FERC approves historic CIP overhaul: virtualization, low-impact controls, and a new Control Center definition

It's an historic week for NERC compliance and we're nerding out pretty hard over here.

FERC just approved three orders that reshape the CIP landscape: 11 virtualization-enabled standards, new low-impact controls in CIP-003-11, and an updated Control Center definition with a compressed 3-month timeline. More on what changed and what you need to do below.

It's also under two weeks until CIP-003-9 enforcement starts on April 1, and low-impact entities need to have their vendor electronic remote access controls finalized. Don't miss registration for NERC's Cat 2 webinar (link below) on March 26.

That's not it... International insights from a wiper malware attack on Polish energy facilities, and from new research tracking 119 cyberattacks on energy infrastructure between 2022 and 2024. Underscoring why the low-impact controls in CIP-003-9 matter.

On our end, we've launched Nico the NERC CoPilot: an AI assistant trained on the full NERC Standards library, Rules of Procedure and Glossary of Terms. Nico can answer your compliance questions in seconds. Available upon request for existing customers.

Industry Update ⚡️

FERC Approves Virtualization Overhaul and New Low-Impact Controls

FERC unanimously approved three orders that reshape the CIP landscape. Order No. 919 finalizes 11 virtualization-enabled CIP standard (CIP-002-7 through CIP-013-3). For entities running virtualized OT environments, the 24-month implementation window starts when the order hits the Federal Register.

Order No. 918 approves CIP-003-11, adding three new control categories for low-impact BES Cyber Systems: remote user authentication, credential protection in transit, and detection of malicious communications. That standard gets a 36-month runway.

The most urgent piece is CIP-002-8, which updates the Control Center definition to explicitly include Transmission Owner SCADA facilities controlling assets at two or more locations. That one has just a 3-month implementation timeline.

Great coverage from Ampyx Cyber here.

CIP-003-9 Enforcement Begins April 1

NERC CIP-003-9 becomes enforceable on April 1, 2026. The standard introduces documented vendor electronic remote access security controls for low-impact BES Cyber Systems under Requirement R1, Part 1.2.6. These must be fully implemented on day one. The remaining periodic actions can continue on their regular schedule.

Poland Energy Sector Attack: Wiper Malware Destroys OT Device Firmware

In December 2025, threat actors compromised OT and ICS systems across multiple Polish energy facilities, including renewable energy plants and a combined heat and power facility. CISA and DOE CESER issued a joint alert in February amplifying the incident for U.S. critical infrastructure operators.

The attackers gained initial access through vulnerable internet-facing edge devices, then deployed wiper malware that destroyed data on HMIs and corrupted firmware on remote terminal units (RTUs). The result: operators lost the ability to monitor or control facilities, even though the renewable energy systems themselves continued operating. CISA's recommendations focus on securing edge devices, implementing firmware verification, and updating incident response plans to account for OT device failures. PV Magazine is hosting a technical dive on April29, 2026: Decoding the First Massive Cyberattack on Europe's Solar Energy Infrastructure.

119 Cyberattacks on Energy Infrastructure in Three Years

Researchers at the University of Belgrade published a dataset of 119 cybersecurity incidents targeting global energy infrastructure between 2022 and 2024. The power sector accounted for 36% of all incidents (44% including nuclear facilities), with ransomware dominating at 51% of attacks.

The geographic pattern shifted over the period: 2022 attacks concentrated on Europe, while 2023 and 2024 saw North America and Asia become primary targets. For U.S. energy operators, the trend line is clear and moving in the wrong direction.

Product Updates 🚀

Nico the NERC CoPilot is live - just in time to walk you through CIP-003-9!

Get in touch if you'd like to take Nico for a spin. Here's an example question that took under 5 seconds to answer. You'll note that sources are always stated along with hyperlinks so you can verify all answers.

Compliance Resources 🛠️

Info-Tech Research Group: Compliance governance must be operational

A new report from Info-Tech Research Group (published March 19, 2026) advises electric utilities to adopt a three-phase governance framework for NERC CIP: establish program, identify obligations, implement strategy. The report highlights common gaps including unclear control ownership between IT and OT teams, reliance on manual evidence collection, and legacy infrastructure that does not align with modern compliance tools. Worth reading if your compliance program is still built around periodic audits rather than continuous operational discipline.

We fully support this philosophy of integrating OT security and compliance process. Sharon Koller, Lead Compliance Strategist & CIP Senior Manager at American Transmission Co. nailed in the quote below:

IBR Cat 2 Registration Webinar

NERC IBR Registration Webinar: March 26, 2026. Covers registration requirements for solar/storage facilities. Register here.

CESER Five-Year Strategic Plan

Lastly, the Department of Energy's cybersecurity office released its first five-year strategic plan, covering OT security training, threat information sharing, and support for smaller energy operators with limited cybersecurity resources.