FERC Audit Reveals Generator Registration Gaps and Rising AI Cybersecurity Risks
A FERC-led audit of NERC CIP compliance for FY 2026 found generator owners delaying registration of new resources and failing to properly categorize cyber systems, while also highlighting growing cybersecurity risks from unauthorized AI tool use.
Federal Energy Regulatory Commission (FERC) auditors have identified critical compliance gaps in generator registration and warned of new cybersecurity threats from artificial intelligence tools. The findings, from fiscal year 2026 audits of Critical Infrastructure Protection (CIP) standards, show several Generator Owners failed to promptly register new generation resources with the North American Electric Reliability Corporation (NERC) or identify associated Bulk Electric System (BES) Cyber Systems.
Misunderstandings about a generator's Commercial Operation Date (COD) were a primary cause of delay. NERC defines COD as the date after initial testing and commissioning are complete, allowing electricity production for sale. Some owners incorrectly waited until a facility reached full nameplate capacity or completed its interconnection queue process before registering. In one case, registration was delayed for over a year after the generation threshold was exceeded. Under CIP-002-5.1a, resources must be registered and evaluated for BES Cyber Systems as soon as they achieve commercial operation for an aggregate amount above the applicable threshold. Delays in this foundational step can lead to misapplied or missing security controls, increasing vulnerability.
The audit also found entities did not adequately account for monitoring and control functions performed by affiliated companies or third-party contractors when categorizing cyber systems. This oversight led to aggregated control capabilities being treated as lower risk than they actually were.
| Issue | Requirement (CIP-002-5.1a) | Consequence of Non-Compliance |
|---|---|---|
| Delayed Registration | R1: Register generation resources synchronized to the BES on time. | Resources operate without mandatory cybersecurity protections. |
| Incomplete BES Cyber System Identification | R1: Evaluate resources for BES Cyber System identification and categorization. | Security controls are misapplied or absent, increasing exposure. |
| Ignoring Affiliate/Third-Party Systems | Generator Operators must consider affiliate and third-party cyber systems used for monitoring/control. | Aggregated control capabilities are under-protected; low-impact systems may collectively meet medium-impact criteria. |
Growing Use of AI and Super Intelligence Tools Introduces New Risks
Audits revealed an increased use of artificial intelligence and super intelligence (SI) tools like chatbots, personal assistants, and automated analytical systems within CIP-networked environments. While these tools can improve operational efficiency, FERC staff highlighted significant access control risks if their access to BES Cyber Systems and related information is not properly authorized, verified, and monitored. Uncontrolled SI tool access could introduce pathways for unauthorized entry and lateral movement across secure networks. Under standards CIP-004-7, R4, R5, and R6, entities must authorize such access and ensure it is covered by existing risk management frameworks.
Report Purpose and Broader Implications
The anonymized summary report, published on October 14, 2026, shares lessons to help NERC, its Regional Entities, and registered entities improve compliance and bulk-power system security. FERC said, "This anonymized summary report informs the regulated community and the public of lessons learned from the FY 2026 CIP audits." Its purpose is to provide information for risk and compliance assessments, aiming to benefit the wider utility cybersecurity community.
Clarification of Key CIP Standards and Definitions
NERC's CIP standards are mandatory requirements for securing the grid. CIP-002-5.1a governs the identification and categorization of BES Cyber Systems, forming the cornerstone for all subsequent security controls. CIP-004 contains personnel and training standards, including rules for access authorization. Timely execution of these standards is essential, as registration obligates a generating resource to be 100% compliant with all applicable Reliability Standards. The report provides information and recommendations to NERC, Regional Entities, and registered entities for risk and compliance assessments to improve reliability and security of the Bulk-Power System.
