NERC Critical Infrastructure Protection - Systems Security Management
NERC reliability standard requiring security management for Bulk Electric System (BES) Cyber Systems. Mandatory for all electric utilities in North America.
What NERC CIP-007-6 draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Security Event Monitoring
Responsible entities MUST log events at BES Cyber System level including login attempts.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Event Log Retention
Security event logs MUST be retained for at least 90 days and available for immediate review.
Retention obligations are easy to state and expensive to meet, because the cost is in keeping the record queryable rather than merely stored. Audit events land in columnar storage on immutable object storage, so a multi-year window costs object-storage prices and is still searchable in seconds when an examiner asks for a sample. Each record carries a verification hash, so what you produce years later is demonstrably what was written at the time.
Log Review
Responsible entities MUST review logs of BES Cyber Systems at least once every 15 days.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Administrative Access
MUST log all administrative actions and configuration changes on BES databases.
Change control fails at the evidence step far more often than at the approval step. Running SELECT 'CR:12345' WHERE 1 = 0 before a change ties every subsequent statement in that session to the request that authorised it — no agents, no application changes, no database configuration. Schema and configuration changes are captured as they happen, so an unapproved DDL is visible rather than discovered at the next review.
What NERC CIP-007-6 covers
NERC Glossary — BES Cyber System Information; protection requirements at CIP-011
Information about a BES Cyber System that could be used to gain unauthorised access to it, or to compromise its operation.
In scope
- Security configuration information
- Network topology and connectivity diagrams
- Floor plans of facilities containing BES Cyber Systems
- Incident response plans and system security information
What falls outside
Information already made public, and information that would not assist an attacker in gaining access or degrading operation.
The class is defined by what the information ENABLES rather than by what it contains, which is unusual in this corpus and means the same document can be in scope in one context and out in another.
NERC Reliability Standards · as at 2026-08
How NERC CIP-007-6 is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by NERC and the Regional Entities, with penalties approved by FERC.
| Published maximum | Charged | As at |
|---|---|---|
| USD 1.54 million, indexed from the statutory USD 1 million | per day, per violation | 2026-08 |
The Energy Policy Act of 2005 set the original ceiling at USD 1 million per day per violation and it is adjusted for inflation. Because the exposure accrues daily and per violation, a control gap that persisted across an audit period compounds. Penalties are public once filed with FERC.
Maximums are ceilings set by the instrument; enforcement is discretionary and tiered.
Uncapped exposure that sits outside this instrument
These come from company law rather than from NERC CIP-007-6, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for NERC CIP-007-6,
not configured for it afterwards
BES Cyber System Monitoring
Track all access and changes to bulk electric system databases
NERC CIP Audit Report
Immutable 90-day logs with 15-day review evidence
BES Data Patterns
Identify SCADA, EMS, and grid control system data
BES Configuration Change
Alert on administrative actions to critical grid systems
Other Critical Infrastructure frameworks
Walk into the NERC CIP-007-6 audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.