nerc-cip-compliance-checklisted

## When to Use - Preparing for a NERC CIP audit or a self-certification. - Determining CIP applicability for a site with on-site generation. - Building the evidence register that supports an audit response. - Reviewing a compliance program after a networking or control change. ## Prerequisites - Registered entity status and functional registration per site. - BES Cyber System categorization from the current CIP-002 assessment. - Evidence pack: ESP diagrams, patch records, access lists, training records, recovery test results, supply chain procedures. - Current NERC CIP standards version list from the NERC website or regional entity. - Credentials: none. This skill produces assessment documents. - Authorization: compliance manager owns the matrix. Legal or regulatory review is required before any external submission. - Upstream skills: `passive-ot-network-discovery` for observed network reality, `ot-asset-ownership-governance` for ownership records. ### Safety This skill is passive. It produces assessment and governance documents only. ## Workflow 1. Establish applicability before assessing anything. Requirement: scope is defined by registration and categorization, not by asset count. Anchor: CIP-002-5.1a. Decision: record registered entity status per site and the functional registration held. A site with no registration and no BES Cyber System has no CIP obligations, and the matrix says so explicitly rather than listing rows as not applicable. Trade-off accepted: narro