It's show time!

Sending positive vibes to all our colleagues grappling with Category 2 IBR go-live day! If you own or operate solar, wind, or storage assets in this category, your obligations changed at the stroke of midnight. Hang in there.

We're also covering two new cybersecurity developments worth a careful read: a breach at smart-meter and grid-device maker Itron, whose hardware is in over 7,700 utility deployments, and the CISA CI Fortify Initiative, which tells utilities to plan for a scenario where their OT networks are actively compromised and their vendor connectivity is gone.

Here's what else you need to know this week.

Product Update

NERC effective dates tracker

Tracking all of the inbound changes to NERC standards is a full time job! Many rely on law firm bulletins or a frantic search of the NERC website.

We added a new widget to the Raptor Comply dashboard with incoming standards and their effective dates. That way, you can stay on top of program changes without having to leave your workspace.

💡 Top tip: try asking Nico (our AI copilot) about the incoming standard and what changes it introduces.

Industry Update

Category 2 IBR Compliance Goes Live Today

As of today, May 15, 2026, non-BES inverter-based resources at 20 MVA or above on 60 kV or higher are now subject to NERC reliability standards as registered Generator Owners and Generator Operators. The lower threshold (previously 75 MVA at 100 kV) brings hundreds of solar, wind, and storage sites into scope for the first time.

Eight standards apply immediately to Cat 2 GO/GOPs: MOD-032-1 (power system modeling data), IRO-010-5 (Reliability Coordinator data sharing), VAR-001-5 and VAR-002-4.1 (voltage and reactive power control), PRC-012-2 and PRC-017-1 (protection system coordination), BAL-001-TRE-2 (frequency control in the ERCOT region), and TOP-003-6.1 (operational data sharing). The IBR-specific PRC trio comes next: PRC-029-1 and PRC-030-1 take effect October 1, 2026, and PRC-028-1's compliance milestones phase in through 2030.

As we all know, non-compliance penalties run up to $1.54 million per day per violation. If you operate Cat 2 assets and haven't confirmed your registration status with your Regional Entity, that would be a good first move.

Itron Breach Reaches Into 7,700 Utility Networks

Smart-meter and grid-device maker Itron disclosed a cyber intrusion discovered on April 13, 2026. Itron's hardware and software are deployed by more than 7,700 utility providers across 100 countries, covering electric, gas, and water meters along with grid-edge devices that touch distribution operations.

The company says it has remediated the unauthorized activity, but the scope of the breach raises supply chain concerns for any utility that uses Itron AMI, distribution automation, or analytics products. For GOs and GOPs, the takeaway is the same one CISA flagged earlier this year: vendor and supply chain compromise is now a credible vector into utility OT environments, and CIP-013 supply chain risk management plans need to assume the vendor has already been hit.

CISA Tells Utilities to Plan for an OT-Down Scenario

On May 5, 2026, CISA released its CI Fortify Initiative, new guidance telling electric utilities and other critical infrastructure operators to plan for a geopolitical crisis in which their OT networks are actively compromised and their connectivity to telecom, internet, vendors, and service providers is gone. This is the federal government's formal acknowledgment that a destructive nation-state cyberattack on U.S. utilities is a realistic near-term contingency.

The guidance pairs with an April 8 joint advisory from CISA, NSA, and DOE warning that Iran-linked actors are targeting programmable logic controllers used in power grid operations, specifically calling out Rockwell Automation PLCs but noting other vendors may be affected.

For compliance teams, the practical implication is that CIP-008 incident response plans and CIP-009 recovery plans should be stress-tested against a scenario where the corporate network, vendor portals, and remote support are all unavailable at the same time. If your plan assumes you can call your vendor for help, it does not survive contact with this threat model.

Compliance Resources

NERC Level 3 Alert: Large Computational Loads Dropping Off the Grid

On May 4, 2026, NERC issued a Level 3 Alert responding to repeated events where 1,000+ MW of data center load dropped off the bulk power system in seconds, causing grid stability issues. The alert directs Transmission Owners, Transmission Planners, Planning Coordinators, and Generator Owners to take essential actions on large-load interconnection, ride-through performance, and modeling.

GOs and GOPs with sites in regions experiencing rapid data center growth should expect downstream impacts: more rigorous interconnection studies, tighter ride-through scrutiny, and increased data requests from Planning Coordinators. The full alert document lists required essential actions and reporting deadlines.

NERC Quarterly Compliance Dates Document

NERC publishes a quarterly compliance dates document listing every standard with an upcoming effective or enforcement date for GOs and GOPs. With Cat 2 obligations now live and PRC-028/029/030 phased dates approaching, this is the document compliance leads should be using to drive their internal calendar. Subscribe to NERC standards announcements to catch each quarterly update.

Important Dates

• June 9-11, 2026: NERC Standards Committee meeting, Arlington VA. Standards-in-development discussions relevant to anyone tracking upcoming PRC and MOD changes.

• June 18, 2026: FERC June Open Meeting. Reliability standards docket items typically appear on the agenda.