FERC Staff Provides "Lessons Learned" From Critical Infrastructure Protection Reliability Standard Audits

In October 2021, Federal Energy Regulatory Commission (FERC) staff issued its annual report on "recommendations to help users, owners and operators of the bulk-power system improve their compliance with the [North American Electric Reliability Corporation (NERC)] mandatory Critical Infrastructure Protection (CIP) reliability standards and their overall cybersecurity posture." The CIP reliability standards are intended to "mitigate the cyber security and physical security risks to . . . facilities, systems, and equipment, which, if destroyed, degraded, or otherwise rendered unavailable as a result of a security incident, would affect the reliable operation of the Bulk-Power System." The report, in turn, is intended to "help entities assess their risk and compliance with mandatory reliability standards and, more generally, . . . facilitate efforts to improve the security of the nation's electric grid."