In October 2026, FERC’s Office of Electric Reliability, Division of Cyber Security released its annual Lessons Learned from Commission-Led CIP Reliability Audits summarizing findings from audits conducted during fiscal year 2026. Registered entities should assess their internal compliance programs in light of the trends and issues identified by FERC in preparation for future Critical Infrastructure Protection (CIP) audits, as the issues highlighted in these reports are often covered during audits. The report highlights compliance with CIP 002-5.1a as a priority for FERC, including registration for new resources, properly accounting for functions performed by third parties, and using AI in a protected environment.
Do Not Wait for the Final Project Phase to Register and Categorize New Generation
All entities that are users, owners or operators of the bulk-power system must register with NERC based on the functions they perform as established in NERC’s State of Compliance Registry Criteria. Typically, NERC uses its FERC-approved definition of the “bulk electric system” (BES) to identify the relevant facilities that are part of the bulk-power system but can also register entities based on their material impact on the reliable operation of bulk-power system or if they are otherwise subject to registration under the NERC rules, such as certain smaller inverter-based resources (IBRs).
Commission staff found that some owners of new IBRs failed to timely register with NERC or identify and categorize associated BES Cyber Systems pursuant to Reliability Standard CIP-002-5.1a R1. Other owners were already registered but had not evaluated their new resources. In one example, an entity delayed registration for more than a year after achieving commercial operation above the applicable BES threshold while waiting to complete all interconnection phases and bring its full nameplate capacity online.
Audit staff observed that failure to meet registration requirements may have been driven by a misunderstanding of NERC’s definition of the term Commercial Operation Date (COD). NERC defines COD as “the date after which all initial testing and commissioning has been completed and is the initiation date on which the Generator Owner and Generation Operators can start producing electricity for sale.”
Registered entities must apply NERC’s COD definition, which may differ from a project’s final-phase completion date, to determine when registration and CIP obligations attach to a generator. NERC’s registration procedure ties COD to completion of initial testing and commissioning and the ability to produce electricity for sale. For phased projects, the effective registration date should coincide with the COD of the phase that brings the aggregate gross nameplate rating of commercially operating resources above the applicable threshold.
Compliance with all applicable Reliability Standards must be met upon the effective registration date; completing the interconnection process is not a substitute for timely CIP compliance. Timely identification and categorization of BES Cyber Systems under CIP 002 5.1a is the cornerstone of the reliability standards because it sets forth criteria for determining how registered entities must comply with remaining requirements.
Registration and CIP applicability also require separate analyses. Under NERC’s rules, a Category 2 Generator Owner is an entity that owns and maintains non-BES IBRs that have, or contribute to, an aggregate nameplate capacity of 20 MVA or more, connected through a system designed primarily to deliver that capacity to a common point of connection at 60 kV. Category 2 registration for non-BES IBRs does not, by itself, make those facilities subject to BES-only Reliability Standards otherwise applicable to Generator Owners and Generator Operators.
Account for Affiliate and Third-Party Controls; Compliance Responsibility Cannot Be Outsourced
Commission Staff identified two circumstances in which an unregistered entity performed, or could perform, monitoring and control of generation on behalf of multiple registered Generator Operators (GOPs) at a single aggregation point. In the first, an unregistered parent company maintained monitoring and control capability over generation operated by several affiliates, each separately registered as a GOP; in the second, several unaffiliated GOPs contracted with the same third party to perform monitoring and control of generation resources. In both cases, each operator identified its BES Cyber Systems as low impact. Commission Staff concluded, however, that the aggregate capability met medium-impact criteria under CIP-002-5.1a.
The difference in treatment for medium versus low impact ratings is significant: The report contrasts approximately 140 requirements and sub requirements for medium-impact systems with approximately 15, primarily plan-based requirements, for low-impact systems. Commission Staff also noted that registered entities were reluctant to discuss affiliate and third-party monitoring and control capabilities during audits.
The report emphasizes that GOPs remain responsible for demonstrating compliance with the Reliability Standards, including for BES Cyber Systems operated by affiliates or third parties. A Registered Entity may delegate performance of a task, but not responsibility for ensuring it is completed. Commission Staff also urged NERC to consider further guidance or modifications to the Reliability Standards or registration procedures to address aggregated-control arrangements, which would help the industry better understand how these relationships would work from a compliance management perspective.
GOPs should map actual monitoring and control capabilities, including what other generation an affiliate or contractor can control from the same location. Agreements should provide access to the information, records, and audit support needed to substantiate the entity’s categorization analysis and continuing compliance; a contract alone does not establish that the required work occurred. In addition, GOPs should recognize that even if they outsource the compliance activities, as the GOPs remain the registered entities, they remain liable for all noncompliance.
Address AI-Enabled Access Under Existing CIP Requirements
Auditors observed that AI tools, described as “super intelligence” tools such as chatbots, personal assistants, and automated analytical systems, have become increasingly embedded within CIP-networked environments. Staff found that entities generally accounted for these tools and applied appropriate controls, but approaches varied. Registered entities reported that vendors are adding AI features faster than compliance programs can adapt, and that a tool’s scope and capabilities may not be fully understood until it is already live on the network. Commission Staff warned that tools capable of mimicking user behavior make it harder to distinguish between legitimate and malicious activity, raising access control risks.
The CIP Reliability Standards neither expressly permit nor prohibit the use of AI tools. Commission Staff instead emphasized existing CIP-004-7, Requirements R4, R5, and R6, for authorizing, periodically verifying, and timely revoking users’ access facilitated by AI tools. Registered entities should assess each tool’s access paths and applicable requirements, rather than wait for an AI-specific standard.
Commission Staff recommend evaluating the business need for AI deployment and considering the following measures, subject to the applicable standards:
- Limit an AI tool’s ability to access BCSI under CIP-011.
- Assess vendor AI risks in CIP-013 supply chain risk management plans. Commission Staff suggested using risk management frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0).
- Inventory AI tools as generic service accounts under CIP-007, and change default passwords, where applicable.
- Understand and monitor any AI tool’s communications outside the CIP-005 Electronic Security Perimeter, including reason for granting access.
Implications for Registered Entities
The report is a nonbinding staff assessment, not an enforcement action, and it does not impose new Reliability Standard Requirements. Instead, the report provides voluntary recommendations alongside discussions of existing requirements. Nevertheless, it provides a useful guide for audit preparation.
Morgan Lewis routinely counsels registered entities on NERC compliance programs, CIP audit preparation and responses, and potential violations. That work includes registration and categorization analyses, affiliate and vendor arrangements, and cybersecurity risks associated with emerging technologies.
Law clerk Stefan Petrovic contributed to this blog post.