Explainer · NERC CIP
NERC CIP in Canada: one standard, five calendars
In Canada a NERC CIP standard binds only once a province adopts it. Québec, Ontario, Alberta, British Columbia and New Brunswick, and the dates each publishes.
By Sentrix · Published 2026-09-25
On the NERC website, a CIP standard has one version and one date. In Canada, the same standard has up to six, one per province. Whoever operates assets in several provinces, or on both sides of the border, must know which one applies to each asset. This article gathers the dates as the provincial authorities publish them.
What the texts say
In the United States, FERC approval makes a standard mandatory. In Canada, nothing happens until a provincial authority adopts it, each at its own pace and under its own law. NPCC, whose region is approximately 57% Canadian in net energy for load according to its "About" page, monitors compliance in New Brunswick, Nova Scotia, Ontario and Québec, according to each province's regulatory structure and agreements ("Canadian Compliance" page).
Québec. The Régie de l'énergie adopts only the standards filed by the Reliability Coordinator (Hydro-Québec), under section 85.5 of the Act respecting the Régie de l'énergie. According to Hydro-Québec's compliance monitoring page, the QCMEP program, born of a 2014 agreement, has been in force since April 1, 2015 and the monetary sanction can reach $500,000 a day. The Régie's list of standards in force shows CIP-003-8 (October 1, 2021), CIP-012-1 (July 1, 2024) and CIP-004-7 and CIP-011-3 (January 1, 2025); CIP-003-9, CIP-012-2 and CIP-015-1 are not on it.
Ontario. Compliance is made mandatory by the IESO Market Rules (chapter 5, sections 1.2.6 and 1.2.7); the IESO publishes the standard within seven days of its approval. The IESO roadmap as of July 10, 2026 sets CIP-003-9 at July 1, 2026, CIP-012-2 at October 1, 2026, CIP-015-1 at October 1, 2028, the virtualization standards at July 1, 2028 and CIP-003-11 at July 1, 2029. In the United States, NERC's 2026 CMEP implementation plan gives April 1, 2026 for CIP-003-9 and July 1, 2026 for CIP-012-2.
Alberta. The AESO recommends Alberta Reliability Standards based on NERC's, which the Alberta Utilities Commission approves. CIP-PLAN-AB-3, effective May 2, 2024, brings CIP-003-AB-8, CIP-005-AB-7, CIP-010-AB-4 and CIP-013-AB-2 into force on October 1, 2024, phases CIP-003-AB-8 requirement R2 up to 100% of assets on October 1, 2027, and sets CIP-004-AB-7 and CIP-011-AB-3 at April 1, 2026. No version of CIP-015 appears in it.
British Columbia. Section 125.2 of the Utilities Commission Act (2009) entrusts adoption to the BCUC after assessment by BC Hydro. Attachment A to Order R-5-26 gives CIP-005-7, CIP-010-4 and CIP-013-2 at July 1, 2024, CIP-004-7 and CIP-011-3 at October 1, 2025, and CIP-003-9 and CIP-012-2 at October 1, 2027, that is 18 and 15 months after the US dates.
New Brunswick. Under section 119 of the Electricity Act and the Reliability Standards Regulation, the NBEUB approves the standards filed by NB Power. Its "Reliability Standards" page dated September 1, 2026 sets CIP-003-9 and CIP-012-2 at October 1, 2026, the virtualization standards at October 1, 2028 and CIP-015-1 at January 1, 2029.
Nova Scotia. A memorandum of understanding has bound NERC and the NSUARB since December 22, 2006. NERC's quarterly filing of February 6, 2023 recalls that the NSUARB does not process applications until FERC has approved or remanded the standards, which institutionalizes the lag.
| Standard | Québec | Ontario | Alberta | British Columbia | New Brunswick |
|---|---|---|---|---|---|
| CIP-003-9 | not adopted | July 1, 2026 | not adopted (CIP-003-AB-8, R2 phased) | October 1, 2027 | October 1, 2026 |
| CIP-012-2 | not adopted | October 1, 2026 | not adopted | October 1, 2027 | October 1, 2026 |
| CIP-015-1 | not adopted | October 1, 2028 | not adopted | not adopted | January 1, 2029 |
Why it matters
Take CIP-004-7. The same personnel and training program becomes mandatory in Ontario on April 1, 2024 (IESO), in Québec on January 1, 2025 (Régie), in British Columbia on October 1, 2025 (BCUC) and in Alberta on April 1, 2026 (AESO). For two years, an entity present in those four provinces lives with two versions of the same standard.
The classic mistake is not ignoring a requirement: it is proving the right requirement under the wrong version. A low impact security plan written to CIP-003-9 is early in Québec, current in Ontario and premature in British Columbia.
What we think at Sentrix
One standard, several calendars: the answer is a system, not another spreadsheet.
- A register of requirements by jurisdiction. Every asset carries its province; every requirement carries its version and date as the provincial authority publishes them, not as the NERC website shows them.
- Evidence collected once, mapped by version. The same control centre access list serves CIP-004-7 in Ontario and CIP-004-AB-7 in Alberta: Sentrix collects it once and maps it to each framework and each version.
- A deadline calendar kept current. Three dates for CIP-003-9 between July 2026 and October 2027, a phased Alberta R2: provincial publications move.
- What stays open between two audits. Sentrix's CTEM module tracks exposure continuously, so the gap found in January does not resurface in the October report.
For entities under the Régie, one detail matters: Sentrix hosts data in Canada by default (execution in the United States or another region on request). Our cybersecurity posture assessment starts from this register by jurisdiction.
The next step
List your BES assets by province, then write next to each one the CIP version in force and the date of the next one. The cells you cannot fill are your work plan. To build it with us, contact us.
Sources
Frequently asked questions
- Does a FERC-approved NERC standard apply automatically in Canada?
- No. In the United States, FERC approval makes the standard mandatory. In Canada, each province adopts it through its own authority: the Régie de l'énergie in Québec, the IESO Market Rules in Ontario, the Alberta Utilities Commission, the BCUC in British Columbia, the NBEUB in New Brunswick and the NSUARB in Nova Scotia. Until that adoption is pronounced, the previous version remains in force in that province.
- Who monitors NERC CIP compliance in the Canadian provinces?
- NPCC conducts compliance monitoring and enforcement in New Brunswick, Nova Scotia, Ontario and Québec, according to each province's regulatory structure and agreements. In Québec, the Régie de l'énergie decides on violations and sanctions under the QCMEP program, in force since April 1, 2015. In Alberta and British Columbia, monitoring falls under the provincial frameworks specific to those provinces.
- Which version of a CIP standard must be proven at an audit?
- The one in force in the province where the asset sits on the audit date, not the one on the NERC website. As of September 25, 2026, CIP-003-9 applies in Ontario since July 1, 2026, reaches New Brunswick on October 1, 2026 and British Columbia on October 1, 2027, and is not yet adopted in Québec, where CIP-003-8 remains the reference. A register by jurisdiction prevents the mistake.
Let's talk about your compliance program.
Last updated: 2026-09-25