Ampyx Cyber Blog
The Intersection of Resilience & Regulation
FERC's 2026 CIP Lessons Are an AI Change-Control Warning
A Federal Energy Regulatory Commission (FERC) staff report on 2026 Critical Infrastructure Protection (CIP) audits found capability beyond what existing reviews had assessed, in phased generation, shared control centers, and artificial intelligence (AI) tools. Read as a change-control problem, it raises the question of which AI updates should reopen an access approval or a CIP-002 categorization.
FERC 2026 CIP Audit Findings: Generator Registration, Aggregated Control, and AI Tool Access
The Federal Energy Regulatory Commission (FERC) staff report on its 2026 Critical Infrastructure Protection (CIP) audits found new generation running before it was registered, aggregated control of generation sitting with affiliates and vendors, and artificial intelligence (AI) tools inside CIP-networked environments. Two of the three lessons are categorization problems again.
Using the Work of Others in NERC CIP and O&P Compliance
The work of others lets you lean on someone else's assessment as compliance evidence. It does not transfer accountability. This breakdown maps the ERO guidance stack, the two-part test auditors apply, worked examples for CIP-013 vendor assessments and BCSI in the cloud, the FERC FY2025 findings on delegation gone wrong, and the audit prep questions to answer first.
CIP-003 Low Impact Vendor Remote Access: Expert Audit Questions
A deep dive into NERC’s Currently Compliant Podcast Episode 8, extracting every key question being asked about CIP-003-9 vendor remote access. These questions provide a clear view into audit expectations across the ERO Enterprise and highlight where entities are struggling with visibility, control validation, and monitoring of vendor access.
FERC 2025 CIP Audit Findings: DER Impact Ratings, Vendor Oversight Gaps, and Cloud Compliance Risk
FERC’s latest CIP audit lessons for 2025 highlight three rising compliance risks. Entities are undercounting DERs in GOP control center impact ratings, outsourcing compliance work without adequate oversight, and moving EACMS or PACS functions to the cloud without a defensible evidence path. These issues now represent real audit exposure across the US bulk power system.
Closing the Gaps: FERC Order 912 and the Future of Supply Chain Risk Management
FERC Order 912 marks a shift in supply chain cybersecurity for the Bulk-Power System. It directs NERC to strengthen supply chain protections by closing gaps in risk identification, reassessment, and response, and by extending coverage to Protected Cyber Assets. Vendor data validation is encouraged but not mandated, and NERC has 18 months to deliver new or revised standards.
FERC’s New Proposed Rule on Supply Chain Risk Management (SCRM)
The Federal Energy Regulatory Commission (FERC) has released a new Notice of Proposed Rulemaking (NOPR) under Docket No. RM24-4-000, focusing on supply chain risk management (SCRM) for the Bulk-Power System (BPS). This proposed directive aims to fill critical gaps in existing NERC Critical Infrastructure Protection (CIP) standards and bolster the defenses of our nation’s critical infrastructure.