Iranian actors in energy-sector PLCs + Nico knows your fleet

CISA and the FBI updated their advisory on Iranian-affiliated actors targeting programmable logic controllers, and this revision names the Energy sector.

Separately, a Rockwell adapter used in energy environments carries a flaw scored at the top of the severity scale, exploitable over the network with no credentials. There is a firmware fix.

On the standards side, the successor draft to PRC-029-1 passed its ballot this month after failing in May, and the inverter-based resource (IBR) ride-through wave is now nine weeks out.

Product Update

Nico Can Now Answer Using Your Own Fleet: AI - Org Context

Nico, the NERC copilot inside Raptor Comply, has always answered from the standards themselves. It knew nothing about your organization, so "does this apply to us?" was out of reach. We just changed that. Turn on AI - Org Context and Nico grounds its answers in your own facility data.

Not sure if or how a new standard will apply to your existing policies, procedures and plans? Ask Nico. Not sure if your evidence has a smoking gun or glaring gap? Ask Nico.

Nico keys on the CIP impact categorization your program already assigns, and never ingests BES Cyber System Information (BCSI). In practice: Nico can name your Low impact facilities. For Medium and High impact facilities, it sees only high level, aggregated data. Off by default, so ask an Organization Admin to enable these features: Settings → AI - Org Context.

Industry Update

CISA and the FBI Name the Energy Sector in Their Updated PLC Advisory The joint advisory AA26-097A, on Iranian-affiliated actors exploiting programmable logic controllers across US critical infrastructure, was revised on July 22, 2026. Since at least March 2026 the group has disrupted PLC function across several sectors, including Government Services and Facilities, Water and Wastewater, and Energy. Some victims experienced operational disruption and financial loss.

The targeting starts with internet-exposed PLCs. Three questions for your Critical Infrastructure Protection (CIP) program: is any PLC reachable from the internet, would you detect a project-file download to a controller, and does anyone check controller logic against a known-good baseline rather than trusting the operator display? That last one is a CIP-010 baseline question.

A CVSS 10.0 Flaw in a Rockwell Adapter Used Across the Energy Sector Earlier this month, on July 14, CISA released ICSA-26-195-04 covering the Rockwell Automation 1715-AENTR EtherNet/IP Adapter. If you have already patched it, skip ahead. The flaw, CVE-2026-10577, scores 10.0 on both CVSS v3.1 and CVSS v4.0, the maximum on each scale.

The adapter exposes a network-reachable debug port that does not enforce privilege controls, giving an unauthenticated attacker access to intrusive command-line commands. From there an attacker could read or delete files, stop tasks, modify memory and change I/O states. Firmware 3.003 and earlier is affected, and the fix is firmware 3.011 or later (Rockwell advisory SD1785).

A firmware update to a device in CIP scope is a CIP-010 baseline change. Log it and assess it against your CIP-007 patch management process in Raptor Comply.

Compliance Resources

The IBR Ride-Through Wave Approaches Three standards from Milestone 2 of FERC Order No. 901 become effective on October 1, 2026:

• PRC-029-1, Frequency and Voltage Ride-through Requirements: requires IBRs to ride through grid disturbances rather than trip offline. Order No. 909 approved it, PRC-024-4 and the Ride-through definition on July 24, 2025.

• PRC-030-1, Unexpected IBR Event Mitigation. Not from Order No. 909: approved earlier, on February 20, 2025, by delegated letter order in Docket RD25-3-000.

• PRC-024-4, Frequency and Voltage Protection Settings: sets the protection settings for synchronous generators, synchronous condensers, and Type 1 and Type 2 wind. Type 3 and Type 4 wind are inverter-based, so they fall under PRC-029-1 instead.

PRC-029-1 binds the Generator Owner, and its implementation plan phases the standard in three stages

• BES IBR design requirements bind on October 1, 2026.

• Applicable non-BES IBR design requirements, and R4, the hardware-limitation exemption, bind on January 1, 2027.

• The performance side of R1, R2 and R3, the part you prove with disturbance data, is not due for any applicable IBR until you have established the disturbance monitoring equipment capabilities PRC-028-1 requires.

PRC-030-1's implementation plan splits on the same line and the same dates.

PRC-029 is being revised under NERC Project 2025-05: the additional ballot that ran from July 2 to July 13 passed with 88.16% weighted-segment approval, and the phase-in schedule above, itself under revision there, balloted separately and better at 91.08%. PRC-029-2 is still a draft with comments under review, so plan against PRC-029-1 for October 1.

For IBR owners and operators: identify which facilities are in scope and on which date, start studies and settings work now, and generate evidence as you go.

Important Dates

• August 3, 2026: Responses due on NERC's Level 3 Essential Action Alert covering computational load modeling, studies, instrumentation, commissioning, operations, protection and control.

• July 30 to August 29, 2026: NERC comment period on the Large Loads Working Group draft white paper, Large Load Disturbance Performance: Impact Analysis and Ride-Through Recommendations. It recommends voltage ride-through and post-fault active power recovery performance for Large Loads (data centers, AI compute, crypto mining).