FERC's FY2026 CIP Audits: Three Recurring OT Security Gaps

On October 15, 2026, Industrial Cyber reported on a report from FERC's Office of Electric Reliability titled "Lessons Learned from Commission-Led CIP Reliability Audits." The document covers audits the Commission conducted in fiscal year 2026 across several U.S. entities registered with NERC.

The overall picture is moderately positive: most cybersecurity processes and procedures complied with the mandatory CIP Reliability Standards. However, staff identified instances of potential noncompliance and risks to the reliable operation of the Bulk-Power System. The report is anonymized and also includes voluntary recommendations that go beyond CIP requirements.

Lesson 1: Late registration and categorization

Some generation owners failed to register new assets with NERC on time, and did not promptly identify and categorize the associated BES Cyber Systems (requirement CIP-002-5.1a R1). The delays stemmed from a misinterpretation of the "commercial operation date." Cases included inverter-based resources that began commercial operation without the required cybersecurity assessment. The result: inadequate or missing protections.

Lesson 2: Affiliate and third-party systems

Some entities did not account for monitoring and control functions managed by affiliates and contractors. In two cases, systems individually classified as low impact met the criteria for medium impact when taken together, yet remained under controls not proportionate to the risk. FERC's guidance is that Generator Operators include in their categorization all affiliate and third-party cyber systems used to monitor and control generation.

Lesson 3: AI tools and access control

Auditors observed growing use of AI tools in environments connected to CIP networks: chatbots, personal assistants and automated analytics systems. The source calls them "super intelligence (SI)," an unusual label that may be an error in the original text, so it should be treated with caution.

The substantive point is different: these tools can mimic user behavior, interact with systems and automate tasks. Without monitoring, they can create unauthorized access and lateral movement risks. Under CIP-004-7 R4, R5 and R6, access to BES Cyber Systems and BES Cyber System Information must be authorized, periodically reviewed and covered by existing risk management frameworks.

Why this matters beyond utilities

The CIP standards are specific to the North American electric sector, but the gaps described are common to many plants. Four practical checks emerge from the report:

What to check in your own facility:

• Commissioning dates and security assessment: the assessment must precede commercial operation, and the definition of the relevant date should be clear and shared.
• Risk aggregation: low-risk systems taken individually may, together, warrant a higher class. Reassess classification for groups of systems, not just single assets.
• Third-party and affiliate control: monitoring and control managed by contractors should be included in the asset inventory and risk classification.
• AI assistants as identities: treat them as users with authorized access that is reviewed over time and monitored, especially if they reach OT networks.

Limits of this reading

This article is based on Industrial Cyber's coverage, not on the full FERC report. Beyond the three lessons, the source provides no audit counts or names of the entities involved, so the actual prevalence of these gaps cannot be assessed.

Low-impact systems, taken together, may require medium-impact controls.