Which NERC standards does BizNerva cover?

BizNerva covers NERC CIP-002 through CIP-015, Operations and Planning standards across the BAL, EOP, FAC, IRO, MOD, PRC and TOP families, and the Inverter-Based Resource standards introduced under FERC Order 901 and Order 909. CIP is tracked at the individual requirement and part; IBR is tracked at the requirement level. For O&P, the periodic generator standards PRC-019, PRC-024 and MOD-025 are tracked at the individual requirement, while the remaining standards are tracked per standard, all with owners, linked evidence and review dates.

Does BizNerva cover NERC O&P standards or only CIP?

Both. Operations and Planning standards are tracked alongside CIP in the same evidence vault, task list and audit binder, so a registered entity does not run its O&P program in a separate spreadsheet. CIP is decomposed to requirement and part level today. For O&P, the periodic generator standards PRC-019, PRC-024 and MOD-025 are decomposed to their individual requirements, while the remaining standards are tracked per standard, with further requirement-level breakout in development. PRC-005 maintenance is scheduled per component through the protection-system component register, whose maximum-interval dates drive review tasks on the same calendar as CIP.

How does BizNerva decide which NERC standards apply to us?

Applicability is derived from the functions the entity is registered for, covering Generator Owner, Generator Operator, Transmission Owner, Transmission Operator, Balancing Authority, Reliability Coordinator and Distribution Provider. CIP applicability is driven separately by BES Cyber System categorization, so a change to categorization re-flags the requirements it affects for review.

Does BizNerva do NERC GADS reporting?

No. BizNerva does not produce GADS performance or availability submissions, and it does not connect to plant historian, PI or SCADA systems. It is a compliance evidence and audit-readiness system of record for CIP, O&P and IBR obligations. Generator Owners with a GADS reporting obligation need a separate GADS tool.

How does BizNerva handle CIP-015 and INSM?

Internal Network Security Monitoring evidence is tracked against CIP-015. FERC Order 887 directed NERC to develop INSM requirements, and FERC approved Reliability Standard CIP-015-1 in Order 907. BizNerva tracks the evidence and review records for the standard; it is not itself a network monitoring or OT security tool.

Can a consultant or advisory firm manage several registered entities?

Yes. Every NERC surface has a partner view, so a Fractional Compliance Officer or NERC consultant can run multiple client programs from one login, with personally identifiable information redacted on partner reads.

What does BizNerva not replace?

BizNerva does not replace legal counsel, real-time system operations and dispatch, GADS performance and availability reporting, engineering studies, OT security tooling, or managed security operations. It is the system of record for compliance obligations, evidence and audit preparation.

Solution

NERC compliance for utilities, co-ops and IBR operators

CIP cybersecurity, Operations and Planning reliability, and Inverter-Based Resource obligations on one platform, scoped to the functions you are registered for. Evidence linked to the standard it satisfies, owners and gaps tracked, and binder-ready when the regulator calls.

What changes for you

The evidence is ready before the audit is

Audit readiness stops being a scramble and becomes a state you can see at any point in the cycle.

Walk into your next audit with the binder built

Every applicable standard carries its evidence, owner, and dates linked back to the requirement, exportable on demand instead of assembled the week before.

Catch stale evidence before an auditor does

Freshness tracking flags records that have aged out, so a stale review is surfaced early rather than found at the audit table.

See a CIP-002 change ripple through

When BES Cyber System categorization changes, the requirements it touches are re-flagged for review instead of quietly going out of date.

Keep pace as IBR standards land

Order 901 and Order 909 obligations are tracked with their effective dates, so an obligation set rolling out through 2031 stays on your radar.

The problem

NERC compliance is an evidence problem before it is an audit problem

Teams need to know which requirements apply, who owns each control, which evidence satisfies each requirement, when records go stale, and whether audit packages are ready before the next review. BizNerva is the structured system of record that holds all of that in one place.

CIP standards cascade. CIP-002 critical-asset identification drives every other CIP requirement, and one change ripples through your evidence.
Audit cycles demand a full evidence binder per applicable standard, with owners, dates, and a clean chain back to the requirement.
IBR reliability standards under FERC Order 901 and Order 909 are rolling out with effective dates from 2026 to 2031, so the obligation set keeps changing.
A stale review record is a finding waiting to happen. Evidence freshness matters more than evidence existence.

Operational depth

How BizNerva supports NERC compliance teams

Map requirements to owners and evidence
Track evidence by CIP standard and requirement
Monitor missing, stale, or insufficient evidence
Assign recurring compliance tasks
Maintain audit-ready binders
Prepare for internal reviews and external audits
Manage IBR reliability obligations as standards evolve
Give consultants and auditors structured access to the compliance record

Modules

What is included

NERC CIP coverage

CIP-002 through CIP-015 evidence tracking, including critical-asset identification, security management controls, personnel and training, electronic and physical security, incident reporting, recovery plans, supply-chain risk management, and Internal Network Security Monitoring (INSM). Tracked at requirement and part level.

IBR Reliability (FERC Order 901 + 909)

Inverter-Based Resource compliance for solar, wind, and battery-storage operators. Track registration, performance, modeling, ride-through (PRC-029), event mitigation (PRC-030), and data-sharing obligations as standards roll out through 2026 and beyond.

Operations & Planning (O&P)

Reliability standards across the BAL, EOP, FAC, IRO, MOD, PRC and TOP families, scoped automatically to the functions you are registered for. PRC-019, PRC-024 and MOD-025 are tracked at the individual requirement, the rest per standard, all with owners, evidence and review dates, alongside your CIP and IBR obligations rather than in a separate spreadsheet.

PRC-005 protection system component register

Register each Protection System component with its maximum maintenance interval. The interval drives the next maintenance-due date and review tasks on the same calendar as CIP cycles, so PRC-005 is scheduled per component rather than as one generic requirement. Bulk-load the register (and personnel rosters) from a spreadsheet with a saved column mapping.

CIP-004 & CIP-007 automation

A termination in a connected HRIS opens the CIP-004-7 R5.1 24-hour access-revocation clock automatically and produces the dated record. Register your patch sources once; the watch reminds you when each is due for a check on its cadence and runs the CIP-007-6 R2 35-day evaluation and action clocks once you open a cycle.

Audit-readiness scoring

Per-standard readiness score that surfaces gaps before your next NERC audit. Evidence stays linked to the specific CIP or IBR requirement it satisfies.

Coverage

CIP requirement to BizNerva workflow

Every CIP standard maps to a structured evidence workflow. IBR standards under FERC Order 901 and Order 909 follow the same pattern.

CIP standard	Example BizNerva workflow
CIP-002	BES Cyber System identification evidence and periodic review tracking
CIP-003	Security management controls, policy evidence, and approval records
CIP-004	Personnel risk assessment, training, and access authorization evidence
CIP-005	Electronic security perimeter records and access evidence
CIP-006	Physical security plan evidence and access logs
CIP-007	System security management tasks and evidence
CIP-008	Incident response plan, testing, and incident evidence
CIP-009	Recovery plan evidence and testing records
CIP-010	Configuration / change evidence and vulnerability assessment tracking
CIP-011	Information protection evidence
CIP-012	Control Center communications evidence and review records
CIP-013	Supply-chain risk management records
CIP-014	Physical security risk assessment and review evidence
CIP-015	Internal Network Security Monitoring (INSM) evidence. Directed by FERC Order 887, approved as CIP-015-1 in FERC Order 907

Scoping

Start from what you are registered for

Tell us your registered functions and the applicable standard set is derived for you, so you are not scoping a 500-requirement universe by hand. CIP applicability is driven separately by your BES Cyber System categorization.

GO|Generator Owner

GOP|Generator Operator

TO|Transmission Owner

TOP|Transmission Operator

BA|Balancing Authority

RC|Reliability Coordinator

DP|Distribution Provider

Coverage

Operations & Planning standards

Your O&P obligations live beside CIP and IBR in the same evidence vault, task list and audit binder. PRC-019, PRC-024 and MOD-025 are tracked at the individual requirement; the rest per standard, all with owners, linked evidence and review dates. CIP is additionally broken out to the individual requirement and part; IBR to the individual requirement.

O&P standard	Example BizNerva workflow
PRC-005	Protection system maintenance evidence and review cycles
PRC-019	Generator voltage control and protection coordination records
PRC-024	Generator frequency and voltage protection setting (no-trip region) evidence
PRC-025	Generator relay loadability setting records
MOD-025	Real and reactive power capability verification records
MOD-026	Excitation control system model verification records
MOD-027	Turbine, governor and active power control verification records
EOP-004	Event reporting obligations and submitted-report evidence
EOP-005	System restoration and blackstart plan evidence and testing
EOP-006	System restoration coordination plan evidence
EOP-008	Loss of control center functionality plan evidence and testing
FAC-001 / FAC-002	Interconnection requirement and study documentation
TOP-001 / TOP-002 / TOP-003	Operating procedure, planning and data specification evidence
IRO-001, 002, 008, 010, 014, 017	Reliability coordination procedure, data and outage coordination evidence
BAL-001 / BAL-002 / BAL-003 / BAL-005	Balancing performance procedure and reporting evidence

In development

What we are building next

These are not available yet. They are listed so you can judge the direction before you commit, and so early customers can shape the order we build them in.

Requirement-level breakout of the periodic O&P standards

PRC-019, PRC-024 and MOD-025 are already decomposed to their individual requirements. The remaining periodic standards — MOD-026, MOD-027 and the EOP-005/006/008 plan-testing standards — are being broken out to the same requirement-by-requirement level, so all of O&P is tracked the way CIP is today.

Automatic patch-feed ingestion for the CIP-007 evaluation cycle

Pull newly published patches from a registered vendor advisory feed and open the CIP-007-6 R2 evaluation cycle automatically. Today the patch-source register tracks your sources, reminds you when each is due for a check on its cadence, and runs the 35-day evaluation and action clocks once you open a cycle.

Trust posture

Built for conservative compliance environments

BizNerva is designed for evidence management, workflow control, audit preparation, and advisor collaboration. AI assistance supports review and gap detection. The core system of record stays structured, permissioned, evidence-linked, and exportable.

Audience

Who this is for

Best fit for

Registered utilities managing NERC CIP evidence
Co-ops and smaller registered entities without large compliance teams
Solar, wind, and battery operators preparing for IBR reliability obligations
NERC consultants and advisory firms running client programs on one platform
Compliance teams that need structured evidence before the next audit cycle

Not a replacement for

Legal counsel
Real-time system operations and dispatch
GADS performance and availability reporting
Engineering studies
OT security tooling
Managed security operations

Platform

Built on the BizNerva platform

Evidence vault, task ownership, readiness scoring, gap detection, exportable audit binders, and partner access apply to CIP, O&P and IBR workflows where traceability, evidence freshness, and audit readiness matter most. See the full platform layer.

FAQ

NERC compliance questions we get asked

Which NERC standards does BizNerva cover?: BizNerva covers NERC CIP-002 through CIP-015, Operations and Planning standards across the BAL, EOP, FAC, IRO, MOD, PRC and TOP families, and the Inverter-Based Resource standards introduced under FERC Order 901 and Order 909. CIP is tracked at the individual requirement and part; IBR is tracked at the requirement level. For O&P, the periodic generator standards PRC-019, PRC-024 and MOD-025 are tracked at the individual requirement, while the remaining standards are tracked per standard, all with owners, linked evidence and review dates.
Does BizNerva cover NERC O&P standards or only CIP?: Both. Operations and Planning standards are tracked alongside CIP in the same evidence vault, task list and audit binder, so a registered entity does not run its O&P program in a separate spreadsheet. CIP is decomposed to requirement and part level today. For O&P, the periodic generator standards PRC-019, PRC-024 and MOD-025 are decomposed to their individual requirements, while the remaining standards are tracked per standard, with further requirement-level breakout in development. PRC-005 maintenance is scheduled per component through the protection-system component register, whose maximum-interval dates drive review tasks on the same calendar as CIP.
How does BizNerva decide which NERC standards apply to us?: Applicability is derived from the functions the entity is registered for, covering Generator Owner, Generator Operator, Transmission Owner, Transmission Operator, Balancing Authority, Reliability Coordinator and Distribution Provider. CIP applicability is driven separately by BES Cyber System categorization, so a change to categorization re-flags the requirements it affects for review.
Does BizNerva do NERC GADS reporting?: No. BizNerva does not produce GADS performance or availability submissions, and it does not connect to plant historian, PI or SCADA systems. It is a compliance evidence and audit-readiness system of record for CIP, O&P and IBR obligations. Generator Owners with a GADS reporting obligation need a separate GADS tool.
How does BizNerva handle CIP-015 and INSM?: Internal Network Security Monitoring evidence is tracked against CIP-015. FERC Order 887 directed NERC to develop INSM requirements, and FERC approved Reliability Standard CIP-015-1 in Order 907. BizNerva tracks the evidence and review records for the standard; it is not itself a network monitoring or OT security tool.
Can a consultant or advisory firm manage several registered entities?: Yes. Every NERC surface has a partner view, so a Fractional Compliance Officer or NERC consultant can run multiple client programs from one login, with personally identifiable information redacted on partner reads.
What does BizNerva not replace?: BizNerva does not replace legal counsel, real-time system operations and dispatch, GADS performance and availability reporting, engineering studies, OT security tooling, or managed security operations. It is the system of record for compliance obligations, evidence and audit preparation.