FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools ...

The Federal Energy Regulatory Commission (FERC) identified gaps in cybersecurity compliance among U.S. electricity sector entities, including delays in registering new generation resources, incomplete identification of critical cyber systems and access control risks associated with emerging artificial intelligence tools. During the CIP audits, staff found that while most cybersecurity protection processes and procedures adopted by registered entities met mandatory requirements of the CIP Reliability Standards, potential non-compliance and security risks remained. Staff also identified practices not required by the CIP Reliability Standards that could improve cybersecurity, which this report includes as voluntary cybersecurity recommendations.

In its staff report, Lessons Learned from Commission-Led CIP Reliability Audits, FERC’s Office of Electric Reliability detailed findings from fiscal 2026 audits of several U.S.-based entities registered with the North American Electric Reliability Corporation (NERC). Although most cybersecurity protection processes and procedures reviewed met mandatory Critical Infrastructure Protection (CIP) Reliability Standards, auditors found potential noncompliance and security risks that could affect the reliable operation of the Bulk-Power System.

The report found that some generator owners failed to register new generation resources with NERC or promptly identify and categorize associated bulk electric system (BES) cyber systems under Reliability Standard CIP-002-5.1a. Misunderstandings commercial operation date contributed to delays, including cases involving inverter-based resources that had begun commercial operations but had not undergone the required cybersecurity evaluation.

The 2026 FERC lessons are intended to help registered entities improve their compliance with the CIP Reliability Standards. Under CIP-002-5.1a, R1, entities should ensure that all generation resources synchronized to the BES and generating power above the applicable threshold in the BES definition are registered with NERC on time and evaluated for BES Cyber System identification and categorization.

Also under CIP-002-5.1a, R1, Generator Operators (GOPs) should ensure that all affiliate and third-party cyber systems used to monitor and control BES generation resources are considered as part of their BES Cyber System identification and categorization procedures. Under CIP-004-7, R4, R5, and R6, entities should ensure that access by SI tools to BES Cyber Systems and BES Cyber System Information is authorized.

FERC staff also found that some entities failed to account for monitoring and control capabilities operated by affiliated companies and third-party contractors. In two cases, systems individually categorized as low impact collectively met criteria for medium-impact classification, potentially leaving them subject to insufficient cybersecurity controls.

FERC staff also highlighted access control risks as super intelligence (SI) tools, including chatbots, personal assistants and automated analytical systems, become more deeply embedded in networks supporting critical infrastructure protection assets. While these tools can improve operational efficiency, their growing ability to mimic user behavior, interact with systems and automate tasks could introduce unauthorized access and lateral movement risks if not properly monitored.

“This anonymized summary report informs the regulated community and the public of lessons learned from the FY 2026 CIP audits,” FERC said in its report. “This report provides information and recommendations to NERC, Regional Entities, and registered entities for use in their assessments of risk and compliance, and to improve overall cybersecurity. Moreover, this information may be generally beneficial to the utility-based cybersecurity community to improve the reliability and security of the Bulk-Power System.”

The FERC report highlights three lessons learned from the FY 2026 CIP Audits. First, several Generator Owners did not register new generation resources with NERC or identify and categorize the associated BES Cyber Systems under CIP-002-5.1a promptly. Misinterpretation of the Commercial Operation Date (COD) delayed implementation of mandatory cybersecurity requirements, leaving protections inadequate or absent.

Second, entities did not adequately account for monitoring and control functions performed by affiliates and third-party contractors when categorizing BES Cyber Systems. In these cases, aggregated control capabilities posed greater risk than those of individual Generator Owners. As a result, potentially medium-impact BES Cyber Systems were treated as low-impact and protected by controls not commensurate with their risk.

Third, audit staff observed growing use of SI tools, including chatbots, personal assistants, and automated analytical systems, within CIP-networked environments. While these tools can improve efficiency, they may introduce access control risks if access is not authorized, verified, and monitored. Entities must ensure that SI-facilitated access is controlled, regularly reviewed, and covered by existing risk management frameworks.

Together, these lessons underscore the need for timely compliance, accurate identification and categorization of BES Cyber Systems, and access controls commensurate with risk, including for functions performed by affiliates, contractors, and SI tools. They reinforce the foundational role of the CIP Reliability Standards in securing the Bulk-Power System.

FERC reported that under CIP-002-5.1a, R1, all generation resources synchronized to the BES and generating power above the applicable threshold in the BES definition must be registered with NERC promptly and evaluated for BES Cyber System identification and categorization. Audit staff found that some entities did not register with NERC as new generator owners and therefore did not conduct the required review to identify BES Cyber Systems, while others registered but did not complete a timely review. In several instances, an inverter-based resource (IBR) was synchronized to the BES, had achieved commercial operation beyond initial testing, and exceeded the applicable threshold, yet its associated cyber systems were not identified and categorized as BES Cyber Systems.

In both scenarios, the delays stemmed from a misunderstanding or unawareness of NERC’s definition of Commercial Operation Date (COD), which is the date after which all initial testing and commissioning have been completed, and the Generator Owner and Generation Operators can start producing electricity for sale. NERC explains that resources that begin commercial operation in phases must register when they achieve commercial operation for an aggregate amount above the applicable threshold, so that the effective registration date coincides with the COD for that phase.

Upon registration, all generating resources are expected to be 100% compliant with all applicable Reliability Standards. Some generator owners, however, waited until they reached full nameplate capacity and completed all phases of the interconnection queue before considering registration and CIP-002 evaluation. One entity delayed registration for over a year after exceeding the threshold, showing that an entity actively attempting to meet its interconnection obligations may still inadvertently neglect its cybersecurity requirements or fail to comply on time.

Timely identification and categorization of BES Cyber Systems is essential because it is the cornerstone of the CIP Reliability Standards, providing the risk-based criteria that determine how an entity must comply with the remaining CIP requirements. Delays can result in misapplied or missing security controls, increasing exposure to vulnerability and the potential for compromise, and heightening risk to the reliable and secure operation of the BES.

To mitigate this risk, generation owners and operators should apply NERC’s definition of COD to determine appropriate timing for registration and compliance. Entities that own a qualifying generation resource should ensure timely registration with NERC and timely identification and categorization of BES Cyber Systems and associated BES Cyber Assets under CIP-002-5.1a, and entities already registered must review their generation resources to do the same.

Under CIP-002-5.1a, R1, Generator Operators (GOPs) must consider affiliate and third-party cyber systems used to monitor and control BES generation resources as part of their BES Cyber System identification and categorization procedures. Correct identification and categorization allow cybersecurity requirements to be applied commensurate with the adverse impact that loss, compromise, or misuse of those systems could have on the reliable operation of the BES, using the impact criteria.

Audit staff identified two circumstances in which an unregistered entity performed, or could perform, generation monitoring and control at an aggregation point, such as a generation control center, on behalf of multiple registered GOPs. In both, each GOP identified one or more low impact BES Cyber Systems, but the aggregate function performed by the unregistered entity met the criteria for a medium impact rating and therefore carried increased compliance responsibility.

In the first circumstance, a parent company that was not registered for any function had multiple affiliated companies, each separately registered as a GOP and each categorizing its BES Cyber Systems as low impact. The parent, however, maintained monitoring and control capability at a single control center for the affiliates’ generation resources, which in aggregate was commensurate with a medium impact rating. In the second, multiple unaffiliated GOPs contracted with the same third party, such as a vendor, contractor, or service provider, to perform monitoring and control of their generation resources.

As in the first case, each GOP identified its systems as low impact, but the third party collectively provided monitoring and control that in aggregate was commensurate with a medium impact rating. In both cases, affiliates and third parties exercised control that could have a material impact on the reliability of the Bulk-Power System, yet when audit staff raised these concerns, registered entities were reluctant to those capabilities.

Failing to properly identify and categorize BES Cyber Systems exposes entities to significant reliability and security risks, because insufficient or missing security controls leave those systems inadequately protected. As control capabilities become more diverse, remote, and complex, identification and categorization must evolve so that systems, individually or in aggregate, are classified commensurate with the risk of their loss, compromise, or misuse.

In the two circumstances observed, the entities failed to account for the aggregation of their own and other parties’ cyber assets, so the assets were categorized as low rather than medium impact and were not subject to the increased requirements for medium impact facilities.

Demonstrating compliance for all cyber systems that should be categorized as BES Cyber Systems, including those operated by an affiliate or third party, is the responsibility of all GOPs. That said, NERC should consider providing further guidance or modifications to the Reliability Standards or registration procedures to address these circumstances, since housing control of multiple generation resources at a single location with a de facto operator increases cybersecurity risk and warrants appropriate action.

The FERC reported that CIP-004-7 , R4, R5, and R6 require that access to BES Cyber Systems and BES Cyber System Information (BCSI) facilitated by super intelligence (SI) tools be authorized. Under R4, registered entities must have a documented process to authorize electronic access to high- and medium-impact BES Cyber Systems based on need, and must periodically verify that the access remains necessary once granted. R5 requires timely revocation of a user’s electronic access to those systems when necessary, and R6 requires entities to authorize, regularly verify, and timely revoke a user’s provisioned access to BCSI as the need arises.

Audit staff observed that SI tools have become more deeply embedded in CIP-networked environments, offering significant efficiencies in automating routine cybersecurity tasks and streamlining analysis workflows. While most entities have mature access control programs, the rapid adoption and evolution of SI tools have introduced new risks that entities must proactively assess and manage.

Audit staff found that registered entities generally accounted for SI tools in their CIP-networked environments and applied appropriate controls, but they observed variations in how entities addressed SI access. SI tools offer useful capabilities, including machine learning that adapts to new situations and optimizes performance over time. Most SI tools are currently limited to chatbots that answer questions and personal assistants that organize schedules or draft emails, but they are becoming more sophisticated, monitoring communication networks, reacting to threats, and performing operations similar to users.

During audit interviews, entities noted that many vendors and suppliers now add SI tools to their products and services while compliance programs are slow to adapt. They also noted that SI tools may mimic user behavior, making it harder to distinguish legitimate activity from malicious use and complicating detection and response. If not properly monitored and controlled, these tools may introduce unanticipated lateral-movement vectors or enable unauthorized access to BES Cyber Systems and BCSI. Entities further indicated that the scope and ability of SI tools may not be fully understood until the products or services are active on their networks, creating access control risks.

As SI tools become increasingly prevalent in all software, their integration into BES Cyber System products and solutions is becoming commonplace. Because these tools may have unrestricted access across systems, they have become attractive targets for adversaries, and NERC’s CIP Roadmap identifies targeting of SI tools as an emerging risk. Recent real-world intrusions show that, if not properly protected, commercially available SI tools residing on entity systems can be leveraged to map environments, identify pathways toward critical systems, accelerate reconnaissance, and automate exploitation attempts.

Although the CIP Reliability Standards neither explicitly allow nor prohibit SI tools, entities should consider the risks these tools pose when evaluating their BES Cyber Systems and apply appropriate controls. They should first consider the business need for deploying SI tools in a CIP-networked environment, and properly grant, regularly verify, and timely revoke electronic access to BES Cyber Systems and BCSI facilitated by SI tools under CIP-004.

Entities should also understand and monitor SI tools’ access to communications outside the CIP-005 electronic security perimeter, including the reason for granting it. In addition, they should identify and inventory SI tools as generic service accounts under CIP-007 and change any default passwords, limit SI tools’ access to BCSI under CIP-011, and assess the risks of SI products or services from prospective vendors as part of their CIP-013 supply chain risk management plan. Finally, entities should use a risk management framework, such as NIST AI 100-1 (AI RMF 1.0), when implementing SI within their networks.

The report recommends that registered entities assess the business need for deploying these tools, authorize and regularly review their access to BES cyber systems and associated information, monitor external communications, inventory tools as generic service accounts, and assess vendor-related risks through supply chain security programs. It also recommends applying appropriate risk management frameworks to help address emerging threats associated with SI technologies.