| Audience: | CIOs 🞄 CISOs 🞄 VPs of IT and Operational Technology Operations |
| Primary Sector: | Utilities / Energy |
| Decision Horizon: | Current shared-control arrangements, upcoming commissioning phases, and supplier contract changes |
Executive Summary
Several generation companies may rely on the same control centre to monitor and direct their plants. The centre can control far more generation than any one company accounts for in its own cybersecurity assessment. FERC's October 2026 audits found this problem in shared arrangements: the combined control capabilities warranted medium-impact classification, while the individual registered Generator Operators had classified their systems as low impact. Auditors also found that registered entities were reluctant to discuss what their affiliates and contractors could control.1
The operator remains accountable even when another company runs the control systems. Utility CIOs, CISOs and operations leaders should require evidence of the combined control capabilities before approving new or expanded arrangements. The registered Generator Operator must be able to support the applicable cybersecurity classification.
Existing arrangements with uncertain classifications require prompt review. An unchanged arrangement with adequate evidence can remain within established compliance procedures. These recommendations reinforce existing NERC CIP obligations; FERC's audit observations do not create new standards.
Our Analysis
The problem is not simply that some systems received the wrong cybersecurity classification. It is that organizations responsible for compliance may depend on operational capabilities controlled by others, without sufficient visibility to determine whether those capabilities change their obligations. This matters because contractual delegation does not transfer regulatory accountability.
The Narrative vs The Reality
Utility cybersecurity compliance is commonly organized around registered entities, designated facilities and individually assessed systems. Outsourcing generation monitoring and control does not eliminate the operator's compliance responsibilities, but the contractual separation can make the complete operational picture difficult to establish.
FERC's audits reveal four related weaknesses:
- Control-centre aggregation was already an established concern. FERC's 2025 audits found that some utilities excluded distributed energy resources and other non-BES generation when calculating the aggregate capabilities of control centres. Under CIP-002-5.1a criterion 2.11, relevant generation must be considered together, including applicable BES and non-BES resources.2
- The 2026 findings extend the problem across organizational boundaries. Auditors identified a parent company and a third-party service provider exercising aggregate generation monitoring and control capabilities for multiple registered operators. Individual low-impact assessments failed to account for the higher-impact capabilities concentrated in those arrangements.1
- The evidence needed for compliance was not readily established. FERC reported that registered operators were reluctant to discuss affiliate and contractor capabilities when auditors questioned their classifications. This raises a practical assurance problem: a registered operator must demonstrate compliance even when the information required to support its classification concerns systems controlled by another organization.
- Commissioning created a separate timing failure. Some generation resources began commercial operation above applicable registration thresholds before registration and cyber-system categorization were completed. In one case, the delay exceeded a year because the owner waited for completion of later project phases.1
The Signal in the Noise
Each participating organization may have a defensible description of its own responsibilities while none has adequately established the classification consequences of the combined control arrangement.
What Changes the Decision
Before approving shared control, the utility needs three answers. Which generation resources can the centre monitor and control? Which NERC CIP impact criteria apply? What evidence can the registered operator obtain to support its compliance position?
The tests depend on the type of operation. Under CIP-002-5.1a criterion 2.11, a Generator Operator control centre meets a medium-impact criterion when it performs the operator's duties for generation with an aggregate highest-rated net real-power capability of at least 1,500 MW in one interconnection, measured over the preceding 12 calendar months. Criterion 2.1 applies a separate test to qualifying shared BES Cyber Systems at a single generation plant. Other criteria may require a high-impact rating.3 The 1,500 MW control-centre test must not be treated as a blanket rule for every supplier arrangement.
If the utility cannot support these determinations, it should not approve new or expanded control authority until it resolves the evidence gap.
Why This Matters Now
The 2026 report extends earlier control-centre categorization concerns to arrangements involving unregistered affiliates and contractors. For utilities consolidating generation operations, the classification implications may therefore be larger than the scope recognized in individual contracts or asset inventories.
The financial risk is particularly important before procurement and commissioning decisions become difficult to reverse. FERC identifies approximately 140 requirements and sub-requirements associated with medium-impact BES Cyber Systems, compared with approximately 15 for low-impact systems. That difference does not establish a particular cost increase, but it demonstrates why an overlooked classification can materially alter protection obligations and operating arrangements.1
The resulting compliance work may require additional controls, supplier evidence, contractual commitments and funding that were never included in the original service decision.
What to Watch for Next
FERC staff recommended that NERC consider additional guidance or changes to standards and registration procedures addressing shared control arrangements and de facto operators. Utilities should track those developments without postponing action on obligations already in force.1
Recommended Actions
Do This
- Gate commissioning on registration and CIP readiness. Before a generation phase begins commercial operation at an applicable registration threshold, the Generator Owner, Generator Operator and compliance lead must confirm the registration date and document the relevant BES Cyber Systems and their CIP-002 categories. In a phased project, assess each qualifying operating phase; do not wait for the whole project to finish. Do not approve operation beyond an applicable threshold while required compliance steps remain unresolved.
- Map combined control before expanding it. When an affiliate or contractor gains control authority, a control centre adds generating resources, or remote control functions materially change, require approval from the VP of Operations and CISO before the change. Their evidence should be a capability map showing which resources and systems can be controlled, the applicable classification criteria and the registered operators responsible. Resolve any indicated impact-rating change before approval. Shared control alone does not automatically mean medium impact; the relevant criteria decide.
- Make supplier evidence a contract condition. For new contracts and material renewals, Procurement and Legal should require proof of control scope, notice of material changes, and suitable audit or independent-attestation rights. If an existing arrangement lacks credible evidence of its combined capabilities, the CISO and compliance lead should start a targeted review now, not at the next scheduled CIP-002 review. Escalate unresolved gaps through a documented plan that protects grid operations; do not abruptly interrupt existing control services.
Avoid This
- Substituting individual asset classifications for an assessment of shared control. A low-impact classification maintained by each generator operator does not establish the correct classification of systems used to control their resources collectively.
- Assuming a supplier's contractual responsibility transfers NERC compliance obligations. Registered operators remain accountable for demonstrating applicable compliance, even when an affiliate or contractor performs the underlying operational tasks.
- Imposing blanket reclassification or unnecessary reassessment. Existing arrangements with verified capabilities and defensible classifications can remain within established review procedures. Concentrate immediate effort on undocumented aggregation, questionable ratings and proposed changes in operational control.
Bottom Line
Regulatory accountability cannot be separated from the evidence needed to discharge it. Before authorizing shared generation control, utilities must establish what the combined arrangement can do, which cybersecurity obligations follow, and how the responsible operator will demonstrate compliance.
Evidence and Sources
- Federal Energy Regulatory Commission, Office of Electric Reliability, Division of Cyber Security. 2026. Lessons Learned from Commission-Led CIP Reliability Audits. October 13, pp. 6–10. Describes delayed generation registration, affiliate and contractor control aggregation, classification deficiencies and recommendations to NERC. These are anonymized audit observations, not sector-wide prevalence estimates.
- Federal Energy Regulatory Commission, Office of Electric Reliability, Division of Cyber Security. 2025. Lessons Learned from Commission-Led CIP Reliability Audits. October 20, pp. 5–7. Addresses aggregation of BES and non-BES generation, distributed resources and control-centre impact ratings.
- North American Electric Reliability Corporation. 2016. CIP-002-5.1a: Cyber Security — BES Cyber System Categorization. Requirements R1–R2 and Attachment 1, particularly criteria 1.4, 2.1 and 2.11. Establishes applicable identification, categorization, review and impact-rating criteria.