Power & Pipes

In October 2026, FERC’s Office of Electric Reliability, Division of Cyber Security released its annual Lessons Learned from Commission-Led CIP Reliability Audits summarizing findings from audits conducted during fiscal year 2026. Registered entities should assess their internal compliance programs in light of the trends and issues identified by FERC in preparation for future Critical Infrastructure Protection (CIP) audits, as the issues highlighted in these reports are often covered during audits.  The report highlights compliance with CIP 002-5.1a as a priority for FERC, including registration for new resources, properly accounting for functions performed by third parties, and using AI in a protected environment.

 

On August 26, US President Trump issued an executive order declaring a national emergency regarding risks associated with foreign-produced equipment used in the US bulk-power system. The order cites potential cyber, remote access, sabotage, and supply disruption risks, noting that growing electricity demand increases the consequences of potential attacks on the electric grid.

The US Department of Energy (DOE) and the Department of Commerce (DOC) announced on October 30, 2024 a Memorandum of Understanding (MOU) signed earlier this year to collaborate on safety research, testing, and standards for artificial intelligence (AI). The National Institute of Standards and Technology (NIST), a federal agency within the DOC and a leader in standards development across a range of industries, will represent the DOC under the MOU.

Yesterday marked the start of CERAWeek 2024 by S&P Global, and for the rest of this week Morgan Lewis partners Kirstin Gibbs and Felipe Alice will be reporting back on the key themes and ideas they are uncovering as the conference unfolds.

FERC has issued its final rule paving the way for incentive-based rate treatment for electric utilities that make certain voluntary cybersecurity investments. As we first noted in 2020 when describing the proposed rule, the final rule provides a new mechanism for promoting cybersecurity of the bulk-power system by rewarding utilities for proactively enhancing their cybersecurity programs beyond the mandatory requirements of the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) reliability standards.

There are no unimportant North American Electric Reliability Corporation (NERC) reliability standards, but from time to time, NERC and the Regional Entities (Regions) place greater emphasis on certain reliability standards in response to events affecting the grid. With headline-grabbing physical attacks on power substations across the country in recent months, one of NERC’s greatest current priorities is evaluating the effectiveness of its physical security standards, most notably CIP-014.

The Cybersecurity and Infrastructure Security Agency (CISA) issued a request for information (RFI) on the new cyber incident reporting requirements for critical infrastructure owners as required by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).