NERC CIP is the set of reliability standards that protect the cyber assets of the North American power grid. Whether a screen falls under it is the utility's decision, made by how the screen connects to systems the standards protect, and that decision sets everything a signage vendor then has to show.
How a utility decides scope
CIP-002 has the utility identify its BES Cyber Systems, the systems that could affect the bulk electric system, and rate each one high, medium or low impact. A screen in an office lobby is almost always out of scope. A screen in a control room is the hard case: if it sits on the same network as the systems that run the grid, or shows data pulled straight from them, it can be drawn in.
The common answer is to keep signage off the control network altogether: its own network segment, outbound internet only, and nothing that can reach the systems in scope.
The standards a signage device touches
| Standard | What it asks |
|---|---|
| CIP-005 | Electronic security perimeters, and how remote access into them is controlled |
| CIP-007 | Only the ports and services needed, security patches evaluated on a fixed cycle, logging |
| CIP-010 | A known baseline configuration, and tracking changes to it |
| CIP-013 | Supply chain risk: how the utility assesses its vendors |
| CIP-003 | Controls for low-impact systems, including vendor remote access |
What to ask a signage vendor
- Can the vendor, or anyone else, reach the device remotely? Over which ports?
- Does the device connect outbound only, and to which hostnames?
- How are updates delivered and verified, and how often?
- Is there an SBOM for the device software?
- What does the device log, and can you collect it?
- Is there a written position on NERC CIP?
Where Screenly stands
ScreenlyOS devices have no remote login and no open ports, connect outbound only to a published list of hostnames, take only signed updates and ship an SBOM with every release, which covers the questions CIP-005, CIP-007 and CIP-013 raise about a device. Screenly does not publish a NERC CIP mapping, and the scope decision stays with the utility. Network security and device security have the detail.
