FERC Outlines Supply Chain Security Rules for Power Plants

FERC has asked NERC to enhance supply chain cybersecurity standards for power sector entities, requiring regular identification of supply chain risks, validation of vendor-provided information, and documented risk response, while adding protected cyber assets to the scope. In the same meeting, FERC proposed approving Reliability Standard CIP-015-1 to mandate internal network security monitoring within electronic security perimeters and requested its extension to systems outside those perimeters, such as physical and electronic access controls, to improve east-west visibility and early intrusion detection.