FERC’s latest staff audit report finds delayed cybersecurity protection where generation owners misunderstood commercial-operation timing. Its observations connect the start of electricity production with the registration, classification and controls needed for the assets already supplying the grid.
FERC’s cyber audit report released on October 13 identifies a timing gap at the point when new generation enters service. Staff found that several generator owners had not registered resources promptly or identified and classified their associated bulk-electric-system cyber systems on time. Misunderstanding the commercial operation date contributed to delays in mandatory protection.
The report draws on non-public audits completed during fiscal year 2026. It is an anonymized staff account, rather than a binding new Commission rule. Most audited cybersecurity processes met the standards’ requirements, but staff still found potential noncompliance and security risks. That qualification keeps the finding specific: the report describes observed weaknesses, not universal failure across the power sector.
Electricity Production Can Precede the Assumed Milestone
In the registration lesson, staff describe owners waiting until all interconnection-queue phases were complete and full nameplate capacity had been achieved. Yet a completed phase could already be operating above the applicable registration threshold. In one example, this situation persisted for more than a year. The delayed evaluation left cybersecurity protection behind the operating resource.
The operational consequence is that a commissioning timetable and a compliance timetable can diverge. A plant’s connection to the bulk power system creates exposure while it is functioning, even if later project phases remain unfinished. Staff call for coordination among owners, operators, NERC and regional entities so that registration and protection account for when resources enter operation.
Responsibility Must Include the Actual Control Function
The same report finds a separate classification problem when affiliates or contractors control multiple generation resources. Individual operators had identified low-impact systems, while the aggregated monitoring and control capability warranted a medium-impact classification. Looking only at each organization’s own plant missed the combined function at the control center.
Both observations direct attention to the asset’s actual operation: when it starts producing and who can control it. The immediate lesson is to carry that information into the registration and classification process. The report does not establish that the weaknesses caused a specific outage; it shows how delays and incomplete identification can leave protections below the risk presented by functioning generation.
Take-Out
Cyber protection must follow each generating phase into service. Waiting for full nameplate capacity can leave an operating resource above the registration threshold before its owner has applied the required protections.
Questions and answers
What readers should know
- What did the new cyber audit report find?
- Several generation owners delayed registration and cyber-system identification or classification, partly because they misunderstood commercial-operation timing.
- Is the report a new binding rule?
- No. It is a FERC staff report that distinguishes mandatory requirements from voluntary cybersecurity recommendations.
- Why does production timing matter?
- A completed phase may already exceed the registration threshold while an owner waits for full nameplate capacity or the completion of all interconnection-queue phases.
- What did staff find about shared control centers?
- Some affiliate and contractor arrangements had aggregated monitoring and control capability warranting medium-impact treatment even where individual operators had classified systems as low impact.
- Does the report prove an outage resulted?
- The cited observations describe potential noncompliance and security risks. They do not establish a specific outage caused by those weaknesses.
Stay in the loop
Keep Mark and Focus in view
Hear about future publications, announcements, and relevant updates from Mark and Focus.