As cited
Copy frozen at (site build).
regulatory
Centrii flags audit risks as NERC CIP-003-9 tightens vendor remote access controls for low-impact BES systems
NERC's updated CIP-003-9 standard, effective April 1, 2026, requires owners and operators of low-impact bulk electric system assets to establish processes for identifying, disabling, and monitoring vendor remote access. Compliance presents recordkeeping challenges because evidence must be retained for three calendar years while audit periods can span six years, and documentation is often dispersed across email, vendor tools, and contractor records. Civil penalties for violations reach $1,584,648 per day per violation, with registered entities remaining accountable even when operations are outsourced.
Why it matters: Energy operators and asset managers overseeing renewable, storage, and other BES-connected facilities must immediately audit vendor remote access paths, document approval and disable procedures, and centralize recordkeeping across contractors to avoid audit findings and million-dollar penalties.
- Source published
- First seen by Cybersecurity Tracker