FERC staff's report on the 2026 CIP audits draws two of its three lessons from generation: inverter-based resources past commercial operation with no CIP-002 categorization, and control centers rated low impact that met medium impact criteria in aggregate. The third covers AI tools inside CIP environments.

NERC's computational load standards passed final ballot. CISA added four remote-access and perimeter vulnerabilities to its Known Exploited Vulnerabilities Catalog, Germany's BSI published guidance on internet-connected plant controls, and the ERO Enterprise set out its cold weather themes ahead of winter.

Note: this newsletter is going monthly for the time being, so your next issue arrives in November! This is so we can serve up the punchiest news items for you.

Industry Update ⚡️

FERC's 2026 CIP Audit Lessons Center on Generation

FERC's Office of Electric Reliability published its lessons learned from the fiscal 2026 CIP audits on October 13. Staff found that most audited processes met the CIP standards, and drew three lessons:

• Registration and CIP-002 timing. Auditors found multiple inverter-based resources that were synchronized to the bulk electric system (BES), past commercial operation and above the BES threshold, but whose cyber systems had not been identified and categorized under CIP-002-5.1a R1. Some owners were waiting until they reached full nameplate capacity and completed every phase of the interconnection queue. Staff points to NERC's Commercial Operation Date definition: a phased resource must register once the capacity in commercial operation exceeds the threshold.

• Aggregated control. In one case an unregistered parent company, and in another a shared third-party contractor, monitored and controlled generation for several Generator Operators (GOPs) from one control center. Each GOP rated its systems low impact; in aggregate, the control center met the medium impact criteria. Staff says compliance remains the responsibility of each GOP, and that NERC "should consider appropriate action."

• AI tools. Staff says access facilitated by what the report calls "super intelligence (SI) tools" falls under CIP-004-7 R4, R5 and R6, so it must be authorized, verified and revoked like other access to high impact BES Cyber Systems, medium impact BES Cyber Systems with External Routable Connectivity, and their BES Cyber System Information. The report also suggests inventorying the tools as generic accounts under CIP-007 and assessing them in CIP-013 supply chain plans.

Computational Load Standards Pass Final Ballot

Every item in the Project 2026-02 final ballot passed when it closed on October 14. CLO-001-1, CLO-002-1 and CLO-003-1 drew between 78.13% and 82.69% weighted segment approval, and the FAC-001-5 and FAC-002-5 revisions drew 95.51%. NERC says the standards now go to the Board of Trustees for adoption and then to FERC.

CLO-001-1 would reach a Generator Owner that has a Computational Load Site interconnection, or a fully executed agreement to study the reliability impact of one. Its implementation plan would make the standard effective on the first day of the first calendar quarter after regulatory approval. Requirements R1 to R3, which include the Generator Owner's interconnection requirements in R3, would come due six months after that.

Four Perimeter Vulnerabilities Added to CISA's KEV Catalog

CISA added four remote-access and perimeter vulnerabilities to its Known Exploited Vulnerabilities Catalog between October 13 and 16:

• Ivanti Connect Secure (CVE-2026-104935): an authentication bypass that lets a remote, unauthenticated attacker execute commands. Ivanti reports exploitation at a limited number of customers. Fixes are in 25.1.1.2 and 22.8R2.5, and the flaw is not present in 25.1.3.0 or later.

• Palo Alto Networks PAN-OS (CVE-2026-0322, CVSS v4 8.6): authenticated remote code execution with root privileges through the management interface. Restricting management access to a jump box reduces the risk.

• BeyondTrust Remote Support (CVE-2026-102764, CVSS v4 9.3): lets a remote attacker perform file operations on the appliance. Self-hosted instances not on automatic updates need the patch applied manually.

• Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624): a path traversal that lets an authenticated administrator with read-write permissions write or delete files. Installations on FortiOS 6.4, 7.0 and 7.2 need to migrate to a fixed release.

Germany's BSI: Take Plant Controls Off the Internet

Germany's federal cybersecurity agency published recommendation BSI-CS 154 on internet-connected OT, aimed mainly at operators of small industrial sites, among them hydro, wind and combined heat and power plants, and solar plants of any size. The first step is to cut direct internet access to PLC, SCADA and HMI devices and to router and firewall management interfaces. Remote access then goes behind a VPN, ideally with multifactor authentication on access to the controllers. It cites the December 2025 attacks on Polish wind farms, which exploited unchanged default credentials and passwords reused across sites.

Compliance Resources 🛠️

Cold Weather: The ERO Enterprise's Four Themes

The ERO Enterprise's Themes and Best Practices: Extreme Cold Weather, dated October 1, groups what Regional Entity outreach, monitoring and enforcement have found into four themes: inadequate programs, component identification, a minimalist approach to preparedness, and external interdependencies and fuel assurance.

For Generator Owners under EOP-012-3, the section most directly on point covers in-field verification: pre-season, real-time and post-season walkdowns of critical components and freeze protection, by someone independent of the program owner, with failures tracked in a corrective action program. The report also finds less mature programs among new non-traditional owners and owners with limited cold weather exposure. Its best practices are not mandatory.

Important Dates 🗓️

• October 22, 2026: Comments close on the two Large Loads Standard Authorization Requests (SARs): computational load loss in studies, and event reporting, model validation and model quality.

• October 26, 2026: Initial ballot and comment period close on the Standards Processes Manual revisions.

• October 26, 2026: ReliabilityFirst Technical Talk, 2:00 to 3:30 p.m. Eastern, including a session on supply chain impacts from Executive Order 14421.

• November 5, 2026: Comments close on BAL-001-TRE-3, the Texas RE regional standard.

• November 16, 2026: NERC Large Loads Working Group meeting, 11:00 a.m. to 1:00 p.m. Eastern.