June 10, 2026 | Source: FERC — Order approving NERC CIP Reliability Standards (issued June 5, 2026)
FERC Locks In New CIP Cyber Standards: Virtualization, Low-Impact Passwords, a Redefined Control Center
On June 5, FERC approved a package of updated NERC Critical Infrastructure Protection (CIP) Reliability Standards.
The headline: eleven revised CIP standards now formally permit the secure use of virtualization technologies on the bulk power system — something the legacy standards never cleanly accommodated.
Two more changes ride alongside it. CIP-003-11 adds password requirements for remote users and intrusion detection at low impact BES Cyber Systems. CIP-002-8 updates the NERC Glossary definition of "control center."
What This Means for Your Compliance Calendar
The virtualization standards are a green light, not a mandate. But if you have been holding off on virtualized EMS or SCADA environments because the old CIP language didn't fit, that blocker is gone — and the efficiency case for consolidating hardware just got easier to defend.
The bigger near-term lift is at low impact. CIP-003-11 pulls password hygiene and intrusion detection down to assets many entities have treated as light-touch. If your low impact inventory hasn't had a fresh review lately, it needs one now.
And the new "control center" definition matters more than it reads. Asset categorization under CIP-002 drives every obligation downstream of it. Move that boundary and the compliance scope attached to it moves too.
EPG Solutions Can Help
GridCert RC training keeps your operators and compliance teams current on exactly these moving CIP targets — what changed, why it changed, and what it means at the asset level before your next audit cycle. When the standards shift, your people shouldn't be the last to know.