U.S. Grid Cyber Rules Are Finally Catching Up With Virtualized Operations

In March 2026, the Federal Energy Regulatory Commission approved the most sweeping rewrite of North American grid cybersecurity rules in years. Order No. 919, published in the Federal Register on March 24 and effective May 26, approves 11 modified Critical Infrastructure Protection (CIP) Reliability Standards from the North American Electric Reliability Corporation, along with four new definitions and 18 revised definitions in NERC's official glossary. In the same package of actions, FERC approved a new version of CIP-003 raising baseline cybersecurity requirements for low-impact grid systems, and a revised definition of "control center" intended to help utilities identify and protect high-risk assets.

At the center of the order is a deceptively simple shift: for the first time, the CIP framework formally recognizes that the computing systems running the bulk-power system no longer live in a one-machine-one-function world. Utilities will be able to build virtualized environments, where many virtual machines share pools of processors, storage, and networks, without stepping outside their compliance obligations. The rules also arrive with a question that matters far beyond engineering departments. Virtualization can make control systems more redundant, recoverable, and defensible. It also concentrates risk in shared infrastructure, expands remote administration, and arrives in an industry where security maturity varies enormously between large investor-owned utilities and small municipal or cooperative systems. Whether the resilience gains outrun the new exposures depends on decisions that are, in several important cases, still unfinished.

What FERC approved in March 2026

Order No. 919, issued in Docket No. RM24-8-000, approves the modified CIP standards together with their violation risk factors, violation severity levels, implementation plans, and effective dates, and it retires the prior version of each standard they replace. The full text appears in the Federal Register notice.

One feature of the order is easy to miss: it does not require anyone to virtualize anything. The order states that the modifications "do not obligate entities to adopt virtualization; rather, if approved, the proposed CIP Reliability Standards would accommodate responsible entities that choose to do so." Adoption is voluntary. What changed is that adoption is accommodated inside the compliance framework instead of in its margins.

The same day, FERC approved two companion actions, described in the commission's news release:

• A final rule for CIP-003-11 (Docket RM25-8-000), which adds baseline cybersecurity controls for low-impact BES Cyber Systems, defined by FERC as "digital or computer systems that support the electric grid but do not meet the criteria for medium or high impact under the tiered approach of the CIP Standards." The new requirements cover password protocols for remote users, including safeguards for those passwords, and the detection of intrusions to low-impact BES Cyber Systems.
• CIP-002-8 (Docket RD25-8-000), which updates the NERC Glossary definition of "control center" to help entities identify and protect high-risk assets.

FERC Chairman Laura V. Swett framed the package against the current threat environment: "Our electric grid faces persistent reliability challenges from cybersecurity threats, extreme weather and rising demand. The actions we approved today are centered on modernizing and securing grid reliability, with a special emphasis on cybersecurity."

Why the old rules couldn't see a virtual machine

To understand what the order fixed, you have to understand the assumption it retired. FERC's September 2025 notice of proposed rulemaking quotes NERC's diagnosis directly: the CIP framework "was designed around the concept that devices have a one-to-one relationship between software and hardware." A control server was a box. You identified the box, drew an Electronic Security Perimeter around it, controlled the Electronic Access Points into that perimeter, and managed the box's configuration, patches, and access rights.

Virtualization breaks that premise at the root. In a virtualized environment, a control system and its operating system become a virtual machine, a software object that can be created, copied, rebuilt, or migrated across physical hosts in seconds. Storage and networking are pooled and shared. The "asset" is no longer a thing you can tag with a serial number; it behaves more like a program that runs wherever capacity is available. Compliance concepts built for fixed hardware, such as device baselines, perimeter diagrams, and port-level access control, map awkwardly onto infrastructure that reconfigures itself.

The drafting effort behind the fix dates to NERC's Project 2016-02. In April 2019, that project's standards drafting team published a white paper, "Virtualization and Future Technologies: The Case for Change", cataloguing the problem areas: how to identify virtual cyber assets, the tension between distributed firewalls and perimeter models, zero-trust architectures, virtualized storage, management-plane isolation, and multi-site data centers. The white paper, it is worth noting, represented the drafting team's views and was not endorsed by NERC. Still, its table of contents reads like a preview of the rule text that would finally arrive seven years later.

The revised standards embed virtualization across the existing framework rather than creating a standalone standard. As Morgan Lewis's analysis of the order explains, the changes introduce new glossary definitions for Virtual Cyber Assets and Shared Cyber Infrastructure and revise concepts such as Electronic Security Perimeters and Electronic Access Points to recognize logical boundaries and policy enforcement points instead of purely physical ones.

What resilience actually looks like in a virtualized control system

"Resilience" is an overused word, so it helps to borrow a working definition. Researchers at the University of Illinois Information Trust Institute, working with the grid regional entity ReliabilityFirst, frame cyber resilience for bulk-power systems as four measurable properties: robustness, redundancy, resourcefulness, and rapidity. Virtualization speaks directly to three of them.

Redundancy and rapidity come from decoupling workloads from hardware. If a physical server fails, a virtual machine running a control application can restart on healthy hardware rather than waiting for a replacement part. If a system is corrupted or compromised, operators can restore from a known-good image instead of rebuilding a machine from scratch. NERC, in its petition to FERC, cited exactly these properties: "increased uptime, fast recovery capability, and flexible architecture that can instantly adapt to changing workloads."

Security can improve too, in a specific way. The 2019 white paper offers a useful analogy: just as locating generation close to load centers reduces outage exposure, virtualization lets entities move access controls from the outer perimeter ever deeper inside their networks, closer to the workloads themselves. Modern virtualized architectures can support microsegmentation and policy-based access controls that apply security rules to individual workloads rather than to whole network zones, techniques Morgan Lewis notes may genuinely strengthen protection of bulk-system assets.

The point is that these gains are not speculative. They are inherent properties of the technology, available from the day a well-designed environment goes live. That timing matters for the race question, because the countervailing risks behave differently.

Where the attack surface grows

Virtualization's risks are not evenly distributed across the technology. They cluster in four places, each of which the revised standards address only partially.

The hypervisor becomes a chokepoint

Sharing cuts both ways. When dozens of workloads run on one host, the hypervisor and its management console become a single point of compromise with outsized reach: an attacker who controls the management layer can potentially reach every workload it hosts. The perimeter-era CIP framework never had to think about this layer, because it did not exist in the asset model.

The threat is documented, not hypothetical. In February 2023, the ESXiArgs ransomware campaign encrypted thousands of VMware ESXi hypervisors worldwide, exploiting a vulnerability for which a fix had been available for roughly two years. CISA and the FBI responded with a joint advisory and recovery tooling. The campaign's lesson for grid operators is blunt: hypervisor fleets are mass-compromise targets, and patching discipline across shared infrastructure is not an administrative nicety but an existential one. The revised standards push in this direction by extending system security management under CIP-007 to the virtualization layer, but a standard is only as strong as its implementation.

Lateral movement changes shape

The old security model trusted the inside of the perimeter. Virtualization can make that trust worse, since traffic between virtual machines on shared hosts may never cross a physical chokepoint where legacy monitoring tools can see it. Or it can make trust smaller, because microsegmentation can wall off each workload. Which way an environment tips is a design choice the standards accommodate rather than dictate in detail.

Legacy operational technology stays behind

Not everything can be virtualized. Timing-sensitive protection and control devices, unsupported vendor systems, and decades-old equipment will remain physical for years, leaving most utilities with hybrid estates: modern virtualized platforms beside legacy devices the new rules still have to govern. The revised standards preserve a non-virtualized path precisely for this reason. The compliance burden, in turn, grows: configuration management under CIP-010 must now handle dynamic virtual baselines, and access management under CIP-004 now reaches personnel who administer Shared Cyber Infrastructure, according to the Morgan Lewis analysis.

Remote access and the long tail

Virtualized environments are administered remotely as a matter of routine, which stretches remote-access risk into shared infrastructure that the perimeter model never contemplated. And it is here that the industry's uneven capacity becomes the decisive variable. The strongest evidence of that unevenness is CIP-003-11 itself: remote-user password protocols and intrusion detection are only now becoming baseline requirements for low-impact systems. The need for those controls in 2026 tells you where the grid's weakest links were. A regional transmission organization with a mature security operations center and a small municipal utility with one part-time engineer face the same rulebook with very different capacity to carry it out.

Three words that now carry the oversight burden

Buried in Order No. 919 is a fight over three words that may matter as much as any technical change. The revised standards repeatedly replace the phrase "where technically feasible" with "per system capability." Under the old phrase, an entity that could not implement a control sought a technical feasibility exception through a documented reporting and approval process. Under the new one, NERC proposed that an entity simply document the limitation, implement alternative mitigation, and keep the paperwork in case of an audit.

FERC called this out in its proposed rulemaking and again in the final order: a self-implementing exception with no reporting obligations would eliminate transparency and meaningful oversight. Exceptions are where security risk accumulates quietly, and a mechanism that lets each entity grade its own homework, invisible until an audit, is exactly the kind of gap that determines whether shared-infrastructure risk stays bounded.

The commission approved the standards anyway, but not unconditionally. The order directs NERC to develop clear criteria for invoking the exception and to create mandatory reporting requirements to the ERO Enterprise when entities do so. FERC's news release summarizes the bargain: the rule reduces administrative burden for alternative mitigation "while still meeting security objectives," with NERC directed to maintain oversight and consistency. Those criteria and reporting obligations are work the order assigns to NERC rather than work it completes. How NERC builds them will largely determine whether the exception regime becomes a manageable relief valve or a blind spot.

Approval is not enforcement

One more gap sits between the headlines and the grid. Order No. 919 took effect on May 26, 2026, but that is the effective date of the commission's action, not the day utilities must comply. The standards carry staggered implementation plans, and Morgan Lewis advises clients that the revised requirements "will not become enforceable for several years." Resilience gains and risk expansion are therefore both paced by the same slow machinery of implementation calendars, capital budgets, and audit cycles. The framework exists on paper; the field changes later.

The next wave is already visible. NERC's Project 2023-09 on risk management for third-party cloud services has drafted a proposed CIP-002-9 plus four new standards, CIP-102-1, CIP-103-1, CIP-105-1, and CIP-113-1, with an informal comment period that closed August 21, 2026. Its stated purpose mirrors the virtualization posture: allow, but not require, cloud services for CIP-regulated systems. Virtualization, in other words, is the bridge between the device-based rulebook and a future in which grid computing increasingly runs on infrastructure someone else owns.

So which grows faster?

The evidence supports a conditional answer rather than a verdict.

On the resilience side, the gains are mature, immediate, and newly permitted. Workload mobility, rapid restoration, and workload-level security controls are properties a utility gets from a well-built virtualized environment from day one, and the revised standards deliberately attach compliance work to adoption: personnel controls under CIP-004, logical perimeters under CIP-005, virtualization-layer security management under CIP-007, dynamic baselines under CIP-010, and supply chain oversight under CIP-013 that more clearly covers vendor-supported shared platforms.

On the risk side, exposure scales with three things: how well each entity isolates its management plane, whether the "per system capability" exception stays visible through the reporting NERC has been ordered to create, and how fast the long tail of smaller utilities can absorb baselines that are only now arriving. Because adoption is voluntary and enforceability is years away, both sides of the ledger will grow slowly. That buys time. Whether the time is used well is the open question.

The March action did not make the grid virtual. Operators have been virtualizing for years, inside a rulebook that could not see what they were doing. What changed is that the rules stopped pretending otherwise, paired flexibility for the most capable utilities with a floor for the least protected ones, and put the burden of proof, in the form of criteria and mandatory reporting, on the exceptions in between. Whether virtualization makes the bulk-power system stronger rather than simply bigger to attack will be decided less by the technology than by that unfinished oversight work, and by the least-resourced utility now holding a new rulebook.

Sources/References

• Federal Energy Regulatory Commission, "Order No. 919; Virtualization Reliability Standards," Federal Register, Vol. 91, No. 56, pp. 13957-13965, March 24, 2026 (Docket No. RM24-8-000).
• Federal Energy Regulatory Commission, "Virtualization Reliability Standards" (Notice of Proposed Rulemaking), 90 FR 45679, September 23, 2025.
• Federal Energy Regulatory Commission, "FERC Action: New Reliability Safeguards for American Power Grid" (news release, March 2026).
• NERC Project 2016-02 Standards Drafting Team, "Virtualization and Future Technologies: The Case for Change" (white paper, April 2019; views of the drafting team, not endorsed by NERC).
• North American Electric Reliability Corporation, "Project 2023-09 Risk Management for Third-Party Cloud Services" (project page, accessed September 2026).
• Morgan, Lewis & Bockius, "Virtualization in the CIP Environment: Preparing for Compliance After FERC Order No. 919," July 7, 2026.
• Information Trust Institute, University of Illinois Urbana-Champaign (CREDC), "Cyber Resilience Metrics for Bulk Power Systems."
• CISA and FBI, "#StopRansomware: ESXiArgs Ransomware," Joint Cybersecurity Advisory AA23-039A, February 2023.