CIP-013 - Supply Chain Risk Management

CIP-013 is a NERC standard that establishes requirements for identifying, assessing and mitigating cyber security risks associated with the supply chain of bulk electric system assets. It mandates utilities to develop and implement a supply chain risk management program, including vendor vetting, contract provisions and ongoing monitoring to protect critical infrastructure.