2026-05715NoticeWallet

Grid Cyber Rules Upgraded: Impact Levels Sorted!

Published Date: 3/24/2026

Notice

Summary

The North American Electric Reliability Corporation (NERC) just got the green light to roll out a new cyber security rule called CIP-002-8. This rule helps electric companies figure out which parts of their systems need the most protection from cyber threats by sorting them into low, medium, or high impact categories. Electric utilities need to start following this updated standard soon, helping keep our power grid safe without breaking the bank.

Analyzed Economic Effects

4 provisions identified: 2 benefits, 2 costs, 0 mixed.

New CIP-002-8 Brings Compliance Costs

The Commission approved Reliability Standard CIP-002-8, which requires about 1,673 U.S. entities on the NERC Compliance Registry to categorize bulk electric system cyber systems as low, medium, or high impact and follow related CIP rules. The order estimates 1,573 entities will incur a 2-hour paperwork increase at $97/hour (about $194 per entity) totaling $305,162 in year one, plus 100 entities will have 4 hours at $85/hour totaling $38,000, and an annual cost burden reported as $101,803 for each of Years 1–3.

Control Center Definition Expanded

NERC's approved change revises the NERC Glossary so a transmission owner is considered to have a 'control center' if it can control transmission facilities at two or more locations using SCADA (supervisory control and data acquisition). That expansion means some transmission owners may now fall under CIP requirements they did not before.

6,000 Threshold Sets Impact Levels

The standard sets a 6,000 aggregated weighted value threshold (based on voltage points for BES transmission lines a control center monitors) to distinguish medium-impact from low-impact control centers. This threshold and inclusion/exclusion rules change which control centers receive higher cybersecurity protections, which the Commission says advances Bulk Electric System reliability.

Implementation Timing Gives Transition Period

NERC's implementation plan makes CIP-002-8 effective on the later of the CIP-002-7 effective date or the first day of the first calendar quarter that is three calendar months after the Commission's approval order. NERC says this balances urgency with time for responsible entities to update their processes.

Your PRIA Score

Score Hidden

Personalized for You

How does this regulation affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this federal register document and every other regulation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Key Dates

Published Date
3/24/2026

Department and Agencies

Department
Independent Agency
Agency
Energy Department
Federal Energy Regulatory Commission
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register

Take It Personal

Get Your Personalized Policy View

Start a Free Government Policy Watch to see how policy affects your household, then upgrade to PRIA Full Coverage for year-round monitoring.

Already have an account? Sign in