BlastShield maps directly to the electronic security perimeter, remote access, and access control requirements that bulk electric system operators must satisfy under NERC CIP — without adding firewall complexity or requiring new hardware.
Electronic Security Perimeters
Systems Security Mgmt
Config & Vulnerability Mgmt
BlastWave publishes compliance mappings. BlastWave is not certified or accredited to any regulatory framework, and no vendor product confers compliance on an operator. This page describes how BlastShield controls support specific required outcomes under the NERC CIP. It supports, but does not replace, an operator's own implementation plan, assessment plan, and formal determination by NERC CIP.
The North American Electric Reliability Corporation's Critical Infrastructure Protection (NERC CIP) standards are mandatory cybersecurity requirements for owners and operators of the North American Bulk Electric System (BES). Enforced by NERC and regional entities with penalties reaching $1 million per violation per day, they are among the most consequential cyber regulations in any industry.
NERC CIP covers the full lifecycle of BES Cyber System security: how assets are identified and categorized, how electronic perimeters are established, how remote access is controlled, how personnel are trained, and how incidents are managed and recovered from.
The standards most directly addressed by an OT network access solution like BlastShield are CIP-005 (Electronic Security Perimeters), CIP-007 (Systems Security Management), and CIP-010 (Configuration Change Management and Vulnerability Assessments).
Who is covered? NERC CIP applies to registered entities in the bulk power system: transmission owners and operators, generation owners and operators, load-serving entities, and reliability coordinators. Coverage extends to high- and medium-impact BES Cyber Systems and their associated Electronic Access Points (EAPs).
Interactive Remote Access (IRA) is one of the most heavily audited areas. CIP-005 R2 requires that all IRA to high- and medium-impact BES Cyber Systems use encryption, multi-factor authentication, and an Intermediate System that prevents direct connectivity from external networks. BlastShield's architecture satisfies all three.
The table below maps key NERC CIP requirements to specific BlastShield capabilities. Use this as the starting point for your compliance documentation.
Standard
Requirement
What It Demands
How BlastShield Delivers
Coverage
CIP-003-9 R2
Security Management Controls
Electronic access and vendor remote access controls for low impact BES Cyber Systems
Section 6 requires methods for determining vendor electronic remote access (6.1), disabling it (6.2), and detecting known or suspected malicious communications within it (6.3). CIP-003-11, approved and subject to future enforcement, adds authentication of each user before access (Section 3.1.3) and protection of user authentication information in transit (Section 3.1.4).
Supports Sections 3.1 and 6.2 today, and Section 3.1.3 of CIP-003-11. BlastShield enforces least-privilege segmentation and blocks and logs connection attempts from any system without a configured policy, so only the flows you define are allowed. Deleting a vendor in the Orchestrator revokes access within seconds and terminates active sessions. Each user authenticates to BlastShield before access is granted, and the tunnels carrying the access are encrypted. BlastShield does not discover vendor access established outside it (6.1) and does not detect malicious communications (6.3). Your cyber security plan is yours.
Supports
CIP-004 R4
Access Management
Implement access management processes; revoke access within 24 hours of role change or termination
Authorize and periodically review access to BES Cyber Systems. Revoke access within 24 hours of personnel changes. Maintain access logs.
Access revocation in BlastShield is immediate and centralized through the Orchestrator. Removing a user from a group or deactivating their identity instantly terminates all BlastShield access — there are no per-device credentials to hunt down or VPN tunnel entries to remove. All access events are logged with user identity, timestamp, and target system.
Full Coverage
CIP-005 R1
Electronic Security Perimeter
Define and control all Electronic Access Points to BES Cyber Systems
Identify the ESP boundary. All connections into the ESP must pass through a documented Electronic Access Point with inbound and outbound access control.
BlastShield's Software-Defined Perimeter establishes a cryptographically enforced access boundary. No unauthorized device can reach a BES Cyber System — not because a firewall rule blocks it, but because it is literally invisible to unauthenticated endpoints. The BlastShield Security Gateway acts as a documented, auditable EAP for every protected system.
Supports
CIP-005 R2
Interactive Remote Access Management
MFA + encryption + Intermediate System for all IRA to high/medium impact BES Cyber Systems
Require: (1) encryption for all IRA sessions; (2) multi-factor authentication before granting access; (3) an Intermediate System so external parties never directly connect to BES assets.
BlastShield satisfies all three simultaneously. The BlastShield Security Gateway acts as the Intermediate System — external users authenticate to the gateway, never to the asset directly. All tunnels use strong end-to-end encryption. The BlastShield Authenticator provides phishing-resistant passwordless MFA (biometric + QR challenge-response + device keystore), far exceeding the minimum MFA bar. BlastAccess adds session recording for auditability.
Full Coverage
CIP-007 R1
Ports and Services
Disable all unnecessary ports and services on BES Cyber System components
Identify all enabled ports and services. Disable any that are not needed for normal operations or security functions. Document and justify all enabled ports.
Network Cloaking removes BES assets from the visible network entirely. Protected systems respond only to authenticated BlastShield clients — all other traffic is silently dropped. This functionally eliminates open ports as an attack surface without requiring per-device OS-level hardening on legacy systems that cannot be patched.
Full Coverage
CIP-007 R5
System Access Controls
Limit access to only necessary BES Cyber System capabilities for each user; manage generic and shared accounts
Implement least-privilege access. Define minimum necessary access for each user. Restrict generic or shared account usage. Enforce session timeouts and authentication requirements.
BlastShield enforces least-privilege access at the application level via the Orchestrator. Each user or role is granted access only to the specific BES Cyber Systems — down to individual PLCs, HMIs, or SCADA interfaces — they need. No user can see or reach systems outside their defined scope, even on a flat Layer 2 network. Shared accounts are eliminated by the identity-based architecture.
Full Coverage
CIP-010 R1
Configuration Change Management
Maintain a baseline configuration for each BES Cyber System; authorize and document all changes
Document and maintain a configuration baseline. Verify configuration before changes. Detect unauthorized modifications within 35 days.
The BlastShield Orchestrator maintains a centralized, auditable policy record for all access configurations and network topology. Any change to access permissions, gateway configuration, or segment definitions is version-controlled and logged. This creates a clear, defensible baseline that maps to BES Cyber System configuration documentation requirements.
Partial Coverage
CIP-010 R3
Vulnerability Assessments
Perform vulnerability assessments of BES Cyber Systems; remediate or document identified vulnerabilities
Obliges the entity to conduct a vulnerability assessment on a defined cycle, at least once every 15 calendar months for a paper or active assessment.
BlastShield performs no vulnerability assessment of any kind. Cloaking reduces the exploitability of a finding, which is a compensating control you may wish to describe to your auditor, and it is not an assessment capability.
Out of scope
CIP-013 R1
Supply Chain Risk Management
Manage cybersecurity risks from vendor remote access
Develop a documented supply chain cyber security risk management plan for high and medium impact BES Cyber Systems and their associated EACMS and PACS. A plan is something an entity develops; no product develops it.
The part BlastShield bears on is R1 Part 1.2.6, coordination of controls for vendor-initiated remote access, and it pairs with Part 1.2.3, notification when vendor access should no longer be granted. BlastShield gives you the control to coordinate and the means to revoke. The plan, the procurement processes, the vendor risk assessment, and the CIP Senior Manager approval cycle are yours.
Supports, at one part of the standard.
CIP-006-6
Physical Security of BES Cyber Systems
Physical security plan, visitor control, and physical access control system testing
R1 requires a documented physical security plan to manage physical access to BES Cyber Systems. R2 requires a visitor control program. R3 requires maintenance and testing of Physical Access Control Systems (PACS).
BlastShield controls electronic access, not physical access. It plays no part in a physical security plan, visitor control, or PACS maintenance and testing.
Out of scope
CIP-008-6
Incident Reporting and Response Planning
Cyber Security Incident response plans and notification
R1 requires documented Cyber Security Incident response plans. R2 requires implementing and testing them, and R3 maintaining them. R4 requires notifying the E-ISAC and, for entities subject to US jurisdiction, the NCCIC.
BlastShield does not write, test, or maintain a response plan, and it makes no notifications. Policy changes take effect immediately, and revoking access terminates active sessions within seconds, so both are actions your plan can name. The plan and the reporting are yours.
Out of scope
CIP-009-6
Recovery Plans for BES Cyber Systems
Recovery Plans for BES Cyber Systems
R1 requires documented recovery plans for the reliability functions BES Cyber Systems perform. R2 requires implementing them, and R3 maintaining them.
BlastShield performs no backup, restoration, or recovery of BES Cyber Systems and does not produce a recovery plan.
Out of scope
CIP-011-3
Information Protection
Protection of BES Cyber System Information
R1 requires a documented information protection program with methods to identify BES Cyber System Information (BCSI) and to protect and securely handle it. R2 covers BES Cyber Asset reuse and disposal.
BlastShield encrypts the traffic it carries, but it does not identify BCSI, govern how BCSI is stored or handled, or address asset reuse and disposal. The information protection program is yours.
Out of scope
CIP-005-7 R2 applies to high impact BES Cyber Systems, to medium impact BES Cyber Systems with External Routable Connectivity, and to their associated Protected Cyber Assets. Where it applies, Part 2.1 requires that for all Interactive Remote Access you use an Intermediate System such that the Cyber Asset initiating that access does not directly access an applicable Cyber Asset. BlastAccess provides that break: the tunnel runs from the client to the BlastAccess server rather than to the end station, so the initiating client never holds a network path to the protected device.
An Intermediate System is itself an Electronic Access Control or Monitoring System, an EACMS. The Applicable Systems conventions in CIP-005-7 give the EACMS examples as firewalls, authentication servers, and log monitoring and alerting systems.
Whether a given BlastShield deployment serves that function in your environment is your determination with your auditor, and your impact rating determines which CIP standards apply at all. Where it does serve that function, obligations that attach to an EACMS attach to it. Three are worth deciding at design time. The clause that applies to each is named below.
Vulnerability assessment. CIP-010-4 R3 Part 3.1 requires a paper or active vulnerability assessment at least once every 15 calendar months, and it applies to high and medium impact BES Cyber Systems and their associated EACMS, PACS, and PCA. BlastShield performs no vulnerability assessment. Build the deployment into your assessment program rather than discovering it at audit.
Supply chain. CIP-013-2 R1 requires a documented supply chain cyber security risk management plan covering high and medium impact BES Cyber Systems and their associated EACMS and PACS. Part 1.2.6 addresses coordination of controls for vendor-initiated remote access, and Part 1.2.3 addresses notification by vendors when remote or onsite access should no longer be granted. Those are the two parts a secure access product bears on.
Vendor remote access to the deployment. CIP-005-7 R3 applies to EACMS and PACS associated with high impact BES Cyber Systems, and with medium impact BES Cyber Systems with External Routable Connectivity. Part 3.1 requires one or more methods to determine authenticated vendor-initiated remote connections, and Part 3.2 requires one or more methods to terminate them and control the ability to reconnect. If your BlastShield deployment is an EACMS, then a vendor's engineering access into it is a vendor-initiated remote connection to an EACMS, and R3 is the clause that applies to it.
The classification follows the function, not the vendor. Any product that carries Interactive Remote Access into an Electronic Security Perimeter raises the same question, and the answer depends on how it is deployed in your environment. Other CIP standards may reach an EACMS in your environment beyond the three above. Confirm your position with your Regional Entity rather than taking a vendor's word for it, including ours.
Revocation evidence is available. Access is revoked by deleting the entity in the Orchestrator. Revocation takes effect within seconds and terminates active sessions, and the deletion is recorded in the configuration change log with the acting user and a timestamp. BlastShield authenticates over OpenID Connect and provisions over SCIM 2.0, and does not support SAML. Where your identity provider is integrated over those two, deprovisioning propagates the removal without a BlastShield administrative action, and the BlastShield-side deletion remains the timed evidence artifact.
Two limits to design around. BlastShield has two administrative roles, read and read-write, applied network-wide, with no policy approval workflow, so separation of duties for administrators is a compensating control you describe rather than one the product enforces. And connection logs are written locally and rotate on available storage with no set retention period, so a retention obligation such as the 90 consecutive calendar days in CIP-007 R4 is met by exporting to your SIEM, not by BlastShield.
Most organizations struggle with NERC CIP because legacy tools force a choice between security and operational continuity. BlastShield eliminates that tradeoff.
The BlastShield Security Gateway creates a verified Electronic Security Perimeter without requiring physical network redesign. All access is controlled at the identity layer — before any packet is exchanged. Undocumented connections are structurally impossible.
The BlastShield Authenticator combines biometric verification, QR-code challenge-response, and device keystore cryptography. There are no passwords to steal, no OTP codes to intercept. This exceeds NERC CIP's Interactive Remote Access authentication standard and eliminates the most common breach vector in energy infrastructure.
BES Cyber Systems protected by BlastShield are invisible to network scans and probes. Unauthorized parties cannot discover, fingerprint, or exploit what they cannot see. This addresses the port-and-services hardening requirement without requiring OS-level changes on unpatchable legacy hardware.
BlastAccess records all remote desktop sessions with full fidelity — keystroke logging, screen capture, and protocol metadata. Every access event is logged with user identity, source, destination, and duration. Audit evidence is available for NERC auditors on demand, without relying on SIEM correlation.
BlastShield operates at Layer 2 and Layer 3 without requiring IP reconfigurations or production outages. Security zones can be defined in hours, not months. Least-privilege access policies are enforced at the application level — engineers see only the systems they're authorized for, even on a flat network.
The BlastShield Orchestrator provides a single pane of glass for access policy, segment configuration, and identity management — deployable on-premises or in the cloud. Configuration baselines are documented, version-controlled, and exportable for compliance submissions. Access can be revoked instantly across all systems simultaneously.
Most NERC CIP compliance programs are built around IT security controls: firewalls, SIEMs, PAM tools, and identity governance platforms. These work well for IT environments. They consistently fail in OT environments for three reasons.
Legacy systems cannot be hardened. The RTUs, PLCs, and SCADA systems at the core of BES infrastructure run on firmware from the early 2000s. They cannot be patched, cannot run endpoint agents, and cannot be taken offline for updates. Traditional security tools that require OS-level access don't apply.
Firewall-based segmentation is fragile. Complex ACL rulesets require constant maintenance. Human misconfiguration is the leading cause of firewall-related incidents. In highly dynamic OT environments where contractors come and go and operational needs change weekly, firewall-based control creates compliance gaps faster than auditors can find them.
VPNs grant too much access. Interactive Remote Access using standard VPNs grants broad network-level access. Under CIP-005 R2, this must be restricted using an Intermediate System. Most VPN architectures weren't designed for this constraint and require expensive add-on products to comply.
The BlastShield approach: Rather than adding security layers on top of a vulnerable architecture, BlastShield changes the architecture. The OT network is overlaid with a cryptographically enforced access layer. Authorized users authenticate and establish point-to-point tunnels to specific assets. Everything else is invisible. There are no open ports, no exposed management interfaces, and no pathways for lateral movement — by design, not by firewall rule.
Deployment without downtime: BlastShield can be deployed in hours on existing infrastructure as a software-only overlay. No hardware replacements, no IP address changes, no production outages. Compliance improvements are visible to auditors immediately after deployment — not after a 12-month firewall refresh cycle.
Our OT security engineers work with utilities on the Electronic Security Perimeter, remote access, and evidence portions of their NERC CIP programs. Schedule a demo and we'll walk your environment against the requirements on this page.
Our Privacy Policy applies.
.svg)
Privacy Policy | Cookie Policy | © 2026 BlastWave, Inc. All Rights Reserved
This website uses cookies to ensure you get the best experience. More Info