CIP-008 - Incident Reporting and Response Planning

CIP-008 establishes the requirements for reporting and responding to security incidents that affect the bulk electric system. Utilities must create and maintain an incident response plan that defines incident categories, reporting timelines, coordination procedures with NERC and other stakeholders, and training for personnel. The standard also mandates documentation of incidents, post-incident analysis, and corrective actions to improve overall system resilience.