{"id":31631,"date":"2025-12-04T20:07:04","date_gmt":"2025-12-04T20:07:04","guid":{"rendered":"https:\/\/www.trccompanies.com\/?post_type=news-and-insights&p=31631"},"modified":"2025-12-04T20:07:07","modified_gmt":"2025-12-04T20:07:07","slug":"ferc-targets-modernization-of-cip-standards-to-address-cyber-security-and-supply-chain-risks-for-critical-infrastructure","status":"publish","type":"news-and-insights","link":"https:\/\/www.trccompanies.com\/fr\/insights\/ferc-targets-modernization-of-cip-standards-to-address-cyber-security-and-supply-chain-risks-for-critical-infrastructure\/","title":{"rendered":"FERC Targets Modernization of CIP Standards to Address Cyber Security and Supply Chain Risks for Critical Infrastructure"},"content":{"rendered":"\n\n
\n
\n \n
\n
\n

On September 18, 2025, the Federal Energy Regulatory Commission (FERC) issued two Notices of Proposed Rulemaking (NOPR) and one final rule aimed at modernizing the reliability and security of the Bulk Power System (BPS). These actions reflect FERC\u2019s ongoing commitment to strengthen the North American Electric Reliability Corporation\u2019s (NERC) Critical Infrastructure Protection (CIP) Reliability Standards to address emerging challenges in cybersecurity and supply chain risks impacting critical infrastructure.<\/span>\u00a0<\/span><\/p>\n

Background<\/span>\u00a0<\/span><\/h2>\n

FERC\u2019s latest rulemakings continue its effort to adapt NERC\u2019s mandatory reliability standards to meet the demands of an increasingly digital and interconnected grid. As utilities integrate cloud computing, virtualized systems and network-connected equipment into operations, new vulnerabilities emerge. These updates build upon previous directives from FERC\u2019s 2024 NOPR, to ensure the standards evolve alongside modern technologies.<\/span>\u00a0<\/span><\/p>\n

Virtualization Reliability Standards<\/span>\u00a0<\/span><\/h2>\n

The first NOPR on Virtualization Reliability Standards proposes approval of four new and eighteen revised definitions in NERC\u2019s Glossary of Terms, along with modifications to eleven CIP Reliability Standards. Historically, these standards were built on the assumption that critical hardware and software were installed and secured onsite.<\/span>\u00a0<\/span><\/p>\n

With increasing adoption of virtual and cloud-based systems, FERC\u2019s proposal seeks to modernize those assumptions, updating security expectations to protect virtualized assets critical to Bulk Power System reliability.<\/span>\u00a0<\/span><\/p>\n

CIP-003-11 Low-Impact BES Cyber Systems<\/span>\u00a0<\/span><\/h2>\n

The second NOPR concerns Critical Infrastructure Protection Reliability Standard CIP-003-11, which FERC proposes a revised standard to strengthen the cybersecurity posture of low-impact BES Cyber Systems. This NOPR introduces new requirements for communications security and system management to address the increasing risk of coordinated cyber threats across connected systems.\u00a0<\/span>\u00a0<\/span><\/p>\n

Addressing the importance of protecting low-impact systems, FERC invites public comments and is considering whether NERC should conduct a study or publish a whitepaper on emerging cyber threats and mitigation strategies for these assets.<\/span>\u00a0<\/span><\/p>\n

Supply Chain Risk Management<\/span>\u00a0<\/span><\/h2>\n

In addition to the two proposed rules, FERC issued a Final Rule regarding Supply Chain Risk Management, adopting proposals from its September 2024 NOPR. The rule directs NERC to revise Reliability Standards addressing supply chain risks, including enhanced measures for certain types of network-connected equipment.<\/span>\u00a0<\/span><\/p>\n

These updates aim to strengthen protection for the BPS against external threats and risks introduced through global technology supply chains. NERC is required to submit corresponding modifications within 18 months of the rule\u2019s effective date.<\/span>\u00a0<\/span><\/p>\n <\/div>\n

\n
\n
\n

Related Services<\/h4>\n