NERC CIP Evidence Collection, Gap Registers and Audit Packaging
Audit Ready NERC CIP Evidence, Indexed by Requirement
A Regional Entity audit does not ask whether your controls exist; it asks for the record proving each one operated across the review period, and that record is scattered through firewall exports, account inventories, patch tickets and exercise reports. GDF collects it requirement by requirement, tests it against the standard version that applied, and logs every gap with an owner and a date. Each exhibit carries its source system, collection date and hash, so your compliance team can walk an auditor from the question to the proof in one step.
The engagement
Every Requirement in Scope Tied to Its Record
We work for utilities and the service providers who support them, inside the scope the Registered Entity sets: its registration, NERC functions, BES Cyber System categorization, requirement versions, implementation dates and review period. Within that boundary we gather, test and organize the records, so the people who attest to compliance and answer the auditor have a technical record they can stand behind.
Evidence Map
Each requirement identifier linked to its version, review period, control owner, covered population, source system and collection method.
Exception Register
Every thin, missing or mismatched record logged with a corrective owner, a target date and the retest that will close it.
Readiness Memoranda
Preparation for future implementation dates, filed apart from current evidence so no reviewer confuses the two.
The Right Version for the Right Review Period
We map each artifact to the official standard, requirement version and implementation phase it supports, working from the NERC CIP reliability standards register, so a reviewer sees the context before the exhibit. Two current changes make that discipline urgent. FERC approved NERC CIP-015-2 in August 2026, extending internal network security monitoring to the access control, monitoring and physical access control systems outside the Electronic Security Perimeter. FERC Order No. 919 approved the virtualization versions of CIP-002 through CIP-013, which take effect on April 1, 2028, with earlier adoption permitted.
Evidence for a requirement in effect today is filed apart from preparation for a date that has not arrived, because a reviewer who finds the two mixed stops trusting both. If an implementation date is close and the material is still tangled, call (800) 868-8189 and we will separate it before the package is built.
Seven Evidence Areas We Assemble
BES asset reconciliation
BES Cyber Asset and BES Cyber System inventories reconciled against network records, configuration exports, engineering files and change history, with each categorization decision and its basis written down.
Electronic Security Perimeter
Firewall rules, vendor and remote access, jump hosts, dial up, cellular and approval workflows, with every dated exception and compensating control linked to the path it governs.
Identity, privilege and termination
Account inventories, privileges, termination workflows, shared account justifications and periodic access reviews, with sampling notes that name the population actually examined.
Vulnerability, patch and configuration
Scan coverage, patch records, testing, baselines, approvals and exceptions connected end to end, with excluded assets and untested controls left in plain view.
Incident, backup, recovery and exercises
Response records, backup tests, recovery exercise participation and corrective actions reconciled with the dates in scope, tying the written procedure to the work people performed.
Physical and information protection
Where in scope, physical access, monitoring, information handling and awareness records gathered against the version that applied during the period.
Packaging for review
Evidence organized by requirement and subordinate requirement, each item stamped with source system, collection date, operator and hash.
Methodology
Scope, Collect, Hash and Index the Record
-
01 / Scope: Requirements and Sources
We start from the Registered Entity's categorization, review period, requirement versions and Regional Entity, then name the source systems and the owners whose records the collection depends on.
-
02 / Collection: Records With Provenance
Configurations, tickets, logs, identity and process records are collected with their source, date, operator, hash and exceptions, preserving exactly how each item was obtained.
-
03 / Reconciliation: Gaps Into the Register
Sampled evidence is tested against the requirement text and corroborating sources, and every gap gets an owner, a correction plan and a retest date.
-
04 / Packaging: Indexed for Review
The package is indexed by requirement and source system, and any future date material is labeled as readiness so it never passes for current evidence.
Evidence Handled by Forensic Examiners
Hashing, provenance and chain of custody are routine in a forensic practice like GDF, which has operated since 1992 and whose examiners have testified in federal and state courts. A CIP package built the same way survives the question every auditor eventually asks: where did this come from, and how do you know it has not changed? Read the examiner biographies.
Call (800) 868-8189 or request a free consultation to plan this work around your operation.
Free scoping pack
Download the NERC CIP Scoping Pack
The scoping pack lays out the categorization, remote access records, evidence owners and validation safeguards to settle before collection begins, and the worksheet captures systems, owners and permissions in a form your team can edit. Bring both to the first call and the evidence work can be sized against your actual requirement list.
NERC CIP Scoping Pack
Categorization, evidence ownership and remote access records for a CIP engagement.
Format: PDF.
Power Planning Pack and Preparation Worksheet
Facility, system and ownership facts, plus an editable worksheet for owners, boundaries and permissions.
Format: fillable PDF and CSV.
Download the Power and Energy Planning Pack (PDF)
The power and energy assessment preparation guide, the OT and utility audit preparation guide and the full library of preparation packages cover the wider audit records. Where the evidence work sits inside a broader program, our critical infrastructure and OT security practice supports utilities beyond the review period.
Frequently asked
Deliverables, Future Versions and Mid Period Starts
What does GDF deliver, and what does our compliance team keep?
We deliver the technical record: the evidence map, the requirement packages, the exception register and the review index. Your compliance team uses that record in its own applicability decisions, attestation and submission, with every item traceable to its source.
How do you treat work for a future standard version?
It is labeled as readiness and filed in its own memoranda, apart from evidence for requirements currently in effect, so the period and purpose of every item are obvious to the reviewer who opens it.
How are OT constraints handled during collection?
Active collection proceeds only under authority the operator designates, with approved process conditions, stop points and recovery steps. Where an active method would add risk we rely on passive and configuration evidence, and every inaccessible source is recorded.
Can you start partway through a review period?
Yes. We map what already exists for the period, register the gaps with owners and dates, and set up collection so the remainder of the period produces records in the form the package needs.
Talk with an examiner
Index the Evidence Before the Audit Notice Arrives
On the first call a senior examiner reviews your categorization, the requirements in scope and the audit date, then lays out the source systems to collect from, the likely gaps, the schedule and the price. The consultation is free.
Global Digital Forensics has served clients since 1992, and the hotline is answered 24/7.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .