In January 2026, NERC released its updated Critical Infrastructure Protection Roadmap, providing the clearest picture yet of where compliance is heading over the next five years. For utility compliance leaders, this document is essential reading.
The Shifting Compliance Landscape
The roadmap signals a decisive shift from periodic compliance checks toward continuous monitoring, automated evidence collection, and expanded coverage of low-impact assets. Enforcement priorities are moving toward cybersecurity resilience rather than checkbox documentation.
Key Compliance Milestones
2026: CIP-003-9 enforcement (April), CIP-012-2 implementation, expanded supply chain controls
2028: Deeper evidence collection requirements, expanded scope for medium-impact systems, formalized cloud security controls
2030 and Beyond: Continuous monitoring as the baseline expectation, automated audit trails, AI-assisted threat detection integration
Aligning Your Program Today
Forward-thinking utilities are using the roadmap to prioritize investments. The utilities that begin building automation, evidence-collection systems, and continuous monitoring capabilities now will have substantial advantages over those that wait until enforcement deadlines force action.
Stay Ahead With EPG Solutions
Our GridCert RC Prep Course incorporates the latest roadmap insights so your team trains on what's coming, not just what exists today. The RTO Intelligence Briefing delivers monthly practitioner interpretation of RTO markets, FERC, NERC, and reliability developments.
The next five years of NERC CIP compliance will reward proactive utilities. Start your roadmap alignment today.