NERC CIP Crosswalk: How to Prove AI Compliance in Bulk Electric System Operations

1. Overview

This crosswalk maps 13 NERC CIP standards (CIP-002 through CIP-014) plus 4 reliability standards (BAL-001, BAL-005, TOP-001, MOD-031, FAC-001) to existing SWT3 witness procedures. The mapping covers 45 procedure-to-requirement relationships across two categories:

• Cyber security controls (CIP-002 through CIP-014): Mapped to AI governance procedures (AI-SAFE, AI-GOV, AI-DRIFT, AI-INCIDENT, AI-SUPPLY, etc.) that produce witness anchors for AI system behavior in BES environments.
• Reliability standards (BAL, TOP, MOD, FAC): Mapped to demand response procedures (ADR namespace) that witness grid signal correlation, curtailment verification, settlement accuracy, and voltage regulation.

SWT3 does not replace NERC CIP compliance programs. It adds a cryptographic evidence layer that proves AI systems operating within BES environments are governed, monitored, and auditable. Every witness anchor is independently verifiable and survives the full NERC audit retention period.

2. The AI-in-Grid Landscape

AI systems are entering grid operations across multiple domains:

Load Forecasting and Demand Response

Machine learning models predict electricity demand 1-72 hours ahead, enabling utilities and ISOs to optimize generation dispatch and activate demand response resources. FERC Order 2222 (effective 2023) opened wholesale markets to distributed energy resource aggregations, accelerating AI adoption for DER coordination.

Autonomous Voltage Regulation

Smart inverters and AI-controlled tap changers make sub-second voltage regulation decisions. IEEE 1547-2018 governs DER interconnection, but NERC has no specific AI provisions. The new ADR-VOLT.1 procedure witnesses autonomous voltage regulation actions with factor-level detail: deviation percentage, response type (tap change, capacitor bank, STATCOM, inverter droop), and response latency.

Frequency Response

Battery storage and fast-responding DERs increasingly provide primary frequency response under NERC BAL-001. AI systems decide when and how much to inject or absorb. ADR-GRID.1 witnesses grid signal correlation with signal type, response latency, and compliance ratio.

Cybersecurity Monitoring

AI-based intrusion detection and anomaly detection are deployed inside Electronic Security Perimeters (ESPs). CIP-005 and CIP-007 require logging and monitoring, but say nothing about the AI models making detection decisions. SWT3 witnesses these AI systems through AI-SEC.1, AI-LOG.1, and AI-DRIFT.1.

3. CIP-to-Procedure Matrix

Complete mapping of all 45 crosswalk relationships. CIP standards with multiple requirements map to multiple procedures.

4. CIP-002: BES Cyber System Categorization

CIP-002 requires entities to identify and categorize their BES Cyber Systems as high, medium, or low impact based on potential reliability impact. When AI systems participate in BES operations, they become part of the Cyber System categorization scope.

5. CIP-003: Security Management Controls

CIP-003 requires documented cyber security policies and a designated senior manager. For AI systems, this extends to governance policies covering model deployment, transparency, and fairness in grid decisions.

6. CIP-004: Personnel and Training

CIP-004 governs personnel risk assessment, training, and access management. For AI systems, this includes oversight of who trains, deploys, and monitors AI models with BES access.

7. CIP-005: Electronic Security Perimeter

CIP-005 defines the electronic boundary around BES Cyber Systems. AI systems operating inside or across ESPs must be monitored at boundary crossings.

8. CIP-007: System Security Management

CIP-007 covers ports, patching, malware prevention, monitoring, and access control. Five requirements map to five SWT3 procedures.

9. CIP-008: Incident Reporting and Response

10. CIP-009: Recovery Plans

11. CIP-010: Configuration Change Management

CIP-010 is where AI governance meets CIP most directly. AI model updates are configuration changes. Drift detection is configuration monitoring. Vulnerability assessments apply to AI models.

12. CIP-011: Information Protection

13. CIP-012: Control Center Communications

14. CIP-013: Supply Chain Risk Management

15. Reliability Standards (BAL, TOP, MOD, FAC)

Beyond the CIP cyber security standards, NERC reliability standards govern the physics of the grid. AI systems participating in frequency response, load management, and settlement need witness evidence too.

16. Demand Response Procedures (ADR Namespace)

The ADR namespace contains 7 procedures purpose-built for energy sector witnessing. Each produces a SWT3 anchor with factor-level detail matching the physical quantities grid operators measure.

17. Energy Grid Profile

SWT3 ships with a pre-built energy-grid profile that bundles all 7 ADR procedures plus 10 NERC CIP-mapped AI procedures into a single configuration.

$ swt3 init --profile energy-grid

# Or with full expansion:
$ swt3 init --profile energy-grid --expand

The profile sets clearing level 2 (Sensitive), requires agent identity and signing, and configures 30-minute trust mesh freshness windows aligned with grid operational cycles. It includes:

• ADR-BASE.1 through ADR-VOLT.1 (7 procedures) -- demand response lifecycle
• AI-SAFE.1, AI-GOV.1, AI-DRIFT.1/2, AI-EMRG.1, AI-INCIDENT.1, AI-CHAIN.1, AI-SUPPLY.1, AI-HITL.1 (10 procedures) -- NERC CIP AI governance

18. Quick Start

Python

from swt3_ai import Witness

witness = Witness(
    agent_id="grid-optimizer-v2",
    signing_key="your-signing-key",
    clearing_level=2  # Sensitive (grid reliability data)
)

# Wrap your AI client
client = witness.wrap(openai_client)

# Witness a voltage regulation decision
witness.record_raw("ADR-VOLT.1",
    factor_a=250,   # 2.50% deviation
    factor_b=1,     # Tap change
    factor_c=150    # 150ms response
)

# Witness a demand response event
witness.record_raw("ADR-EVENT.1",
    factor_a=2,     # Curtailment start
    factor_b=5000   # 5000 kW committed
)

# Flush to clearing house
witness.flush()

TypeScript

import { Witness } from '@tenova/swt3-ai';

const witness = new Witness({
  agentId: 'grid-optimizer-v2',
  signingKey: process.env.SWT3_SIGNING_KEY,
  clearingLevel: 2
});

// Witness voltage regulation
witness.recordRaw('ADR-VOLT.1', {
  factorA: 250,   // 2.50% deviation
  factorB: 1,     // Tap change
  factorC: 150    // 150ms response
});

await witness.flush();

19. References

• NERC Reliability Standards Library
• NERC CIP Standards (CIP-002 through CIP-014)
• FERC Order 2222 -- Participation of Distributed Energy Resources in Wholesale Markets
• IEEE 1547-2018 -- Standard for Interconnection of Distributed Energy Resources
• SWT3 Protocol Specification v2.0.0
• SWT3 Demand Response Guide (ADR Namespace)
• CISA AI-in-OT Crosswalk -- complementary guide for OT environments
• UCT Registry -- full procedure catalog (277 procedures, 80 frameworks)