# FERC Identifies Power-Sector Cybersecurity Gaps

FERC’s FY 2026 Critical Infrastructure Protection (CIP) audit report identifies cybersecurity and compliance weaknesses among U.S. electricity-sector entities. Findings include delayed NERC registration and cyber-system reviews for generation resources, aggregated monitoring and control functions operated by affiliates or contractors, and access management for AI-enabled tools. The report also points to a need for NERC guidance on aggregated control arrangements, making third-party access and system-control practices relevant considerations for bulk-power-sector procurements.

- Contractors and suppliers serving the electricity sector should evaluate how their system access, monitoring, and control capabilities align with applicable NERC CIP requirements and the audit issues identified.
- Procurement teams may need to scrutinize third-party and affiliate control arrangements, access management for AI-enabled tools, and supply-chain risk in evaluating suppliers.
- The findings identify areas where buyers and contractors can review existing generation-resource registration and cyber-system review processes; the signals do not specify new deadlines or contract opportunities.

**Jurisdictions:** federal
**Industries:** Energy & Utilities
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 15, 2026

### Government Entities
- Federal Energy Regulatory Commission (FERC)

### Sources
- [FERC Staff Report Offers Lessons Learned from 2026 CIP Audits | Federal Energy Regulatory Commission](https://www.ferc.gov/news-events/news/ferc-staff-report-offers-lessons-learned-2026-cip-audits) - FERC
- [
		FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools and third-party control systems - Industrial Cyber	](https://industrialcyber.co/utilities-energy-power-water-waste/ferc-identifies-cybersecurity-compliance-gaps-in-us-power-sector-flags-risks-from-ai-tools-and-third-party-control-systems) - Industrial Cyber