Ampyx Cyber Flags AI and Registration Gaps in FERC’s 2026 CIP Audit Report
Ampyx Cyber identified registration delays and inconsistent impact ratings in FERC’s latest audit, noting evolving risks from AI tools in critical infrastructure networks.
Key points
- Auditors found unregistered inverter-based resources operating above Bulk Electric System thresholds.
- Shared control centers were misclassified as low impact despite meeting medium-impact criteria.
- FERC’s report highlights varied access controls for AI tools within CIP-networked environments.
Ampyx Cyber published an analysis of the Federal Energy Regulatory Commission’s 2026 Critical Infrastructure Protection audit findings on Thursday, identifying persistent compliance gaps in generator registration and cybersecurity risk categorization. The review highlights how shared control centers and artificial intelligence tools are complicating adherence to mandatory standards for U.S. electric sector entities under NERC oversight.
Auditors discovered that inverter-based generation resources operated above applicable Bulk Electric System thresholds without prior registration or required cybersecurity evaluations. The report also noted instances where affiliates and third-party service providers monitored multiple generation resources from shared control centers that met medium-impact criteria, even though individual operators had classified those systems as low impact.
Audit Scope and Methodology
The Federal Energy Regulatory Commission’s report covers non-public audits of several North American Electric Reliability Corporation registered entities during fiscal year 2026. This federal fiscal period ran from October 1, 2025, through September 30, 2026. Staff from NERC and the Regional Entities participated in both the virtual and on-site portions of the audit process.
Patrick Miller, president and CEO of Ampyx Cyber, stated in a company blog post that the top-line findings resembled previous years. He noted that most audited entities met mandatory requirements, though potential noncompliance and security risks remained. Staff included voluntary recommendations in the report for practices not strictly required by the standards.
Report Structure and AI Risks
Miller observed that the report is shorter than prior versions, containing about twelve pages of substance. It drops the appendix of lessons from previous years that the 2025 report carried, instead directing readers to a summary on FERC’s staff reports page. Miller advised reading the footnotes closely, as they contain useful details on low and medium impact requirements and Order No. 693 delegation language.
The report addresses artificial intelligence capabilities increasingly incorporated into products and services within CIP-networked environments. Auditors generally found appropriate controls for these tools but identified differences in how entities managed access. The findings note that AI tools can monitor networks, respond to threats, and perform tasks similar to human users, potentially complicating compliance efforts.
What should you do?
Security professionals should review their generator registration status against Bulk Electric System thresholds to ensure timely compliance. Organizations using shared control centers should verify that impact classifications match the actual operational scope and criteria. Teams managing AI tools in CIP networks should audit access controls to ensure they align with internal policies and regulatory expectations.
What to do and how to stay safe: Ampyx Cyber
- Verify that all inverter-based generation resources are registered before operating above applicable Bulk Electric System thresholds.
- Re-evaluate the impact classification of shared control centers to ensure they meet the correct medium or high-impact criteria.
- Audit access controls for AI tools operating within CIP-networked environments to confirm they match internal security policies.
- Review FERC footnotes and Order No. 693 language to understand delegation requirements for cybersecurity responsibilities.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What fiscal year does the FERC CIP audit report cover?
The report covers fiscal year 2026, which ran from October 1, 2025, through September 30, 2026.
Did auditors find that AI tools lacked basic controls?
Auditors generally found appropriate controls for AI tools but identified differences in how entities managed access within CIP networks.
What issue was found with shared control centers?
Auditors found cases where shared control centers met medium-impact criteria but were classified by operators as low impact.
