On March 19, 2026, FERC unanimously approved the Virtualization Reliability Standards, which include 11 modified CIP Standards, 4 new definitions to the NERC Glossary, and 18 modified definitions to the NERC Glossary; CIP-003-11, which brings changes to Electronic Access Controls for entities with low impact BES Cyber Systems; CIP-002-8, which changes the NERC Glossary definition of “Control Center” and modifies the medium impact rating criteria for Control Centers of Transmission Operators and
Transmission Owners.
The Virtualization Reliability Standards and CIP-003-11 were covered in depth in our write up of the FERC NOPR issued September 18, 2025. CIP-002-8 will also be superseding CIP-002-7 that comes with the Virtualization Reliability Standards. CIP-002-8 will go into effect on July 1, 2028.
CIP-002-8 modifies the existing definition of Control Center:
One or more facilities hosting operating personnel that monitor and control the Bulk Electric System (BES) in real-time to perform the reliability tasks, including their associated data centers, of: 1) a Reliability Coordinator, 2) a Balancing Authority, 3) a Transmission Operator for transmission Facilities at two or more locations, or 4) a Generator Operator for generation Facilities at two or more locations.
OR
One or more facilities of a Transmission Owner that have the capability to control transmission Facilities at two or more locations in real-time using Supervisory Control and Data Acquisition (SCADA), including their associated data centers, and excluding field Cyber Assets used for telemetry.
CIP-002-8 also reworks criterion 2.12 in Attachment 1, for medium impact rating. Criterion 2.12 applies to Control Centers of Transmission Operators and Transmission Owners. Control Centers with an aggregate weighted value exceeding 6000 according to the new table below will now meet this criteria:
This updated version of CIP-002 has the potential to have a major impact on Transmission Owners that have Control Centers based on the new definition. For example, a Transmission Owner who has SCADA control over their Bulk Electric System (BES) breakers but takes operations instructions from another entity as their Transmission Operator would now be considered to have a Control Center and associated data center. In previous versions of the CIP Standards this determination was not clear. The new criteria 2.12
may also be helpful to smaller Transmission Operators as it may allow them to from having medium impact BES Cyber Systems to only have low impact BES Cyber Systems at their Control Centers.
Our NERC CIP and Cybersecurity Team are available to discuss these changes and any NERC CIP questions that you may have. Please let us know at ers@gdsassociates.com and we will be happy to set up a meeting with you and your Team