FERC flags AI and registration gaps in US power sector audits
Federal regulators found compliance delays and third-party risks during recent reviews of bulk power system cybersecurity measures.
Key points
- FERC identified delays in registering new generation resources with NERC.
- Auditors flagged risks from third-party control systems and AI tools.
- Many entities met mandatory CIP standards, but voluntary improvements remain.
The Federal Energy Regulatory Commission reported significant cybersecurity compliance gaps among U.S. electricity sector entities in a recent audit review. The agency highlighted specific failures in registering new power generation assets and managing access controls for emerging artificial intelligence tools.
According to Industrial Cyber, FERC’s Office of Electric Reliability detailed these findings in a staff report titled Lessons Learned from Commission-Led CIP Reliability Audits. The review covered fiscal 2026 audits of entities registered with the North American Electric Reliability Corporation. While most reviewed processes met mandatory Critical Infrastructure Protection Reliability Standards, auditors noted persistent risks that could impact bulk power system reliability.
Audit findings and compliance issues
The primary issue identified involved delays in registering new generation resources with NERC. Some generator owners failed to promptly identify or categorize associated bulk electric system cyber systems under Reliability Standard CIP-002-5.1a. This standard requires entities to register generation resources synchronized to the bulk electric system that exceed specific power thresholds.
Misunderstandings regarding commercial operation dates contributed to these registration delays. The report noted cases involving inverter-based resources that had begun commercial operations but had not undergone the required cybersecurity evaluation. These delays prevented timely identification of cyber systems necessary for maintaining grid security and operational reliability.
Third-party and technology risks
Auditors also identified security risks associated with third-party cyber systems used to monitor and control bulk electric system generation resources. Generator operators are required to include affiliate and third-party systems in their cyber system identification and categorization procedures. Failure to account for these external connections creates blind spots in the overall security posture.
The report specifically flagged access control risks linked to emerging artificial intelligence tools. While not always a direct violation of mandatory standards, these gaps represent potential vulnerabilities in the broader security landscape. FERC included voluntary cybersecurity recommendations in the report to help entities address these non-mandatory but critical practices.
What should you do?
Entities should review their registration timelines for new generation resources to ensure compliance with CIP-002-5.1a. Organizations must verify that all third-party systems controlling or monitoring generation assets are included in their cyber system inventories. Security teams should also assess access controls for any AI tools integrated into operational technology environments.
What to do and how to stay safe: FERC
- Verify that all new generation resources are registered with NERC within required timeframes.
- Audit third-party and affiliate cyber systems to ensure they are categorized correctly.
- Review access controls for artificial intelligence tools used in operational technology.
- Implement the voluntary cybersecurity recommendations outlined in the FERC staff report.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which reliability standard was cited for registration failures?
The report cited Reliability Standard CIP-002-5.1a regarding the identification and categorization of bulk electric system cyber systems.
Did most entities fail the mandatory CIP standards?
No, most reviewed processes met mandatory requirements, but auditors found potential noncompliance and remaining security risks.
What technology posed new access control risks?
Emerging artificial intelligence tools were flagged for potential access control risks in the audit findings.
