Each year, the Federal Energy Regulatory Commission (FERC) conducts its own commission-led Critical Infrastructure Protection (CIP) audits to gain a direct view of how utilities and other registered entities are implementing the NERC CIP Reliability Standards.
These audits are part of FERC’s own CIP audit program, rather than typical regional entity-led audits. In this process, FERC staff issue data requests, hold webinars and teleconferences, conduct virtual and on-site visits, interview personnel at multiple levels, review documentation and observe cyber-asset operations to provide the Commission with a more direct view of compliance maturity and cybersecurity practices across the Bulk Electric System.
On October 20, 2025, FERC released its latest Lessons Learned from Commission-Led CIP Reliability Audits summarizing findings from its Fiscal Year 2025 reviews. While anonymized, the report offers valuable insight into where registered entities continue to face challenges and how FERC interprets compliance obligations in emerging technology areas.
FERC’s direct participation in CIP audits helps the Commission validate that approved standards are being implemented as intended and identify where evolving technologies or operational models may be introducing new risk.
FERC staff found that several entities failed to include distributed energy resources (DERs) and distribution-connected generation when calculating aggregate generation capacity for control centers performing generator operator (GOP) functions.
In some cases, utilities operated hundreds of small DERs—totaling more than 1,700 MVA—through the same physical control centers that managed bulk generation. When these facilities were not properly categorized, the result was a misapplied impact rating and missing security controls required for medium-impact systems.
Takeaway: Identification and categorization remain the foundation of the CIP standards. As DER portfolios expand, entities must ensure control center impact ratings reflect all generation resources operated through those facilities, consistent with CIP-002 Attachment 1 Section 2.11.
Many entities now rely on third parties to perform key compliance or technical functions, such as firewall rule management, physical access control system (PACS) maintenance and vulnerability assessments. FERC staff observed cases where these responsibilities were delegated but not adequately monitored, leading to missed tasks, outdated firewall rules, or unverified testing intervals.
Key risks observed:
Takeaway: Outsourcing does not transfer accountability. Entities must document third-party responsibilities, monitor execution, and retain evidence of oversight. FERC also recommends including security and compliance clauses in contracts, maintaining compensating controls, and ensuring third-party operations and data remain within the continental U.S.
FERC’s audit staff found multiple instances where entities could not demonstrate compliance when using cloud service providers (CSPs) for Electronic Access Control or Monitoring Systems (EACMS) and PACS functions.
Because the current CIP standards were developed before widespread cloud adoption, they do not explicitly address CSP environments, making it difficult for entities to verify baseline configurations, perform vulnerability assessments, or demonstrate personnel risk screening for CSP staff.
Key risks observed:
Takeaway: While cloud services offer scalability and efficiency, FERC cautions that under current standards it remains “unlikely that entities can provide the measures needed to demonstrate compliance.” Entities should fully assess whether their BES Cyber Systems—or associated cyber assets—reside in the cloud and plan accordingly, especially before any change in impact rating.
For the full report, access it on FERC's website here: https://www.ferc.gov/news-events/news/ferc-staff-report-offers-lessons-learned-2025-cip-audits
The 2025 findings underscore the following:
Organizations should expect future FERC and NERC oversight to continue probing these areas, particularly third-party reliance and the emerging use of cloud services in operational technology environments.
Industrial Defender’s unified OT asset and compliance platform gives utilities and critical infrastructure operators the data and context needed to stay ahead of evolving compliance expectations:
As one of the longest-standing platforms purpose-built for OT cybersecurity and compliance, Industrial Defender has been helping registered entities NERC CIP requirements for over two decades. Supporting utilities across audit cycles, evolving standards, and real-world operations, we remain committed to strengthening reliability and resilience across the grid through better visibility, stronger evidence, and continuous compliance.
