Project Management Toolkit - Comprehensive 370 Templates Subtotal: $99.00
Subtotal: $99.00
The NERC CIP Toolkit delivers 130 ready-to-use Microsoft Office templates for US-registered Responsible Entities — 90 Word documents and 40 Excel workbooks covering all 46 requirements and 210 requirement parts of the 13 CIP Reliability Standards enforceable today. Sixteen sections follow the standards themselves, one per standard, because that is how a Regional Entity audits you. Includes a dedicated low-impact route, an evidence register pre-loaded with every requirement and part, and the standard-version matrix that tells you which version is enforceable now and what replaces it on 1 July 2028.
$99.00
✓ In stock — instant download after checkout
Almost every compliance toolkit sold is for a voluntary standard. This one is not. Section 215 of the Federal Power Act makes FERC-approved Reliability Standards mandatory and enforceable, and a Registered Entity is audited against them by its Regional Entity using a Reliability Standard Audit Worksheet — with civil penalties available for violations.
If you are securing operational technology outside the North American bulk electric system, the IEC 62443 Toolkit is the international equivalent and covers industrial automation and control systems generally. European operators of essential services should start with the NIS2 Toolkit.
The NERC CIP Toolkit is written against the 13 CIP standards enforceable in the United States and covers all 46 of their requirements and all 210 requirement parts.
Sixteen sections, one per standard, in standard number order. That is not a stylistic choice. A Regional Entity works through an RSAW for CIP-002, then an RSAW for CIP-003, and so on. A document set organised any other way — by control family, by ISO 27001 Annex A, by security domain — forces you to re-map your own evidence under audit conditions, which is where mistakes happen.
If your documentation predates 2026, two specific gaps are almost certainly in it:
| Standard | Enforceable from | What changed |
|---|---|---|
| CIP-003-9 | 1 April 2026 | Added vendor electronic remote access controls to the low-impact Attachment 1 topic list |
| CIP-012-2 | 1 July 2026 | Added loss of availability to the Control Center communications risks, plus a duty to initiate recovery of the links |
Both are checkable in an afternoon. A low-impact plan written to CIP-003-8 has no vendor remote-access section. A CIP-012 plan written to CIP-012-1 covers disclosure and modification and is silent on availability — and because it reads as a complete plan, nothing signals the gap.
This is the part nobody documents, and it is the reason section 16 of this toolkit exists.
Eleven of the currently enforceable standards carry an inactive date of 30 June 2028. The replacement set — produced principally by NERC’s Project 2016-02 — becomes enforceable on 1 July 2028. That is one coordinated programme event, not eleven separate revisions, and an entity that treats it as eleven will do it eleven times and badly.
The toolkit ships a standard-version register listing every enforceable standard with its enforcement date and inactive date, every approved-but-not-yet-enforceable replacement with its date, and the one standard currently filed and pending at FERC. It also ships a transition plan built around the single cutover date.
You will find a great deal of material selling internal network security monitoring as a present NERC obligation, usually dated from September 2025.
That date is the FERC rule’s effective date. The standard’s enforcement date is 1 October 2028, and a CIP-015-2 already sits behind it at 1 October 2029.
Three different dates circulate for every NERC standard and only one governs what you are audited against:
| Date | What it is | Does it bind you? |
|---|---|---|
| FERC order date | When the Commission issued the order | No |
| FERC rule effective date | When the rule took effect | No |
| Standard enforcement date | When the standard becomes enforceable | Yes |
Section 16 of this toolkit is therefore readiness material, labelled as readiness. It gives you the traffic mapping, the visibility assessment and the phased implementation plan you need to start now — because sensor placement inside an Electronic Security Perimeter usually needs an outage window, and those are scheduled a year out — without pretending you are late for something that has not started.
An entity whose assets contain only low-impact BES Cyber Systems is in scope for CIP-002 and for CIP-003 Requirement R2 and its Attachment 1, and substantially nothing else.
Section 03 carries a dedicated low-impact route — one document per Attachment 1 topic, written to be self-contained, so a low-impact entity never has to read the high and medium impact set. That matters commercially as well as practically: every control you adopt beyond what applies to you becomes evidence a Regional Entity can ask for, and which you must then produce for the whole audit period.
Five of the 40 Excel workbooks ship pre-loaded from the requirement register, not empty:
| Workbook | What is already in it |
|---|---|
| CIP Evidence Register | All 256 identifiers — every requirement and every part — with VRF and functional-entity applicability |
| Applicability Matrix | All 210 requirement parts, ready for the applies / does not apply decision an auditor tests first |
| Internal Audit Checklist | All 210 parts, phrased as the question an auditor asks |
| Roles and RACI Matrix | All 256 identifiers, so no requirement can be left without an accountable owner |
| Standard Version Register | The 13 enforceable standards, the 14 approved replacements, the one pending at FERC |
They come from one data module, which is what stops them drifting from each other or from the documents.
NERC’s clocks are unforgiving and they are easy to merge by accident. The toolkit states them, per requirement part, with the trigger each one runs from:
within 24 hours of a termination action, but revoke the non-shared accounts within 30 calendar days. Different things, different clocks, routinely conflated.
available at its source, the other from the evaluation being completed.
by the end of the next calendar day after determining an attempt to compromise. Two triggers, an order of magnitude apart, and a single “notify within 24 hours” rule is more than twenty hours late on the first.
months** for the test in a representative environment. One annual exercise satisfies the first only.
CIP-014 requires an unaffiliated third party twice, and they are not the same engagement:
They happen at different points, cover different subject matter, and draw on different permitted reviewer pools. Running one engagement to answer both leaves one gate with no evidence at all — and because the two reports address different documents, the gap is immediately visible to an auditor. Section 14 gives each gate its own procedure and shares one confidentiality procedure between them, which is what CIP-014 R2.4 and R6.4 both require.
It is for US-registered Responsible Entities — the asset owners and operators who face a Regional Entity audit. How much of the pack applies depends on the functions you are registered under, and the spread is wider than most summaries suggest:
| Registered function | Requirements in scope |
|---|---|
| Transmission Owner | 46 of 46 |
| Transmission Operator | 43 of 46 |
| Balancing Authority, Generator Owner, Generator Operator, Reliability Coordinator | 40 of 46 |
| Distribution Provider | 39 of 46 |
| Interchange Authority | 13 of 46 |
Transmission Owner is the only function in scope for every requirement — which is why CIP-014 belongs inside this pack rather than beside it. An Interchange Authority, at the other end, is in scope for well under a third and should expect to use a small part of the toolkit.
It is not for vendors selling into the sector. If you supply products to a Responsible Entity, the obligations you will be asked to meet come through your customer’s CIP-013 procurement process, not directly — and this pack is written from the customer’s side of that conversation.
It covers the United States only. Adoption of the CIP standards in Canada differs by province and Mexico differs again. Where you operate across borders, the differences are yours to establish and the toolkit says so rather than implying a coverage it does not have.
It can give you the documented processes, the registers, the evidence structure and the audit readiness material — which is the great majority of what a CIP programme consists of, because CIP compliance is evidence-driven by construction.
It cannot perform your CIP-014 Requirement R1 risk assessment. That is a transmission planning study, run by people who model the power system, and no template performs it. Section 14 documents the process around it — the intervals, the record of what was considered, the identification of the primary control center, the two third-party gates — and is explicit that the study itself is yours.
Nor does buying a toolkit make you compliant. Compliance is evidence covering the whole audit period. The toolkit is what turns your practice into that evidence.
Unlike ISO and IEC standards, NERC Reliability Standards download free from nerc.com — no subscription, no per-seat licence, no purchase before you can read what you are being asked to do.
That is unusual and it changes what a toolkit should be. There is no value in us restating requirement text you can read for nothing. What is scarce is the documented processes, the registers, the interval arithmetic, the evidence structure and the version matrix — which is what these 130 documents are.
| # | Section | Documents |
|---|---|---|
| 01 | CIP Programme Foundation | 8 |
| 02 | CIP-002 Categorization | 6 |
| 03 | CIP-003 Security Management | 12 |
| 04 | CIP-004 Personnel and Training | 13 |
| 05 | CIP-005 Electronic Perimeter | 7 |
| 06 | CIP-006 Physical Security | 7 |
| 07 | CIP-007 System Security | 12 |
| 08 | CIP-008 Incident Response | 9 |
| 09 | CIP-009 Recovery Plans | 7 |
| 10 | CIP-010 Change and Vulnerability | 11 |
| 11 | CIP-011 Information Protection | 5 |
| 12 | CIP-012 Control Centers | 4 |
| 13 | CIP-013 Supply Chain | 7 |
| 14 | CIP-014 Transmission Security | 8 |
| 15 | Evidence and Audit Readiness | 9 |
| 16 | Transition and CIP-015 | 5 |
Each of the 90 Word documents carries a Requirements addressed table immediately after its standard basis, citing the requirement identifiers exactly as NERC writes them — CIP-007-6 R4.1.1, not “logging”. That is the string an auditor searches for, and it is what lets you hand over a document and have it map to the RSAW without argument.
01 — CIP Programme Foundation (8 documents)
02 — CIP-002 Categorization (6 documents)
03 — CIP-003 Security Management (12 documents)
04 — CIP-004 Personnel and Training (13 documents)
05 — CIP-005 Electronic Perimeter (7 documents)
06 — CIP-006 Physical Security (7 documents)
07 — CIP-007 System Security (12 documents)
08 — CIP-008 Incident Response (9 documents)
09 — CIP-009 Recovery Plans (7 documents)
10 — CIP-010 Change and Vulnerability (11 documents)
11 — CIP-011 Information Protection (5 documents)
12 — CIP-012 Control Centers (4 documents)
13 — CIP-013 Supply Chain (7 documents)
14 — CIP-014 Transmission Security (8 documents)
15 — Evidence and Audit Readiness (9 documents)
16 — Transition and CIP-015 (5 documents)
Which CIP standards does the toolkit cover? The 13 enforceable in the United States: CIP-002-5.1a, CIP-003-9, CIP-004-7, CIP-005-7, CIP-006-6, CIP-007-6, CIP-008-6, CIP-009-6, CIP-010-4, CIP-011-3, CIP-012-2, CIP-013-2 and CIP-014-3 — covering all 46 requirements and 210 requirement parts between them.
Do I need to buy the NERC standards as well? No. NERC Reliability Standards are published free at nerc.com. You should read the ones that apply to you, and the toolkit cites requirement identifiers throughout so you can follow along, but there is nothing to purchase.
Does this cover CIP-015 and internal network security monitoring? It covers readiness, and it labels it as readiness. CIP-015-1 is not enforceable until 1 October 2028. The toolkit gives you the internal traffic mapping, the visibility assessment and a phased implementation plan so you can start on the work with long lead times, and it states the enforcement date plainly rather than presenting the work as a current obligation.
What happens to the toolkit on 1 July 2028? Eleven of the thirteen standards are replaced that day. Section 16 carries a transition plan and a version register for exactly that. Updates are free for the life of the product, so you will receive the revised pack.
We only have low-impact assets. Is this over-specified for us? No — section 03 has a dedicated low-impact route covering CIP-002 and the CIP-003 Attachment 1 topics, written to be read on its own. You will use a fraction of the pack, which is the correct outcome, and the toolkit is explicit that adopting high and medium impact controls you do not need creates evidence obligations you will then be audited against.
Will this make us compliant? No toolkit can. Compliance is evidence covering your whole audit period, produced by controls you actually operate. The toolkit gives you the documented processes and the evidence structure — the evidence register ships pre-loaded with all 256 requirement identifiers so you can see immediately where you have evidence and where you do not.
Is it US-only? Yes. It is written for US-registered Responsible Entities. Canadian adoption of the CIP standards differs by province and Mexico differs again; those differences are out of scope and the toolkit says so.
What format are the files? Microsoft Word (.docx) and Microsoft Excel (.xlsx) — 90 Word documents and 40 Excel workbooks. Fully editable, no macros, no add-ins, no online account.
What do we get after purchase? Immediate download of the complete toolkit, free updates for the life of the product, and free email support.
Reviews
There are no reviews yet