Federal Regulatory
FERC Updates Bulk Power Cybersecurity Standards
March 20, 2026
The Federal Energy Regulatory Commission (FERC) has approved final rules updating Critical Infrastructure Protection (CIP) standards to enhance the cybersecurity and reliability of the U.S. bulk power system amid increasing cyber threats. These updates introduce virtualization standards, strengthen baseline protections for low impact bulk electric system cyber assets, and refine definitions to improve risk identification and asset protection. This regulatory action impacts entities responsible for grid security and compliance, including utilities and contractors supporting bulk power infrastructure.
- Why this matters: Procurement professionals should anticipate updated cybersecurity requirements affecting contracts related to bulk power system operations and technology deployments.
- Organizations involved in grid security must align with the new CIP standards, particularly regarding virtualization technologies and protections for low impact cyber assets.
- Vendors and contractors offering cybersecurity solutions or compliance services for the energy sector may find increased demand driven by these regulatory enhancements.
- Agencies and industry stakeholders should prepare for compliance deadlines and potential contract modifications reflecting the strengthened cybersecurity mandates.
Our electric grid faces persistent reliability challenges from cybersecurity threats, extreme weather and rising demand. The actions we approved today are centered on modernizing and securing grid reliability, with a special emphasis on cybersecurity, so every American can count on the grid and get power when they need it.
— Laura V. Swett
We agree with NERC that Reliability Standard CIP-003-11 strengthens baseline cybersecurity protections for low impact BES cyber systems by addressing the risk of coordinated cyberattacks that exploit distributed, externally routable assets.
— FERC Final Rule
Agencies
Federal Energy Regulatory Commission, North American Electric Reliability Corporation