Planning for the CIP standards approved for future enforcement: the 2028 virtualization set, CIP-015 internal network security monitoring, 'per system capability' in place of TFEs, and the supply chain revisions FERC ordered in 2025.
What the 11 virtualization standards approved in FERC Order No. 919 mean for a CIP program: the 1 July 2028 effective date and early adoption, what changes even without virtualization, retirement dates for current versions, and FERC's documentation effort estimate.
Planning internal network security monitoring under CIP-015-1 and CIP-015-2: phased dates from 2028, what must be documented, the evidence auditors will look for, and FERC's published per-entity effort estimate.
How the 2028 standards replace 'where technically feasible' with 'per system capability', what FERC asked NERC to build around it, and what happens to the Technical Feasibility Exception process and existing TFEs.
What FERC Order No. 912 asks NERC to change in the supply chain standards, risk identification and response in plans and coverage of Protected Cyber Assets, the 18-month deadline, and how it relates to CIP-013-3 in the 2028 set.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.