Iranian PLC Attacks & Upcoming Deadlines

A joint CISA advisory confirmed Iranian state-linked threat actors are already inside U.S. energy infrastructure. CyberAv3ngers, tied to Iran's IRGC Cyber Electronic Command, is actively connecting to internet-exposed PLCs at U.S. energy facilities using Rockwell's Studio 5000 software, installing persistent backdoors, and modifying control logic while feeding operators falsified readings on their HMI screens.

For NERC-registered Generator Owners and Operators, internet-exposed PLCs without proper access controls are a live CIP-005 Electronic Security Perimeter violation and a CIP-007 Systems Security Management deficiency.

This is why it is essential to maintain a current, accurate inventory of your BES Cyber Assets and map each one against your CIP-005 and CIP-007 obligations. This is how your team knows where your perimeter gaps are before an auditor, or an adversary, finds them first.

Here's what else you need to know this week.

Industry Update

IBR Category 2 Registration: May 15th Deadline

GO-2 and GOP-2 entities with aggregate inverter-based resource nameplate capacity of 20 MVA or greater, connected at 60 kV or higher are required to register. If you fail to meet the deadline you could be subject to up to $1.54M in fines per violation per day.

NERC Project 2026-02 Computational Loads: Comment Period Closes April 30

NERC's Standards Committee accepted a Standard Authorization Request on March 18 for Project 2026-02, launching a new reliability standard development effort targeting large computational load entities, primarily AI data centers, connecting to the Bulk Power System. Formal comment period closes April 30, 2026.

This matters for Generator Owners and Operators with solar or storage assets co-located with or interconnected to large data center loads. Review the SAR and consider submitting comments before the deadline.

Important Dates

April 30: NERC Project 2026-02 Computational Loads SAR formal comment period closes.

May 15: IBR Category 2 NERC CORES registration deadline for GO-2 and GOP-2 entities.

October 1: PRC-029-1, PRC-030-1, and PRC-024-4 enforcement begins for bulk power system IBR, wind, and storage owners.

October 20–23: GridSecCon 2026, Orlando, FL. NERC, E-ISAC, and SERC co-host the 15th annual grid security conference.