NERC is calling on industry to help the ERO identify the top security risks facing the North American electric grid in a new survey, while also providing guidance for newly registered owners of inverter-based resources ahead of next year’s deadline.
The 2025 Emerging Security Risks and CIP Standards Roadmap Survey of Industry, released July 2, is intended to satisfy one of the ERO’s 2025 Work Plan Priorities approved by NERC’s Board of Trustees at its Dec. 10 meeting. (See “Organizational Items Endorsed,” NERC Board of Trustees Briefs: Dec. 10, 2024.) One of the priorities was to “create a road map for ensuring CIP [critical infrastructure protection] standards provide baseline protection for an evolving risk environment.”
The survey provides participants with a list of 34 emerging physical and cybersecurity risks, to be ranked according to “their likelihood of occurrence and potential impact on [grid] reliability.” Topics included in the list range from broad issues such as supply chain, ransomware and malware attacks, and physical attacks on infrastructure, to more focused areas like targeting of distributed energy resource aggregator control systems, targeting of artificial intelligence tools and capabilities, compromising of metering infrastructure, weaponization of drones and unusable data backups.
To prevent confusion among stakeholders, NERC also provided a supplemental information document outlining the risk statement and one or more hypothetical risk scenarios for each risk. The survey form also includes spaces for comments on the risk ranking and security risks not included on the list, along with their ranking.
Survey responses are due by July 22. NERC said in an announcement it would “assess responses from the survey participants and use the collected insights in further developing” the CIP road map. The ERO then will develop a report with an overview of the risks prioritized in the survey, current applicable CIP standards, ongoing risk mitigation activities addressing each risk and recommendations for addressing identified gaps.
IBR Materials Posted
The ERO’s IBR registration guidance, comprising two infographics also released July 2, are aimed at owners of IBRs that will need to be registered with NERC by May 2026. The deadline is based on the work plan approved by FERC in May 2023, which laid out a three-year process for registering IBRs that were not previously required to register but that are connected to the grid and, “in the aggregate, have a material impact” on reliable operation.
Earlier in 2025, NERC told FERC it estimated there were 863 IBRs whose owners will need to be registered under the new classification “Category 2 generator owners.” This includes entities that own or maintain IBRs that “either have or contribute to an aggregate nameplate capacity of greater than or equal to 20 MVA, connected through a system designed primarily for delivering such capacity to a common point of connection at a voltage greater than or equal to 60 kV.”
NERC prepared one infographic for GOs that already are registered with the ERO and will need to update their registration to include relevant facilities, and another for entities that are new to the ERO Enterprise. For the latter, NERC included explanations of the ERO and its mission, along with a brief outline of the registration process.
The release of the new infographics is part of the third and final step of the IBR registration initiative, which NERC called an effort to welcome new participants into the ERO Enterprise.” NERC and the regional entities have events planned to further assist entities with the transition.
