Two FERC orders, a July 1 deadline, and a rare NERC alert

It feels like major updates are flying thick and fast in this regulatory era.

Two FERC orders took effect on May 26. Order No. 918 finalizes CIP-003-11, a meaningful upgrade to low-impact controls. Order No. 919 finalizes 11 new and revised CIP standards that bring virtualization explicitly into the CIP framework.

CIP-012-2 goes live in less than a month, on July 1, 2026. Best of luck to those of you in the final stretch of implementation.

Raptor Comply is our NERC OT compliance platform built for scaling lean, high quality and highly automated compliance programs meeting the demands of growing fleets and expanding regulations.

Industry Update

FERC Finalizes CIP-003-11: New Low Impact Controls

FERC's Order No. 918 finalizing CIP-003-11 became effective May 26, 2026. The standard targets low impact BES Cyber Systems with external routable connectivity and adds three control categories that did not exist in CIP-003-9 or CIP-003-10: remote user authentication, protection of authentication information in transit, and detection of malicious communications. Per NERC's Implementation Plan, compliance is due July 1, 2029.

Why it matters: this is NERC's answer to a coordinated attack distributed across many low-impact sites. It pushes low-impact environments toward identity-centric access and forces the retirement of unauthenticated or plaintext remote access paths. The work starts now: map every low-impact system with external routable connectivity and start scoping the architecture changes.

FERC Brings Virtualization Into the CIP Framework

Order No. 919, also effective May 26, 2026, finalizes eleven new and revised CIP standards and introduces four new NERC Glossary definitions, including Shared Cyber Infrastructure and Virtual Cyber Asset. It is FERC's acknowledgment that the hardware-centric assumptions in the original CIP framework no longer match how utility OT environments run. Compliance lands on April 1, 2028, a shorter window than CIP-003-11.

Why it matters: any GO or GOP running virtualized BES Cyber Systems, or planning to in the next two years, now has a real deadline. The work is largely scoping: which assets meet the new Shared Cyber Infrastructure or Virtual Cyber Asset definitions, and how they map into your existing electronic security perimeter and configuration management programs.

On May 4, 2026, NERC issued a Level 3 "Essential Actions" Alert, its highest severity tier, after repeated events in which more than 1,000 MW of data center and computational load dropped off the bulk power system in seconds. The Alert directs Transmission Planners, Planning Coordinators, Transmission Owners, Balancing Authorities, Reliability Coordinators, and Transmission Operators to assess and report on their modeling, study, protection, and communications practices for large loads. Entities had to acknowledge by May 11 and must report status by August 3, 2026.

Why it matters: for the named entities, large loads just shifted from a forecasting footnote to a concrete obligation, with their assessment of modeling, study, and protection practices due August 3. GOs and GOPs are not on the list today, but the load-loss transients behind the Alert are exactly what PRC-024 and PRC-029-1 ride-through standards govern, so Project 2026-02 (standards filing due December 31, 2026) and the interconnection studies that follow are likely to be rewritten around large-load behavior. Generators near concentrated load growth should plan for new study assumptions and tighter ride-through scrutiny.

Compliance Resources

CIP-012-2 Goes Live July 1, 2026

CIP-012-2 takes effect in under a month, on July 1, 2026, replacing CIP-012-1. The standard requires documented plans to protect the confidentiality, integrity, and availability of Real-time Assessment and Real-time monitoring data exchanged between Control Centers, an expansion from the confidentiality-and-integrity scope of the prior version.

The standard applies to Responsible Entities that own or operate a Control Center, including Generator Owners and Generator Operators with Control Center operations. If your existing CIP-012-1 plan only addresses confidentiality and integrity, the July 1 effective date is the deadline to extend it to availability, document compensating controls for any inter-Control Center link that cannot meet all three properties, and update your evidence collection accordingly.

Quarterly Compliance Dates Document

NERC publishes a quarterly compliance dates document listing every standard with an upcoming effective or enforcement date for GOs and GOPs. With Cat 2 obligations live as of May 15, CIP-012-2 in under a month, the PRC trio in October, and Orders 918 and 919 stretching into 2028-2029, this is the document compliance leads should be driving their internal calendar from.

Important Dates

• June 9, 2026: Microsoft Patch Tuesday. Expected release of the permanent fix for the Exchange OWA zero-day flagged in Issue #17 (CVE-2026-42897).

• June 9-11, 2026: NERC Standards Committee meeting, Arlington VA. Standards-in-development discussions relevant to anyone tracking upcoming PRC and CIP changes.

• June 18, 2026: FERC June Open Meeting. Keep an eye out for reliability standards docket items on the agenda.

• July 1, 2026: CIP-012-2 becomes effective.