A North American electric utility plans to move systems that support real-time monitoring and control of its bulk electric system to a cloud service operated across several regions. Which compliance requirement is most specific to this workload?

The North American Electric Reliability Corporation Critical Infrastructure Protection standards impose mandatory cybersecurity requirements on registered entities for BES Cyber Systems, the systems that support reliable operation of the bulk electric system. They cover areas such as categorization, electronic security perimeters, access management, configuration and change management, incident reporting and information protection, and they demand auditable evidence. Moving such systems to a cloud service raises questions about how the provider's controls, personnel access and multi-region operations support compliance and how the utility will produce evidence for audits, which makes NERC CIP the most specific requirement here. PCI DSS applies to environments that store, process or transmit payment card data; customer billing may be in scope for that standard, but it does not govern grid control systems. The HITECH Act strengthened HIPAA for health information held by covered entities and business associates, and an employer's workforce records do not make grid operations subject to it. FERPA protects student education records at institutions receiving US Department of Education funds, not corporate training records. Exam caveat: distributed cloud operations can also cross jurisdictions with their own critical infrastructure rules. Operational check: confirm the provider can document how each applicable CIP requirement is met and supply evidence for compliance audits.