Multi-factor authentication has been required for high- and medium-impact BES Cyber Systems for years. The 2026 NERC CIP Roadmap signals that MFA expectations are extending to low-impact systems, a change that will most significantly affect municipal utilities and rural cooperatives.
Current MFA Requirements
CIP-005-7 requires MFA for interactive remote access to high- and medium-impact BES Cyber Systems. The standard recognizes that single-factor authentication, particularly password-only access, is no longer sufficient against modern credential theft and phishing campaigns.
What's Changing for Low-Impact Systems
The 2026 Roadmap pushes MFA into low-impact territory. While final standard language is still in development, utilities should expect:
- MFA for remote access to low-impact BES Cyber Systems
- Stronger authentication for vendor remote access
- Documentation requirements proving MFA enforcement
- Compensating controls when MFA is technically infeasible
Why This Affects Utilities With Lean IT Teams
Utilities with lean IT teams may operate legacy infrastructure that wasn't designed for modern authentication. PLCs, RTUs, and older HMI systems frequently lack native MFA support, creating implementation challenges.
Cost-Effective MFA Implementation Strategies
1. Deploy MFA at the jump host or bastion layer rather than at every endpoint
2. Use TOTP-based MFA via free authenticator apps to avoid per-user licensing
3. Implement certificate-based authentication for service accounts
4. Document compensating controls (network segmentation, session monitoring) where MFA isn't feasible
5. Standardize on a single MFA solution across IT and OT to simplify management
Protecting Field Devices
For PLCs, RTUs, and similar devices, MFA isn't typically feasible at the device level. Instead, protect them through:
- Strong network segmentation isolating field devices
- MFA-protected jump hosts as the only path to device access
- Comprehensive logging of all device interactions
- Regular audits of access privileges
Get Implementation Support
EPG Solutions Benchmark Reports detail how peer utilities of your size are implementing MFA cost-effectively. Don't wait for the standard to be finalized. Start building your MFA roadmap now.