NERC CIP Compliance for SoCal Energy Contractors: What Utilities and Their Vendors Need

Energy organizations and their vendors must protect systems that support essential services. NERC Critical Infrastructure Protection (CIP) standards and TSA pipeline security directives address different parts of that work. Their applicability depends on the entity, assets, and current requirements, so a supplier should not assume every utility contract makes it directly subject to every standard.

In brief: NERC CIP applies to specified registered entities and assets under each standard's applicability section. A vendor may have security duties through its contract or its customer's supply-chain program. TSA directives apply to designated pipeline owner/operators, who may impose relevant obligations on their service providers. Check the current standard or directive and the contract before making compliance commitments.

Who is responsible for NERC CIP?

NERC's reliability standards define their own applicable entities, facilities, systems, and requirements. A utility can require a vendor to document controls, support an audit, report incidents, or follow remote-access procedures without the vendor itself becoming a NERC-registered responsible entity. The applicable standard and the customer's contract determine what each party must do. Consult the NERC CIP standards and the regional entity for the current versions.

What does CIP-013 cover?

CIP-013-2 requires responsible entities to develop and implement supply-chain cyber risk management plans for specified high- and medium-impact systems and associated assets. Its procurement processes address issues such as vendor incident and vulnerability notifications, software integrity, and coordination of vendor remote access. The standard assigns duties to responsible entities; it does not turn a vendor's contract or performance into direct NERC obligations by itself.

How do patching and network controls fit?

Applicable CIP standards address electronic access, system security, patch management, incident response, and recovery. Requirements vary by asset category and version. For example, CIP-007's patch process distinguishes evaluating an applicable patch from applying it or creating a dated mitigation plan. Do not treat a 35-day interval as a universal deadline to install every patch. Confirm the current enforceable text and the asset's scope before setting a schedule.

Network segmentation, controlled remote access, logging, backups, and tested response procedures can reduce risk in operational technology environments. They should be designed around safety, availability, and the applicable system requirements. An IEC 62443 design can complement a CIP program, but using it does not automatically satisfy a particular CIP requirement.

What about TSA pipeline directives?

TSA's pipeline security directives apply to designated pipeline owner/operators and can change through renewal or replacement. For example, Pipeline-2021-02F stated that it expired on May 2, 2026. Do not use an older directive number as proof of the current obligations. Covered operators and vendors should confirm the current directive with TSA and the operator, then map contractual responsibilities to the work being performed. TSA's pipeline security guidance can also inform risk planning, but guidance and binding directives are different.

What should a vendor ask its utility customer?

1. Which facilities, systems, and information are in scope for the engagement?
2. What access, logging, incident reporting, vulnerability notification, and evidence obligations are in the contract?
3. Who approves remote access and removes it when personnel leave?
4. How will software integrity, patch decisions, and changes be documented?
5. Who owns incident response, recovery, and coordination with the regulator?

AdVran's network infrastructure and cybersecurity services can help design and document technical controls. The regulated operator and its compliance advisers determine the requirements that apply to its assets and vendors.

Related reading

• NERC CIP overview
• TSA pipeline security overview
• IEC 62443 overview