FERC Approves New Cybersecurity Standards For Low-Impact Electric Assets

At its open monthly meeting on March 16, 2023, the Federal Energy Regulatory Commission (FERC) approved a new cybersecurity standard proposed by the North American Electric Reliability Corporation (NERC) to address the supply chain risks posed by "low-impact" assets within the nation's bulk electric system (BES). The new standard, entitled Reliability Standard CIP-003-9, would require responsible entities to include the topic of "vendor electronic remote access security controls" in their cybersecurity policies and have methods for determining and disabling vendor electronic remote access.

This directive expands upon, and replaces, a previous cybersecurity standard, Reliability Standard CIP-003-8, which applied only to high- and medium-impact BES assets. In justifying this expansion to FERC, NERC explained that it identified supply chain risks affecting low-impact BES cyber systems similar to those affecting medium- and high-impact BES cyber systems, such as