Energy utility engineering teams should start with scope, because obligations depend on which systems are classified, then build four habits: a configuration baseline, a patch cycle, event monitoring and scheduled assessments. In North America these map to NERC CIP standards. CISA's goals give a voluntary benchmark for the rest.
Which systems are in scope?
NERC CIP requirements attach to categories of systems. In the standards, requirement tables list applicable systems, for example high impact BES Cyber Systems and their associated electronic access control and monitoring systems, physical access control systems and protected cyber assets, and medium impact systems with the same associations. If a system is not in a category, a given requirement may not apply to it, so the first engineering deliverable is an accurate, current categorization.
The standards also differ by entity type. CIP-010 lists applicability for balancing authorities, certain distribution providers, generator owners and operators, reliability coordinators and others. Read the applicability section of each standard for your registration.
Priority 1: baselines and change records
CIP-010 requirement R1 covers configuration change management, with a baseline configuration per system. R2 part 2.1 asks high impact systems to monitor for baseline changes at least every 35 calendar days, and to document and investigate unauthorized changes. Engineering teams own this one: tooling, naming and records.
Priority 2: ports, patches and malicious code
CIP-007 groups several habits, each with documented processes: R1 ports and services, R2 security patch management, R3 malicious code prevention, R4 security event monitoring and R5 system access control. For patching, the cycle is a 35-day evaluation followed by apply, mitigate or revise within 35 days. See the companion post on the evidence for that cycle.
Priority 3: monitoring you can explain
R4 asks for security event monitoring. The practical point: decide which logs matter per system, where they go, who reviews them, and how long you keep them. Check the standard's exact retention and alert parts for your impact level rather than relying on summaries.
Priority 4: assessments on a calendar
CIP-010 R3 sets a vulnerability assessment at least every 15 calendar months, and an active assessment in a test or carefully run production environment at least every 36 calendar months for high impact systems where technically feasible. Calendar both dates and keep the output of tools.
What does CISA add?
CISA's Cross-Sector Cybersecurity Performance Goals 2.0 are voluntary. They align to NIST CSF 2.0, add a Govern function, and include new goals on oversight, managed service provider risk, least privilege and incident communications. CISA also lists sector-specific goals, including an energy set for distribution and distributed energy resources. Use them as a benchmark for areas the standards leave open, not as a replacement.
Constructed example: a mid-size generator operator
The team has 12 plants and a thin security group. It sorts systems by impact category in a spreadsheet, assigns each a named owner, and builds one monthly cycle: baseline check, patch evaluation, log review sample, open mitigation plans review. Four artifacts per system per month. Auditors can sample any month and see all four.
What to do
- Confirm registration, applicability and categorization for each system.
- Name an owner for each system and each requirement.
- Create baselines and a monthly change-detection routine.
- Run the 35-day patch evaluation cycle and record decisions.
- Define log sources, review steps and retention per impact level.
- Calendar assessments, with owners and test-environment plans.
- Map your program to CISA's goals to find gaps the standards do not cover.
- Keep an inventory of software components so supply chain questions have an answer.
Safeguard's asset and dependency inventory features can feed step 8. They are one input among the operational technology and compliance tools a utility uses.
Quick check
Do CISA performance goals replace NERC CIP?
No. The goals are voluntary and complement mandatory standards. NERC CIP obligations remain for registered entities.
What is the first thing to do?
Confirm which systems fall into which impact category. Requirements attach to those categories, so every later task depends on that answer.
Sources
Last reviewed: 18 October 2026.
