Four IBR standards, four different compliance clocks

NERC and its Regional Entities spent this week sitting down with individual Generator Owners (GOs) and Generator Operators (GOPs), one at a time, to talk through compliance with four inverter-based resource (IBR) standards: PRC-028-1, PRC-029-1, PRC-030-1 and MOD-026-2.

It says a lot about how many are affected by the Category 2 IBR wave, and it suggests the implementation periods are hard to pin down: which facilities, and on what date.

Below: what the sessions covered, and where each standard stands today.

Product Update

Controls: Tasks Are Clickable, and Tabs are Sticky

The Controls page is where you engage a control and work through the tasks it generates. Getting from a control to a task meant leaving the page and hunting for it. Tasks are now clickable in place.

Policies and Controls also remember the tab you left on, independently of each other. Come back to Controls and you land on the standard family you were last viewing.

Smaller quality of life upgrades landed alongside: the Dashboard widget showing incoming NERC standards now covers Transmission Owner (TO) and Transmission Operator (TOP) applicability, and the Settings page got a makeover.

Industry Update

The ERO Enterprise Ran One-on-One IBR Compliance Sessions This Week

NERC and the Regional Entities held a round of Small Group Advisory Sessions on the new IBR standards. A public general session ran Monday, August 10, and closed one-on-one meetings between individual registered entities and ERO Enterprise staff August 11 to 14. Watch out for any broader communication and clarification coming out of those sessions.

In scope: PRC-028-1, PRC-029-1, PRC-030-1 and MOD-026-2, and their phased implementation requirements.

The phase-ins turn on whether a facility meets the Bulk Electric System (BES) definition, not on when the entity registered. And the four standards arrived through different orders on different schedules, so there is no single IBR deadline.

In case you didn't get to sit down with the ERO Enterprise, we've put together a little explainer on implementation periods below.

Hardcoded Credentials in a Johnson Controls Device

CISA published ICSA-26-218-02 on August 6, covering the Johnson Controls TL280 on firmware below version 5.63. CVE-2026-27871 describes credentials embedded directly in the firmware file, which an attacker could use to read sensitive information off the device. Energy is a listed sector. CISA scores it 4.1 under CVSS v3, at the low end of the scale, and the fix is firmware 5.63.

Alongside the firmware update, Johnson Controls recommends keeping the devices off the internet and on trusted management VLANs, monitoring access logs for unusual authentication activity, and rotating any shared credentials derived from the hardcoded values. Patching does not retire a credential already reused elsewhere.

Compliance Resources

Making Sense of Timing for Four IBR Standards

PRC-029-1 (Frequency and Voltage Ride-through Requirements)

Effective October 1, 2026. Binds the GO. Its implementation plan runs three stages:

• BES IBRs: the design portion of R1, R2 and R3 plus all of R4 on October 1, 2026;

• Applicable non-BES IBRs at "both new and existing registered entities": those same design requirements and R4 on January 1, 2027; and

• Any IBR: the performance portion of R1, R2 and R3 due when you have established the disturbance monitoring equipment capabilities PRC-028-1 requires.

PRC-029 is already being revised. NERC Project 2025-05 answers FERC's Order No. 909 directive on two gaps: the equipment limitations of HVDC-connected IBRs with choppers, and the long lead time between locking an IBR's design specifications and putting it in service. The successor, PRC-029-2, cleared its final ballot on August 7, 2026 and now goes to the Board of Trustees, then the regulators. That sequence cannot finish before October 1: plan against PRC-029-1, and watch PRC-029-2 for the changes it makes.

PRC-030-1(Unexpected IBR Event Mitigation)

Effective October 1, 2026. Also GO only. Its implementation plan splits on the same line, with the same January 1, 2027 date for applicable non-BES IBRs.

PRC-028-1 (IBR disturbance monitoring)

Already effective, since April 1, 2025. Its implementation plan phases the monitoring build-out across your fleet rather than switching it on at once, and it splits on the same BES line as the two above. For BES IBRs in commercial operation on or before the effective date, R1 through R7 reach 50% of those resources on April 1, 2028 and 100% by January 1, 2030. Applicable non-BES IBRs in commercial operation on or before May 2026 carry the January 1, 2030 date for all of R1 through R7. PRC-028-1 also gates PRC-029-1's performance requirements, so the performance side can trail your October 1 design work by years on the same facility. And it is not a ride-through standard, despite sitting next to two that are.

MOD-026-2 (Verification and Validation of Dynamic Models and Data)

Effective April 1, 2026. FERC approved it on February 19, 2026, consolidating MOD-026-1 and MOD-027-1 and covering IBR-connected facilities. Its verification milestones sit in its own implementation plan, not on the effective date: R1 and R7 come due 12 months after the standard takes effect, R2 through R6 at 36 months. If you registered under Category 2: for facilities commissioned before the effective date that were not applicable under MOD-026-1 or MOD-027-1, the plan gives the Transmission Planner 365 days to review submitted models rather than the usual 120.

Important Dates

• August 14, 2026: Final day of the ERO Enterprise's closed one-on-one IBR advisory sessions. Registration is closed; noted here for context on what the ERO is currently fielding.

• August 29, 2026: Close of NERC's comment period on the Large Loads Working Group draft white paper, Large Load Disturbance Performance: Impact Analysis and Ride-Through Recommendations. It recommends voltage ride-through and post-fault active power recovery performance for Large Loads (data centers, AI compute, crypto mining).