Lion Cipher Lab

Build a NERC CIP Compliance Program for a Utility

• GRC / Compliance
• Advanced
• ~45 min
• Free · no account required

Why it matters

Most cybersecurity frameworks are advice you may take or leave. NERC CIP is not. It is federal law in effect: the Federal Energy Regulatory Commission (FERC) approves the Critical Infrastructure Protection standards, the North American Electric Reliability Corporation (NERC) is the Electric Reliability Organization that writes and enforces them, and Regional Entities audit registered owners and operators of the bulk power system. Violations carry civil penalties up to roughly one million dollars per violation per day. That single fact changes everything about how you run the program: the…

What you'll learn

• categorizing BES Cyber Systems as High / Medium / Low impact with the CIP-002 bright-line criteria for a worked, named-asset scenario
• applying the 15-minute BES Cyber Asset test to decide what is even in scope
• mapping the CIP-003 through CIP-013 requirement families to each impact rating, and knowing why Low-impact systems owe far less
• identifying which standard governs the Electronic Security Perimeter, Interactive Remote Access, and the Intermediate System (CIP-005)
• stating the CIP-008-6 reporting obligation -- the one-hour E-ISAC/CISA notification for a Reportable Cyber Security Incident, plus reporting attempts to compromise
• building a requirement -> control -> evidence artifact table under the 'evidence-or-it-didn't-happen' audit standard, and a risk-sequenced gap-remediation plan
• distinguishing mandatory, enforceable NERC CIP from voluntary NIST CSF outcomes, the IEC 62443 zones-and-conduits engineering method, and IT-centric frameworks -- and using the Technical Feasibility Exception (TFE) correctly

Steps in this lab

1. What NERC CIP is, and why 'mandatory' changes everything
2. Meet the scenario: Riverbend Power & Light
3. CIP-002: the 15-minute test, then categorize each asset
4. Map requirements to impact: what each rating actually owes
5. CIP-005 up close: the perimeter, the access point, and the jump host
6. CIP-008-6: the incident-reporting clock you cannot miss
7. Build the requirement -> control -> evidence table
8. Write the gap-remediation plan, sequenced by enforceable risk
9. When strict compliance is impossible: the Technical Feasibility Exception
10. NERC CIP vs its neighbors -- CSF, IEC 62443, and IT frameworks
11. The judgment: categorization is the load-bearing decision

Open the full interactive lab →