Updated: Secrecy Reigns as NERC Fines Utilities $10M citing Serious Cyber Risks

NERC issued its largest-ever penalty — $10 million across undisclosed entities within a Regional Entity — for 127 violations of Critical Infrastructure Protection (CIP) standards, including 13 rated as serious risks and 62 as moderate. The public notice is heavily redacted, but describes systemic failures such as absent/insufficient electronic access controls, weak change-control practices, and poor management oversight; the report requires the fined companies to undertake governance, documentation, and technical remediation. The article situates the enforcement in the context of growing concern about nation-state actors (notably Russia, China, and Iran) targeting North American critical infrastructure, but does not provide indicators of compromise or evidence of an active cyber intrusion.