Cybersecurity Policy Report, Electricity Sector Gets New Set of Cyber Rules, (Mar 23, 2026)
Large generators and distributors of electricity will have to strengthen their cyber protections for “low impact” systems under final rules due to be published in tomorrow’s Federal Register.
The Federal Energy Regulatory Commission (FERC) adopted the rules after determining that low-impact digital systems could be exploited for cyber attacks on higher-impact systems within the bulk electric system (BES).
When it proposed the rules last September, FERC cited Volt Typhoon, a cyber threat attributed to the Chinese government that targeted the electricity sector (CPR, Sept. 23, 2025).
“The proposed modifications to the Reliability Standard mitigate the risks posed by a coordinated attack utilizing distributed low impact BES Cyber Systems by adding controls to authenticate remote users, protecting authentication information in transit, and detecting malicious communications to or between assets containing low impact BES Cyber Systems with external routable connectivity,” according to the Federal Register notice.
“Together, these controls should improve the cybersecurity posture of the BES by protecting against potential coordinated attacks on multiple low impact BES Cyber Systems or using a compromised low impact BES Cyber System to move laterally and pivot to a medium or high impact BES Cyber System,” the notice says.
FERC also finalized separate cybersecurity rules due to be published in tomorrow’s Federal Register that will enable BES providers to adopt network virtualization and other technologies without undermining their cyber defenses.
The new rules were adopted by FERC last Thursday and will go into effect 60 days after their Federal Register publication.
“Our electric grid faces persistent reliability challenges from cybersecurity threats, extreme weather and rising demand,” FERC Chairman Laura Swett said in a news release. “The actions we approved are centered on modernizing and securing grid reliability, with a special emphasis on cybersecurity, so every American can count on the grid and get power when they need it.”
News: FederalLegislation DataSecurity