As cited
Copy frozen at (site build).
ot ics
FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools and third-party control systems
The Federal Energy Regulatory Commission (FERC) released findings from fiscal 2026 cybersecurity audits of U.S. power sector entities, identifying three compliance gaps: delays in registering new generation resources and categorizing associated critical cyber systems, failure to account for monitoring and control functions performed by third parties and affiliates when assessing risk levels, and inadequate access controls for artificial intelligence (AI) tools increasingly embedded in industrial control system networks. FERC recommended that utilities ensure timely compliance with registration deadlines, aggregate control capabilities across multiple parties when assessing system criticality, and implement authorization and monitoring procedures for AI tool access to critical systems and data.
Why it matters: Electricity generators and operators must review FERC's three lessons to avoid enforcement action: those with new generation resources risk noncompliance by missing registration and categorization deadlines, entities using third-party or affiliate monitoring face misclassification of cyber system risk levels and insufficient controls, and organizations deploying AI tools in critical infrastructure networks must implement proper access management to prevent unauthorized lateral movement and system compromise.
- Source published
- First seen by Cybersecurity Tracker