Don’t do SECURITY. Do business SECURELY.
Threat intelInsightsBook a consultation
Back to all insights

NERC CIP-013 supply chain standard takes effect

North American electricity utilities must now manage cyber security risk in their supply chains under NERC CIP-013-1.

The NERC CIP-013-1 supply chain risk management standard comes into force today for the North American bulk electric system, after a three-month deferral due to COVID-19.

Key points

  • Responsible entities must maintain supply chain cyber security risk management plans for high and medium impact systems.
  • Plans must cover vendor incident notification, coordination of responses and remote access controls.
  • Software integrity and authenticity must be verified before installation.
  • Companion changes to CIP-005 and CIP-010 also take effect.

UK suppliers of software, hardware and services to US and Canadian utilities should expect detailed security questionnaires and contract terms.

Source: FERC: order deferring the effective date of CIP-013-1 (PDF)

Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.

Get our weekly insights by emailA free weekly threat and vulnerability round-up with a link to our threat log spreadsheet, plus legal, regulatory, standards, and AI updates.
Subscribe free

How we can help: consulting, auditing, and AI governance. Book a complimentary consultation.

More insights