A new post from Centrii warned that new vendor remote access requirements under the North American Electric Reliability Corp.’s (NERC) Critical Infrastructure Protection standard CIP-003-9 are creating compliance and recordkeeping challenges for owners and operators of renewable energy, storage and other facilities with low-impact bulk electric system (BES) cyber systems. Effective Apr. 1, this year, the standard requires covered entities to establish processes to identify vendor electronic remote access, disable it and detect known or suspected malicious communications associated with it.
The requirements apply to qualifying assets that permit vendor remote access, including systems involving controllers, supervisory control and data acquisition (SCADA) and communications that could affect the BES.
“FERC can impose civil penalties of up to $1 million per violation, per day, under section 316A of the Federal Power Act and that maximum is adjusted for inflation every January,” Centrii detailed in a post last week. “The 2025 adjustment raised it to $1,584,648. It is a ceiling, though, not a floor. In practice, NERC and the Regional Entity weigh the risk to the grid, how long the issue lasted, the strength of your internal controls, and your compliance history. As a result, settled penalties are typically well below the maximum.”
It added, “A finding usually brings a mitigation plan that you must complete and certify. Notices of Penalty are filed with FERC and published. For CIP violations, they traditionally name the entity only as an unidentified registered entity. For a portfolio, the bigger cost is staff time to rebuild records.”
The analysis mentioned that covered entities must retain evidence for each requirement for three calendar years, while audits of low-impact requirements can span six years, potentially leaving operators unable to substantiate compliance if older vendor access records are missing. Evidence may be dispersed across email approvals, original equipment manufacturers’ remote support tools and records held by operators or operations and maintenance contractors.
NERC and its regional entities oversee compliance audits and enforcement, while the registered entity remains responsible even when day-to-day operations are outsourced. The standard’s evidence examples include access preauthorization, vendor login alerts, session monitoring and recording, and system logs.
“Written plans show intent; records show the process ran,” Centrii said. “For every vendor path into your sites, you want one name for who approves it, one for who can disable it, and one place where its record lives, kept for as long as an audit can reach back.”
Centrii explained that low-impact is a rating NERC gives to BES cyber systems, based on the effect they could have on the BES. Under CIP-002, every BES cyber system is rated high, medium, or low-impact; and low impact covers the systems that do not meet the high or medium criteria. For generation, the medium-impact threshold starts at 1,500 MW in a single interconnection, and NERC staff have described dispersed generation resources as falling into the low-impact category. Most solar, wind, and storage sites that are in scope will be in this category. A control center that operates several facilities is the main exception.
“At the asset level, this includes a registered generation or storage site with BES Cyber Systems: the controllers, SCADA, and communications that could affect the BES. Inverter-based resources of 20 MVA or more connected at 60 kV or higher had to register with NERC as Category 2 by May 15, 2026, which brought many sites into the program for the first time,” according to the post. “Applicability still depends on the entity, its registered function, the facility, and the systems involved.”
At the portfolio level, the audience is owners, operators, and asset managers who hold several of these sites, such as independent power producers, funds, and storage developers. Day-to-day operations are often outsourced to operators and O&M providers, but the registered entity remains responsible.
“For CISOs and security leaders, the program is yours to defend, even when you do not run the sites,” Centrii said. “CIP-003-9 requires the registered entity to name a CIP Senior Manager (Requirement R3). The security lead usually supports that person with evidence. The hard part is accountability across contractors.”
Centrii detailed that NERC CIP-003-9 added Section 6 to Attachment 1, covering vendor electronic remote access security controls. It applies to assets containing low-impact BES Cyber Systems that allow vendor electronic remote access. Section 6 requires a process with three parts, including a method to determine vendor remote access, a method to disable it, and a method to detect known or suspected malicious communications tied to it.
“The standard’s own examples of evidence give us a sense of what auditors may look for: steps to preauthorize access, alerts generated by vendor log on, session monitoring, session recording and system logs,” according to the post analysis. “Something to watch: the standard never defines ‘vendor.’ ReliabilityFirst says we should expect auditors to read it broadly, and points to staff augmentation as an example. Their guidance is to treat any non-employee with remote access to low-impact systems as a vendor, unless that person meets the same screening, training, and equipment conditions as your employees.”
CIP-003-9 requires evidence for each requirement to be kept for three calendar years. If the last audit was more than three years ago, the compliance enforcement authority can ask for other evidence that the entity was compliant for the whole period. The audit period for the low impact requirements can run six years, and auditors can ask about any date in it. Evidence pulled together on the day of the audit shows where an entity stands now, not where it stood three or four years ago. ReliabilityFirst advises that if the records aren’t bulky, they should be kept for the full period since the last audit.
That is harder than it sounds for vendor access, because the records are scattered. Approvals sit in email, session logs sit in an OEM’s remote support tool, and the people who can disable access work for an operator or O&M provider. A change of operator, asset manager or O&M contractor makes it worse, since older records don’t always stay with the site, yet the auditor will still put the question to the responsible entity. For a portfolio manager, a gap in records can turn a routine process into a finding, a mitigation plan and a conversation with lenders and insurers about what else might be missing.
Centrii asked that each asset allowing vendor remote access have a way of determining when a vendor is connected. It asked who can disable that access and where the record of the last test is kept. It also asked where approval and session records live today and who holds them, what would be handed over if an auditor asked about a date in the oldest year of the audit period, and what happens to the records when a vendor, operator or asset manager changes.
“If two or more answers start with ‘it depends on who you ask,’ that is a problem that needs to be solved,” according to the post.
Earlier this month, Centrii warned that cyber risk in the energy sector is increasingly becoming a financial and geopolitical concern as nation-state activity, ransomware and renewable-energy supply-chain risks converge. It observed that state-linked hackers are increasingly positioning themselves inside energy infrastructure for potential future disruption, while criminal ransomware attacks are creating measurable financial exposure for utilities.
