FERC 2026 CIP Audit Findings: Generator Registration, Aggregated Control, and AI Tool Access
By Patrick Miller
The Federal Energy Regulatory Commission (FERC) staff report on its 2026 Critical Infrastructure Protection (CIP) audits found new generation running before it was registered, aggregated control of generation sitting with affiliates and vendors, and artificial intelligence (AI) tools inside CIP-networked environments. Two of the three lessons are categorization problems again.
Overview
FERC staff released the 2026 Lessons Learned from Commission-Led CIP Reliability Audits on October 13, 2026. It covers non-public CIP audits of several U.S.-based North American Electric Reliability Corporation (NERC) registered entities during fiscal year 2026, which for the federal government ran from October 1, 2025 through September 30, 2026, with staff from NERC and the Regional Entities taking part in both the virtual and on-site portions. The top-line finding reads a lot like other years. Most of what the audited entities had in place met the mandatory requirements, potential noncompliance and security risks remained, and staff folded practices the standards don't require into the report as voluntary recommendations. The report is short, about twelve pages of substance, and it drops the appendix of prior years' lessons that the 2025 report carried, pointing to a summary on FERC's staff reports page instead. I'd read the footnotes closely, because some of the more useful details are down there, including FERC's count of low and medium impact requirements and the Order No. 693 language on delegation.
| Lesson | Standard | What auditors found |
|---|---|---|
| Timely registration and CIP compliance for generation resources | CIP-002-5.1a R1 | New inverter-based resources (IBRs) in commercial operation above the Bulk Electric System (BES) threshold before NERC registration or CIP-002 evaluation, traced to misreading the Commercial Operation Date (COD) |
| Identify and categorize all BES Cyber Systems used for generation operation | CIP-002-5.1a R1 | Affiliates and third parties monitoring and controlling several Generator Operators' (GOPs') generation from one control point that met medium impact criteria in aggregate, while each GOP rated itself low impact |
| Access to BES Cyber Systems and BES Cyber System Information (BCSI) facilitated by super intelligence (artificial intelligence) tools | CIP-004-7 R4, R5, and R6 | These tools increasingly embedded in CIP-networked environments, generally controlled, with variation in how entities handled their access |
Lesson 1: Registering New Generation at the Right Commercial Operation Date (COD)
Audit staff found multiple cases where an IBR was synchronized to the BES, past initial testing, in commercial operation, and producing more than the applicable BES threshold, and its cyber systems still hadn't been identified and categorized as BES Cyber Systems. Some of the owners weren't registered with NERC yet, so no CIP-002 review had happened at all. Others were registered and already subject to the CIP standards but hadn't run the new resources through the CIP-002-5.1a impact rating criteria. FERC traces both back to a misunderstanding, or plain unawareness, of how NERC defines the COD.
NERC's ERO Enterprise Registration Procedure defines COD as the date after which all initial testing and commissioning is complete and the Generator Owner and Generator Operator can start producing electricity for sale. For resources that come online in phases, NERC expects registration once commercial operation for an aggregate amount crosses the applicable threshold, timed so the effective registration date lines up with the COD for that phase. Several generator owners told auditors they had multiple CODs tied to phased interconnection in organized markets, and that they planned to wait until full nameplate capacity and every phase of the interconnection queue were done before looking at NERC registration or CIP-002. One entity ran above the threshold in commercial operation for more than a year before it registered.
The threshold in this lesson is the BES one. FERC quotes the BES definition's Inclusion I2, which covers generating resources connected at 100 kilovolts (kV) or above with a gross individual nameplate rating above 20 megavolt-amperes (MVA) or a gross plant aggregate above 75 MVA, though most solar, wind, and battery plants come into the BES through Inclusion I4 instead, which covers dispersed power producing resources aggregating to more than 75 MVA at a common point of connection at 100 kV or above. FERC's background section also quotes the Category 2 Generator Owner criteria, for non-BES IBRs of at least 20 MVA connected at 60 kV or above, and I'd guess a fair number of readers will put those two quotes together and conclude that Category 2 registration brings the CIP standards with it, which under the current standards it doesn't. The CIP standards list the Generator Owner and Generator Operator in their applicability sections without distinguishing between categories, but the Facilities section then limits them to BES Facilities, and a Category 2 resource is non-BES by definition. NERC's implementation plan for Project 2024-01, the project aligning the Glossary definitions with the new registration categories, says that standards applicable only to BES Facilities won't be enforceable on Category 2 facilities unless a standards project revises them to include those facilities. The IBRs in FERC's observations were producing above the BES threshold, which makes their owners Category 1, and Category 1 has carried CIP-002 obligations all along.
A phased project can spend its early phases below the BES threshold, possibly registered as Category 2 with no CIP obligations, and then become a BES Facility on the COD of the phase that pushes the aggregate past 75 MVA. That COD is when Category 1 registration and the CIP-002 evaluation are due, regardless of how many phases remain in the interconnection queue. Category 2 resources aren't entirely outside CIP's reach, though, because last year's report made clear that criterion 2.11 counts non-BES generation, so a Category 2 IBR with no CIP obligations of its own can still count toward the 1,500 megawatt (MW) aggregate at a GOP Control Center that operates it.
FERC is fairly generous about how this happens, noting that an entity actively trying to meet its interconnection obligations can still inadvertently miss its cybersecurity requirements, and I think that's probably the correct read. The interconnection queue and NERC registration run on different clocks and usually belong to different people, so the project team tracking the queue's last milestone may not be the team that knows the registration clock already started. FERC's mitigation is to apply NERC's COD definition, register when a phase pushes the aggregate over the BES threshold, and identify and categorize the BES Cyber Systems under CIP-002-5.1a at that point. Entities that are already registered need to review new generation resources the same way, on the same COD trigger.
FERC notes in a footnote that earlier reports raised generation identification problems in other contexts, citing the first lesson of the 2025 report and a lesson from 2017. Last year's version was about distributed energy resources (DERs) counted toward GOP Control Center impact ratings, which we covered in our breakdown of the 2025 findings.
Lesson 2: Affiliate and Third-Party Control of Generation
Audit staff found two arrangements where an unregistered entity performed, or could perform, generation monitoring and control at an aggregation point, which FERC describes as a generation control center, on behalf of several registered GOPs. In the first, a parent company registered for no function at all kept monitoring and control capability over its affiliates' generation at a single control center, while each affiliate registered separately as a GOP and rated its own BES Cyber Systems low impact. In the second, several unaffiliated GOPs contracted with the same third party (a vendor, contractor, or service provider) for monitoring and control, and each of them also rated its systems low impact. In both cases the aggregate capability at the shared control point met the criteria for a medium impact BES Cyber System. FERC also notes that the registered entities were reluctant to discuss affiliate or third-party monitoring and control when auditors raised it.
The gap between the two ratings is large. FERC's report puts medium impact at the full suite of CIP controls, approximately 140 requirements and sub-requirements, against a limited and mostly plan-based subset of approximately 15 for low impact.
FERC ties the medium impact outcome to CIP-002-5.1a Attachment 1, and the report's footnote cites Section 2.1, the criterion for commissioned generation at a single plant location of 1,500 megawatts (MW) or more. I'd probably read the shared control center scenarios against criterion 2.11 instead, which covers Control Centers performing Generator Operator functions for an aggregate of 1,500 MW or more in a single Interconnection, and which is the criterion last year's report applied to DERs. Either way the result is a medium impact rating, but if you're documenting the analysis I think 2.11 is the cleaner link.
On responsibility, FERC is direct. Demonstrating compliance for every cyber system that should be categorized as a BES Cyber System, including systems an affiliate or third party operates, falls to the GOPs, and the report quotes Order No. 693 for the principle that a registered entity can delegate performance of a task but not its responsibility for making sure the task gets done. NERC's Registration Procedure says the same about non-registered third parties, that the registered entity remains solely responsible for compliance and accountable for violations even on tasks they perform on its behalf. This is the same accountability line we walked through in Work of Others in NERC CIP. It's harder to apply here though, because the party holding the aggregated control isn't registered and each registered GOP sees only its own slice of what that party controls.
Staff also say NERC should consider further guidance, modifications to the Reliability Standards, or changes to registration procedures to address these arrangements, and that housing control of multiple generation resources at one location with a de facto operator increases cybersecurity risk. That recommendation is aimed at NERC. Keep an eye on this because, depending on how NERC responds, a registration change could bring the aggregator itself into scope. NERC's own CIP Roadmap made a related point in January, describing low impact systems, third-party operators, and newly registered Category 2 IBRs as a growing share of operational dependency that sits outside medium and high impact coverage. Until then, a GOP's practical step is to find out who else can monitor or control its generation (a parent company's operations center, a shared remote operations provider, an asset manager, an equipment manufacturer's monitoring service) and what else those parties control from the same place. I'd document that aggregation analysis even when the conclusion stays low impact, and if the aggregate gets anywhere near 1,500 MW, I'd probably run this by your Regional Entity before any audit or other CMEP activity.
Lesson 3: Super Intelligence (Artificial Intelligence) Tools and CIP-004 Access
FERC uses the term super intelligence (artificial intelligence), abbreviated SI, for software that performs tasks traditionally requiring human intelligence, and it names ChatGPT, Google Gemini, and Microsoft 365 Copilot as examples. The lesson applies to what FERC calls the CIP-networked environment, which Order No. 907 described as the networks inside the Electronic Security Perimeter (ESP) along with the associated Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS). Order No. 907-A, the clarification order that followed, narrowed that to communications among the CIP systems themselves, leaving non-CIP assets and their traffic out even where they share a network segment, which we covered in CIP-015 Clarified.
Auditors saw SI (artificial intelligence) tools in use across the audited entities' CIP-networked environments, and found that entities generally accounted for them and applied appropriate controls, with variation in how they handled that access. FERC says most of these tools are still limited to chatbots and personal assistants, though they're picking up network monitoring, threat response, and operations similar to a user's. Some of the sharper points came from the entities themselves, who told auditors that vendors are adding these capabilities to products and services faster than compliance programs adapt, that tools able to mimic user behavior make legitimate activity harder to distinguish from malicious use, and that the scope of what a tool can do sometimes isn't fully understood until it's already active on the network. Keirsten Brager wrote about that last problem, AI capability arriving through a vendor feature or a model update without ever entering the change process, in When AI Changes Without a Change Request.
On risk, FERC cites the same CIP Roadmap as identifying the targeting of SI (artificial intelligence) tools as an emerging risk, and says that because these tools may have unrestricted access across systems, they've become attractive targets. Staff also state that recent real-world intrusions show adversaries using commercially available tools of this kind already on entity systems to map environments, identify pathways toward critical systems, accelerate reconnaissance, and automate exploitation attempts. The report doesn't cite a specific incident for that statement. I'd also note that the Roadmap does carry targeting of AI tools in its risk registry, but it ranked 21st of 22 risks in NERC's final weighted ranking, and the scenario NERC described there involved poisoned training data. I think FERC's audit observations probably make a stronger case for the access angle than the Roadmap does.
FERC is careful to say the CIP standards neither explicitly allow nor prohibit SI (artificial intelligence) tools. Entities should consider the business need before deploying one in a CIP-networked environment, and should grant, verify, and revoke electronic access to BES Cyber Systems and BCSI that's facilitated by these tools under CIP-004-7. Staff then list four further considerations, each tied to a different standard, and the last points to the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0) as a framework to use when bringing these tools into a network.
| Standard | FERC's consideration | What I'd want on file |
|---|---|---|
| CIP-005 | Understand and monitor every SI (artificial intelligence) tool's communications outside the ESP, including the reason access was granted | The external endpoints each tool reaches, with a business justification for each |
| CIP-007 | Identify and inventory SI (artificial intelligence) tools as generic service accounts, and change default passwords where applicable | Each tool in the account inventory, with credentials managed like any other generic account |
| CIP-011 | Limit an SI (artificial intelligence) tool's ability to access BCSI | The BCSI repositories each tool can reach, and the controls that limit that reach |
| CIP-013 | Identify and assess risk from SI (artificial intelligence) products or services from prospective vendors in the supply chain risk management plan, using a framework such as AI RMF 1.0 | Vendor questions about AI features, including features that can be switched on after purchase |
The CIP-007 suggestion is probably the one with the most weight. Treating an AI tool as a generic account gives it a place in an account management process entities already run. It also raises a question I don't think CIP-004 answers cleanly, which is whether a given tool is acting on a person's authorized access or on its own service credentials. I think most programs will end up answering that tool by tool.
Questions for the Next Audit Cycle
Registration timing. For each generation project in an interconnection queue, do you know the date its commercial operation will first exceed the BES threshold, and who owns the registration and CIP-002 steps on that date?
Who else controls your generation. Can you name every affiliate, contractor, or service provider with monitoring or control capability over your resources, and what else they control from the same place?
Aggregation analysis. Where those parties aggregate control, is the 1,500 MW analysis documented, even if your own rating is low impact?
AI inventory. Do you know which products in your CIP-networked environment have AI features today, including features a vendor enabled after you bought the product?
AI access. For each AI tool, can you show the CIP-004 authorization, the account it runs under, the BCSI it can reach, and the communications it makes outside the ESP?
Where This Report Fits
Categorization has now come up in the 2017, 2024, 2025, and 2026 reports in one form or another, and I'd expect it to keep coming up as generation gets more distributed and control gets more shared. The third-party thread from last year's report continues in this year's second lesson. Last year's cloud lesson and this year's AI lesson have a similar shape too, with entities adopting technology the standards weren't written around and auditors checking whether the existing requirements still cover it.
Sources
FERC staff, 2026 Lessons Learned from Commission-Led CIP Reliability Audits (October 13, 2026), with FERC's announcement
FERC staff, 2025 Lessons Learned from Commission-Led CIP Reliability Audits (October 20, 2025)
FERC, announcement of the 2024 Lessons Learned report (August 2024)
NERC, ERO Enterprise Registration Procedure (June 11, 2026)
NERC, Critical Infrastructure Protection Roadmap (January 2026)
NIST, AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (January 2023)
