Ampyx Cyber Blog
The Intersection of Resilience & Regulation
Execution Integrity in the Age of NIS2 & CRA: What Comes After Perimeter Compliance
Many compliance programs under the revised Network and Information Security Directive (NIS2) are built around network architecture, but a firewall cannot verify what code actually runs on the controller behind it. This fifth report in the series maps what NIS2, the Cyber Resilience Act (CRA), and Germany's BSI Act ask for, draws on how US utilities met similar demands under NERC CIP, and sets out what a defensible firmware baseline requires, including for legacy operational technology (OT) that cannot verify its own firmware.
FERC's 2026 CIP Lessons Are an AI Change-Control Warning
A Federal Energy Regulatory Commission (FERC) staff report on 2026 Critical Infrastructure Protection (CIP) audits found capability beyond what existing reviews had assessed, in phased generation, shared control centers, and artificial intelligence (AI) tools. Read as a change-control problem, it raises the question of which AI updates should reopen an access approval or a CIP-002 categorization.
AI-Built Exploits Are Probing Siemens S7 PLCs
Joint advisory AA26-231A warns that threat actors are using artificial intelligence (AI) to build tools that probe Siemens S7 programmable logic controllers (PLCs) across U.S. critical infrastructure. This post walks through the techniques the agencies describe and the hardening steps they recommend.
Supply Chain Trust: Verified Source, Unknown Origin
A firmware update can pass every cryptographic check and still come from a compromised or state-influenced vendor. This fourth report in the series looks beyond verification to the trustworthiness of operational technology (OT) suppliers. It covers what the revised Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), and Germany's BSI Act expect from supply chain assessments, how ICS Advisory Project data can help evaluate vendor transparency, and how to document risk acceptance when a vendor cannot be replaced.
Would an OT Directive Make CISA an OT Regulator?
A new coalition paper asks the Cybersecurity and Infrastructure Security Agency (CISA) to issue a Binding Operational Directive (BOD) for operational technology (OT). It would bind federal civilian agencies only, and an Inspector General audit found CISA can't enforce BODs even there. Here's what a directive can reach, how one travels anyway, and what utilities should watch.
FERC 2026 CIP Audit Findings: Generator Registration, Aggregated Control, and AI Tool Access
The Federal Energy Regulatory Commission (FERC) staff report on its 2026 Critical Infrastructure Protection (CIP) audits found new generation running before it was registered, aggregated control of generation sitting with affiliates and vendors, and artificial intelligence (AI) tools inside CIP-networked environments. Two of the three lessons are categorization problems again.
What DOE's EO 14421 FAQ Puts in Writing
The Department of Energy (DOE) published a 22-question frequently asked questions (FAQ) document on Executive Order (EO) 14421 on October 6, three days before its request for information closed. Most of it puts on paper what DOE said at the September webinar, and a few answers go further, on data centers, on reliability standards, and on when a transaction counts as initiated.
UEFI in OT: Hardware Trust, Secure Boot & CE Marking
Most industrial PCs and gateways in Europe run Unified Extensible Firmware Interface (UEFI) firmware that was shipped long before either of today's regulatory clocks started. This third report in the series explains where Secure Boot breaks down under real operational technology (OT) conditions, how the Cyber Resilience Act (CRA) divides responsibility for CE marking between component suppliers, equipment manufacturers, and operators, and what engineering and procurement teams can audit now under the revised Network and Information Security Directive (NIS2).
Firmware and Bootloader: The Verification Gap in OT Infrastructure
Proving that the code running on a field device is what the vendor shipped is one of the hardest problems in industrial security. This second report in the series compares four verification mechanisms, from SHA-256 hashing to remote attestation, and maps them to the revised Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), and Germany's BSI Act. It also looks at what US utilities learned under NERC CIP, and which compensating controls work for legacy controllers that cannot verify their own firmware.
The Execution Layer Gap: Why European Critical Infrastructure May Be Looking at the Wrong Regulatory Clock
Many European critical infrastructure operators are planning around December 2027, when the Cyber Resilience Act (CRA) fully applies. Its vulnerability reporting duty under Article 14 took effect on September 11, 2026, and it covers products already deployed in the field. This Foundation report, the first in a six-part series, looks at why regulators are turning to the firmware and bootloader layer below the operating system, how the CRA and the revised Network and Information Security Directive (NIS2) reach it, and what Germany's implementation adds.
One Incident, Several Reports: What GAO's Panel & CISA's Town Halls Say About Harmonization [Updated]
A single cyber incident at a utility can owe reports to several federal agencies, each with its own clock and definition. The Government Accountability Office's latest panel heard that again, and electric, gas, oil, and water groups told the Cybersecurity and Infrastructure Security Agency the same thing in June. This post looks at where the overlap sits and where the reporting rule stands.
Four Things in the EO 14421 Webinar That Aren't in the RFI
The Department of Energy (DOE) held its public webinar on the Executive Order (EO) 14421 request for information (RFI) on September 16. Most of the hour restated the notice, but four things came up that aren't in the RFI text at all. The one with the shortest fuse is that a phone call to DOE about this proceeding puts a memo in the public docket, and you're the one who has to write it.
CIP-014-4 Approved: The New Physical Security Risk Assessment and the 2028 Clock
FERC approved Reliability Standard CIP-014-4 on September 10, 2026 in Docket No. RD26-9-000, and the version number understates the change. CIP-014-3 had six requirements. CIP-014-4 has ten, three of them new. The risk assessment now needs a documented methodology, mandatory dynamic simulations, and a neighboring substation in the model. All of it has to be finished by October 1, 2028.
Question H-3: DOE Asks Whether Industry Should Execute the Bulk-Power Order
DOE's Request for Information on Executive Order 14421 includes one question, H-3, asking whether industry standards bodies and third-party labs can execute the order instead of the federal government. The electric sector ran something close to this before, under the Electric Reliability Organization. This post looks at what changes when the statute is IEEPA, not the Federal Power Act, and what a working precedent outside the sector suggests.
Nothing Is Grandfathered: The EO 14421 RFI on Existing Equipment
DOE has opened a 30-day request for information on how it will implement Executive Order 14421, the order restricting foreign-produced bulk-power system equipment. The most consequential questions concern equipment already installed, since the order does not grandfather it, and how DOE will define "foreign-produced" in the first place. Comments are due October 9, with a public webinar on September 16.
An ERO for Water: What H.R. 2594 Borrows From NERC, and What It Leaves Behind [Updated]
Water utilities in at least seven states reported cyber incidents this summer, and Congress now has two answers that point in opposite directions. One bill gives EPA direct authority. The other certifies a sector-led body to write and enforce the requirements, modeled on the electric sector. A close read of what H.R. 2594 borrows from the Federal Power Act, where it departs, and what twenty years inside that model cost.
Executive Order 14421 and the Bulk-Power System Supply Chain [Updated]
An executive order signed August 26, 2026 declares a national emergency over foreign-produced bulk-power system electric equipment. It reaches 69 kV and above, adds software, firmware, a list of OT/ICS gear, and vendor remote access to scope, and creates authority to condition or remove equipment already installed. Here is what changed since the 2020 order, where it meets CIP-003-9 and CIP-013-2, and what to do before December 24.
Poland's Energy Sector Attack, Part Two: When the Path Into OT Is a Private Cellular Network
A second Polish combined heat and power plant was hit the same morning as the December 2025 attacks. CERT Polska's follow-up report describes something no one had seen in the wild, an attacker pivoting into an operational technology network across a shared private cellular network (a private APN). It explains how the chain worked, why the weak link sat on infrastructure the plant did not control, and what every operator relying on a private APN should check now.
Ampyx Cyber Joins the E-ISAC Vendor Affiliate Program
Ampyx Cyber has joined the Electricity Information Sharing and Analysis Center (E-ISAC) Vendor Affiliate Program. For a services firm that sits across a wide cross-section of the electric sector, membership formalizes something we already believed: grid threat intelligence is only as good as its willingness to move in both directions.
ANCHOR-CI: The Partnership Framework Returns, the Liability Shield Does Not
DHS just reopened the closed-door forum where critical infrastructure operators and federal agencies compare notes on cyber threats in private. The legal protection that once made those conversations safe did not come back with it. ANCHOR-CI restores the room and leaves the shield behind, and here is what that changes for anyone who plans to speak in it.