Full Report
Ampyx Cyber highlighted gaps in generator registration, cyber risk categorization and artificial intelligence (AI) access controls in the... The post Ampyx Cyber examines FERC 2026 CIP audit findings on generator registration, shared control and AI access risks appeared first on Industrial Cyber.
Analysis Summary
# Regulation/Compliance: FERC 2026 CIP Audit Findings on Generator Registration, Categorization, and AI Access
## Overview
The Federal Energy Regulatory Commission (FERC) issued non-public Critical Infrastructure Protection (CIP) audit findings for fiscal year 2026, covering several U.S.-based NERC-registered entities. Ampyx Cyber's analysis highlights three problem areas:
1. **Generator registration and categorization:** New inverter-based resources (IBRs) entered commercial operation above Bulk Electric System (BES) thresholds before NERC registration or CIP-002 evaluation.
2. **Shared control and categorization:** Affiliates and third-party service providers monitored or controlled multiple generation resources from shared control centers that met medium-impact criteria, although individual operators had classified their systems as low impact.
3. **AI access controls:** Auditors generally found appropriate controls for AI tools in CIP-networked environments but noted inconsistent access management practices.
Most audited entities met the mandatory requirements, but potential noncompliance and security risks remained.
## Key Details
- **Issuing Authority:** FERC (audit report), with NERC and Regional Entities participating in the audits
- **Effective Date:** The audits covered fiscal year 2026 (October 1, 2025 through September 30, 2026). The effective dates of the underlying standards are not stated in the article excerpt.
- **Jurisdiction:** U.S. bulk power system; NERC-registered entities, including generator owners and operators
- **Status:** The audit findings are published guidance. The underlying CIP standards are in effect. The report's recommendations are voluntary.
## Requirements
### Mandatory Requirements
1. **Timely NERC registration and CIP-002 evaluation** for generation resources before or at commercial operation, under CIP-002-5.1a R1.
2. **Accurate BES determination** using the BES definition, including Inclusion I2 (generating resources connected at 100 kV or above with gross individual nameplate above 20 MVA or gross plant aggregate above 75 MVA) and Inclusion I4 (dispersed power producing resources aggregating more than 75 MVA at a common point of connection at 100 kV or above). Most solar, wind, and battery plants enter the BES through I4.
3. **Correct impact categorization** (low, medium, or high) that accounts for shared control centers and third-party or affiliate monitoring and control of multiple resources.
4. **Use of the Commercial Operation Date (COD) correctly** in determining when registration and compliance obligations begin. The audits found this was misread.
### Recommended Practices
1. Assess the business need for AI tools before deployment.
2. Manage access to BES Cyber Systems and sensitive information by AI tools.
3. Monitor external communications from AI tools.
4. Account for AI-related risks in vendor supply chain security programs.
5. Follow voluntary practices that FERC staff included in the report, which the standards do not require.
## Affected Organizations
- **Industries:** Electric utilities, independent power producers, generator owners and operators, inverter-based resource (solar, wind, battery storage) developers and operators, and third-party service providers that monitor or control generation resources
- **Organization Size:** Size is not the trigger. Thresholds are based on capacity, voltage, and aggregation. Entities with multiple small resources at a common point of connection can still reach BES thresholds through aggregation.
- **Geographic Scope:** United States and the NERC registered footprint
## Compliance Timeline
The article excerpt does not provide specific milestone dates. Key dates that are known:
- **October 1, 2025:** Start of FERC fiscal year 2026 audit period
- **September 30, 2026:** End of FERC fiscal year 2026 audit period
- **October 16, 2026:** Ampyx Cyber publishes analysis of the findings
- **Ongoing:** Entities should verify registration and categorization for any resource approaching or past commercial operation
## Implementation Guidance
### Assessment Phase
- Inventory all generation resources, including recently energized IBRs, and record each COD.
- Compare each resource's capacity, voltage, and point of connection against BES Inclusions I2 and I4 to confirm registration status.
- Identify all shared control centers and map which resources each one monitors or controls, including resources run by affiliates or third parties.
- Review current CIP-002 categorizations against aggregated control-center impact, not only individual asset classifications.
- Inventory AI tools and features in CIP-networked environments, including AI features embedded in vendor products.
### Implementation Phase
- Register any unregistered resources with NERC and complete CIP-002 evaluations before or at commercial operation.
- Recategorize affected systems where shared control centers meet medium-impact criteria, and apply the corresponding CIP requirements.
- Revise procedures so COD is interpreted in line with the standards and the registration timeline.
- Establish access controls for AI tools, including least-privilege access, authentication, logging, and restrictions on external communications.
- Update vendor contracts and supply chain risk programs to cover AI-related risks.
### Validation Phase
- Confirm registration status and CIP-002 categorizations with a documented review and sign-off.
- Test access controls on AI tools and verify that logs capture AI actions on BES Cyber Systems.
- Review third-party and affiliate monitoring arrangements to confirm they match the categorization.
- Perform internal audits before external audits, and track findings to closure.
## Technical Requirements
The article does not list specific technical controls. Relevant requirements include:
- Asset identification and categorization under CIP-002
- Access management, authentication, and logging for BES Cyber Systems under the CIP-004 and CIP-005 series
- Controls for remote and vendor access under CIP-005 and CIP-013
- Supply chain risk management under CIP-013
Confirm specific requirement language against the current NERC standards.
## Penalties & Enforcement
- **Fines:** The article does not describe penalty amounts. NERC CIP violations can result in civil penalties imposed by FERC or NERC, with per-violation, per-day exposure set by statute and adjusted for inflation.
- **Other Consequences:** Noncompliance findings, mitigation plan requirements, and reputational and regulatory scrutiny. The audit findings identified "potential noncompliance" in several entities.
- **Enforcement:** Non-public CIP audits conducted by NERC and Regional Entities, with staff findings reported to FERC. Findings may lead to enforcement actions under FERC and NERC processes.
## Related Standards
- **NERC CIP-002-5.1a:** BESCS categorization and registration linkage
- **NERC CIP-003 through CIP-011:** Ongoing CIP requirements for cyber security controls
- **CIP-013:** Supply chain risk management, relevant to vendor and AI tool risks
- **FERC Order No. 693:** Referenced in the report regarding delegation. Review the order for the specific language.
- **NERC BES Definition:** Governs inclusion and exclusion of generation resources
## Resources
- **Official Documentation:** FERC staff reports page (summary of the 2026 CIP audit findings; the 2025 report included lessons-learned appendix). NERC CIP standards and the BES definition are available on NERC's website.
- **Guidance Documents:** Ampyx Cyber blog analysis: ampyxcyber[.]com/blog/ferc-2026-cip-audit-findings
- **Tools:** Not specified in the article. Entities may use NERC's registration tools and internal asset inventory systems.
## Practical Recommendations
- Verify NERC registration for every generation resource that has reached or is nearing commercial operation, and do not rely on COD assumptions.
- Review BES Inclusions I2 and I4 for all IBR and aggregated resources, including solar, wind, and battery sites.
- Re-examine CIP-002 categorizations for shared control centers, especially those run by affiliates or third parties.
- Treat "low impact" classifications as provisional until aggregation and shared control have been reviewed.
- Document AI tool inventory, business justification, access controls, and external communication monitoring.
- Add AI-related risk requirements to vendor contracts and supply chain security reviews.
- Read the full FERC report footnotes, which may contain details on low and medium impact requirement counts and Order No. 693 delegation language.
- Treat voluntary recommendations as a baseline for audit readiness, even though they are not mandatory.