applicable NERC CIP Reliability Standards.
The supplied STORM technical description does not list NERC CIP as a current built-in framework. STORM provides documented governance, risk and evidence workflows; applicability, versions and mappings must be confirmed.
BES security operating recordEvidence trace active
BESscope & impact
Cyber SystemsAssets and categorisation context
Access & protectionElectronic and physical safeguards
Supply chainVendors, services and dependencies
Response & recoveryIncidents, actions and evidence
Scope · risk · ownership · evidence · review
Mandatory standardsapproved CIP Reliability Standards are enforceable within their applicable jurisdiction
Bulk Electric Systemcyber and physical protection tied to reliable BES operation
CIP-002–CIP-015the current NERC catalogue includes enforced and future-enforcement standards
Version specificapplicability and effective dates must be checked standard by standard
What the family addresses
From BES categorisation to operational resilience.
The NERC catalogue separates the CIP family into distinct Reliability Standards. Responsible Entities need the applicable versions, requirements and evidence for their jurisdiction and BES Cyber System context.
02 · Govern003–004
Management, personnel & training
Connect security governance, accountable roles, access responsibilities, awareness and supporting personnel records.
03 · Protect005–007
Electronic, physical & system security
Organise the assets, boundaries, access controls and operational safeguards relevant to protected cyber environments.
04 · Recover008–009
Incident response & recovery
Maintain response and recovery plans, assigned actions, incident records, testing evidence and lessons learned.
05 · Operate010–012
Change, vulnerability & information protection
Track configuration and vulnerability work, protected information and relevant communications safeguards.
06 · Extend013–015
Supply chain, physical security & monitoring
Bring vendor dependencies, physical-security concerns and emerging internal network monitoring obligations into oversight.
Product evidence boundary
Documented GRC capabilities, without claiming built-in NERC CIP coverage.
The technical description supports many underlying governance activities, but it does not name NERC CIP among the platform's current built-in standards.
Documented STORM building blocks
- IT and OT asset and dependency cartography
- Impact, threat, vulnerability and risk workflows
- Policy lifecycle and acknowledgement records
- Supplier assessment and evidence collection
- Incident, audit and management-review records
Must be confirmed or configured
- Applicable NERC CIP standard versions
- Ready-made NERC CIP assessment content
- BES impact-category and requirement mappings
- NERC-specific evidence tests and retention rules
- Regional Entity reporting or submission integrations
Where STORM can support the programme
Connect operational context to reviewable proof.
STORM can organise assets, risks, controls, evidence and improvement work while qualified compliance and engineering teams determine NERC CIP applicability and operate the required technical safeguards.
IT/OT cartography
Inventory locations, services, processes, data, hardware, software, infrastructure, users and suppliers, then model their dependencies.
Assets · services · flowsRisk assessment & treatment
Connect impact, threats and vulnerabilities to defined risk criteria, treatment decisions, controls, owners and review dates.
Risk register · treatmentTechnical vulnerability work
Centralise supported Nessus and Microsoft Defender findings, correlate them with assets and track SLA-driven remediation.
Findings · priority · actionsPolicy & responsibility evidence
Manage document versions, approvals, reviews, acknowledgements, mappings and retained history with accountable owners.
Governance · traceabilitySupplier security oversight
Classify suppliers, assess business impact and security posture, request control evidence and monitor remediation.
Third-party risk · evidenceIncident, audit & review
Bring incident records, root causes, corrective actions, audit findings and management decisions into one follow-through cycle.
Response · audit · improvement
Establish operational context
Keep scope, impact and dependencies connected.
STORM Cartography models IT and OT assets together with services, processes, users, locations and external providers. That context can support impact, threat and risk work, but does not itself make a regulatory categorisation decision.
- Reusable asset and dependency inventory
- Impact, threat and vulnerability context
- Exportable registers and risk results
Connect technical signals
Move supported findings into owned remediation.
Threat intelligence and technical vulnerability workflows add current context to risk decisions. Microsoft security monitoring can generate evidence for supported cloud configurations; it is not presented as complete NERC CIP or OT network monitoring.
- CVE, breach and supplier-related intelligence
- Nessus and Microsoft Defender finding ingestion
- Assigned remediation, SLA and exception tracking
Extend accountability
Link supply-chain and incident work to governance.
Supplier assessments, incident records, controlled policies, audit findings and management reviews create a traceable operating record around external dependencies and response activity.
- Supplier tiering, questionnaires and evidence
- Incident impact, root cause and corrective actions
- Audit and management-review follow-through
A connected CIP operating model
01 · CIP-002–004
02 · CIP-005–007
03 · CIP-008–012
04 · CIP-013–015
Keep requirements anchored to assets, owners and evidence.
These groupings summarise the public standard titles and do not reproduce or replace the official Reliability Standards.
Scope & govern
Maintain the system context, security governance, personnel responsibilities and training records used by the programme.
Categorisation · management · peopleProtect environments
Connect electronic and physical boundaries, access responsibilities and system-security work to affected assets.
Perimeters · physical · system securityRespond & recover
Coordinate incidents, recovery, configuration changes, vulnerability work, information protection and communications evidence.
Response · recovery · change · protectionExtend assurance
Bring supply-chain risk, physical-security concerns and future internal network monitoring obligations into review.
Suppliers · physical security · monitoringNERC publishes separate enforced and future-enforcement versions. Always use the official standard page, implementation plan and jurisdiction-specific status when determining an obligation.
Programme workflow
01
02
03
04
From applicability to defensible follow-through.
Use STORM for the connected governance record while regulatory interpretation and compliance determinations remain with the Responsible Entity and its qualified advisers.
Confirm
Determine jurisdiction, functional applicability, effective versions, systems and responsible roles.
Applicability · versionsMap
Relate applicable requirements to assets, processes, policies, safeguards, suppliers and accountable owners.
Scope · controls · ownershipOperate
Perform required security, personnel, vulnerability, response, recovery and supply-chain activities.
Operations · evidence · actionsReview
Test evidence, remediate findings and retain audit and management decisions through change.
Audit · remediation · reviewPractical questions
Separate platform support from regulatory compliance.
A reliable implementation starts with the applicable official standards and honest product boundaries.
Who is subject to NERC CIP Reliability Standards?
The CIP standards apply through the NERC reliability framework to relevant registered entities and functions involved with the Bulk Electric System. Exact applicability depends on jurisdiction, registration, facilities, systems and the language of each effective standard; it should be confirmed with official NERC and Regional Entity resources.
Is there one current NERC CIP version?
No. NERC publishes separate standards across the CIP family, each with its own version and status. The official catalogue currently shows versions that are mandatory and subject to enforcement alongside versions subject to future enforcement.
Does STORM currently contain a ready-made NERC CIP assessment?
The supplied technical description does not list NERC CIP among the current built-in standards and does not document a ready-made NERC CIP template. It does document configurable assessments and the asset, risk, policy, supplier, incident, audit and evidence workflows described on this page.
Can STORM determine BES Cyber System impact categories?
No such automated categorisation capability is documented. STORM can organise asset and dependency context, assessments and evidence, but qualified teams must apply the effective CIP-002 requirements and make the formal categorisation determination.
Does STORM Security Monitoring provide complete CIP monitoring?
No. The documented module continuously checks supported Microsoft cloud, identity, device and security configurations. It should not be presented as complete BES, OT, electronic perimeter or internal network monitoring for NERC CIP.
Can STORM certify NERC CIP compliance?
No. STORM can maintain governance records and evidence. Compliance obligations, monitoring and enforcement operate through the NERC and Regional Entity framework under applicable regulatory oversight.
Bring your BES context
Book a STORM demo
Test STORM against the evidence your programme must actually maintain.
Walk through your applicable standards, assets, dependencies, personnel, suppliers, vulnerabilities, incidents, recovery work and evidence—and identify the NERC-specific content that still requires configuration.