USV UpdatesQ1 has proven to be a busy start to 2026. Many of you have received audit notifications and have been required to fill out self-certifications. On top of this, we had the new Vendor Electronic Remote Access Policies that required implementation for CIP-003-9 by April 1st, FERC accepted the Milestone 3 standards, and Category 2 IBRs are required to be registered by May 15th. In addition, NERC has been working on a few initiatives that could be impactful to many of you down the road. Please see below for more details.
CIP-003-9 became effective on April 1, 2026. For those with Low Impact BES Cyber Systems, this required creating a Vendor Remote Access Policy and potentially some equipment upgrades. The new version requires entities implement methods for determining and disabling vendor electronic remote access and detecting known or suspected malicious communications associated with this access.
CIP-003 was modified further to Version 11 and was adopted by the NERC board in late 2024. In the fall of 2025, FERC proposed to accept CIP-003-11 in a Notice of Proposed Rulemaking (NOPR) and recently issued a directive accepting the change. These revisions take the Version 9 changes further and more broadly address requirements like permitting only necessary electronic access, detecting malicious communications, and authenticating users. For those subscribed to our CIP Maintenance services, Utility Services will reach out to you as we get closer to the July 2029 enforceable date to prepare your program for these changes.
In 2025, NERC initiated an effort through the RSTC to assess the residual cyber risks posted to the Bulk Power System. The report began with an extensive risk categorization effort, and concluded with a handful of recommendations, including a few near-term recommendations. The most immediate effort is developing a Standard Authorization Request (SAR) to extend multi-factor authentication requirements to low impact interactive remote access. NERC is already seeking volunteers for a group to develop this SAR, which will eventually turn into a standards development project. Other recommendations from the roadmap was to assign a CIP-012 based study to develop a SAR addressing data security that utilizes public network communications, and to evaluate the residual risk associated with minimum defense-in-depth achieved through cyber hygiene across all BPS cyber systems which could inform further CIP applicability updates to low impact BES cyber systems. Please see the full report and recommendations on NERC’s website under Our Work > Reports, and see the “NERC Critical Infrastructure Protection Roadmap” under the miscellaneous reports.
At the same FERC open meeting where the CIP-003-11 changes were approved, FERC also approved the suite of CIP Virtualization Standard revisions (project 2016-02) which included 11 standards, as well as the approval of CIP-002-8. All standards from these two projects will be effective in July 2028.
NERC has continued to review the impact to the Bulk Power System from large computational loads, such as data centers. These facilities have unique operating characteristics that are growing at a level where their impact to the grid needs to be mitigated, similar to what happened with inverter-based resources. After two white papers, technical conferences, and many other discussions with the Large Load Working Group, NERC has laid out an aggressive plan to put requirements in place for these large loads.
In March, the process was initiated to seat the drafting team (Project 2026-02), post a SAR for industry feedback, begin a registration effort, and build an advisory group of subject matter experts. Initial standards are expected to be balloted by August 2026, but NERC will also issue a Level 3 NERC Alert in May 2026, which comes with required actions to be completed by the applicable entities. We anticipate that even TOs and DPs will be implicated in the Alert and future standards revisions. The NERC Alert will require immediate action, whereas the standards revisions will have some implementation timeframe, though we expect it to be short, possibly with enforceable standards required by April 2027. This is an extremely aggressive timeline, but Utility Services will continue to monitor and provide updates. NERC has a dedicated page on their website that provides more detail – see the Large Loads Action Plan page under the Initiatives section.
NERC has finalized their recommendations for standards process revisions, known as the Modernization of Standards, Processes, and Procedures (MSPP) effort. Last year, the MSPP Task Force went through several rounds of recommended proposals and receiving industry feedback. The final versions have been accepted by the NERC Board of Trustees, and the implementation of these changes will be developed throughout this year, which will be seen as changes to the NERC Rules of Procedure. The purpose of these revisions is to expedite the time it takes to initiate, develop, and ballot a standard, and NERC plans to do so by creating better intake and prioritization processes, utilizing AI tools to expedite aspects such as review of industry comments and make the initial version of the standard revisions, and to front-load projects with better information and project needs which will avoid disputes at the balloting stage. This will also come with the disbandment of the Standards Committee, as well as a completely new way that stakeholders can participate in standards development. To participate on a drafting team, you will need to be pre-vetted and join a Subject Matter Expert pool, from which NERC will call upon as standards development projects arise. Utility Services is asking our clients to consider joining the “SME Pool” so you may be able to participate when a standard project of interest arises. We will be sharing more information as this effort develops. NERC will share updates on the Modernization of Standards Processes and Procedures page under the Initiatives section.
At the February 2026 FERC Open Meeting, the Commission approved the Milestone 3 Standards that were filed at the end of 2025. This includes MOD-026-2, MOD-032-2, MOD-033-3, IRO-010-5, and TOP-003-8.
We use cookies to improve your experience and analyze traffic on our website. By clicking “Accept” you consent to our use of cookies and tracking. Read our Cookie Policy to learn more.
