On March 19, 2026, FERC issued Order No. 919, which approved eleven proposed Critical Infrastructure Protection (CIP) Reliability Standards, four new definitions, and eighteen proposed revised definitions to the North American Electric Reliability Corporation’s (NERC) Glossary of Terms Used in Reliability Standards (NERC Glossary). FERC asserted that the new and revised definitions and new CIP Reliability Standards will support entities’ adoption of virtualization, which will improve the reliability of the Bulk-Power System against cyber security threats. NERC’s revisions will become effective the first day of the first calendar quarter that is 24 months after Order No. 919’s May 26, 2026, effective date, or April 1, 2028.
On July 20, 2024, as supplemented May 20, 2025, NERC requested FERC’s approval of eleven proposed CIP Reliability Standards, four new defined terms (Cyber System, Management Interface, Shared Cyber Infrastructure, and Virtual Cyber Asset), and revisions to eighteen defined terms in the NERC Glossary. NERC also proposed to replace the phrase “technical feasibility” with “per system capability” across nine requirements in the currently effective versions of the CIP Reliability Standards and to add such language to six requirements in the currently effective versions. The “technical feasibility” language previously allowed entities to seek exceptions to CIP requirements when compliance would lead to premature retirement or the costly replacement of operational technology. NERC argued its proposed changes would allow entities to implement virtualization—the process of creating virtual as opposed to physical versions of computer hardware resources—and manage associated risks.
On September 18, 2025, FERC issued a Notice of Proposed Rulemaking (NOPR) proposing to adopt NERC’s proposed CIP Reliability Standards. However, FERC’s NOPR took concern with NERC’s proposal to replace the “technical feasibility” exception and sought comment on whether the modification would reduce transparency and oversight.
In Order No. 919, FERC approved the eleven proposed modified CIP Reliability Standards, four new proposed definitions, and eighteen proposed modified definitions in the NERC Glossary. FERC found the proposed CIP Reliability Standards would provide responsible entities the opportunity to take advantage of the efficiencies and flexibilities associated with virtualization in a secure manner. As for the new and revised definitions, FERC found NERC’s proposal would ensure consistency across the CIP Reliability Standards and encourage entities to adopt virtualization. However, despite being persuaded by commenters that an exception process was still needed for existing and emerging technologies, FERC found that NERC’s proposal to replace the phrase “where technically feasible” with “per system capability” across multiple Reliability Standards would eliminate transparency and meaningful FERC and NERC oversight by introducing a self-implementing exceptions process with no reporting obligations. To address this concern, FERC directed NERC to: (1) develop criteria that promotes consistency and clarity for entities invoking the “per system capability” exception; (2) develop reporting requirements for entities invoking the “per system capability” language; and (3) file an annual report at FERC that contains anonymized data on how entities are using the “per system capability” exception.
FERC’s order, issued in Docket No. RM24-8-000, is available here.