NERC proposes standards for data centers

NERC posted three proposed standards on August 19 for computational load: data centers, artificial intelligence (AI) compute clusters and cryptocurrency mining.

A turbine that stopped at a Polish heat plant last December was written off at the time as operator error. It was not...

FERC has also set its annual reliability technical conference for October 21, and has reopened the comment window on what it thinks CIP-014-3 physical security compliance costs a transmission entity each year.

Product Update

No Need to Resubmit a Pending TCA Access Request

We're all about making it easier to operate in the field. That's why we listened when customers said it was painful to have to resubmit an access request correcting a minor detail. You can now correct a pending TCA access request and approve or deny it in the same action.

Industry Update

Data Centers Behind Your Plant Get Their Own NERC Standard, Starting at 50 MW

NERC posted Project 2026-02 Computational Loads for a 30-day formal comment period on August 19, 2026, kicking off Phase I of a multi-phase effort. It proposes three new standards, plus edits to FAC-001-5 and FAC-002-5.

Why is NERC moving so fast? On July 16 FERC ordered NERC to develop standards addressing computational load integration and to revise its Rules of Procedure including registry criteria for computational load entities. FERC set a December 31, 2026 deadline to finish both, and a March 2027 deadline for an action plan on what comes after.

The three new ones:

• CLO-001-1 Computational Load Interconnection, Studies, & Modeling Data

• CLO-002-1 Computational Load Operational Data and Communications

• CLO-003-1 Computational Load Protection Coordination & Disturbance Monitoring

Under CLO-001-1, GOs with a Computational Load Site interconnection, or a fully executed Agreement to study the reliability impact of interconnecting one, are caught. The proposed threshold: a Computational Load Site with total connected Load at or above 50 MW, supplied through electrical equipment connected at 100 kV or above from one or more points of connection.

What counts as a Computational Load Site? One or more buildings, structures or installations at a single location that primarily contain information technology infrastructure for software applications and services, AI training and delivery, cryptocurrency mining or other data center computational activities, and that are supplied through electrical equipment connected to the Bulk-Power System.

The edits to FAC-001-5 (Facility Interconnection Requirements) and FAC-002-5 (Facility Interconnection Studies) go the other way. Both add the same exclusion: "end-user Facilities" and "third-party Facilities" no longer include Computational Load Sites subject to CLO-001. Neither standard's GO applicability changes. So, for a qualifying site, the obligation it moves from FAC-001 and FAC-002 to CLO-001-1.

Running alongside the standards, NERC has re-posted proposed revisions to Rules of Procedure Appendices 2, 5A and 5B that would create two registered entity types, Computational Load Owner and Computational Load Operator. Comments close on the same September 18 date.

Registered Ballot Body members must join the ballot pool by 8:00 p.m. Eastern on Thursday, September 3, 2026 to vote. Comments close 8:00 p.m. Eastern on Friday, September 18, 2026, with the initial ballot running September 9 to 18. The drafting team's own timeline then runs a 20-day comment period and additional ballot in October, a five-day final ballot in November, and Board adoption in December 2026.

If a computational load site is interconnecting anywhere on your system, check it against the 50 MW and 100 kV thresholds now, and join the ballot pool by September 3 if you want a vote rather than a comment.

A Wind Farm Was the Way Into a Heat Plant's Controls

On December 29, 2025, a combined heat and power plant serving roughly 50,000 residents in Poland lost a steam turbine and its process-water treatment. Staff caught it quickly and no customer lost heat or power.

After an investigation of more than three months, CERT Polska published its supplementary technical report on August 8, 2026. The attacker did not come in through the plant. They came in through an entirely unrelated wind farm substation via an internet-facing VPN with no multi-factor authentication (MFA), then crossed on the distribution operator's private cellular network

This validates NERC's narrative behind the CIP Roadmap that each inverter-based resource (IBR) represents an attack surface and potential entry point to the grid. As well as NERC's focus on MFA in CIP-003-11.

FERC Sets Its Reliability Technical Conference for October 21

FERC issued a supplemental notice on August 12 scheduling its reliability technical conference in Docket No. AD26-8-000 for Wednesday, October 21, 2026, roughly 10:00 a.m. to 2:40 p.m. Eastern, in person at FERC headquarters in Washington. It is open to the public, there is no attendance fee, and it will be webcast.

Compliance Resources

CIP-015-2 Is Approved. The Approval Date Is Not Your Deadline

Internal network security monitoring (INSM) applies to Generator Owners and Generator Operators, so unlike the item below, this one is yours directly.

FERC approved CIP-015-2 on August 10, 2026 in a short, uncontested delegated letter order. Excellent coverage from Ampyx Cyber in a write-up of the order and the timeline. One line is doing some damage: the approval is "effective as of the date of this order." That sets the effective date of the Commission's action, not anyone's compliance obligation.

The obligations sit in the implementation plan, and CIP-015-1's schedule had already fixed them before FERC signed. NERC's filed plan makes CIP-015-2 effective the later of 12 months after CIP-015-1's effective date, or the first calendar quarter starting 12 months after the approving order. CIP-015-1 is effective October 1, 2028. Here's what that looks like:

• October 1, 2028: CIP-015-1. INSM inside the electronic security perimeter (ESP) for high impact BES Cyber Systems (BCS) and medium impact BCS with external routable connectivity (ERC) at Control Centers and backup Control Centers.

• October 1, 2029: CIP-015-2 Phase 1. Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS) and supporting Shared Cyber Infrastructure (SCI) at Control Centers and backup Control Centers. CIP-015-1 retires immediately before this date, so there is no gap and no overlap.

• October 1, 2030: Phase 2a. Remaining medium impact BCS with ERC, associated Protected Cyber Assets (PCA) and supporting SCI at assets other than Control Centers.

• October 1, 2031: Phase 2b. The EACMS, PACS and SCI supporting those non-Control-Center systems. CIP-015-2 is fully enforceable.

FERC Wants Comment on What CIP-014-3 Costs You, and Last Time Nobody Answered

FERC has reopened the comment window on what CIP-014-3, the physical security standard covering identification and protection of transmission stations and substations vulnerable to physical attack, actually costs Transmission Owners (TOs) and Transmission Operators (TOPs). The notice published August 19, 2026 in Docket No. IC26-29-000. Comments are due September 18, 2026.

FERC currently puts it at 341 TOs and 170 TOPs, 511 respondents in total, at 32 hours and $2,032.64 per respondent per year, or 16,352 hours and roughly $1.04 million across the industry.

Important Dates

• September 3, 2026: Ballot pool closes for Project 2026-02 Computational Loads, 8:00 p.m. Eastern. Registered Ballot Body members must join by this date to vote on CLO-001-1, CLO-002-1, CLO-003-1, FAC-001-5 and FAC-002-5.

• September 15-16, 2026: NERC Load Modeling Working Group workshop on data center load modeling, 12:00 p.m. to 5:00 p.m. Eastern each day, on Microsoft Teams.

• September 18, 2026: Comments close on Project 2026-02 Computational Loads, 8:00 p.m. Eastern. Same day, comments due on FERC-725U, the CIP-014-3 information collection (Docket No. IC26-29-000), which is Transmission Owners and Transmission Operators.

• October 1, 2026: PRC-024-4, PRC-029-1 and PRC-030-1 become effective. PRC-029-1 and PRC-030-1 bind the Generator Owner, and on this date it is the design requirements for Bulk Electric System (BES) IBRs that come due. Applicable non-BES IBRs run to January 1, 2027. Issue #27 has the full breakdown.

• October 21, 2026: FERC reliability technical conference, Docket No. AD26-8-000, at FERC headquarters and by webcast. Save the date.