Ampyx Cyber Blog
The Intersection of Regulation & Resilience
FERC Issues Orders on Virtualization and Low Impact: What Changed and What You Need to Do
FERC unanimously approved Order Nos. 918 and 919 on March 19, 2026, finalizing CIP virtualization standards and new low-impact BES Cyber System controls, plus an updated "Control Center" definition. All CIP-registered entities are affected. Implementation windows are 24 and 36 months respectively. Compliance programs should begin gap assessments now.
Cyber on Tap, Part Two: New York's Water Cybersecurity Regulation Is Now in Force
New York's Appendix 5-E cybersecurity regulation for public water systems took effect March 11, 2026, making it the first mandatory, enforceable water cybersecurity framework in the country. This post covers who is in scope, what is required, when it is due, and what resources are available to help. It also examines what New York's action means in the context of a federal policy environment that is actively stepping back from sector-specific cybersecurity regulation.
![Poland's Energy Sector Attack: When Cyber Sabotage Targets OT [Updated]](https://images.squarespace-cdn.com/content/v1/5f80bdfaeeac37068ed8c60e/1750463988120-77LW8AOEP96E0SZ38CV2/Deep+Dive.png)
Poland's Energy Sector Attack: When Cyber Sabotage Targets OT [Updated]
On December 29, 2025, Poland experienced coordinated destructive cyberattacks across 30+ wind/solar farms, a CHP plant, and manufacturing. Attackers exploited FortiGate devices without MFA, used default credentials on OT equipment, and deployed custom wiper malware designed to damage industrial controls. Every failure was preventable.
NERC’s CIP Roadmap and the Future of Grid Cybersecurity
NERC’s new CIP Roadmap signals a major shift in how cyber risk will be regulated across the power grid. This Policy Pulse explains what NERC released, why it matters, what standards and guidance are coming next, and how utilities, generators, and grid operators should prepare for expanding CIP scope and enforcement.
The Human Factor: The Greatest Challenge in Organizational Cybersecurity
Despite significant investments in technical controls, frameworks, and compliance efforts such as NIST SP 800-171 Rev 3, NIST SP 800-53 Rev 5, and NERC CIP standards, many organizations still struggle with implementing effective cybersecurity programs. The root of this challenge is not just technology or documentation — it's human behavior.