R1 - Cyber Security Policy

The CIP-003 R1 requirement mandates that bulk-electric system owners and operators create a written cyber security policy that defines authority, responsibilities, and coordination for protecting critical assets. The policy must be approved by senior management, address risk management, personnel training, incident response, and be reviewed and updated at least annually.