BES Cyber System Categorization (CIP-002) on the NERC RC Exam: Test Tips and 5 Practice Questions

Every CIP compliance program starts in the same place: figuring out what actually counts as a BES Cyber System, and how much protection it needs. That's CIP-002 — and on the NERC RC exam, it shows up less as a memorization drill and more as a "do you understand the logic" test. Get the categorization framework wrong and every downstream CIP obligation (CIP-003 through CIP-011) points at the wrong assets.

Test Tips

• Know the two-requirement structure. CIP-002-5.1a R1 requires the Responsible Entity to implement a process that identifies and categorizes BES Cyber Systems as High, Medium, or Low impact using the criteria in Attachment 1. R2 requires that categorization to be reviewed and approved by a CIP Senior Manager (or delegate) at least once every 15 calendar months. Exam writers love testing the 15-month figure — don't confuse it with the CIP-004 training cycle or other CIP renewal intervals.
• RC Control Centers are the exam's favorite High Impact example. A Control Center (or backup Control Center) that performs the functional obligations of the Reliability Coordinator is categorized High Impact under Attachment 1 — regardless of the size of the footprint it monitors. If a question asks "what makes an asset automatically High Impact," an RC control center performing RC functional obligations is the answer they're fishing for.
• Impact rating drives everything downstream. The High/Medium/Low label assigned under CIP-002 determines which CIP-003 through CIP-011 requirements actually apply to that BES Cyber System. Low Impact assets get a lighter-touch set of controls under CIP-003; High and Medium get the full CIP-004 through CIP-011 stack. Questions that look like they're about CIP-005 or CIP-007 sometimes hinge on a CIP-002 categorization fact — read carefully.
• The asset list in R1 comes first, categorization comes second. The process starts by identifying the qualifying assets (Control Centers, transmission stations/substations, generation resources, and related facilities) before applying impact criteria. A common distractor swaps the order or implies categorization happens before asset identification.
• "No BES Cyber Systems identified" is a valid, documented outcome. A small entity can complete the CIP-002 process and legitimately conclude it has no High, Medium, or Low Impact BES Cyber Systems — but the process and its documentation still have to exist and be reviewed on the R2 cycle. The exam sometimes uses this to test whether you understand that CIP-002 is a process obligation, not just a labeling exercise.
• Memory aid: "Identify, Categorize, Approve, Repeat." R1 identifies and categorizes; R2 reviews and approves on a recurring 15-month cadence. If a question describes any recurring review timeline tied to impact categorization, it's pointing at R2.

5 Practice Questions

1. Under CIP-002-5.1a, how often must the categorization of BES Cyber Systems be reviewed and approved by the CIP Senior Manager or delegate?
   A) Every 12 calendar months
   B) Every 15 calendar months
   C) Every 18 calendar months
   D) Every 24 calendar months
2. A Control Center that performs the functional obligations of the Reliability Coordinator is categorized under CIP-002 Attachment 1 as:
   A) Low Impact, unless it exceeds a generation threshold
   B) Medium Impact by default
   C) High Impact
   D) Not subject to categorization, since RC functions are excluded from CIP scope
3. Which requirement in CIP-002-5.1a establishes the process for identifying and categorizing BES Cyber Systems?
   A) R1
   B) R2
   C) R3
   D) CIP-002 does not contain numbered requirements
4. An entity completes its CIP-002 process and determines it has no High, Medium, or Low Impact BES Cyber Systems. Which statement is accurate?
   A) This outcome is not permitted — every entity must identify at least one BES Cyber System
   B) This is a valid outcome, but the process and its documentation are still required and subject to periodic review
   C) This exempts the entity from all further CIP obligations, including CIP-003
   D) This outcome only applies to Generator Operators, not Reliability Coordinators
5. The impact rating (High, Medium, or Low) assigned to a BES Cyber System under CIP-002 primarily determines:
   A) The entity's NERC registration category
   B) Which subsequent CIP-003 through CIP-011 requirements apply to that system
   C) The entity's balancing authority area boundaries
   D) Whether the asset is subject to FAC-003 vegetation management

Answer Key & Explanations

1. B — Every 15 calendar months. CIP-002-5.1a R2 sets the review-and-approval cycle for BES Cyber System categorization at 15 calendar months, not 12 or 24 — a cadence unique to this requirement among the CIP standards.
2. C — High Impact. Attachment 1 of CIP-002-5.1a categorizes a Control Center (or backup Control Center) performing RC functional obligations as High Impact, independent of the size of the footprint it operates.
3. A — R1. CIP-002-5.1a R1 requires the Responsible Entity to implement a process that identifies qualifying assets and categorizes associated BES Cyber Systems using the Attachment 1 criteria.
4. B — Valid outcome, documentation still required. CIP-002 is a process obligation. An entity can legitimately have no High, Medium, or Low Impact BES Cyber Systems, but it still must perform, document, and periodically review that determination under R1/R2.
5. B — Which CIP-003 through CIP-011 requirements apply. The High/Medium/Low categorization from CIP-002 is the gating factor for the scope and rigor of controls required under the rest of the CIP standards, from security management controls (CIP-003) through information protection (CIP-011).

Working through CIP-002 logic questions like these is exactly the kind of drilling that separates a pass from a retake. EPG Solutions' NERC RC exam prep resources are built around this same standard-by-standard approach — check the EPG Solutions store for the full practice test book and study guide lineup.