NERC CIP-002-8 Implications

NERC CIP-002-8 introduces a new Control Center classification for certain BES assets. Effective July 1, 2028, Transmission Owners must evaluate whether they have the capability to control transmission Facilities at two or more locations in real time using Supervisory Control and Data Acquisition (SCADA), including associated data centers and excluding field Cyber Assets used for telemetry. Entities that meet this scenario may need to classify the applicable capability as a Transmission Owner Control Center (TOCC).

Registered Entities with a TOCC must evaluate both medium and high impact criteria. This can significantly affect compliance obligations, as Control Centers and associated data centers meeting medium or high impact criteria may become subject to the full suite of CIP Reliability Standards. Existing controls then need evaluation for any gaps and subsequent efforts to meet compliance.

CIP-002-8 is effective July 1, 2028, subject to the caveats in the Implementation Plan. The periodicity of CIP-002 Requirement R2 remains in place, with initial performance required within 15 calendar months of the last performance of Requirement R2 under the version of CIP-002 that was immediately effective before CIP-002-8. The Implementation Plan also defines Planned and Unplanned Changes and includes phase-in provisions for Registered Entities that identify BES Cyber Systems with higher impact ratings under CIP-002-8 Criterion 2.12.

Organizations are encouraged to begin evaluating whether they have the capability to control transmission Facilities at two or more locations and if the TOCC scenario applies. If a TOCC is identified, the next step is to evaluate the aggregate weighted value outlined in CIP-002-8 Attachment 1, Criteria 1.3 and 2.12.

1.3. For Transmission Operators and Transmission Owners, each Control Center or backup Control Center for one or more of the assets that meet criterion 2.2, 2.4, 2.5, 2.7, 2.8, 2.9, or 2.10.

2.12. For Transmission Operators and Transmission Owners, each Control Center or backup Control Center with an “aggregate weighted value” exceeding 6000 according to the table below and subject to the listed exclusion. The “aggregate weighted value” for a Control Center or backup Control Center is determined by summing the “weight value per BES Transmission Line,” shown in the table below, for lines that are monitored and controlled by the Control Center or backup Control Center. Include each BES Transmission Line that is connected between two or more Transmission stations or substations.

Entities should verify applicability, implementation timelines, and terminology against the approved CIP-002-8 standard, the associated Implementation Plan, and any applicable NERC or Regional Entity guidance before making compliance decisions.

Contact Arcova if you’d like to discuss how CIP-002-8 may impact your environment or evaluate potential TOCC applicability. There are also a significant number of resources found within Project 2016-02 Modifications to CIP Standards and Project 2021​-03 CIP-002.