FERC Launches Major Cybersecurity Initiative to Protect Energy Grid

Rules for grid cybersecurity matter because an attack on the power sector can quickly become a public safety and economic problem. When FERC tightens its standards, it is treating utility security as part of keeping the country running, which goes well past an IT ticket.

That is why FERC’s actions deserve attention outside compliance teams. New requirements on supply chain risk, low-impact systems and virtualization will shape how the whole sector manages operational risk, and the number of attackers and system dependencies keeps growing.

The September 18 actions

On September 18, 2025, FERC voted unanimously to approve a set of reliability and security actions for the Bulk Power System. It covers a lot of ground: supply chain risk, cyber controls for low-impact systems, virtualization, and even extreme cold weather preparedness. Busy day.

What changes in the CIP standards

At the center are FERC’s Critical Infrastructure Protection (CIP) standards, which cover the grid’s physical security and its cyber resilience. A final rule, Order No. 912, directs NERC to write new or modified standards within 18 months covering how good utilities’ supply chain risk management plans are and extending supply chain protections to protected cyber assets. A proposed standard, CIP-003-11, adds controls for low-impact BES Cyber Systems, including authentication for remote users and detection of malicious communications. “The reliability and security of our country’s electric system is essential to our economic prosperity, national security, and everyone’s wellbeing,” FERC Chairman David Rosner said.

Sharing threat information

Information sharing is a big part of how this works in practice. Federal agencies, utility operators and other stakeholders each hold a piece of the threat picture, and the commission has long pushed them to pass it along quickly so that a technique seen at one utility in Ohio does not catch a co-op in Texas off guard a week later. Speed matters.

The national security angle

Energy infrastructure ties directly into national defense and the economy. That makes it a prime target. A successful grid attack could cascade, shutting down hospitals, water pumps and payment systems and disrupting daily life for millions of people, which is why FERC’s orders go after the weak links in the equipment and services utilities buy.

Other actions in the package

FERC also proposed approving changes to 11 CIP standards plus new glossary definitions so utilities can use virtualization and cloud-based technology while staying compliant. Long overdue. Separately, it approved NERC’s revised extreme cold weather standard, EOP-012, effective October 1, 2025.

What utilities should do now

For utilities, the September actions set the agenda for the next two years. Supply chain plans will face tougher scrutiny, low-impact sites will need stronger access controls, and virtualized systems finally get a compliance path, all of which takes budget and staff time that has to be planned well before NERC finishes drafting.

Read the orders. Map them against your current CIP program. The work is unglamorous, and it is also how the grid gets harder to attack.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.