Power & Pipes

In October 2026, FERC’s Office of Electric Reliability, Division of Cyber Security released its annual Lessons Learned from Commission-Led CIP Reliability Audits summarizing findings from audits conducted during fiscal year 2026. Registered entities should assess their internal compliance programs in light of the trends and issues identified by FERC in preparation for future Critical Infrastructure Protection (CIP) audits, as the issues highlighted in these reports are often covered during audits.  The report highlights compliance with CIP 002-5.1a as a priority for FERC, including registration for new resources, properly accounting for functions performed by third parties, and using AI in a protected environment.

 

On August 26, US President Trump issued an executive order declaring a national emergency regarding risks associated with foreign-produced equipment used in the US bulk-power system. The order cites potential cyber, remote access, sabotage, and supply disruption risks, noting that growing electricity demand increases the consequences of potential attacks on the electric grid.

FERC recently approved a stipulation and consent agreement between the Los Angeles Department of Water and Power (LADWP) and Office of Enforcement and Regulatory Accounting to resolve an investigation into potential violations of the North American Electric Reliability Corporation (NERC) Rules of Procedure (ROP) and FERC regulations during a 2020 audit by the Western Electricity Coordinating Council. The settlement, and with it the large monetary penalty and additional compliance obligations, underscores the critical importance of transparency, accuracy, and truthfulness in reliability compliance monitoring and enforcement.

The US Department of Energy (DOE) and the Department of Commerce (DOC) announced on October 30, 2024 a Memorandum of Understanding (MOU) signed earlier this year to collaborate on safety research, testing, and standards for artificial intelligence (AI). The National Institute of Standards and Technology (NIST), a federal agency within the DOC and a leader in standards development across a range of industries, will represent the DOC under the MOU.

Electric vehicle (EV) charging relies on a complex ecosystem involving multiple entities, including utility operators, third-party data network providers, charging infrastructure owners, and the EVs themselves. The high degree of digital interconnectivity required to run that ecosystem presents significant cybersecurity risks, including the potential for data theft, physical property damage, and electric grid disruptions.

FERC has issued its final rule paving the way for incentive-based rate treatment for electric utilities that make certain voluntary cybersecurity investments. As we first noted in 2020 when describing the proposed rule, the final rule provides a new mechanism for promoting cybersecurity of the bulk-power system by rewarding utilities for proactively enhancing their cybersecurity programs beyond the mandatory requirements of the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) reliability standards.

On March 16, FERC approved North American Electric Reliability Corporation (NERC) Reliability Standard CIP-003-9, Cyber Security – Security Management Controls, which introduces two new requirements to the suite of cybersecurity protections for low-impact bulk electric system (BES) cyber systems. The requirements focus on mitigating a supply chain risk that continues to challenge the electric industry: vendor remote access to critical electronic systems. The new rule will ensure these vendor risk mitigation requirements apply across every BES facility in the continental United States.

On March 2, the White House issued the National Cybersecurity Strategy (the Strategy), a broad vision to reinvigorate the federal government’s approach to cybersecurity and address a wide spectrum of long-term challenges. The Strategy reflects the latest significant cybersecurity-focused activity from the Biden administration and contains an ambitious set of goals and initiatives.

The Cybersecurity and Infrastructure Security Agency (CISA) issued a request for information (RFI) on the new cyber incident reporting requirements for critical infrastructure owners as required by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).

Be sure to check out the latest issue of Empowered, our energy industry newsletter.