Cyber Security Incident Reporting (CIP-008) on the NERC RC Exam: Test Tips and 5 Practice Questions

Cyber security is no longer a back-office concern for the Reliability Coordinator — it lives in the control room. CIP-008 governs how registered entities identify, classify, respond to, and report Cyber Security Incidents affecting the Bulk Electric System (BES). On the NERC RC certification exam, expect scenarios that test whether you know what qualifies as a Reportable Cyber Security Incident, who to notify, and how fast the clock runs.

Here's what to focus on, and five practice questions to sharpen your recall.

Test Tips

• Know the two reporting triggers. Under CIP-008-6, entities must report both (1) Reportable Cyber Security Incidents and (2) attempts to compromise applicable BES Cyber Systems. "Attempts" was added specifically to give visibility to reconnaissance and failed intrusions — a common exam trap where students only remember successful compromises.
• Memorize the reporting recipients. Reports go to E-ISAC (Electricity Information Sharing and Analysis Center) and DHS CISA (Cybersecurity and Infrastructure Security Agency). Exam distractors often list FERC, NERC directly, or the Regional Entity as recipients — those are wrong for the initial CIP-008 notification.
• Understand the timing. One hour after determination for a Reportable Cyber Security Incident that compromised or disrupted a Reliability Task; end of the next calendar day for attempts. Don't confuse these with EOP-004 event reporting timelines.
• Response plan ≠ reporting. CIP-008 requires a documented Cyber Security Incident response plan that is tested at least once every 15 calendar months. If a question asks about the frequency of testing, 15 months is the answer — not annually.
• Watch the scope. CIP-008 applies to High and Medium Impact BES Cyber Systems. Low Impact assets fall under CIP-003's incident response requirements — a different (and lighter) obligation.
• Lessons-learned window. Documentation and updates to the response plan must be completed within 90 calendar days of completion of a Cyber Security Incident response or a test.

5 Practice Questions

1. Under CIP-008-6, a Reportable Cyber Security Incident that has compromised or disrupted a Reliability Task must be reported to E-ISAC and DHS CISA within what timeframe of the determination?

   • A. 15 minutes
   • B. 1 hour
   • C. 24 hours
   • D. By the end of the next calendar day

2. Which two organizations are the required initial recipients of a Reportable Cyber Security Incident notification under CIP-008?

   • A. FERC and NERC
   • B. E-ISAC and DHS CISA
   • C. The Regional Entity and FERC
   • D. NERC and the local FBI field office

3. How often, at a minimum, must an entity's Cyber Security Incident response plan be tested under CIP-008?

   • A. Every 12 calendar months
   • B. Every 15 calendar months
   • C. Every 24 calendar months
   • D. Every 36 calendar months

4. A Medium Impact BES Cyber System logs multiple failed authentication attempts from an external IP over a 30-minute window. No system was compromised. Under CIP-008-6, this most likely constitutes:

   • A. A Reportable Cyber Security Incident requiring 1-hour notification
   • B. An attempt to compromise, reportable by the end of the next calendar day
   • C. A non-reportable event because no compromise occurred
   • D. An EOP-004 reportable event

5. Following a Cyber Security Incident response or a scheduled test of the response plan, within how many calendar days must documentation and lessons-learned updates to the plan be completed?

   • A. 30 days
   • B. 60 days
   • C. 90 days
   • D. 180 days

Answer Key & Explanations

1. B. 1 hour. CIP-008-6 requires notification to E-ISAC and DHS CISA within one hour after the determination that a Reportable Cyber Security Incident has occurred and compromised or disrupted a Reliability Task.
2. B. E-ISAC and DHS CISA. CIP-008-6 specifically names these two entities for the initial notification. FERC, NERC, and the Regional Entity have different reporting relationships under other standards and processes.
3. B. Every 15 calendar months. CIP-008 Requirement R2 requires the Cyber Security Incident response plan to be tested at least once every 15 calendar months, using a paper drill, tabletop exercise, operational exercise, or response to an actual Reportable Cyber Security Incident.
4. B. An attempt to compromise, reportable by the end of the next calendar day. Failed authentication attempts targeting an applicable BES Cyber System are treated as an attempt to compromise under CIP-008-6 and are reportable by the end of the next calendar day, giving cyber defenders visibility into reconnaissance and probing activity.
5. C. 90 days. CIP-008 requires documentation of deviations from the plan (if any) and updates based on lessons learned to be completed within 90 calendar days of the completion of the response or test.

Bottom Line

CIP-008 questions on the RC exam reward operators who can separate reporting obligations from response obligations, and who remember that "attempts" — not just successful compromises — must be reported. Lock in the 1-hour, end-of-next-calendar-day, 15-month, and 90-day timers. If a distractor names FERC or the Regional Entity as the initial CIP-008 recipient, it's wrong.

Ready to drill more standards? Explore EPG Solutions' NERC RC exam prep resources at epgsolutions.services — practice question banks, study guides, and instructor-led boot camps built by control-room veterans.