Ampyx Cyber Blog
The Intersection of Regulation & Resilience
Would an OT Directive Make CISA an OT Regulator?
A new coalition paper asks the Cybersecurity and Infrastructure Security Agency (CISA) to issue a Binding Operational Directive (BOD) for operational technology (OT). It would bind federal civilian agencies only, and an Inspector General audit found CISA can't enforce BODs even there. Here's what a directive can reach, how one travels anyway, and what utilities should watch.
FERC 2026 CIP Audit Findings: Generator Registration, Aggregated Control, and AI Tool Access
The Federal Energy Regulatory Commission (FERC) staff report on its 2026 Critical Infrastructure Protection (CIP) audits found new generation running before it was registered, aggregated control of generation sitting with affiliates and vendors, and artificial intelligence (AI) tools inside CIP-networked environments. Two of the three lessons are categorization problems again.
What DOE's EO 14421 FAQ Puts in Writing
The Department of Energy (DOE) published a 22-question frequently asked questions (FAQ) document on Executive Order (EO) 14421 on October 6, three days before its request for information closed. Most of it puts on paper what DOE said at the September webinar, and a few answers go further, on data centers, on reliability standards, and on when a transaction counts as initiated.
One Incident, Several Reports: What GAO's Panel & CISA's Town Halls Say About Harmonization [Updated]
A single cyber incident at a utility can owe reports to several federal agencies, each with its own clock and definition. The Government Accountability Office's latest panel heard that again, and electric, gas, oil, and water groups told the Cybersecurity and Infrastructure Security Agency the same thing in June. This post looks at where the overlap sits and where the reporting rule stands.
When AI Changes Without a Change Request
On September 28 and 29 I will be at The Utility Change Conference West 2026 in Phoenix to talk about the artificial intelligence (AI) changes that never enter a utility's change process. A vendor feature toggle or a model update can alter what a tool reaches and how it behaves while the configuration baseline shows nothing. This preview walks through the questions those changes raise under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards, using three recent incidents outside the utility sector as context.
Four Things in the EO 14421 Webinar That Aren't in the RFI
The Department of Energy (DOE) held its public webinar on the Executive Order (EO) 14421 request for information (RFI) on September 16. Most of the hour restated the notice, but four things came up that aren't in the RFI text at all. The one with the shortest fuse is that a phone call to DOE about this proceeding puts a memo in the public docket, and you're the one who has to write it.
Who Owns the Risk? The AI Reliability Boundary Assessment Questions
An AI decision-support platform fails at 2:07 on a weekday afternoon. At 2:22 the fifteen-minute reliability window closes and the vendor is still investigating. This is the full question set from the CYBR.SEC.CON talk, forty questions across four NERC CIP standards plus the ownership map behind them. You score your own answers, and nothing on this page collects anything.
CIP-014-4 Approved: The New Physical Security Risk Assessment and the 2028 Clock
FERC approved Reliability Standard CIP-014-4 on September 10, 2026 in Docket No. RD26-9-000, and the version number understates the change. CIP-014-3 had six requirements. CIP-014-4 has ten, three of them new. The risk assessment now needs a documented methodology, mandatory dynamic simulations, and a neighboring substation in the model. All of it has to be finished by October 1, 2028.
Question H-3: DOE Asks Whether Industry Should Execute the Bulk-Power Order
DOE's Request for Information on Executive Order 14421 includes one question, H-3, asking whether industry standards bodies and third-party labs can execute the order instead of the federal government. The electric sector ran something close to this before, under the Electric Reliability Organization. This post looks at what changes when the statute is IEEPA, not the Federal Power Act, and what a working precedent outside the sector suggests.
Nothing Is Grandfathered: The EO 14421 RFI on Existing Equipment
DOE has opened a 30-day request for information on how it will implement Executive Order 14421, the order restricting foreign-produced bulk-power system equipment. The most consequential questions concern equipment already installed, since the order does not grandfather it, and how DOE will define "foreign-produced" in the first place. Comments are due October 9, with a public webinar on September 16.
Top 10 Computational Load Accountability Mapping Questions for Leaders
NERC's August 19, 2026 posting split the single Computational Load Entity concept into two registrations, Computational Load Owner and Computational Load Operator, and raised the thresholds to 50 MW and 100 kV. Ten questions that help leaders map who is responsible for the work and who is accountable for the outcome, before registration positions harden.
An ERO for Water: What H.R. 2594 Borrows From NERC, and What It Leaves Behind [Updated]
Water utilities in at least seven states reported cyber incidents this summer, and Congress now has two answers that point in opposite directions. One bill gives EPA direct authority. The other certifies a sector-led body to write and enforce the requirements, modeled on the electric sector. A close read of what H.R. 2594 borrows from the Federal Power Act, where it departs, and what twenty years inside that model cost.
Executive Order 14421 and the Bulk-Power System Supply Chain [Updated]
An executive order signed August 26, 2026 declares a national emergency over foreign-produced bulk-power system electric equipment. It reaches 69 kV and above, adds software, firmware, a list of OT/ICS gear, and vendor remote access to scope, and creates authority to condition or remove equipment already installed. Here is what changed since the 2020 order, where it meets CIP-003-9 and CIP-013-2, and what to do before December 24.
The Computational Load Entity Just Became Two
NERC's August 19 posting replaced the Computational Load Entity with two separate registrations, Computational Load Owner and Computational Load Operator, raised the thresholds to 50 MW and 100 kV, and moved the test for who is in scope into a new Site definition. What changed between April and August, who should be running the applicability test, and the eight questions to answer before the window closes.
Your Environment, Your Risk: Building an OT Risk Management Program You Can Defend
There is no rulebook for securing an OT environment, and there never could be. Two utilities can make entirely different choices and both be defensible. Here is how to build an OT risk management program you can stand behind: map your environment, rank the consequences you will not tolerate, choose controls deliberately, and document why, so you can defend every decision an auditor asks about.
What Is a Computational Load Entity?
A large AI data center used to be just a customer of the grid. On July 16, 2026, FERC changed that, directing NERC to create the Computational Load Entity, a new class of registered entity subject to mandatory federal reliability standards. A plain-English guide to what the category is and why it exists, and the anchor for the AI Reliability Boundary series.
NERC Computational Load Alert: August 3 Deadline for Utilities 2026
The NERC Level 3 alert on computational load looks voluntary, but Rule 810 makes the August 3 response mandatory, and a July FERC order turns the guidance into standards due by the end of 2026. What to file before the deadline, which gaps to start closing by role, and why unpriced AI load risk surfaces in prudency reviews, interconnection revenue, and daily penalties.
NERC Computational Load Standards: FERC Sets December 2026 Deadlines
FERC did not accelerate NERC's timeline, it made the calendar a directive and moved registration onto the critical path. The order creates the computational load entity, sets the December 31 and March 1 deadlines, and leaves the AI Reliability Boundary, the line between what the grid must command and what it leaves to private contract, for Phase II to draw. What is settled, what is not, and what to do in the next ninety days.
Cloud Comes to NERC CIP: The 100-Series and Project 2023-09
NERC did not revise the CIP Standards for the cloud. It forked them. Project 2023-09 introduces a parallel 100-Series, an entity can elect into per system, built on a new foundation called BES Cyber Services and Systems (BCSS), with System Security Plans replacing asset lists and Cyber Security Zones replacing the Electronic Security Perimeter. Here is how the parallel track works, what the first drafts actually say, and the open problems worth commenting on before August 21.
Using the Work of Others in NERC CIP and O&P Compliance
The work of others lets you lean on someone else's assessment as compliance evidence. It does not transfer accountability. This breakdown maps the ERO guidance stack, the two-part test auditors apply, worked examples for CIP-013 vendor assessments and BCSI in the cloud, the FERC FY2025 findings on delegation gone wrong, and the audit prep questions to answer first.