Key Takeaways
- FERC staff’s 2026 CIP audit report finds that most audited entities meet the CIP Reliability Standards, but compliance gaps remain, especially for new entrants and new technologies such as AI.
- Developers of new generation should register with NERC and identify BES Cyber Systems by the NERC-defined commercial operation date, not when full nameplate capacity or all project phases are online.
- Generator Operators relying on an affiliate or third-party for monitoring and control of their generating resource should account for aggregation when assigning impact ratings to their generator’s BES Cyber Systems.
- Registered Entities using AI tools in CIP environments should carefully authorize, inventory and monitor those tools and watch for further NERC guidance.
On Oct. 13, 2026, the Federal Energy Regulatory Commission’s (FERC) Office of Electric Reliability, Division of Cyber Security released its annual “lessons learned” report based on FERC-led audits of compliance with the North American Electric Reliability Corporation’s (NERC’s) Critical Infrastructure Protection (CIP) Reliability Standards. The annual report for fiscal year 2026 (CIP Report)[1] provides Generation Owners (GOs), Generation Operators (GOPs) and other types of entities registered with NERC (Registered Entities) critical insights into FERC staff’s interpretation of the relevant CIP Reliability Standards, as well as actionable recommendations for enhancing compliance.
FERC has issued similar reports for the past 10 years to identify compliance gaps and provide recommendations to address emerging cybersecurity risks. Compliance with NERC Reliability Standards is mandatory for all Registered Entities. Failure to comply exposes entities to penalty risk and costly mitigation efforts and can jeopardize transactions involving relevant generation and transmission assets.
The CIP Report found that most cybersecurity protection processes and procedures adopted by the audited Registered Entities met the CIP Reliability Standards, but gaps remain. Accordingly, the CIP Report provides information and recommendations to NERC, Regional Entities and Registered Entities on cybersecurity risks.
The CIP Report identifies three lessons learned from the audits. While CIP Reliability Standards are now 20 years old and industry compliance programs have matured significantly, compliance issues persist, especially for new entrants and with use of new technologies, particularly AI.
Lesson 1: Timely Registration of New Generation
The Reliability Standards require GOs — a specific category of NERC Registered Entity that owns generation equipment — to register with NERC and the applicable Regional Entity and to promptly identify and categorize associated Bulk Electric System (BES) Cyber Systems.[2] Several audits identified examples of new GOs failing to timely register with NERC and therefore failing to timely identify and categorize the associated risk of their BES Cyber Systems. In other cases, registered GOs failed to identify BES Cyber Systems. FERC staff found these failures were often due to a misunderstanding or lack of awareness of the appropriate commercial operation date (COD) for purposes of NERC registration and compliance.[3] For example, some audited entities delayed NERC registration until their generating resources achieved full nameplate capacity. Similarly, owners of multiphase generation resources waited until all phases were interconnected before registering and identifying and categorizing associated BES Cyber Systems, when they should have completed these steps as soon as the commercially operational phases of the generating resources reached the applicable threshold for GO registration and BES Cyber System identification.[4] The CIP Report notes that timely identification of BES Cyber Systems is the “cornerstone” of the CIP Reliability Standards, and GOs should apply the NERC definition of COD to ensure timely compliance with CIP-002-5.1a.[5]
Compliance Takeaway: Entities developing new generation projects should build in adequate time and processes to complete NERC registration and ensure compliance with the applicable reliability standards as of the NERC-defined COD. This includes identification of all BES Cyber Systems (and associated BES Cyber Assets) and implementation of all necessary protection measures to comply with the CIP Reliability Standards. For purposes of NERC compliance, COD means “the date after which all initial testing and commissioning has been completed and is the initiation date on which the Generator Owner and Generation Operators can start producing electricity for sale,” and should coincide with the date when the facility’s output first meets or exceeds the size thresholds provided in the applicable Reliability Standards.
Lesson 2: Account for Affiliate and Third-Party Monitoring and Control When Categorizing BES Cyber Systems
The Reliability Standards require Registered Entities to identify and categorize all BES Cyber Systems and associated BES Cyber Assets that are used to monitor and control BES generation resources. The CIP Report identified two scenarios in which BES Cyber Systems used by affiliates or third parties to monitor and control generators were not properly identified by GOPs — a type of Registered Entity that operates a generating resource.
In the first scenario, FERC staff observed circumstances in which a parent company had multiple affiliated GOPs, which classified their respective BES Cyber Systems as “low impact,” but the parent company maintained monitoring and control capability over the affiliated generation resources at a single control center. Yet, the CIP Report concluded that, in the aggregate, the BES Cyber Systems should have been classified as “medium impact.”[6] In the second scenario, multiple unaffiliated GOPs contracted with the same third-party vendor to perform monitoring and control of their generation resources. Each GOP identified its respective BES Cyber Systems as “low impact.” However, FERC staff found the third party provided monitoring and control for multiple generation resources which, in the aggregate, was commensurate with a “medium impact” rating.[7]
The CIP Report concluded that these Registered Entities failed to properly account for the aggregation of their facilities in determining the appropriate impact rating. By not properly identifying and categorizing the BES Cyber Systems, these entities may fail to implement the appropriate levels of controls necessary to mitigate risks to the Bulk-Power System.[8] Notably, the CIP Report also called on NERC to consider providing further guidance or revising the Reliability Standards or registration procedures, or to address the risks of aggregation identified by FERC staff in the CIP Report.[9] According to the CIP Report, “[h]ousing control of multiple generation resources at a single location with a de facto operator enhances the cybersecurity risk, and NERC should consider appropriate action.”[10]
Compliance Takeaway: GOs and GOPs under common affiliated control or that use third-party vendors responsible for monitoring and/or controlling other unaffiliated generation resources should assess and ensure that their systems are properly categorized. For scenarios in which a GO does not perform the GOP function, the GO should be mindful of this issue and evaluate any compliance responsibility agreements with the GOP.
Registered Entities should be on the lookout for any guidance or other action by NERC on aggregated generator monitoring and operational functions given the prompting in the CIP Report.
Lesson 3: Authorize and Actively Manage AI Tools
Under Reliability Standard CIP-004-7, Requirement R4, Registered Entities must have a documented process “to authorize based on need” electronic access to high- and medium-impact BES Cyber Systems. Once access to such systems is granted, a Registered Entity must periodically verify and timely revoke such access when necessary.
The CIP Report recognized the increasing use of AI (the CIP Report refers to this as super intelligence or SI) tools in BES Cyber Systems. The CIP Report found that entities generally had appropriate access controls in place and were actively monitoring AI access. However, the CIP Report also acknowledged that as AI tools continue to advance, compliance and monitoring tools will also need to evolve. Further, the growing sophistication of AI capabilities may “enable these tools to perform actions that mimic user behavior, increasing the difficulty of distinguishing legitimate activity from malicious use that complicates detection and response efforts.”[11]
Noting that the use of AI is not expressly permitted or prohibited by the CIP Reliability Standards, the CIP Report encouraged Registered Entities to think carefully about employing AI tools at all in CIP environments and provided four recommendations for Registered Entities that choose to do so:
- Ensure all AI tools’ access to communications outside the CIP-005 electronic security perimeter is understood and monitored, including the reason for granting access.
- Identify and inventory AI tools as generic service accounts per Reliability Standard CIP-007, and ensure that default passwords, if applicable, are changed.
- Limit AI tools’ ability to access BES Cyber System Information per Reliability Standard CIP-011.
- Identify and assess the risks from AI products or services from prospective vendors as part of their CIP-013 supply chain risk management plan. The CIP Report encourages Registered Entities to use a risk management framework (e.g., NIST AI 100-1 Artificial Intelligence Risk Management Framework (AI RMF 1.0)) when implementing AI within their networks.
Compliance Takeaway: AI tools are becoming increasingly prevalent, yet they could present targets for adversaries with potential for significant risk. Registered Entities should carefully consider the risks associated with AI tools in CIP environments and look to NERC and Regional Entities for continued guidance on this evolving topic.
McGuireWoods is available to assist with any FERC and NERC compliance questions. For more information, contact the authors or a member of the firm’s Federal Energy Regulatory Commission team.
[1] The full CIP Report is available at https://www.ferc.gov/news-events/news/ferc-staff-report-offers-lessons-learned-2026-cip-audits.
[2] NERC Rules of Procedure, App. 5B (effective Jun. 27, 2024); Reliability Standard CIP-002-5.1a.
[3] CIP Report at 7 (explaining, “NERC’s Enterprise Registration Procedure defines COD as ’the date after which all initial testing and commissioning has been completed and is the initiation date on which the Generator Owner and Generation Operators can start producing electricity for sale’”) (citing NERC, ERO Enterprise Registration Procedure at 16 (Jun. 11, 2026)).
[4] CIP Report at 7.
[5] CIP Report at 8.
[6] CIP Report at 9.
[7] CIP Report at 9-10.
[8] CIP Report at 10.
[9] CIP Report at 10.
[10] CIP Report at 10.
[11] CIP Report at 11-12.