FERC's 2026 CIP audit lessons: late registration, aggregated control and AI tools

Every autumn, FERC's Office of Electric Reliability publishes what its staff learned from the CIP audits it led during the fiscal year. The 2026 report came out on October 13. The audits themselves are not public, and the report is anonymized, but it is one of the clearest signals of what auditors are looking at.

Staff found that most of the processes and procedures they audited met the CIP requirements, and that potential noncompliance and security risks remained. The report names three lessons. Two of them are about generation owners and operators, and the third is about AI tools inside CIP environments.

1. New generation registered late, so CIP-002 started late

Under CIP-002-5.1a R1, a registered entity identifies and categorizes its BES Cyber Systems. Auditors found Generator Owners that had not registered new generation with NERC on time, and registered entities that had not yet run new resources through the CIP-002 impact criteria. The report says it saw multiple inverter-based resources that were synchronized to the BES, past initial testing and above the BES threshold, with cyber systems that had not been identified and categorized.

The cause in both cases was the Commercial Operation Date. NERC's ERO Enterprise Registration Procedure defines COD as the date after which all initial testing and commissioning is complete and the owner and operator can start producing electricity for sale. For a plant built in phases, registration is due when the phases in commercial operation add up to more than the threshold, not when the whole project is finished. On the registration date, NERC expects the resources to be fully compliant with every applicable standard.

Some owners waited until full nameplate capacity and the last phase of the interconnection queue. One entity ran above the threshold for more than a year before registering. For solar, wind and storage, the BES inclusion that usually matters is I4 (dispersed generation): more than 75 MVA in aggregate, through a common point at 100 kV or higher.

2. Several low impact sites, one medium impact control center

The second lesson is about who actually monitors and controls the plants. Auditors saw two set-ups. In one, a parent company that was not registered for any function ran monitoring and control, from a single control center, for affiliates that were each registered as GOPs. In the other, several unrelated GOPs used the same third party to monitor and control their plants.

Each GOP rated its own BES Cyber Systems low impact. In aggregate, the control function met the medium impact criteria in CIP-002-5.1a Attachment 1, which turn on 1,500 MW of generation in a single Interconnection. The report notes the difference that makes: medium impact systems face roughly 140 requirements and sub-requirements, low impact systems roughly 15.

FERC staff is direct about responsibility. A GOP can hand the task to an affiliate or a contractor, but not the obligation, and that includes categorizing the cyber systems those parties use to control its plants. Staff also noted that entities were reluctant to discuss these arrangements, and suggested NERC consider further guidance, standard changes or registration changes.

3. AI tools in CIP-networked environments

The report calls them super intelligence (SI) tools: chatbots, personal assistants and automated analysis systems, with ChatGPT, Google Gemini and Microsoft 365 Copilot as examples. Staff found that entities generally accounted for these tools and applied controls, but handled their access in different ways. Entities themselves said vendors are adding AI features to products faster than compliance programs adapt, and that the scope of a tool is sometimes not understood until it is already running on the network.

The CIP standards neither allow nor forbid these tools. The lesson ties them to CIP-004-7 R4, R5 and R6: access to BES Cyber Systems and BES Cyber System Information that an AI tool facilitates has to be authorized, reviewed and revoked like any other access. Staff also suggests:

• Understand and monitor every connection an AI tool makes outside the CIP-005 Electronic Security Perimeter, and why it needs it.
• Inventory AI tools as generic accounts under CIP-007 and change any default passwords.
• Limit what BCSI an AI tool can reach, under CIP-011.
• Assess AI features from prospective vendors in the CIP-013 supply chain risk management plan, using a framework such as the NIST AI Risk Management Framework (AI RMF 1.0).

What to check this quarter

• For every plant built or expanded in phases, write down the COD of each phase and the date the total in commercial operation crossed the BES threshold. Compare that date with your registration date and your CIP-002 evaluation.
• List every party that can monitor or control your plants: your own control center, a parent or affiliate, an O&M provider, an asset manager, a vendor portal. For each, note the total MW it controls across all owners, not just yours.
• If a third party's control center serves several owners, ask how its systems were categorized, and by whom.
• Search your CIP-networked environment for AI features: in vendor software, in remote access tools, on engineering workstations. Each one gets an owner, an account, an access authorization and a review date.
• Add AI questions to your vendor risk assessment for CIP-013 before the next procurement, not after.

None of this is new law. The report is a staff view and is not binding on the Commission. But each lesson points to a gap that is cheap to close before an audit and expensive to explain during one.

Not sure whether a site is a BES site under CIP, a Category 2 site, or neither? Our free Category 2 registration check gives a first answer from two numbers.