The NERC CIP loophole between the loading dock and go-live

Not Air-Gap Tight series, part 2 of 2

A shipment of inverters, battery controllers and other grid equipment arrives at an integrator's shop. A technician unboxes the controllers, plugs in a laptop, loads firmware and settings, and tests everything on the bench. A few weeks later, the equipment goes live at a grid site.

Under NERC CIP, the North American Electric Reliability Corporation's Critical Infrastructure Protection standards, utility systems that support the grid are rated high, medium or low impact. If the systems at that site are rated low impact, none of that work fell under a CIP requirement. At medium and high impact, the utility's supply chain plan must weigh the risks of buying and installing vendor equipment, but no requirement sets controls for the bench itself.

Part 1 covered what NERC CIP expects once a contractor's laptop connects to utility equipment. This part follows the equipment before that moment, from the factory to go-live, and shows where malware could ride along.

Trusted USB drives and engineering workstations have already carried malware into control systems, and Reuters has reported undocumented communication devices in some imported inverters and batteries. The bench is the part contractors control, so they can secure it today, and utilities can require the same in their contracts.

What Colonial Pipeline teaches about gaps in the rules

It's easy to picture critical infrastructure as sealed off, with control systems walled away from the internet and from anyone who might tamper with them. We called this series Not Air-Gap Tight because that picture doesn't survive a close reading of the rules.

Security rules work like a contract: auditors check what the rules name, and what the rules leave out is left to each company's judgment.

Colonial Pipeline found out what one loose end can cost. In his Senate testimony, CEO Joseph Blount said the company believed the attackers got in through a legacy VPN profile that was "not intended to be in use." At the same hearing, he said the profile lacked multifactor authentication (Cybersecurity Dive).

To help keep the ransomware from spreading to its operational technology network, Colonial halted all pipeline operations on May 7, 2021. Fuel deliveries stopped across most of the East Coast and the southern U.S., and some gas stations ran out of fuel. The lines returned to service on the evening of May 12.

Before the attack, the Transportation Security Administration (TSA) had relied on pipeline operators' voluntary compliance with its security guidelines. About three weeks after the attack, TSA issued its first mandatory cybersecurity directive for pipelines, and a second followed in July (GAO, CRS).

Pipelines don't fall under NERC CIP, but the lesson carries over to the grid. When we read the CIP standards in force line by line, looking for a requirement that sets controls for the laptop a technician uses to configure new equipment, we didn't find one. That part of the job is left to each company's judgment.

What NERC CIP covers, by impact level

NERC CIP binds the registered entity that owns or operates the asset, such as a transmission owner or a generator owner, which we call the utility for short. How much it asks depends on the impact rating of each BES Cyber System. In this article, a low impact site means one whose BES Cyber Systems are all rated low impact.

A battery or solar site that is part of the Bulk Electric System, and below the 1,500 MW threshold, lands in the low impact column unless another criterion applies. Generation outside the Bulk Electric System falls outside NERC CIP altogether.

Five places where NERC CIP goes quiet

Each one comes straight from the text of the standards or from what the Federal Energy Regulatory Commission (FERC) has written, so you can check it yourself.

1. The laptop on the bench. In our review of the CIP standards in force, no requirement sets controls for a laptop used to configure equipment before it goes into service, at any impact level. The Transient Cyber Asset rules from Part 1 apply only once a laptop connects directly to a BES Cyber Asset or other in-scope equipment. At medium and high impact, the utility's supply chain plan must assess the risks of installing vendor equipment, which can take in this step, but the standard sets no controls for the laptop.
2. No supply chain plan at low impact. CIP-013-2 applies only to high and medium impact BES Cyber Systems, and in Order No. 912 FERC declined to extend its new supply chain directive to low impact assets. CIP-003-9 does require a process to manage vendor electronic remote access at low impact sites, but that covers remote access into a working site. No low impact requirement covers buying, shipping or configuring the equipment.
3. No required reassessment or testing before installation. FERC wrote that the supply chain standards "currently do not require a responsible entity to perform a reassessment of its equipment before installation." It also found that calls for mandatory testing of imported items exceeded the scope of its proposed directive. The only requirement to assess a new device for vulnerabilities before it enters production, an active vulnerability assessment under CIP-010-4 Part 3.3, applies only to high impact systems, and it exempts like replacements and CIP Exceptional Circumstances.
4. A laptop review that can happen on paper. For low impact systems, CIP-003-9 has the utility review a vendor laptop's protections, such as antivirus updates, application allowlisting or hardening, and decide whether more mitigation is needed before the laptop connects. Its examples of evidence include memoranda, email, policies or contracts from the vendor. Nothing in it requires scanning the laptop itself.
5. Vendor promises sit outside the audit. CIP-013-2 says "vendor performance and adherence to a contract" are beyond the scope of its implementation requirement. A utility needs a plan that asks vendors for the right things. Whether vendors deliver is not what the standard measures.

Any one of these is manageable on its own. Lined up, they leave a stretch of an asset's life that the rules barely touch.

Follow one battery from the factory to go-live

Pick one battery, inverter or converter and follow it from purchase to service. The rules show up late in its life. At a low impact site, they show up only once it is live.

At every impact level, the bench step has no specific requirement.

How malware could ride new equipment into a grid site

Here is the path an attacker could take. Each step opens with the short version, and the Under the hood paragraph after it is for security teams. The steps map to MITRE ATT&CK for ICS (version 20.1), the public catalog of techniques used against industrial control systems.

At a low impact site, steps 1 through 5 all happen before any CIP rule applies to the equipment. By the time the go-live controls switch on, the malicious code is already inside.

1. Tampered at the source

The equipment, its firmware or a part inside it is altered before it reaches the contractor (Supply Chain Compromise, T0862).

Under the hood: The targets that matter are the controllers. For battery sites, Idaho National Laboratory's threat hunting guide names the battery management system, which "protects cells by enforcing voltage, current, and temperature limits," and the power conversion system, which converts between DC and AC and manages grid-forming or grid-following modes. The same guide traces risks to third-party components, firmware inconsistencies and insecure default configurations.

A buyer sees the enclosure, the datasheet and the test results, not what sits on each circuit board. That is why the undocumented communication devices in the cases below were found by experts who strip equipment down. The Cybersecurity and Infrastructure Security Agency (CISA) published a hardware bill of materials framework for this problem: a consistent way for vendors to tell buyers what hardware is inside, so buyers can weigh the risk.

2. The bench laptop becomes the bridge

If the configuration laptop also handles email, downloads and hotel or airport Wi-Fi, it can be compromised there and carry the attacker onto every device it touches. MITRE tracks this technique as Transient Cyber Asset, T0864, named for devices that move between control networks and outside networks. NERC uses the same term, though its rules reach the laptop only once it connects to in-scope equipment.

Under the hood: The configuration laptop is the most trusted machine a controller will ever meet. Its vendor software exists to write firmware and settings, so the controller is designed to accept what it sends. An attacker on that laptop doesn't have to break into the controller. They use a connection the controller already trusts.

TRITON, in the cases below, reached its targets through an engineering workstation on the safety network. Some controllers add a physical safeguard: Triconex safety controllers can't be programmed while their key switch is set to RUN or REMOTE (CISA), and the FBI advises an alarm whenever that switch sits in PROGRAM. Ask whether the equipment you configure has anything similar, and who watches it.

3. Malicious code goes onto the controller

During setup, the laptop loads firmware, logic or project files onto the battery management or power conversion controller (Modify Firmware, T1693; Program Download, T0843; Project File Infection, T0873).

Under the hood: Setup also loads the settings that decide how the plant behaves when the grid is under stress, such as when to trip, how fast and how soon to come back. During the 2016 Blue Cut fire in California, nearly 1,200 MW of solar dropped offline. The trigger was a wildfire, not an attacker. NERC traced most of the loss to how the inverters were configured, including inverters set to trip in 10 milliseconds on a low-frequency reading that turned out to be wrong.

Stuxnet showed the attacker's version of the same idea. According to Symantec's analysis, it copied itself into the Siemens Step 7 projects engineers use to program controllers, modified the controller code and hid the changes. A hash or signature check catches a file changed after the vendor released it. It can't catch tampering at the source, which is why step 1 matters.

4. A USB drive spreads it further

Files moved by USB between bench machines and equipment can carry the same payload (Replication Through Removable Media, T0847).

Under the hood: Isolated networks still need files, so USB drives become the bridge, and the files they carry can be the ones that matter most. In one case reported by ICS-CERT, the Industrial Control Systems Cyber Emergency Response Team at the Department of Homeland Security (DHS), a power plant's USB drive "used routinely to back up control system configurations" carried sophisticated malware onto two engineering workstations critical to operations, and those workstations had no backups (POWER).

In the second case from the same report, described below, the infected drive arrived during a scheduled outage for equipment upgrades, the same window when new equipment gets installed. Stuxnet also spread through removable drives. Once equipment is in service at a low impact site, CIP-003-9 requires checking removable media for malicious code on a separate machine before it connects. On the bench, nothing does.

5. Installed without a second look

At a low impact site, no standard requires anyone to check the equipment's firmware or logic before it goes live. The controller enters service carrying whatever the bench loaded.

Under the hood: Commissioning tests prove the equipment does what it should. They aren't designed to find what else it does. A real second look compares the firmware version and hash with the vendor's published values, compares every setting with an approved baseline, and confirms the unit has no communication paths beyond the documented ones. In the standards, the closest thing is CIP-010-4's active vulnerability assessment before a new Cyber Asset enters production, and it applies only to high impact systems.

6. Activated in service

Once connected, the implant can sit quietly, call out over ordinary network traffic, or open a way in through a hidden radio that never passes through the utility's firewall (Commonly Used Port, T0885; External Remote Services, T0822).

Under the hood: An implant doesn't have to act right away. In February 2024, U.S. agencies and their allies warned that state-sponsored actors from the People's Republic of China, known as Volt Typhoon, were pre-positioning on critical infrastructure IT networks for disruptive or destructive attacks, in some cases holding access for at least five years.

A hidden radio also creates a compliance problem. CIP-003-9 requires low impact sites to permit only necessary routable communications between their BES Cyber Systems and anything outside the site. A radio nobody documented is a path those controls were never built for, and it can leave a site out of compliance without anyone knowing.

7. Impact

The attacker changes setpoints, trips converters or takes the equipment offline (Manipulation of Control, T0831; Device Restart/Shutdown, T0816; Loss of Availability, T0826).

Under the hood: A bench can prepare many units with the same firmware and settings, so one compromise can repeat across a fleet. Blue Cut showed what one setting does when it sits in many inverters at once. Idaho National Laboratory's consequence analysis for battery sites lists safety, local equipment damage and bulk grid damage among the possible repercussions.

Two incidents show how far firmware tampering can reach. In Ukraine in December 2015, attackers cut power to about 225,000 customers and loaded malicious firmware onto serial-to-Ethernet gateways at substations, so remote commands could not bring the substations back online (E-ISAC and SANS).

In February 2022, attackers who got in through a misconfigured VPN appliance overwrote key data in the flash memory of Viasat KA-SAT satellite modems, and tens of thousands dropped off the network (Viasat). Enercon lost remote monitoring and control of 5,800 wind turbines in central Europe, with 11 GW of capacity. The turbines kept running in automatic mode, but any fault meant sending a crew to the site (Euronews, DCD).

Steps 2 through 5 all run through something the contractor or the utility controls: the laptop, the files, the USB drive and the decision to go live. Those four are where to start.

Not hypothetical: two incidents and two field findings

None of this needs a new kind of attack. Each piece has already shown up in a real incident or a field finding.

• A technician's USB drive delayed a plant restart by about three weeks. In October 2012, a third-party technician loaded software updates from a USB drive during a scheduled outage at a power plant. The drive carried crimeware the technician didn't know about, and the infection affected about 10 computers on the turbine control network, according to DHS's ICS-CERT (POWER).
• Attackers reached safety controllers through the engineering side. In 2017, attackers moved through the IT and control networks of a Middle East petrochemical facility and installed the TRITON malware on its Triconex safety controllers, modifying their in-memory firmware. Bugs in the malware tripped the controllers into a safe state, and the investigation of that shutdown exposed the attack (FBI). Reaching those controllers required control of an engineering workstation on the safety network (Dark Reading).
• Undocumented communication devices turned up inside imported power electronics. In 2025, Reuters reported that U.S. experts who strip down grid-connected equipment found communication devices not listed in product documents in some Chinese-made solar inverters, and cellular radios in batteries from multiple Chinese suppliers. The report said such devices could allow firewalls to be circumvented remotely. Reuters also reported that in November 2024, inverters in the U.S. and elsewhere were disabled from China, according to three unnamed people, and that the U.S. government had not publicly acknowledged the discoveries (Reuters via Insurance Journal).
• Some battery systems are already visible from the internet. Dragos's 2026 year in review reported over 100 internet-exposed devices found in its research on battery energy storage systems, including power inverters of about 1 MW (CIO Influence summary of the Dragos report).

Three of these cases start with something people had every reason to trust: a technician's USB drive, an engineering workstation and equipment straight from the supplier.

What FERC and NERC are changing, and what they leave open

FERC has noticed part of this gap. In Order No. 912, issued September 18, 2025, it directed NERC to set a maximum time between a utility's initial risk assessment during procurement and the deployment of the equipment. If deployment comes later than that, the new standard should require an updated risk assessment first.

NERC's answer is still in progress. The first draft of CIP-013-4 (May 2026) would require a new risk assessment before deploying products, spare equipment and emergency repairs included, when the last assessment is more than 24 months old for high impact systems or 36 months old for medium impact systems. In the July 2026 initial ballot, the draft drew 30.64% approval (NERC bulletin), well short of the two-thirds weighted segment majority that NERC's standards process requires. FERC gave NERC 18 months to file, which puts the deadline in the first half of 2027.

Even if NERC adopts it along these lines, three gaps stay open:

• Low impact sites remain outside the supply chain standard. FERC declined to extend its directive to them, and the draft does not either.
• The new step is a risk assessment. Neither the order nor the draft requires testing the device itself.
• Neither one addresses the laptop used to configure equipment before it goes into service.

What contractors can do now, before any rule requires it

Pipeline operators got mandatory cybersecurity rules only after Colonial. You don't have to wait for the grid's version of that story. The bench sits in your own shop, so you can secure it there.

Start with what the utility will already ask of you:

1. Keep the laptop evidence packet from Part 1 current: endpoint protection, patch status, hardening and a named contact.
2. Ask each utility for its written requirements for vendor laptops, removable media and supply chain security before the job starts.
3. Read the security clauses in your contracts and purchase orders, including any documents they incorporate by reference. This is how utilities pass their supply chain obligations down to vendors, and the Edison Electric Institute publishes model contract language built for exactly that.

Then map each clause to the CIP-013-2 process it supports, so you know what you have promised:

• Telling the utility about security incidents on your side (Part 1.2.1)
• Coordinating your response with theirs (Part 1.2.2)
• Telling them when a person's remote or onsite access should end (Part 1.2.3)
• Disclosing known vulnerabilities in what you supply (Part 1.2.4)
• Letting them verify the integrity and authenticity of software and patches you provide (Part 1.2.5)
• Coordinating controls for remote access you start (Part 1.2.6)

Under NERC CIP these are the utility's obligations. Once they are written into your contract, you owe them to the utility as contract terms.

Finally, secure the bench itself, and assume nothing arrives clean until you have checked it:

• Use dedicated configuration laptops that are hardened, patched and never used for email or web browsing.
• Check firmware against the vendor's published hash or digital signature before loading it, and keep your own hashes of approved configuration and project files.
• Scan every USB drive on a separate machine before it touches the equipment.
• Record the firmware version and configuration loaded on each unit before it leaves the bench, and give that record to the utility.
• Tell the utility which equipment you configure off-site, so it can account for that step in its own risk reviews.

What utilities can require before the rules catch up

Utilities don't have to wait for CIP-013-4 either. Contracts can reach the bench today, at any impact level.

The Edison Electric Institute's model procurement contract language (Version 4.0, June 2026) already includes clauses for it. Among them:

• Before delivering products or connecting devices, the vendor documents its patch and vulnerability management programs.
• The vendor verifies and documents that products, including third-party hardware, software and firmware, have the appropriate updates and patches installed before they are supplied.
• The vendor publishes or provides a hash that meets the Federal Information Processing Standard, so the utility can verify software and patches.
• The vendor ships through trusted channels, with tamper-evident packaging for physical deliveries.
• A computer used for remote access does not connect to the internet or other third-party networks at the same time.

EEI built this language around CIP-013-2, which covers only medium and high impact systems. A utility can still use the same clauses for low impact sites, where no supply chain standard applies. It can also ask contractors for the bench controls above: dedicated configuration laptops, hash checks and a record of what was loaded on each unit.

How CyberBlip helps secure the bench

If your technicians are the ones unboxing controllers and loading firmware before a site goes live, that bench is where CyberBlip can help. We set up and maintain dedicated configuration laptops, keep endpoint protection and patching on a set schedule, build the evidence packet utilities ask for, and map the security clauses in your contracts to the controls behind them. Our compliance programs include NERC CIP.

If a utility has sent you a supply chain questionnaire or contract terms you are unsure about, we will walk through it with you. Request a free assessment, or reach us at [email protected] or 954-469-6970. Utilities writing these controls into vendor contracts can reach us the same way.

NERC CIP and new grid equipment: frequently asked questions

Does NERC CIP require testing new grid equipment before it is installed?

Not as a general rule. FERC has said the supply chain standards "currently do not require a responsible entity to perform a reassessment of its equipment before installation." High impact systems are the exception: CIP-010-4 requires an active vulnerability assessment before a new Cyber Asset enters production, apart from like replacements and CIP Exceptional Circumstances.

Does CIP-013 apply to low impact sites?

No. CIP-013-2 covers high and medium impact BES Cyber Systems only, and FERC declined to extend its 2025 supply chain directive to low impact assets. Low impact sites do have to manage vendor electronic remote access under CIP-003-9.

Is the laptop used to configure equipment covered by NERC CIP?

Not while the equipment is on the bench. The Transient Cyber Asset rules apply only once a laptop connects directly to a BES Cyber Asset or other in-scope equipment. At medium and high impact, the utility's supply chain plan must assess the risks of installing vendor equipment, but no requirement sets controls for the bench laptop.

What will CIP-013-4 change?

As drafted in May 2026, it would require a new risk assessment before deployment when the last one is more than 24 months old for high impact systems or 36 months old for medium impact systems. The draft did not pass its July 2026 initial ballot, and it still leaves low impact sites out.

The other gap: controls that exist on paper but not in the field

Part 1 and this part cover gaps on paper: what the rules ask for and what they leave out. The other gap is in practice. Field laptops that sit offline for months miss the updates frameworks treat as the minimum, whatever the reason. We cover that in our article on patching field laptops that can't stay connected.

This article is for planning and is not legal advice. Each utility's procedures and contracts govern what applies on its sites.

About CyberBlip

CyberBlip provides IT, cybersecurity and compliance support to organizations without mature internal IT teams, such as engineering firms, with a particular focus on critical infrastructure, including electric utilities.

Sources

All pages accessed November 10, 2026.

Standards and regulators

• NERC, Reliability Standard CIP-002-5.1a (PDF): Attachment 1, criteria 2.1 and section 3
• NERC, Reliability Standard CIP-003-9 (PDF): Applicability, Attachment 1 Sections 5 and 6, Attachment 2
• NERC, Reliability Standard CIP-010-4 (PDF): Parts 1.6 and 3.3
• NERC, Reliability Standard CIP-013-2 (PDF): Requirement R1, Parts 1.1 and 1.2, note to R2
• NERC, Draft 1 of CIP-013-4, May 2026 (PDF)
• NERC, Standards and Compliance Bulletin, July 27, 2026 (PDF): Project 2025-06 initial ballot
• NERC, Standard Processes Manual (PDF): Section 1.4, ballot approval threshold
• FERC, Order No. 912, Dockets RM24-4-000 and RM20-19-000, Federal Register, September 23, 2025 (PDF): P 12, P 27, P 32, P 64, P 69, P 83
• Edison Electric Institute, Model Procurement Contract Language Addressing Cybersecurity Supply Chain Risk, Version 4.0, June 2026 (PDF)
• MITRE, ATT&CK for ICS techniques, version 20.1: T0862, T0864, T1693, T0843, T0873, T0847, T0885, T0822, T0831, T0816 and T0826

Incidents and findings

• U.S. Senate Committee on Homeland Security and Governmental Affairs, Testimony of Joseph Blount, CEO of Colonial Pipeline, June 8, 2021 (PDF)
• Cybersecurity Dive, report on the Colonial Pipeline CEO's Senate testimony, June 9, 2021
• U.S. Government Accountability Office, GAO-21-105263, on TSA pipeline security, 2021
• Congressional Research Service, Insight IN12006 on pipeline cybersecurity directives, via EveryCRSReport
• POWER, DHS: USB drives spread malware in control system environment at two power plants, January 17, 2013
• FBI, Private Industry Notification on TRITON, March 24, 2022 (PDF)
• Dark Reading, Schneider Electric: TRITON/TRISIS attack used 0-day flaw in its safety controller system, and a RAT, January 18, 2018
• Reuters, Rogue communication devices found in Chinese solar power inverters, as republished by Insurance Journal, May 16, 2025
• CIO Influence, summary of the Dragos 2026 OT/ICS Cybersecurity Report, February 2026

Research, guidance and technical analyses

• Idaho National Laboratory, Threat Hunt Guide for BESS Environments, INL/RPT-25-89299, December 2025 (PDF)
• Idaho National Laboratory, BESS consequence analysis one-pager (PDF)
• CISA, A Hardware Bill of Materials Framework for Supply Chain Risk Management, September 2023 (PDF)
• NERC, 1,200 MW Fault Induced Solar Photovoltaic Resource Interruption Disturbance Report, June 2017 (PDF)
• CISA, NSA, FBI and partners, PRC state-sponsored actors compromise and maintain persistent access to U.S. critical infrastructure, February 2024, as published by the Australian Signals Directorate
• E-ISAC and SANS, Analysis of the Cyber Attack on the Ukrainian Power Grid, March 18, 2016 (PDF, National Security Archive copy)
• Viasat, KA-SAT network cyber attack overview, March 30, 2022
• Euronews, Reuters report on Enercon wind turbines after the satellite outage, February 28, 2022
• DatacenterDynamics, Satellite outage impacts more than 5,000 wind turbines across Europe, 2022
• Symantec, W32.Stuxnet Dossier, version 1.2, November 2010 (PDF, MIT course copy)
• CISA, MAR-17-352-01, HatMan: Safety System Targeted Malware (PDF)