By Patrick Miller
The North American Electric Reliability Corporation's 2027 Compliance Monitoring and Enforcement Program Implementation Plan has five risk elements instead of seven. Most Critical Infrastructure Protection (CIP) requirements carry over from 2026, though CIP-012 comes off the list and aggregation of control and cloud storage of grid cyber information get new language.
Overview
The North American Electric Reliability Corporation (NERC) has posted the 2027 Electric Reliability Organization (ERO) Enterprise Compliance Monitoring and Enforcement Program (CMEP) Implementation Plan, dated November 2026, with a revision history that marks its release as November 1. Each year the ERO Enterprise, which is NERC plus the six Regional Entities, publishes one of these plans listing the risk elements its Compliance Enforcement Authorities (CEAs; the Regional Entities) should prioritize, along with the Reliability Standards and requirements mapped to each one, including the Critical Infrastructure Protection (CIP) standards that apply to Bulk Electric System (BES) Cyber Systems. It's an input to oversight planning, and the plan says there's no expectation that every risk element, or every requirement mapped to one, shows up in every engagement, and that CEAs tailor their focus to each registered entity's facts and circumstances. We went through last year's plan when it came out. This year's is shorter, and I think the structure changed more than the requirement list did.
Seven Risk Elements Become Five
The 2026 plan ended the year with seven risk elements, though it started with six. NERC revised it on February 24, 2026 to add Communication Protocols & Operating Instructions, and that's the version the 2027 plan compares itself against. The 2027 plan has five. Remote Connectivity, Supply Chain, and Physical Security merge into a single Security element, and two topics that sat under Grid Transformation last year move into it. One is the protection of BES Cyber System Information (BCSI), now paired with cloud security in its own subsection. The other is Aggregation of Control. Grid Transformation, Facility Ratings, Extreme Weather Response, and Communication Protocols & Operating Instructions carry over by name.
| 2026 risk element | Where it sits in 2027 | What changed |
|---|---|---|
| Remote Connectivity | Security | CIP-012 removed, CIP-005-7 R1 added |
| Supply Chain | Security (Supply Chain Security) | Same three requirements, new rationale on CIP-013-2 R1 |
| Physical Security | Security | Same requirements |
| Grid Transformation | Grid Transformation | BCSI and Aggregation of Control moved to Security, Large Load Integration added |
| Facility Ratings | Facility Ratings | FAC-008-5 R3 and PRC-023-6 R1 added |
| Extreme Weather Response | Extreme Weather Response | Same three standards |
| Communication Protocols & Operating Instructions | Communication Protocols & Operating Instructions | PER-005-2 R1 and R3 added |
The plan doesn't say much about why it merged the three. The Security introduction points to the convergence of information technology (IT) and operational technology (OT), reliance on cloud-based technology, the emergence of artificial intelligence (AI) technology, and potential workforce knowledge gaps, and it says the ERO Enterprise recognizes the interdependence of cyber and physical security. I don't think the merge lowers the attention any one of the three gets, since the requirements underneath changed in only a few places. It probably does mean the CIP work now shows up in one table instead of being spread across four, which is probably easier to read.
The CIP Requirements, Year Over Year
Here's the CIP list from both plans side by side. Last year's plan listed CIP-003 R2 in three separate tables, under Remote Connectivity, Physical Security, and Grid Transformation, and this year it appears once with the three rationales combined.
| Standard | 2026 plan | 2027 plan |
|---|---|---|
| CIP-002-5.1a | R1, under Grid Transformation | R1 and R2, under Security |
| CIP-003 | CIP-003-8 and CIP-003-9 R2, in three tables | CIP-003-9 R2, once, under Security |
| CIP-004-7 | R6, under Grid Transformation | R6, under Security |
| CIP-005-7 | R2 and R3 | R1, R2, and R3 |
| CIP-006-6 | R1 | R1 |
| CIP-007-6 | R2 | R2 |
| CIP-010-4 | R1 | R1 |
| CIP-011-3 | R1, under Grid Transformation | R1, under Security |
| CIP-012 | CIP-012-1 R1 (CIP-012-2 effective July 1, 2026) | Removed |
| CIP-013-2 | R1 | R1, with a new rationale |
| CIP-014-3 | R4 and R5 under Physical Security, R1 under Grid Transformation | Same |
The CIP-005-7 change is small on paper. R1 covers the Electronic Security Perimeter (ESP) itself, and the Remote Connectivity narrative now says that defined ESPs, electronic access controls, and secure communications between Control Centers are critical to protecting the systems that support the bulk power system (BPS). Last year's version of that paragraph said the ERO Enterprise continued to see appropriate mitigation of risks involving security management controls, ESPs, and communication between Control Centers. I'm not sure I'd read too much into the shift in tone, but R1 is on the list now.
The CIP-013-2 R1 row also has a new rationale. Last year it shared CIP-010-4 R1's language about unverified software sources and counterfeit software. This year it reads "Mitigate risks associated with unauthorized changes to BES Cyber Systems." CIP-010-4 R1 keeps the software-integrity rationale.
CIP-012 Comes Off the List
The plan removes the risks associated with Real-time Assessment and Real-time monitoring data transmitted between Control Centers. It says the ERO still identifies Remote Connectivity as a risk but determined the risks associated with CIP-012 were low with respect to BPS reliability, and it doesn’t explain further. Last year’s plan listed CIP-012-1 R1 and noted that CIP-012-2 would take effect July 1, 2026.
CIP-012-2 is still enforceable, and the plan’s own framing is that CEAs build an entity-specific list and that requirements outside the plan may be more relevant for a given entity. Our earlier CIP-012 post covers the controls beyond encryption that a CIP-012 plan can document, and those are probably the records an auditor would ask for if a Regional Entity scopes the standard in anyway.
I read the low rating as a statement about audit priority for 2027, and the standard itself is probably going to grow. NERC’s CIP Roadmap calls for extending CIP-012’s confidentiality and integrity protections to facility-to-Control-Center communications that run over public or carrier networks, which we went through in our post on the Roadmap. Further, if the Quantum-GUARD Act (S. 5313) becomes law, a revision like that would also get a new kind of review at FERC. The bill, introduced by Senators Coons and Rounds in August and still in committee, would require FERC, beginning on enactment, to consider cybersecurity risks from quantum computers and potential uses of post-quantum cryptography whenever it reviews a proposed reliability standard or a modification to one. CIP-012 probably leans harder on encryption than any other CIP standard, mostly through the key exchange in VPN and TLS connections that a large enough quantum computer is expected to be able to break, so I’d expect it to be one of the first places that review would apply.
Aggregation of Control Moves Into Security
Last year this sat under Grid Transformation and was framed mostly as a registration and compliance question. The ERO Enterprise had observed several registered Generator Owners (GOs) and Generator Operators (GOPs) contracting with the same unregistered third parties for day-to-day operations, which put control of a lot of generation in a common control center. The 2027 version keeps that observation and adds a security framing. A cyber compromise or failure involving shared systems can affect multiple facilities, and the plan names unsecured remote connectivity, inconsistent security and change management practices, and inadequate access controls as the things that raise the risk across facilities under common control.
It also says something new about the threshold. The plan notes that CIP-002-5.1a includes a 1,500 megawatt (MW) criterion for medium impact categorization of BES Cyber Systems at certain GOP Control Centers within a single Interconnection, and that aggregation below this threshold may still create a concentration risk where multiple facilities rely on common third-party systems or services. The plan doesn't number the criterion, but the way it describes it matches criterion 2.11. The CIP-002-5.1a row picks up R2 as well, the periodic review and approval of those identifications, alongside R1.
The bright line in Attachment 1 hasn't moved, and a CMEP plan can't move it. I read the below-threshold sentence as the ERO telling GOs and GOPs that a low impact rating probably won't end the conversation if a lot of generation runs through one third party's systems. That's more or less where the Federal Energy Regulatory Commission (FERC) auditors landed in October. FERC's staff report on its 2026 CIP audits found affiliate and third-party arrangements where the aggregate capability at a shared control point met medium impact criteria while each GOP rated its own systems low impact, which we went through in our breakdown of the 2026 findings. That post read those arrangements against criterion 2.11 as well.
The plan cites CIP-002-5.1a because that's the version in effect through 2027. CIP-002-8 takes effect July 1, 2028, and its changes are mostly about Transmission Owner and Transmission Operator Control Centers, which we covered in CIP-002-8, Decoded.
The plan doesn’t mention CISA, but my own read is that this sits close to the CI Fortify initiative the Cybersecurity and Infrastructure Security Agency (CISA) launched in May, which asks critical infrastructure operators to plan on losing third-party connections, vendors and service providers included, during a crisis. For a plant whose day-to-day operation runs through a contractor’s control center, I think that probably means knowing whether anyone can run it without them, and I’d guess that’s close to what the plan has in mind when it asks for contingency arrangements alongside oversight and clearly defined responsibilities.
BCSI and the Cloud Get Their Own Subsection
Last year CIP-004-7 R6 and CIP-011-3 R1 were rows in the Grid Transformation table, and cloud services came up in a single sentence under Workforce Adequacy. This year they have a subsection called Cloud Security and BES Cyber System Information (BCSI) Protection. It says increasing reliance on cloud services brings risks from third-party dependencies, shared infrastructure, and unauthorized access to sensitive information, and that when BCSI is stored or processed in cloud environments, unclear security responsibilities, inadequate access controls, or weaknesses in encryption and key management can increase the potential for unauthorized disclosure. It cites NERC's primer on cloud and BCSI protection and the National Security Agency's Mitigating Cloud Vulnerabilities document, and closes by saying organizations should consider cyber risks to cloud resources the same way they would on premises.
In September, NERC also retired the CMEP Practice Guide on BES Cyber System Information, dated April 26, 2019, after a comment period that ran from August 28 to September 14 and drew no comments. NERC said the guide was outdated given the revisions in CIP-004-7 and CIP-011-3. With the practice guide retired, I'd treat the plan's subsection as the current statement of what CMEP staff will look for with BCSI in the cloud. If your BCSI program depends on a cloud provider, I'd make sure you can show who is responsible for which control, who has provisioned access, and where the keys are held, since those map directly to what the plan names. Our earlier deep dive on CIP-004-7 and CIP-011-3 covers the access and encryption mechanics.
The Security introduction's mention of AI isn't mapped to any requirement. FERC's auditors did look at AI tools' access to BES Cyber Systems and BCSI under CIP-004-7 this year, and a follow-up post read that lesson as a change-control problem.
Supply Chain, With an Executive Order Footnote
The supply chain requirements are unchanged, CIP-010-4 R1, CIP-013-2 R1, and CIP-007-6 R2. The narrative around them is different. Last year's version talked about digitization, AI-powered attacks, trade disputes, and transformer lead times. This year's focuses on vendor management, saying it should include ongoing security assessments, vulnerability disclosure and management, security patching, and coordination with vendors throughout the product lifecycle.
The first sentence of the subsection, that third-party supplied hardware and software used in grid systems continue to present risk to the BPS, carries a footnote to Executive Order 14421. The plan doesn’t map anything to the order or say more about it than that. We’ve been following the order since August, and the part that bears most on CIP so far is DOE’s October 6 FAQ, which says compliance with NERC standards isn’t an automatic exemption and doesn’t replace NERC obligations, as we covered in What DOE’s EO 14421 FAQ Puts in Writing. A CIP-013-2 program probably won’t keep anything out of the order’s scope, though it’s likely the first evidence you’d hand DOE about an asset, which is one more reason to keep it current.
Large Loads Get Their Own Subsection
Grid Transformation keeps Resource Adequacy, Voltage and Frequency Fluctuations, Interconnection and Modeling, and Workforce Adequacy, and adds Large Load Integration. The new subsection leans on NERC's 2026 State of Reliability (SOR) Overview, released June 24, 2026. The SOR reports a February 2025 event in the Eastern Interconnection where 1,800 MW of data center load dropped off in a customer-initiated load reduction after a transmission fault, and a June 2025 event of 1,300 MW, along with nine events in the Electric Reliability Council of Texas (ERCOT) footprint where at least 100 MW of computational load dropped. The SOR describes the ERCOT events as cryptocurrency mining facilities, which the plan folds into computational load. The plan also points to NERC's 2026 Level 3 Computational Load Alert and notes that NERC is advancing registration criteria and Reliability Standards for Computational Load Owners and Computational Load Operators, the two registrations that replaced the computational load entity in August.
Two other SOR figures show up elsewhere in Grid Transformation. The weighted equivalent forced outage rate for conventional generation rose from 7.6% in 2024 to 9.2% in 2025, and NERC identified a 1,132 MW generation loss from sub-synchronous oscillation protection, a failure mode it hadn't seen at that scale before. On the requirement side, MOD-026-2 R1 replaces last year's MOD-026-1 and MOD-027-1 rows, and PRC-029-2 R1 through R3 replaces PRC-024-3.
NERC’s Board of Trustees approved the registry criteria on October 8, and on October 21 NERC petitioned FERC to approve them on an expedited basis, with registration starting at sites of 50 MW or more connected at 100 kV or above. The Board then adopted the first computational load standards, CLO-001-1 through CLO-003-1 along with revisions to FAC-001 and FAC-002, on October 26, and NERC plans to file those with FERC separately. None of it takes effect until FERC approves it.
Facility Ratings and Operator Training
Facility Ratings adds FAC-008-5 R3 and PRC-023-6 R1 to last year's FAC-008-5 R6. The plan connects both to the ambient-adjusted ratings required by FERC Order No. 881, since ratings that change with ambient conditions also call for a look at relay settings. Communication Protocols & Operating Instructions keeps COM-002-4 and IRO-001-4 for Reliability Coordinators and adds PER-005-2 R1 and R3, on the reasoning that a clear Operating Instruction still depends on trained personnel who can interpret and execute it in real time. Extreme Weather Response keeps the same three standards.
What I'd Do With It
The plan is careful to say it isn't an audit scope. CEAs pick the monitoring tool for each registered entity, requirements outside the plan may be more relevant for a given entity, and there's no expectation that every risk element shows up in every engagement. Even so, I'd treat the requirement tables as the baseline for most 2027 audits and spot checks. In my experience the areas of focus are where a Regional Entity's planning usually starts, and the plan itself says registered entities should consider them as they evaluate their internal controls and compliance operations. Most of the CIP list also appears in both the 2026 and 2027 plans, and two years running is a fair sign of what auditors will expect to see well documented. A few places I'd start:
Your oversight plan. I'd line up the requirements in your Compliance Oversight Plan and your Entity Risk Profile Questionnaire (ERPQ) answers against Table 2. Requirements that show up in both are probably where evidence requests come first, since the ERPQ feeds how your Regional Entity weighs these risk elements for you.
Electronic Security Perimeters. With CIP-005-7 R1 now in the areas of focus, I'd check that ESP documentation matches the network as it's built today, including every External Routable Connectivity path through an identified Electronic Access Point. R2 and R3 stay on the list as well, so interactive remote access and vendor remote access to access control and monitoring systems should get the same review.
Low impact assets. CIP-003-9 R2 now carries remote access, physical security, and low impact security plans in a single row. I'd confirm the vendor electronic remote access controls in Section 6 of Attachment 1 are in place and tested, since they're the newest part of the attachment, and that physical security controls actually cover the low impact sites the rationale has in mind.
Aggregated generation. If you're a GO or GOP, I'd list every affiliate, contractor, or service provider that can monitor or control your generation and what else they control from the same place. I'd also document the aggregation analysis behind each Control Center's impact rating, even when it stays low impact, and bring it into the CIP-002-5.1a R2 review along with a note on who would run the plant if that third party's connection were cut.
BCSI in the cloud. If BCSI lives with a cloud provider, I'd check that your documentation shows the split of security responsibilities, provisioned access, and encryption and key management for each repository.
Patching and software integrity. CIP-007-6 R2 is framed around supply chain policies for security patching, and CIP-010-4 R1 around unverified software sources. I'd check that patch sources are identified and that the software identity and integrity checks under CIP-010-4 Part 1.6 leave a trail an auditor can follow from the vendor to the baseline change.
Physical security routines. The CIP-006-6 R1 rationale mentions task fatigue, and the physical security narrative talks about personnel losing focus on repetitive work over long periods. I'd look at the routine parts of the physical security plan, such as visitor logging and alarm response, for signs they've become rote.
CIP-012. I'd keep the program running as it is, since the standard is still enforceable and can still be scoped into an audit.
I think the consolidation is mostly bookkeeping, and the new language under Aggregation of Control and BCSI is where the 2027 plan differs most from last year's.
Sources and Further Reading
NERC, 2027 ERO Enterprise Compliance Monitoring and Enforcement Program Implementation Plan (November 2026), posted on NERC's CMEP Resources page.
NERC, 2026 ERO Enterprise CMEP Implementation Plan (released November 1, 2025, revised February 24, 2026).
NERC, 2026 State of Reliability Overview (June 24, 2026), the source of the forced outage, large load, and sub-synchronous oscillation figures.
NERC, Weekly Regulatory Updates, September 28, 2026, announcing the retirement of the CMEP Practice Guide on BES Cyber System Information.
