CIP-003-9 Is Now Enforceable & OT Ransomware Is Up 49%

It’s Dalton checking in on you. It's hard to believe that we’re already three months into 2026. A lot is changing in the grid security landscape and I know teams are feeling the pressure. My goal is to keep you informed about critical policy changes and deadlines so your program is always ahead of what’s coming. Here's what you need to know this week.

CIP-003-9 is live as of April 1st. The Dragos 2026 OT report dropped in February and the headline numbers are hard to ignore: OT ransomware groups up 49%, Volt Typhoon assessed with five-plus years of dwell time in U.S. infrastructure, and fewer than 10% of OT networks were assessed as having meaningful monitoring.

Also this week: a monitoring standard expanding beyond the Electronic Security Perimeter, a May 15 IBR deadline, and NERC sanctions rising 15% per year through 2028.

Industry Update ⚡️

CIP-003-9 Enforceable as of This Week

As of April 1st,CIP-003-9 is an active compliance requirement. The standard targets vendor remote access to low-impact BES Cyber Systems and malicious communications detection for externally routable assets. Make sure you have documented your vendor electronic remote access controls for SCADA and ICS.

Looking ahead,FERC Order No. 918 (approved March 19) replaces CIP-003-9 with CIP-003-11 (leapfrogging CIP-003-10). The update adds three new control categories: remote user authentication for externally routable assets, protection of authentication credentials in transit, and malicious communications detection across all external connections.

OT Adversaries Are Mapping Your Control Systems

TheDragos 2026 OT Cybersecurity Year in Review documents a clear shift from reconnaissance to destruction. Ransomware groups with OT reach surged 49%year-over-year, with 119 groups now tracked. Three new threat groups are identified: Sylvanite, Azurite, and Pyroxene.

CISA-tracked Volt Typhoon remains active, with U.S. authoring agencies observing the group maintaining access in some victim IT environments for at least five years.

The most actionable finding: fewer than 10% of OT networks have sufficient monitoring.

Organizations with monitoring contained OT ransomware for an average of five days while those without monitoring averaged 42 days of ransom dwell time. It’s never a bad time to pulse check your CIP-007 and CIP-015-1 programs for up-to-date monitoring policies.

CIP-015-2 Passes Industry Ballot: Monitoring Will Expand Beyond the ESP

NERC's CIP-015-2 passed its final industry ballot on March 5. The standard expands Internal Network Security Monitoring beyond the Electronic Security Perimeter to cover Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS), and Shared Cyber Infrastructure (SCI).

The standard now goes to the NERC Board of Trustees for adoption, then a FERC filing. No implementation deadline is set yet.

Compliance Resources 🛠️

IBR Category 2 Registration: Six Weeks to May 15

Generator Owners and Operators with inverter-based resource plants rated 20 MVA or more at 60 kV or higher must register withNERC by May 15, 2026. Eight reliability standards apply on May 15 for registered entities, (MOD-032-1, IRO-010-5, VAR-001-5, VAR-002-4.1, PRC-012-2, PRC-017-1, BAL-001-TRE, and TOP-003-6.1).

NERC Penalty Starting Amounts Rising 15% Per Year Through 2028

Per NERC's Penalty Inflation Adjustment Notice, the ERO Enterprise is increasing starting penalty amounts in the Sanction Guidelines' VRF-VSL Table by 15% per year in 2026, 2027, and 2028.

That means the minimum civil monetary penalty is increasing from $1,000 in 2025 to $1,749 in 2029. The maximum civil monetary penalty will also increase, from $1.58M in 2025 to $1.75M in 2029.

Important Dates 🗓️

April 1: CIP-003-9 and TPL-008-1 become enforceable.

Through April 10: One-on-one sessions between newly registering IBR entities and ERO Enterprise staff.Schedule via your Regional Entity.

May 15, 2026: IBR Category 2 NERC registration deadline for GO-2 and GOP-2 entities.