NERC Reliability Standard CIP-013-2 — Cyber Security — Supply Chain Risk Management, R1–R3

NERC CIP-013-2 supply chain risk management: vendor evidence

R1: Each Responsible Entity shall develop one or more documented supply chain cyber security risk management plan(s) for high and medium impact BES Cyber Systems … R2: implement the plan(s) … R3: review and obtain CIP Senior Manager approval at least once every 15 calendar months. source

Who it reaches

Registered entities with high and medium impact BES Cyber Systems — utilities, generators, transmission owners.

The record the rule expects

Dated public-record reads for each vendor under the plan: SAM, Consolidated Screening List, DoD 1260H, UFLPA, plus enforcement rows as printed (EPA ECHO, OSHA, PHMSA, NRC where applicable). The risk assessment and the plan are the entity's; the receipt is the evidence line the auditor can re-verify.

Questions readers ask

This page quotes the rule and describes the record; whether your organization meets the rule is your compliance office's and counsel's reading. All rules · Methodology.