Critical Infrastructure Protection / CIIP
Critical infrastructure information protection is the broad practice of protecting digital systems, communications and dependencies that support essential services. Sector definitions and legal duties vary by jurisdiction.
A mature program combines asset/architecture visibility, identity/access, segmentation, secure remote access, vulnerability management, monitoring, incident response, safety/reliability engineering and supply-chain governance.
CIRCIA: Current Status
The U.S. Cyber Incident Reporting for Critical Infrastructure Act of 2022 establishes a federal reporting framework. The statute sets a 72-hour covered-cyber-incident timeframe and a 24-hour ransom-payment timeframe once implementing obligations apply.
As of October 14, 2026, CISA’s final implementing rule is still forthcoming. CISA continued 2026 town halls/refinement after the 2024 NPRM. Do not present proposed covered-entity criteria as final requirements.
Sector-specific reporting duties can apply independently of CIRCIA.
NERC CIP
NERC CIP Reliability Standards apply to applicable entities/assets in the North American Bulk Electric System. They cover BES Cyber System categorization, management, personnel/training, electronic security perimeters, system security, incident response, recovery, configuration/vulnerability management, information protection and related areas.
NERC maintains current mandatory standards and future-enforcement versions. In 2026 FERC approved updated CIP standards including virtualization-related revisions with later effective dates. Track the exact standard version and enforcement date applicable to the audit period.
IEC 62443
IEC 62443 is a standards series for industrial automation and control systems. It distributes responsibilities across asset owners, service providers/system integrators and product/component suppliers and covers security programs, zones/conduits, system security requirements/security levels and secure development lifecycles.
NERC CIP and IEC 62443 can coexist: an electric utility may have mandatory NERC CIP obligations while using IEC 62443 engineering practices for broader OT environments.
CIRCIA vs NERC CIP vs IEC 62443
| Framework | Purpose | Key point |
|---|---|---|
| CIRCIA | Federal incident/ransom reporting | Final implementing rule still pending Oct 2026 |
| NERC CIP | Mandatory BES cybersecurity standards | Enforceable sector standards with exact versions/effective dates |
| IEC 62443 | IACS/OT security lifecycle | International role/lifecycle standards family |
| CIIP | Umbrella critical-infrastructure protection | Broader than one law or control set |
IT/OT Security Architecture
- Inventory IT and OT assets/firmware/protocols.
- Segment zones and conduits by function/consequence.
- Use controlled remote access/jump mechanisms.
- Protect engineering workstations, HMIs, historians and gateways.
- Allowlist communications where operationally feasible.
- Monitor without destabilizing fragile OT systems.
- Separate control/management paths from operational flows.
- Use compensating controls for unpatchable assets.
Incident Response in Safety-Critical Environments
OT response cannot blindly copy enterprise IT playbooks. Isolation or shutdown can create safety/availability harm. Define decision authority with operations, safety, engineering, legal and communications teams.
Preserve evidence needed for reporting while prioritizing safe operations and rehearsing failover/manual-operation/vendor decisions.
APIs and Digital OT Dependencies
Modern infrastructure uses APIs for cloud analytics, mobile apps, partner integrations, identity and IT/OT data exchange. Treat API gateways/integration services as critical conduits: authenticate workloads, authorize objects/functions, minimize exposed commands/data and isolate management interfaces.
Related Ammune reading: East-west vs north-south traffic and Network TAP vs port mirroring.
Implementation Roadmap
- Determine applicable laws/sector standards.
- Identify critical functions and consequence-driven assets.
- Create IT/OT inventories/data-flow maps.
- Segment and protect admin/remote access.
- Map controls to evidence.
- Implement OT-safe monitoring.
- Exercise response/reporting/recovery.
- Manage vendor/product lifecycle.
- Track future-effective standards separately.
- Continuously validate resilience.
Zones, Conduits and Remote Access in OT
One of the most useful IEC 62443 concepts is separating industrial systems into zones with similar security requirements and controlling communication through conduits. The objective is not segmentation for its own sake; it is to reduce the ability of one compromise to reach systems with different consequence levels.
Remote access is a high-risk conduit. Vendor support should traverse controlled access paths with strong identity, explicit approval, session logging/recording where appropriate, time-bounded access and a documented method to disable access quickly. Avoid persistent inbound exposure of PLCs, HMIs or engineering interfaces to the internet.
Where legacy controllers cannot support modern authentication or encryption, place compensating controls at gateways, jump hosts and network boundaries. Passive monitoring can be safer than intrusive endpoint scanning for fragile devices, but monitoring should still provide enough context to detect new communication paths, unauthorized engineering actions and changes in normal process behavior.
| Boundary | Security objective |
|---|---|
| Enterprise IT ↔ OT | Restrict/inspect approved business data flows |
| Vendor remote access ↔ OT | Strong identity, approval, time limit and audit |
| Control network ↔ safety/critical zone | Minimize pathways; consequence-driven policy |
| OT ↔ cloud analytics | Outbound-limited, authenticated and monitored |
| API/edge gateway ↔ operational systems | Authorize commands/data, isolate management plane |
IEC 62443 Security Levels in Context
IEC 62443 uses security-level concepts to express the protection strength expected for industrial systems, but they should not be treated as generic product grades. The target is selected for a zone, conduit or system based on risk and attacker capability and then translated into technical requirements.
At a high level, the progression moves from protection against casual/accidental violation toward increasingly intentional, sophisticated and well-resourced attacks. A safety-critical control zone can therefore require a different target from a historian or enterprise integration zone.
Do not equate an IEC 62443 target level with NERC CIP compliance. NERC CIP obligations are regulatory standards for applicable BES entities/assets; IEC 62443 security levels are engineering concepts inside the industrial-security lifecycle.
How CIRCIA, NERC CIP and IEC 62443 Can Overlap in One Organization
An electric or industrial organization can be affected by more than one layer at the same time. A utility may have NERC CIP obligations for applicable BES Cyber Systems, use IEC 62443 engineering practices for wider OT environments, and eventually have CIRCIA reporting duties if it falls within the final covered-entity rule and experiences a reportable event.
| Question | Primary lens |
|---|---|
| Which cybersecurity controls are mandatory for an applicable BES asset? | NERC CIP |
| How should OT zones, conduits and product/system lifecycle security be engineered? | IEC 62443 |
| When must a covered cyber incident/ransom payment be federally reported? | CIRCIA once implementing rule applies |
| How do we protect essential digital services beyond those exact requirements? | Broader critical-infrastructure / CIIP program |
Maintain separate applicability matrices so one framework is not incorrectly used as evidence that another legal or engineering requirement has been satisfied.
Critical Infrastructure Checklist
- Do not treat CIRCIA NPRM criteria as final.
- Track NERC CIP exact versions/effective dates.
- Select applicable IEC 62443 parts by role.
- Inventory OT assets/dependencies.
- Segment zones/conduits.
- Control vendor remote access.
- Monitor safely.
- Integrate cyber response with safety/operations.
- Include cloud/API integrations.
- Maintain audit/reporting evidence.
Frequently Asked Questions
Is CIRCIA reporting in force now?
The statute exists, but as of October 14, 2026 the final implementing reporting rule is still forthcoming.
What timeframes are in the CIRCIA statute?
72 hours for covered cyber incidents and 24 hours after ransom payment, once implementing obligations apply.
Is NERC CIP the same as IEC 62443?
No. NERC CIP is a mandatory North American BES standards regime; IEC 62443 is an international IACS/OT standards family.
Can utilities use both?
Yes.
Does IEC 62443 only apply to asset owners?
No. The series also covers service providers and product/system/component suppliers.
Primary References
Protect the API Layer Connecting Critical Systems
Combine OT/sector controls with runtime visibility at the APIs and gateways connecting operational systems to cloud, enterprise and partner environments.