Ampyx Cyber highlighted gaps in generator registration, cyber risk categorization and artificial intelligence (AI) access controls in the Federal Energy Regulatory Commission’s (FERC) 2026 Critical Infrastructure Protection (CIP) audit findings. Auditors found inverter-based generation resources operating above applicable Bulk Electric System thresholds before registration or required cybersecurity evaluations, as well as cases in which affiliates and third-party service providers monitored or controlled multiple generation resources from shared control centers that met medium-impact criteria, although individual operators had classified their systems as low impact.
The FERC report covers non-public CIP audits of several U.S.-based North American Electric Reliability Corporation (NERC) registered entities during fiscal year 2026, which for the federal government ran from October 1, 2025 through September 30, 2026. Staff from NERC and the Regional Entities took part in the virtual and on-site portions.
“The top-line finding reads a lot like other years. Most of what the audited entities had in place met the mandatory requirements, potential noncompliance and security risks remained, and staff folded practices the standards don’t require into the report as voluntary recommendations,” Patrick Miller, president and CEO of Ampyx Cyber, wrote in a Thursday company blog post. “The report is short, about twelve pages of substance, and it drops the appendix of prior years’ lessons that the 2025 report carried, pointing to a summary on FERC’s staff reports page instead. I’d read the footnotes closely, because some of the more useful details are down there, including FERC’s count of low and medium impact requirements and the Order No. 693 language on delegation.”
Ampyx Cyber also highlighted FERC’s findings on AI tools operating within CIP-networked environments, where auditors generally found appropriate controls but identified differences in how entities managed access.
The report notes that AI capabilities are increasingly being incorporated into products and services, potentially complicating compliance as tools gain the ability to monitor networks, respond to threats and perform tasks similar to those of human users. FERC recommends that entities assess the business need for AI tools, manage their access to bulk electric system cyber systems and sensitive information, monitor external communications, and account for AI-related risks in vendor supply chain security programs.
The first lesson, on timely registration and CIP compliance for generation resources, falls under CIP-002-5.1a R1. Auditors found that new inverter-based resources (IBRs) entered commercial operation above the Bulk Electric System (BES) threshold before NERC registration or CIP-002 evaluation, which traced to a misreading of the Commercial Operation Date (COD).
Miller observed that the threshold is the BES one. FERC quotes the BES definition’s Inclusion I2, which covers generating resources connected at 100 kilovolts (kV) or above with a gross individual nameplate rating above 20 megavolt-amperes (MVA) or a gross plant aggregate above 75 MVA, though most solar, wind, and battery plants come into the BES through Inclusion I4 instead, which covers dispersed power producing resources aggregating to more than 75 MVA at a common point of connection at 100 kV or above.
FERC’s background section also quotes the Category 2 Generator Owner criteria, for non-BES IBRs of at least 20 MVA connected at 60 kV or above, and I’d guess a fair number of readers will put those two quotes together and conclude that Category 2 registration brings the CIP standards with it, which under the current standards it doesn’t.
The CIP standards list the Generator Owner and Generator Operator in their applicability sections without distinguishing between categories, but the Facilities section then limits them to BES Facilities, and a Category 2 resource is non-BES by definition. NERC’s implementation plan for Project 2024-01, the project aligning the Glossary definitions with the new registration categories, says that standards applicable only to BES Facilities won’t be enforceable on Category 2 facilities unless a standards project revises them to include those facilities. The IBRs in FERC’s observations were producing above the BES threshold, which makes their owners Category 1, and Category 1 has carried CIP-002 obligations all along.
“A phased project can spend its early phases below the BES threshold, possibly registered as Category 2 with no CIP obligations, and then become a BES Facility on the COD of the phase that pushes the aggregate past 75 MVA,” according to Miller. “That COD is when Category 1 registration and the CIP-002 evaluation are due, regardless of how many phases remain in the interconnection queue. Category 2 resources aren’t entirely outside CIP’s reach, though, because last year’s report made clear that criterion 2.11 counts non-BES generation, so a Category 2 IBR with no CIP obligations of its own can still count toward the 1,500 megawatt (MW) aggregate at a GOP Control Center that operates it.”
He points out that FERC is fairly generous about how this happens, noting that an entity actively trying to meet its interconnection obligations can still inadvertently miss its cybersecurity requirements. “The interconnection queue and NERC registration run on different clocks and usually belong to different people, so the project team tracking the queue’s last milestone may not be the team that knows the registration clock already started. FERC’s mitigation is to apply NERC’s COD definition, register when a phase pushes the aggregate over the BES threshold, and identify and categorize the BES Cyber Systems under CIP-002-5.1a at that point. Entities that are already registered need to review new generation resources the same way, on the same COD trigger.”
The second lesson, on identifying and categorizing all BES Cyber Systems used for generation operation, also falls under CIP-002-5.1a R1. Auditors found that affiliates and third parties monitored and controlled the generation of several Generator Operators (GOPs) from one control point that met medium impact criteria in aggregate, while each GOP rated itself low impact.
Here, Miller said that FERC ties the medium impact outcome to CIP-002-5.1a Attachment 1, and the report’s footnote cites the criterion for commissioned generation at a single plant location of 1,500 megawatts (MW) or more. “I’d probably read the shared control center scenarios against criterion 2.11 instead, which covers Control Centers performing Generator Operator functions for an aggregate of 1,500 MW or more in a single Interconnection, and which is the criterion last year’s report applied to DERs. Either way, the result is a medium impact rating, but if you’re documenting the analysis I think 2.11 is the cleaner link.”
On responsibility, FERC is direct. Demonstrating compliance for every cyber system that should be categorized as a BES Cyber System, including systems an affiliate or third party operates, falls to the GOPs, and the report quotes Order No. 693 for the principle that a registered entity can delegate performance of a task but not its responsibility for making sure the task gets done. NERC’s Registration Procedure says the same about non-registered third parties: the registered entity remains solely responsible for compliance and accountable for violations even on tasks they perform on its behalf.
“This is the same accountability line we walked through in Work of Others in NERC CIP. It’s harder to apply here though, because the party holding the aggregated control isn’t registered and each registered GOP sees only its own slice of what that party controls,” according to Miller.
Staff also say NERC should consider further guidance, modifications to the Reliability Standards, or changes to registration procedures to address these arrangements, and that housing control of multiple generation resources at one location with a de facto operator increases cybersecurity risk. That recommendation is aimed at NERC.
“Keep an eye on this because, depending on how NERC responds, a registration change could bring the aggregator itself into scope,” Miller said. “NERC’s own CIP Roadmap made a related point in January, describing low impact systems, third-party operators, and newly registered Category 2 IBRs as a growing share of operational dependency that sits outside medium and high impact coverage.”
Until then, he added that a GOP’s practical step is to find out who else can monitor or control its generation (a parent company’s operations center, a shared remote operations provider, an asset manager, an equipment manufacturer’s monitoring service) and what else those parties control from the same place. “I’d document that aggregation analysis even when the conclusion stays low impact, and if the aggregate gets anywhere near 1,500 MW, I’d probably run this by your Regional Entity before any audit or other CMEP activity.”
The third lesson concerns access to BES Cyber Systems and BES Cyber System Information (BCSI) facilitated by super intelligence (artificial intelligence) tools, and it falls under CIP-004-7 R4, R5, and R6. Auditors found that these tools are increasingly embedded in CIP-networked environments and are generally controlled, but entities varied in how they handled access.
“Auditors saw SI (artificial intelligence) tools in use across the audited entities’ CIP-networked environments, and found that entities generally accounted for them and applied appropriate controls, with variation in how they handled that access,” according to Miller. “FERC says most of these tools are still limited to chatbots and personal assistants, though they’re picking up network monitoring, threat response, and operations similar to a user’s.”
He added that some of the sharper points came from the entities themselves, who told auditors that vendors are adding these capabilities to products and services faster than compliance programs adapt, that tools able to mimic user behavior make legitimate activity harder to distinguish from malicious use, and that the scope of what a tool can do sometimes isn’t fully understood until it’s already active on the network.
On risk, Miller highlighted that FERC cites the same CIP Roadmap as identifying the targeting of SI tools as an emerging risk, and says that because these tools may have unrestricted access across systems, they’ve become attractive targets. Staff also state that recent real-world intrusions show adversaries using commercially available tools of this kind already on entity systems to map environments, identify pathways toward critical systems, accelerate reconnaissance, and automate exploitation attempts.
Miller said that under CIP-005, FERC’s consideration is to understand and monitor every SI tool’s communications outside the Electronic Security Perimeter (ESP), including the reason access was granted. He said the documentation to keep on file is the external endpoints each tool reaches, with a business justification for each.
Under CIP-007, FERC’s consideration is to identify and inventory SI (artificial intelligence) tools as generic service accounts and change default passwords where applicable. The documentation he would like to keep on file is each tool in the account inventory, with credentials managed like any other generic account. Under CIP-011, he pointed out that FERC’s consideration is to limit an SI tool’s ability to access BCSI. The documentation Miller would like to keep on file is the BCSI repositories each tool can reach, along with the controls that limit that reach.
Under CIP-013, he mentioned that FERC’s consideration is to identify and assess risk from SI (artificial intelligence) products or services from prospective vendors in the supply chain risk management plan, using a framework such as AI RMF 1.0. The documentation to keep on file includes vendor questions about AI features, including features that can be switched on after purchase.
“The CIP-007 suggestion is probably the one with the most weight,” Miller wrote. “Treating an AI tool as a generic account gives it a place in an account management process entities already run. It also raises a question I don’t think CIP-004 answers cleanly, which is whether a given tool is acting on a person’s authorized access or on its own service credentials. I think most programs will end up answering that tool by tool.”
Miller also provided a couple of questions for the next audit cycle beginning with registration timing for each generation project in an interconnection queue, entities should know the date its commercial operation will first exceed the BES threshold, and who owns the registration and CIP-002 steps on that date. Entities should also be able to name every affiliate, contractor, or service provider with monitoring or control capability over their resources, and what else those parties control from the same place.
Where those parties aggregate control, the 1,500 MW analysis should be documented, even if the entity’s own rating is low impact. Entities should also know which products in their CIP-networked environment have AI features today, including features a vendor enabled after the product was purchased. Finally, for each AI tool, they should be able to show the CIP-004 authorization, the account it runs under, the BCSI it can reach, and the communications it makes outside the ESP.
