Category 2 IBR registration: which NERC standards apply, and why CIP isn't one of them yet

For years, NERC registration was a question for large plants. A solar, wind or storage project of 75 MVA or less, or connected below 100 kV, usually sat outside the Bulk Electric System and outside the NERC registry. That changed in 2026.

Under NERC's revised Generator Owner and Generator Operator definitions, owners and operators of inverter-based resources with 20 MVA or more in aggregate, connected through a common point at 60 kV or higher, now register as Category 2 GOs and GOPs. By April 20, 2026, NERC and the Regional Entities had identified 531 IBR facilities that meet those criteria.

If your company is one of them, the first question is simple: what do we have to comply with? The answer is shorter than many people expect, and it does not include CIP. Yet.

What applies from May 15, 2026

NERC's 2026 State of Reliability lists the standards that Category 2 GOs and GOPs must follow, as applicable, from May 15, 2026:

• BAL-001-TRE: primary frequency response in the Texas RE region.
• IRO-010-5: data the Reliability Coordinator asks for.
• MOD-032-2: data for power system modeling.
• PRC-012-2: remedial action schemes.
• PRC-017-1: remedial action scheme maintenance and testing.
• TOP-003-6.1: data the Transmission Operator and Balancing Authority ask for.
• VAR-001-5 and VAR-002-4.1: voltage and reactive power control.

Most of this list is about data and operating behavior: answering data specifications on time, keeping models right, holding voltage schedules, and running any remedial action scheme the site is part of. "As applicable" matters. A site with no remedial action scheme has nothing to do under PRC-012-2, and BAL-001-TRE applies only in Texas RE.

More is coming. FERC's Order No. 901 directed NERC to write new IBR standards on ride-through performance, data sharing, model validation and studies. Some are approved and others are still in development, and their applicability to Category 2 is set in each standard's own implementation plan. Check each one as it is approved.

Why CIP is not on the list

The CIP standards apply to BES Cyber Systems: cyber systems at BES facilities. Category 2 IBRs are, by design, the plants that do not meet the BES definition. NERC's own Security Guideline for Inverter-Based Resources puts it plainly: newly registered Category 2 IBRs are not individually classified as BES facilities, and so, as of Q1 2026, they are not subject to the existing CIP requirements.

Two things follow from that.

Being registered is not the same as being in CIP scope. A Category 2 GO has real NERC obligations, but CIP-002 through CIP-015 are not among them today. If someone proposes a full CIP program for a Category 2 site, ask which requirement they think applies, and why.

The cyber risk has not gone away. The same guideline exists because these sites run the same inverters, plant controllers, SCADA and vendor remote access as larger plants. It recommends a practical security baseline anyway. Many owners also have BES plants (more than 75 MVA in aggregate at 100 kV or higher) in the same fleet, and those sites are under CIP, usually at low impact.

What a sensible owner does now

Our free Category 2 IBR security baseline checklist turns NERC's guideline into 30 checks you can work through site by site.

• Confirm your list with your Regional Entity. Ask which standards they will audit for your Category 2 registration, and from what date. Keep their answer.
• Name an owner for each standard. Data requests under IRO-010 and TOP-003 arrive from the RC and TOP on their schedule. Somebody has to answer them, and somebody has to be able to show they did.
• Treat data specifications as evidence. Most findings under data standards come from not being able to show what was sent and when. Keep the request, the reply and the date.
• Separate your BES and non-BES sites clearly. If part of your fleet is under CIP, write down which sites are and why. CIP-002 asks for that identification at BES sites; for the rest, a short record of why a site is out of scope saves an argument later.
• Start the security baseline before it is required. Know what is on each site's network, who can reach it remotely, and what changed last month. It is good practice today, and it will make any future CIP obligation a smaller step.