In Order No. 706, issued on 18 January 2008, FERC was asked to require "twice a year penetration tests" and declined. It directed NERC instead to require "representative active vulnerability assessments at least once every three years, with subsequent annual paper assessments in the intervening years" (FERC Order No. 706, paragraphs 546 and 547). That design still governs. Requirement R3 of CIP-010-4 runs a 15-month clock for paper or active vulnerability assessments and a 36-month clock for active ones, and NERC's CIP-010-4 page lists it as enforceable until 30 June 2028, when CIP-010-5 takes over with the same clocks.
Quick answer. No NERC CIP standard requires a "penetration test" by name. CIP-010-4 Requirement R3 requires a "paper or active vulnerability assessment" at least once every 15 calendar months for high and medium impact BES Cyber Systems and their associated EACMS, PACS and PCA (Part 3.1), an active assessment of high impact systems at least once every 36 calendar months where technically feasible (Part 3.2) and before any new applicable Cyber Asset enters production (Part 3.3), and documented results with a dated action plan (Part 3.4). A penetration test scoped to those parts produces the active-assessment evidence and also tests the CIP-005 and CIP-007 controls a scan only lists. Stingrai, a CREST-accredited penetration testing firm, runs that work human-led across Electronic Security Perimeter boundaries, EACMS, remote access paths and Active Directory, as a one-time annual engagement or a continuous program.
Figure 1: The NERC CIP requirements that shape a vulnerability assessment or penetration test, how often each applies and the verb the text uses, as of 16 October 2026. Source: NERC CIP standards.
Quotations come from NERC's standard text and FERC's orders; this is not legal advice.
What CIP-010-4 Requirement R3 says
R3's operative verb is "shall implement one or more documented process(es)" covering four parts:
Part | Applies to | Requirement (quoted) |
|---|---|---|
3.1 | High and medium impact BES Cyber Systems and their associated EACMS, PACS and PCA | "At least once every 15 calendar months, conduct a paper or active vulnerability assessment." |
3.2 | High impact BES Cyber Systems | "Where technically feasible, at least once every 36 calendar months: 3.2.1 Perform an active vulnerability assessment in a test environment, or ... in a production environment where the test is performed in a manner that minimizes adverse effects, that models the baseline configuration ...; and 3.2.2 Document the results of the testing and, if a test environment was used, the differences between the test environment and the production environment" |
3.3 | High impact BES Cyber Systems and their associated EACMS and PCA | "Prior to adding a new applicable Cyber Asset to a production environment, perform an active vulnerability assessment of the new Cyber Asset," except in CIP Exceptional Circumstances and for like replacements |
3.4 | The same systems as Part 3.1 | "Document the results of the assessments ... and the action plan ... including the planned date of completing the action plan and the execution status of any remediation or mitigation action items." |
The clocks run per system. The violation severity levels count months since the last assessment on any one applicable system: beyond 15 months is Lower, beyond 18 Moderate, beyond 21 High and beyond 24 Severe; the active-assessment bands step at 36, 39, 42 and 45 months.
"Model", not "duplicate". NERC's technical rationale says "the requirement is to 'model' the baseline configuration and not duplicate it exactly." Part 3.2.2 then demands a written record of the differences.
Infeasible means documented. NERC's audit worksheet tells auditors, where an active assessment was not feasible, to "verify the compensating measures identified by the TFE are implemented," meaning an approved Technical Feasibility Exception.
Who R3 covers, and who it does not
CIP-010-4 applies to balancing authorities, reliability coordinators, transmission owners and operators, generator owners and operators, and distribution providers that own specified protection and restoration systems. Scope follows CIP-002-5.1a, which sorts BES Cyber Systems into high, medium and low impact and must be reviewed "at least once every 15 calendar months." Section 4.2.3 exempts Cyber Assets at facilities regulated by the Canadian Nuclear Safety Commission, systems under a Nuclear Regulatory Commission cyber security plan, links between discrete Electronic Security Perimeters, and entities with no high or medium impact systems. Low impact systems have no R3 clock: CIP-003-9 Attachment 1, enforceable in the United States since 1 April 2026, requires controls that permit "only necessary inbound and outbound electronic access" (Section 3) and methods to determine, disable and detect malicious vendor remote access (Section 6).
Paper, active and penetration test: how they relate
We searched the text of all 29 CIP standards enforceable in the United States or approved for future enforcement as of 16 October 2026, and the 335 terms in the NERC Glossary: none contains the word "penetration." NERC distinguishes paper from active assessments, and its technical rationale says "the justification for this distinction is well-documented in FERC Order No. 706." The guidance NERC's drafting team published with the CIP-010 revisions in November 2014 spells it out:
Element | Paper assessment | Active assessment |
|---|---|---|
Network discovery | "A review of network connectivity to identify all Electronic Access Points" | "Use of active discovery tools to discover active devices and identify communication paths" |
Ports and services | "A review to verify that all enabled ports and services have an appropriate business justification" | "Use of active discovery tools (such as Nmap) to discover open ports and services" |
Vulnerabilities | "A review of security rule-sets and configurations" | "Use of a vulnerability scanning tool" against exposed services |
Wireless | Wireless networks used for BES Cyber System communications and "a review of their controls" | "Use of a wireless scanning tool" |
The same guidance points to NIST SP 800-115. A penetration test goes further than an active assessment: it exploits and chains what the scan finds, for example from a corporate laptop through an Intermediate System toward the Electronic Security Perimeter, showing whether CIP-005 and CIP-007 controls hold under attack rather than whether they exist. As FERC put it in 2008, "A responsible entity cannot protect its system from exploitation of vulnerabilities that it does not know about."
Read against the Part 3.1 and 3.2 measures, a penetration test counts as R3 evidence when it is dated, names each Cyber Asset covered, keeps method and tool output, records test-versus-production differences and feeds the Part 3.4 action plan.
The other CIP requirements a test should touch
Standard and part | What it requires | What a test checks |
|---|---|---|
CIP-005-7 R1.3 and R1.5 | Permissions at each Electronic Access Point "including the reason for granting access, and deny all other access by default"; methods for "detecting known or suspected malicious communications" | Probes from each adjacent zone are denied and detected; every allowed rule has a reason |
CIP-005-7 R2.1 to 2.3 | Interactive Remote Access through an Intermediate System, encryption that terminates there, and multi-factor authentication for every session | Ways around the jump host and MFA |
CIP-005-7 R2.4, 2.5 and R3 | Methods to determine and disable vendor remote access, extended to EACMS and PACS by R3 | Whether a vendor session can be seen, cut off and kept off |
CIP-007-6 R1.1 and R2 | Only needed logical ports enabled; patches evaluated every 35 calendar days, then applied or given a dated mitigation plan within 35 days | Open ports and known vulnerabilities against records |
CIP-013-2 R1.2.4 and 1.2.6 | Vendor disclosure of known vulnerabilities; coordination of controls for vendor-initiated remote access | Vendor access paths and vendor-disclosed vulnerabilities |
NERC's 2026 CMEP Implementation Plan names CIP-005-7 R2 and R3 an area of focus, citing "remote access to Critical Infrastructure Cyber Assets introducing increased attack surface"; our OT vendor remote access test matrix lists the checks.
How to scope a CIP test without disturbing production
Figure 2: Scoping a CIP-010 R3 penetration test by zone. Requirements per NERC's standards and Glossary; the test approach is Stingrai guidance. Source: NERC Glossary of Terms.
Start from the asset list. Scope the Cyber Asset identifiers the auditor samples, including the EACMS (Intermediate Systems, firewalls, authentication servers) and PACS servers that Part 3.1 names.
Test the path in at full depth. The corporate network, internet edge and corporate Active Directory sit outside CIP-010 but are how an attacker reaches an Intermediate System: ordinary internal and external network testing.
Treat the inside as Part 3.2 does. Test BES Cyber Systems in a test environment that models the baseline, or in production only in agreed windows, with passive discovery first, written stop conditions, operators on call and no exploitation of controllers or protection relays.
Clear the testers first. A tester with authorized electronic access needs CIP-004-7 training (R2.2), a personnel risk assessment (R3) and an authorization (R4.1); access to BES Cyber System Information needs authorization under R6.1.
What changes next: CIP-010-5 and CIP-015
CIP-010-5. FERC approved the virtualization revisions on 19 March 2026 in Order No. 919, and CIP-010-5 becomes enforceable on 1 July 2028. It keeps the 15- and 36-month clocks, adds shared cyber infrastructure ("SCI supporting an Applicable System"), replaces "where technically feasible" with "per system capability," and accepts reports from automated assessment and remediation mechanisms as evidence for new systems. FERC directed NERC to set criteria and mandatory reporting for that exception.
CIP-015. Following Order No. 887 of January 2023, Order No. 907 (26 June 2025) approved CIP-015-1, which requires "methods for detecting and evaluating anomalous network activity" inside the perimeters of high impact systems and medium impact systems with External Routable Connectivity, from 1 October 2028 at Control Centers and 24 months later elsewhere. FERC approved CIP-015-2 on 10 August 2026, per its own Federal Register notice, extending monitoring to EACMS and PACS from 1 October 2029, Control Centers first. A test inside the perimeter is the plainest proof that monitoring sees an intruder (our reading).
NERC CIP in Canada
NERC standards bind Canadian utilities once each province adopts them, on its own dates and sometimes in its own words.
Province | How the standards apply | CIP-010 in force | Other dates and variances |
|---|---|---|---|
Alberta | The AESO drafts Alberta Reliability Standards and recommends that the Alberta Utilities Commission approve them | CIP-010-AB-4 since 1 October 2024 | Clocks read "at least once every 15 months" and "36 months" |
Ontario | The IESO enforces them through the Market Rules after an Ontario Energy Board review window | CIP-010-4 since 1 October 2022 | CIP-003-9 from 1 July 2026; CIP-010-5 from 1 July 2028; CIP-015-1 from 1 October 2028 |
British Columbia | The BCUC adopts them on BC Hydro's assessment reports; WECC assists with compliance monitoring | CIP-010-4 since 1 July 2024 | CIP-003-9 from 1 October 2027; CIP-015-1 from 1 October 2029 (Order R-12-26) |
Quebec | The Régie de l'énergie adopts them with Quebec appendices and monitors compliance | CIP-010-4 since 1 October 2023 | Applies to the main transmission system (RTP); exempts generating facilities of 300 MVA or less that cannot synchronize with a neighbouring system |
Federally, Bill C-8's Critical Cyber Systems Protection Act lists "interprovincial or international pipeline and power line systems" as vital systems, but designates no operators in the Justice Laws text dated 28 September 2026 (see our Bill C-8 brief).
The evidence an auditor samples
The audit worksheet tells auditors to "verify the Responsible Entity conducted a paper or active vulnerability assessment at least once every 15 calendar months" for each Applicable System, then to check the action plan's planned date and execution status. NERC's CIP Evidence Request Tool (version 10.1) samples Cyber Assets one by one, with a separate sample of assets activated during the audit period.
Keep these for at least three calendar years, the retention period in CIP-010-4 section C.1.2:
The documented R3 process and the scope, mapped to Cyber Asset identifiers.
Each dated report, with the method per asset, tool output and, for Part 3.2, the test environment's differences from production.
The action plan with planned dates and status, and the retest records that close it.
The testers' CIP-004 authorizations.
Balancing authorities, reliability coordinators and transmission operators are audited "at least once every three years" under section 403 of NERC's Rules of Procedure, with at least 270 days' notice and a document request at least 90 days out (Appendix 4C).
What R3 findings look like in an enforcement filing
Following a 2020 joint staff white paper, NERC asks FERC to treat its CIP spreadsheet Notices of Penalty as wholly non-public, so the clearest public R3 example is older. In NP20-15-000, filed on 30 April 2020 and listed on NERC's enforcement page, ReliabilityFirst settled 34 CIP violations with an unidentified entity for US$450,000. Three were CIP-010-2 R3. In one, assets "added into a [redacted] production environment have not been actively scanned for vulnerability since 7/1/2016," because "no checks existed in change control" to confirm the assessment. In another, new cyber assets entered production on 29 March 2017 "without an active vulnerability assessment." Both were Part 3.3 failures, fixed with asset-onboarding work instructions that run the assessment inside the change management process.
The ceiling is far higher: NERC's Sanction Guidelines cap a penalty at the maximum in 18 CFR 385.1602(d), which eCFR lists at US$1,584,648 per violation, per day.
A first-year plan
Month | Activity | Requirement |
|---|---|---|
1 to 2 | Confirm the categorization and Cyber Asset list; set scope, test environment and windows; clear testers for access | CIP-002-5.1a; CIP-004-7 |
2 to 3 | Path-in testing: perimeter, corporate network, Active Directory, remote and vendor access | CIP-005-7 R2, R3 |
3 to 4 | Boundary tests at each Electronic Access Point; EACMS and PACS servers | CIP-005-7 R1; CIP-010-4 Part 3.1 |
4 to 5 | Active assessment of high impact systems in the test environment | CIP-010-4 Part 3.2 |
5 to 8 | Action plan, remediation or mitigation, retest | CIP-010-4 Part 3.4; CIP-007-6 R2 |
Each change | Active assessment before a new high impact Cyber Asset goes live | CIP-010-4 Part 3.3 |
By month 12 | Book the next cycle well inside 15 months | CIP-010-4 Part 3.1 |
What a NERC CIP test costs
No regulator publishes a price for a CIP-010 assessment and we found no public vendor price list we could verify, so cost follows scope: perimeters and sites, Cyber Assets, EACMS and PACS servers, test environments and production windows. Stingrai's fixed prices cover one web application and associated APIs only, such as a customer portal outside CIP scope: the Autonomous Pentest by Snipe at US$3,000 per assessment or US$650 a month, and the Hybrid Pentest at US$6,800 per assessment or US$1,275 a month, with monthly prices on a 12-month plan (pricing). CIP scopes are human-led and quoted through get a quote.
Questions to ask a testing vendor
How will findings map to our Cyber Asset identifiers and to Parts 3.1 to 3.4?
What runs in production, what in the test environment, and what are the stop conditions?
Can your testers clear our CIP-004 training and risk assessment before the window?
Is retesting included, and who are the named testers?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a registered entity, that means human-led testing by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team; Stingrai Inc holds the accreditation, per its CREST Marketplace profile.
Scope: external and internal network testing up to and across the Electronic Security Perimeter boundary, EACMS and Intermediate Systems, PACS servers, Active Directory, remote and vendor access, and phishing, remotely across the United States and Canada or on site where scoped.
Evidence for Part 3.4: whether the test is one-time or continuous, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed; retesting of remediated findings is included; and every human-led and hybrid report ships with an attestation letter: pentest evidence for your CIP-010 program.
Canadian delivery: a Toronto-headquartered Canadian entity for utilities in Alberta, Ontario, British Columbia and Quebec.
Device-level work: anything touching relays and controllers stays in your test environment, run with your OT engineers and agreed at scoping.
Snipe, Stingrai's AI agent, covers web applications and their APIs only; CIP work is human-led.
Frequently Asked Questions
Does NERC CIP require penetration testing?
No standard requires a test by that name. CIP-010-4 Requirement R3 requires a paper or active vulnerability assessment at least once every 15 calendar months for high and medium impact BES Cyber Systems and their associated EACMS, PACS and PCA, and an active assessment at least once every 36 calendar months for high impact systems where technically feasible. A penetration test documented the way R3 asks serves as active-assessment evidence.
How often does CIP-010-4 require a vulnerability assessment?
At least once every 15 calendar months for each applicable high and medium impact system, and an active assessment of high impact systems at least once every 36 calendar months where technically feasible. New applicable Cyber Assets at high impact systems need an active assessment before they enter production.
What is the difference between a paper and an active vulnerability assessment?
A paper assessment reviews documentation and configurations. An active assessment runs discovery and scanning tools against live or modeled systems. A penetration test goes further and tries to exploit and chain what those tools find.
Can an active vulnerability assessment run in production?
Yes, if the test is performed in a manner that minimizes adverse effects. Part 3.2 also allows a test environment that models the production baseline, provided the differences from production are documented.
Do low impact BES Cyber Systems need a vulnerability assessment?
No. CIP-010-4 R3 covers high and medium impact systems only. Low impact assets fall under CIP-003-9, enforceable in the United States since 1 April 2026, which requires electronic access controls and vendor remote access controls.
What changes when CIP-010-5 takes effect?
CIP-010-5 becomes enforceable on 1 July 2028. It keeps the 15- and 36-month clocks, adds shared cyber infrastructure, replaces "where technically feasible" with "per system capability," and accepts automated assessment reports as evidence for new systems.
Does CIP-015 require penetration testing?
No. CIP-015-1 requires internal network security monitoring from 1 October 2028 at Control Centers, and CIP-015-2 extends it to EACMS and PACS from 1 October 2029, Control Centers first. A test inside the perimeter checks that the monitoring works.
Are NERC CIP standards mandatory in Canada?
Yes, once a province adopts them. CIP-010-4 took effect on 1 October 2022 in Ontario, 1 October 2023 in Quebec and 1 July 2024 in British Columbia, and Alberta's CIP-010-AB-4 on 1 October 2024.
What evidence do auditors ask for under CIP-010 R3?
The documented process, dated assessment records per Cyber Asset with methods and tool output, test environment differences, and the action plan with planned dates and status, kept for three calendar years.
Related reading
References
NERC. CIP-010-4. https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-010-4.pdf
NERC. CIP-010-5. https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-010-5.pdf
NERC. Technical Rationale for CIP-010-4, October 2020. https://www.nerc.com/globalassets/standards/reliability-standards/cip/2019-03_cip-010-4_technical_rationale_clean_10072020.pdf
NERC. Reliability Standard Audit Worksheet, CIP-010-4, 2022. https://www.nerc.com/globalassets/programs/compliance/rsaws/rsaw-cip-010-4_2022_v1.docx
NERC. CIP-010 draft with Guidelines and Technical Basis, Project 2014-02, November 2014. https://www.nerc.com/globalassets/standards/projects/2014-02/cip-010-3_clean.pdf
NERC. CIP standards. https://www.nerc.com/standards/reliability-standards/cip
NERC. CIP-010-4 standard page, effective and inactive dates. https://www.nerc.com/standards/reliability-standards/cip/cip-010-4
NERC. US Reliability Standards. https://www.nerc.com/standards/us-reliability-standards
NERC. Glossary of Terms. https://www.nerc.com/glossary-of-terms
NERC. 2026 ERO Enterprise CMEP Implementation Plan, February 2026. https://www.nerc.com/globalassets/programs/compliance/cmep-resources/2026-ero-enterprise-cmep-implementation-plan.pdf
NERC. CIP Evidence Request Tool, version 10.1. https://www.nerc.com/globalassets/programs/compliance/cmep-resources/cip-evidence-request-tool-master-v10.1.xlsx
NERC. Rules of Procedure, section 403. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
NERC. Rules of Procedure, Appendix 4C. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
NERC. Rules of Procedure, Appendix 4B, Sanction Guidelines. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4b.pdf
NERC. Notice of Penalty NP20-15-000, 30 April 2020. https://elibrary.ferc.gov/eLibrary/filelist?accession_number=20200430-5292
FERC. Order No. 706, 18 January 2008. https://www.ferc.gov/sites/default/files/2020-04/E-2_11.pdf
FERC. Order No. 887, 88 FR 8354. https://www.federalregister.gov/documents/2023/02/09/2023-01453/internal-network-security-monitoring-for-high-and-medium-impact-bulk-electric-system-cyber-systems
FERC. Order No. 907, 90 FR 28889. https://www.federalregister.gov/documents/2025/07/02/2025-12309/critical-infrastructure-protection-reliability-standard-cip-015-1-cyber-security-internal-network
FERC. Order No. 919, 91 FR 13957. https://www.federalregister.gov/documents/2026/03/24/2026-05716/virtualization-reliability-standards
FERC. FERC-725B notice on CIP-015-2, 91 FR 64921, 13 October 2026. https://www.federalregister.gov/documents/2026/10/13/2026-20880/commission-information-collection-activities-ferc-725b-comment-request-extension
eCFR. 18 CFR 385.1602. https://www.ecfr.gov/current/title-18/section-385.1602
AESO. Alberta Reliability Standards. https://www.aeso.ca/rules-standards-and-tariff/alberta-reliability-standards/
IESO. Ontario Enforcement Dates, July 2026. https://www.ieso.ca/-/media/Files/IESO/Document-Library/orcp/2026/Standards-Roadmap-Milestone-July-2026.pdf
BCUC. Order R-12-26, Attachment A, 29 September 2026. https://docs.bcuc.com/documents/MRS/2026/Attachment-A-All-Standards.pdf
Régie de l'énergie. Reliability Standards. https://www.regie-energie.qc.ca/fr/entites-visees/reliability-standards
Justice Laws Website. Statutes of Canada 2026, chapter 9. https://laws-lois.justice.gc.ca/eng/AnnualStatutes/2026_9/FullText.html
Stingrai. Pricing. https://www.stingrai.io/pricing
Talk to Stingrai
If your next CIP-010 assessment is due inside the 15-month window, Stingrai will scope it against your Cyber Asset list: named penetration testers, path-in, boundary, EACMS and remote access testing, retesting and an attestation letter, as a one-time annual engagement or a continuous program. Get a quote or book a free discovery call.
