CIP-002 — BES Cyber System Categorization

Description

CIP-002 establishes the process for identifying and categorizing BES Cyber Systems and associated BES Cyber Assets according to their potential impact on the reliable operation of the Bulk Electric System. Systems are generally categorized as high, medium, or low impact, with requirements increasing with impact.

Implications

• Requires a complete, defensible inventory of BES Cyber Systems, their assets, dependencies, locations, owners, and responsible functions.
• Classification drives which downstream CIP requirements apply and how much evidence, testing, monitoring, and protection are required.
• Changes to plant, substation, control-center, telecommunications, or protection-system architecture can change scope or impact ratings.
• Incorrect categorization creates both reliability and compliance risk; under-classification can leave critical systems inadequately protected.

Common Compensating Controls

• Formal asset-discovery and inventory reconciliation using configuration management, network diagrams, and engineering records.
• Independent classification review by cybersecurity, operations, engineering, and compliance personnel.
• Risk-based treatment of ambiguous or borderline assets at the higher reasonable protection level until classification is resolved.
• Periodic and change-triggered scope reviews, including acquisition, retirement, firmware, connectivity, and architecture changes.
• Documented rationale, assumptions, approvals, and evidence for every categorization decision.

Applicability and acceptable measures depend on the current approved standard, implementation plan, and regional guidance.