Centrii warns low-impact grid assets now fall under auditable vendor access rules

Centrii posted a warning on Oct. 21, 2026 saying NERC CIP-003-9’s tighter vendor remote-access rules now reach low-impact bulk electric system assets and bring audit and recordkeeping challenges. Industrial Cyber reported the advisory on Oct. 26, 2026.

Since April 1, 2026, the tightened vendor remote-access controls on low-impact assets have been subject to audit. The standard added Section 6 to Attachment 1, creating obligations for low-impact BES Cyber Systems that permit vendor electronic remote access. Under CIP-002, NERC assigns every BES Cyber System a high, medium, or low impact rating, with the rating based on the system’s effect on the bulk electric system. Low impact covers systems that fail to meet the high or medium thresholds.

Section 6 sets out a three-step process: identify vendor remote access, turn it off, and spot malicious communications linked to it that are known or suspected. The section covers vendor electronic remote access set up under Section 3.1.

Under CIP-003-9, two-way electronic remote access used for configuration, troubleshooting, or system interaction is in scope, but passive or one-way data flows are not. Any non-physical vendor connection counts, such as VPN sessions, remote desktop links, and machine-to-machine data feeds. A VPN left open continuously does not meet the standard. Vendors carry no direct compliance duty; the utility controls vendor access to its own assets.

Most solar, wind, and storage sites within scope fall under low impact, though a control center running several facilities is the chief exception. Generation assets become medium impact at 1,500 MW inside one interconnection. Inverter-based resources of 20 MVA or more linked at 60 kV or higher had to register under NERC Category 2 by May 15, 2026. That move enrolled many sites in the NERC program for the first time.

FERC signed off on CIP-003-9 in March 2023 after a 2019 NERC gap analysis found missing low-impact vendor-remote-access controls. NERC and FERC aimed at low-impact facilities because vendor access to control settings lacked explicit management under the CIP framework. Unmanaged vendor access repeated across many sites creates a measurable risk to bulk power system reliability. The SolarWinds breach demonstrated that trusted vendor pathways can be exploited at scale.

CIP-003-9 demands that entities retain evidence for every requirement for three calendar years. The audit window for low-impact requirements may stretch across six years, and auditors may ask about any date in that span. If the last audit happened more than three years ago, the compliance enforcement authority may seek different evidence demonstrating compliance across the whole period. ReliabilityFirst says entities should keep records for the whole period since the last audit if they are not bulky, and Centrii says those records should remain available for as long as an audit reaches back.

System logs, recordings, session monitoring, vendor logon alerts, and preauthorization can all serve as auditor evidence. Section 6 relies on connectivity set up under Section 3, meaning visibility into inbound and outbound electronic access supports vendor-access determination. Requirement Part 1.2.6 requires policy updates that specifically address vendor electronic remote access. The podcast raised audit questions about visibility, control validation, and monitoring of vendor access after the standard took effect.

The standard does not define “vendor.” ReliabilityFirst expects auditors to interpret “vendor” broadly. ReliabilityFirst says auditors should treat “vendor” broadly; outside contractors who access low-impact systems remotely count as vendors unless screened, trained, and equipped like employees. The Midwest Reliability Organization said many utilities depend on VPNs without the required monitoring and session-control capabilities.

Even when operators or O&M providers run daily operations, the registered entity still carries compliance responsibility. CIP-003-9 requires the registered entity to appoint a CIP Senior Manager under Requirement R3. The security lead typically backs the CIP Senior Manager with evidence, but accountability across contractors is difficult. Vendor-access records often live in e-mail approvals, OEM remote-support session logs, and with staff able to disable access.

A change in operator, asset manager, or O&M contractor can widen gaps because older records may not remain at the site. Auditors still question the responsible entity after changes to the operator, asset manager, or O&M contractor.

A finding usually results in a mitigation plan the entity must finish and certify. Notices of Penalty go to FERC and are published, and for CIP violations they traditionally name only an unidentified registered entity. For portfolios, a records gap can lead to a finding, a mitigation plan, and heavy staff time to rebuild records.

Under section 316A of the Federal Power Act, FERC can impose civil penalties reaching $1 million per violation per day. The cap increases with inflation each January, and it hit $1,584,648 in 2025. The maximum penalty is not a floor. Settled penalties usually fall well below the maximum.

NERC and Regional Entities consider grid risk, duration, internal controls, and compliance history when setting penalties. NERC and its Regional Entities supervise compliance audits and enforcement.

Centrii recommends naming one person to approve each vendor path, one person to disable it, and one location for its record. Centrii asks how each asset knows when a vendor connects, who can disable access and where the entity stores the last test record, where approval and session records live and who controls them, what an entity would produce for a date in the oldest year of the audit period, and what happens to those records after a vendor, operator, or asset manager changes. Centrii says fragmented answers that start with “it depends on who you ask” point to a problem needing a solution.

CIP-003-9 compliance does not change generation capacity or transmission flows. Commands for automatic voltage regulation and frequency control face manipulation when EMS and SCADA systems allow unsecured vendor access. Centrii said criminal ransomware attacks create measurable financial exposure for utilities.

Centrii scheduled a GridSecCon walkthrough in Orlando for Oct. 20 to 23, 2026, using synthetic data rather than live operational systems. Centrii supports governance, risk, compliance assessment, and evidence-management work. Centrii does not certify compliance, determine compliance, or guarantee compliance. Centrii has no affiliation or endorsement from NERC, the E-ISAC, SERC, or the GridSecCon conference organizers.

CIP-003-10 is already approved, and CIP-003-11 is moving through the standards development process. Under CMEP Version 8, the standards stayed the same, but how they are applied, evaluated, and defended changed. CMEP Version 8 oversight depends more on professional judgment tied to documented risk and control effectiveness.