NERC CIP Virtualization: Your Questions Answered

Key Takeaways

• NERC is modernizing CIP standards for virtualized environments. Project 2016-02 updates 11 CIP standards and introduces new terminology to better address virtualization and Shared Cyber Infrastructure (SCI).
• Virtualization is not required. The revised standards provide flexibility for organizations that use virtualized technologies, but traditional Electronic Security Perimeter (ESP) architectures remain fully acceptable.
• Start preparing now. With a compliance deadline of July 1, 2028, Responsible Entities should review the revised standards, identify Virtual Cyber Assets and SCI, perform gap analyses, and evaluate impacts to standards such as CIP-005-8 and CIP-010-5.

Are You Ready for the NERC CIP Virtualization Updates?

Virtualization is becoming more common across utility environments, and NERC's latest CIP revisions are designed to address that reality. But the updates have also raised a lot of questions. Does virtualization become mandatory? Do organizations need to redesign their security architectures? Which standards require the most attention?

To help separate fact from fiction, we've compiled answers to some of the most common questions about NERC Project 2016-02 and what it means for Responsible Entities. The expert brief explains that Project 2016-02 updates 11 existing CIP Reliability Standards, introduces four new glossary terms, and modifies 18 existing glossary definitions to better address virtualization, Shared Cyber Infrastructure (SCI), and modern cybersecurity approaches.

What is NERC Project 2016-02?

NERC Project 2016-02 updates 11 CIP Reliability Standards, adds four new glossary terms, and modifies 18 existing glossary definitions to help the standards better account for virtualized environments, SCI, and modern cybersecurity architectures. The revisions were developed because the existing standards were written primarily around physical Cyber Assets and traditional Electronic Security Perimeter, or ESP, architectures. As virtualization became more widely adopted, utilities encountered questions and inconsistent interpretations around shared infrastructure. The revised standards aim to address those challenges while maintaining the core reliability and cybersecurity objectives of the CIP program.

Does NERC now require utilities to virtualize?

No.

This is one of the most common misconceptions about the project. The revised standards do not require organizations to virtualize their environments, redesign their security architectures, or replace existing compliance programs. Traditional ESP architectures remain acceptable, and the underlying reliability and cybersecurity objectives of the CIP standards have not changed.

The purpose of the revisions is to accommodate virtualized environments when organizations choose to use them, not to force a technology migration.

Why did NERC revise the standards?

As utilities adopted virtualization technologies, compliance teams often struggled to apply standards that were originally written around physical Cyber Assets. Shared infrastructure, virtual machines, containerized environments, and other modern technologies created situations that were not always clearly addressed in the existing framework. Project 2016-02 updates the standards to provide additional clarity for virtualization environments while remaining compatible with traditional security approaches.

What new terms should compliance teams understand?

The revisions introduce four important glossary terms that help explain how the standards apply to virtual environments.

What is a Shared Cyber Infrastructure?

Shared Cyber Infrastructure, or SCI, refers to the underlying infrastructure that supports virtual environments. This infrastructure includes environments where computing, memory, storage, or other resources are shared among multiple systems or applications.

What is a Virtual Cyber Asset?

A Virtual Cyber Asset, or VCA, is a logical instance of an operating system or firmware currently executing on a virtual machine. VCAs do not include dormant file-based images or the SCI or Cyber Assets that host them.

What is a Cyber System?

A Cyber System is one or more Cyber Assets, Virtual Cyber Assets, or Shared Cyber Infrastructure. The term is intended to provide a broader framework for addressing modern architectures.

What is a Management Interface?

A Management Interface is an administrative interface used to initialize, deploy, or configure SCI, provide independent console access, or configure an Electronic Access Point (EAP). As organizations adopt more virtualized technologies, these interfaces become increasingly important from both operational and security perspectives.

Note: These explanations are intended as a practical summary. Organizations should consult the current NERC Glossary of Terms for official definitions and applicable provisions.

Which standards deserve the closest attention?

Not all 11 revised standards will require the same level of effort. Many updates are primarily terminology or conforming changes. However, several standards introduce more significant technical and operational considerations.

Based HSI’s preliminary assessment, compliance teams should pay particular attention to:

• CIP-005-8
• CIP-010-5
• CIP-007-7.1
• CIP-002-7

These standards introduce changes related to logical isolation, dynamic configuration management, virtualization-specific security controls, and categorization of Virtual Cyber Assets and SCI.

Why is CIP-005-8 getting so much attention?

CIP-005-8 still uses Electric Security Perimeters, or ESPs, but it also introduces logical isolation as another way to meet applicable security requirements. Organizations can use logical isolation alongside, or in some cases instead of, traditional perimeter-based approaches. However, this does not make existing ESP architectures obsolete. Traditional perimeter-based architectures remain acceptable under the revised standards.

For many organizations, this update may require a review of current security architectures, remote access practices, and supporting documentation to determine whether changes are needed.

What changes with CIP-010-5?

CIP-010-5 focuses on configuration management in dynamic virtualized environments.

Organizations should evaluate whether their configuration baselines, change management processes, monitoring activities, and vulnerability assessments adequately address virtual environments and applicable Shared Cyber Infrastructure. Virtual machines, containers, and other dynamic technologies can create challenges that traditional processes may not fully address.

What about Low Impact entities?

Low Impact entities should not assume these revisions have no impact.

CIP-002-7 and CIP-003-10 are standards that Low Impact entities should review. The updates may affect identification and categorization activities, terminology, security management controls, and supporting documentation.

Low Impact entities should also track CIP-003-11, which adds further Low Impact electronic access controls to the CIP-003-10 virtualization changes.

When do organizations need to comply?

The mandatory compliance date for the revised standards is July 1, 2028. Early adoption is permitted.

While 2028 may seem distant, compliance teams should begin evaluating the impact now, especially if they have virtualized environments, SCI, or plans to modernize their cybersecurity architecture.

What should organizations do now?

A practical starting point includes five activities:

• Reviewing the revised standards and glossary definitions
• Identifying Virtual Cyber Assets and SCI
• Performing a gap analysis
• Updating documentation and technical controls
• Validating implementation plans against the revised requirements. Organizations should also coordinate with their Regional Entity when questions arise regarding timing, implementation considerations, or early adoption.

The goal is not to overhaul existing compliance programs overnight. Instead, organizations should take a structured approach that helps them understand where the revisions apply, prioritize resources, and prepare for the compliance deadline.

How can HSI help?

Navigating regulatory change is often easier when compliance, operations, and cybersecurity teams have experienced guidance.

HSI's compliance team can help organizations determine how the revised standards apply and what actions may be necessary. Services include readiness assessments, gap analyses, implementation planning, documentation support, training, mock audits, compliance reviews, and assistance with RSAWs and evidence packages.

Final takeaway

The biggest takeaway from Project 2016-02 is NERC is modernizing the CIP standards to better accommodate virtualization and shared infrastructure. The revisions provide additional flexibility and clarity, but they do not require organizations to virtualize, abandon traditional ESP architectures, or replace existing compliance programs. Instead, they give Responsible Entities a clearer framework for addressing today's technology environments while maintaining the reliability and cybersecurity objectives that have always been at the heart of the CIP standards.