✣ For electric utilities
Test your response plan
inside every 15 months
NERC CIP-008 requires each cyber security incident response plan to be tested at least once every 15 calendar months. Preppr builds the test from your own plans, runs it with operations and IT/OT, and keeps the record for your next audit.
NERC CIP-008
15 mo
maximum time between tests of each cyber security incident response plan.
✣ The compliance clock
One plan. A 15-month clock.
CIP-008 applies to high and medium impact BES Cyber Systems. Each response plan has to be tested on schedule, updated after every test or real incident, and its lessons shared with everyone who carries it out.
15 mo
Test every plan
Test each incident response plan at least once every 15 calendar months, through a tabletop, a drill or a real incident.
90 days
Update after every test
Document lessons learned, update the plan and notify everyone with a role within 90 days of a test or a reportable incident.
R1–R4
Plan, test, update, report
Specify the plan, implement and test it, keep it current, and report incidents to E-ISAC and CISA.
IT/OT
One response across both
The plan has to work across control centers, substations and corporate IT at the same time.
Source: NERC Reliability Standard CIP-008-6, Cyber Security — Incident Reporting and Response Planning. Confirm applicability with your compliance team.
✣ When the auditor asks
Every step leaves evidence
Preppr records each part of the cycle as it happens, so the documentation exists before anyone requests it.
Assess
Ask Preppr
Reads your incident response plan alongside NIST CSF 2.0 and shows where it is thin.
✓ Gap register against NIST CSF 2.0
Gather intel
Intelligence
Brings cyber, physical and weather threat signal into context with your plans.
✓ Threat picture linked to your assets
Engage
Collaborate
Gathers input from control-room operators, field crews, IT/OT and mutual-aid partners.
✓ Documented partner input with dates
Design
Exercise & Simulation
Builds scenarios checked against MITRE ATT&CK from your highest-risk systems.
✓ Exercise plan tied to your response roles
Exercise
Exercise & Simulation
Runs the test with operations, IT/OT and leadership, in person or virtually.
✓ Dated participant and decision log
Improve
Improve
Tracks lessons learned and plan updates to closure.
✓ Test record and plan updates ready for your audit
✣ Scenarios utilities run in Preppr
Test the day you hope never comes
Cyber
Ransomware in the control center
Manual operations, IT/OT isolation and E-ISAC coordination.
Physical
Attack on a substation
Load shedding, restoration priorities and law enforcement coordination.
Weather
Extreme cold
Generation shortfalls, rotating outages and customer communications.
✣ Inside Preppr
From your plans to a ready exercise
Exercise Designer reads your own plans and the rules your sector answers to, then drafts the scenario, injects, and objectives for your team to review.
app.preppr.ai
Build a CIP-008 test from your own incident response plan, run it, and keep the lessons learned for your next audit.
How Preppr supports electric utilities across the cycle
1 · Ask
Ask Preppr
Ask about your incident response and recovery plans, and draft updates cited to the page.
2 · Remember
Knowledge
Keep plans, procedures and past test records in one cited memory across control centers and sites.
3 · Watch
Intelligence
Track cyber, physical and weather threats against your critical assets.
4 · Engage
Collaborate
Gather input from control-room operators, field crews, IT/OT and mutual-aid partners.
5 · Practice
Exercise & Simulation
Build cyber, physical and weather scenarios checked against MITRE ATT&CK, and run them across operations and IT/OT.
6 · Improve
Improve
Track lessons learned and plan updates to closure, with coverage against NIST CSF 2.0.
Requirements this covers
NERC CIP-008
Test incident response plans every 15 months and update them within 90 days.
NERC CIP-009
Recovery plans for BES Cyber Systems, tested on the same 15-month cycle.
Scenarios teams test
Ransomware on OT systems
Physical attack on a substation
Extreme cold and load shedding
Wildfire and power shutoffs
Supply chain compromise
Insider threat
“I applied a scenario that I’d typically see within the electric utility industry. Preppr caught on QUICK and talked the talk.”
Cassandra M.
Emergency Management Pro · Private energy sector
See it with your own plans.
A 30-minute demo built around your hazards and obligations.
Other sectors