CIP-012-2: confidentiality isn't enough anymore

CIP-012-2 replaced CIP-012-1 yesterday. If you own or operate a Control Center that exchanges Real-time Assessment or Real-time monitoring data with another, your documented plan now has to cover availability and recovery, not just confidentiality and integrity. See the checklist below.

NERC opens an additional ballot on draft PRC-029-2 tomorrow, July 3, and it closes July 13. That is a 10-day window across a holiday weekend.

Physical Areas land in the Raptor Comply platform, making physical access requests easier and more accurate, and we are calling on feedback for a revamped Baseline Configuration figure.

Product Update

Physical Areas for Access Requests

Facility and control center asset inventories now include a Physical Areas section. Define named areas, like the Control House or BESS Yard, and link the cyber assets that sit inside each one. When someone requests physical access, they pick the area instead of hunting through the asset list, and every linked cyber asset rides along automatically. Field technicians and vendors no longer need to know which cyber assets sit behind a door to file a correct request, and the same flow works on the sharable form link, so field crews can submit from a phone at the gate.

The access control report export on the Evidence folder page gains a matching Physical Areas column, so area-based requests show up audit-ready in the same CSV your evidence already lives in.

Feedback Wanted: Baseline Configurations

Industry Update

Washington and Berlin Both Move on Chinese Inverters

Reuters reports the administration is drafting a ban on new foreign models of inverters, the equipment that connects solar and battery projects to the grid, over concerns they could be used to disrupt power supplies. The rule is being drafted at the Federal Communications Commission and could be published as early as this year. The move follows the European Commission's May decision to bar Chinese-made inverters from publicly funded projects, and Germany is now weighing its own restrictions after a parliamentary inquiry into cybersecurity risks in energy infrastructure.

For owners and operators of solar and storage fleets, the direction of travel is clear even before any rule publishes: equipment provenance is becoming a regulatory question, not just a procurement one. An inventory of inverter makes, models, firmware versions, and remote-update paths is the groundwork for whatever disclosure or replacement requirements follow, and for the supply-chain risk conversations your compliance program already owes under CIP-013 where BES Cyber Systems are in scope.

Five Eyes on AI and Cyber Risk: "The Timeline Is Not Years, It Is Months"

The heads of the Five Eyes cyber agencies, including CISA and the NSA, issued a rare joint statement on June 22 warning that frontier AI models are about to transform offensive cyber operations: "Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months."

The practical guidance is not exotic. The agencies direct leaders to assess risk, readiness, and accountability, and to prioritize foundational security controls, because AI compresses the time between a weakness existing and a weakness being found. For energy operators, that reframes basic hygiene work, credential rotation, multi-factor authentication, patch discipline, as the highest-leverage response to a headline-grade threat.

FortiBleed: Credential Harvesting at the Grid's Perimeter

CISA urged organizations on June 18 to harden Fortinet devices after researchers reported a campaign, dubbed FortiBleed, that has harvested credentials tied to roughly 86,600 FortiGate devices across 194 countries, with critical infrastructure among the affected sectors. There is no new vulnerability here: attackers reused credentials from earlier breach dumps and brute-forced internet-facing devices with weak passwords and no multi-factor authentication, then used compromised firewalls as listening posts to collect more credentials from VPN traffic.

If Fortinet gear sits at your plant or Control Center perimeter, the Five Eyes report suggests: enforce multi-factor authentication on management and VPN interfaces, rotate credentials that predate the campaign, and check your exposure. For CIP programs, this is also an evidence moment: your CIP-005 interactive remote access controls are only as good as the credential hygiene behind them.

Compliance Resources

CIP-012-2 Is Live: Three Things to Confirm This Week

CIP-012-2 became enforceable yesterday, July 1, replacing CIP-012-1 for Responsible Entities that own or operate a Control Center, including GOs and GOPs. Version 2 keeps the confidentiality and integrity protections and adds two plan elements: methods to mitigate the loss of your ability to communicate Real-time Assessment and Real-time monitoring data (Part 1.2), and methods to initiate recovery of lost communication links (Part 1.3).

Three things to confirm now: your plan explicitly covers availability and recovery, not just confidentiality and integrity; you can show how you would know a link is down, because initiating recovery presupposes noticing the loss; and where the Control Center on the other end belongs to another entity, the plan names who does what to restore the link (Part 1.5), not just who protects it. Plan updates should be documented and dated on or before yesterday, with evidence matching the updated scope.

PRC-029-2 Ballot Opens Friday: A 10-Day Window Over the Holiday

NERC's Project 2025-05 Ride-Through Revisions posts draft PRC-029-2 for additional ballot and a non-binding poll of its Violation Risk Factors and Violation Severity Levels from July 3 through July 13. The revision responds to FERC Order No. 909, issued July 24, 2025, which approved PRC-029-1 and PRC-024-4 and directed NERC to file revisions rebalancing the ride-through requirements within 12 months.

Note the sequence: PRC-029-1 does not take effect until October 1, 2026, and its successor is already on the ballot. If your fleet includes IBRs, this draft is where the ride-through obligations you will actually live under are being shaped, and the voting window spans July 4. Confirm your ballot body representative is registered and briefed.

Important Dates

• July 3-13, 2026: PRC-029-2 additional ballot and non-binding poll open in the NERC balloting system (Project 2025-05).

• July 16, 2026: FERC July Open Meeting. The sunshine notice typically posts about a week before; large-load items are likely given FERC's June show-cause orders.

• August 3, 2026: NERC Level 3 Alert entity responses due on modeling, study, protection, and communications practices for large loads.

If you're based in Canada, hope you had a great Canada Day, and if you're based in the US, we wish you a restful long weekend!