Welcome to The Calibre Brief, a Calibre Code USA production.

The electric grid increasingly relies on software that can move between machines. Regulators have changed the rules, but shared systems may change the risks.

Picture a control application restored from a known-good virtual-machine image after its server fails. It no longer belongs to one labeled box in one rack. Yet cybersecurity rules were built around physical hardware and fixed boundaries. Grid computing had begun to change beneath that model, creating a compliance problem before it became a policy change.

In March 2026, FERC approved Order 919, revising eleven CIP standards to accommodate virtualization. The order does not tell utilities to virtualize. It recognizes virtual cyber assets, shared infrastructure, and logical security boundaries. That lets a control workload restart on healthy hardware and supports tighter workload-level separation, often called microsegmentation.

That recovery promise carries a concentrated risk. A hypervisor console controls many virtual workloads on shared hardware. A compromise could reach beyond one machine. The 2023 ESXiArgs ransomware campaign encrypted thousands of VMware ESXi hypervisors worldwide after exploiting a vulnerability with an available fix. This shows risk, not a grid attack. FERC adopted a per system capability exception, but NERC must create criteria and mandatory reporting.

Approval is only the start. The standards took effect May 26, but their requirements will become enforceable in stages over several years. Secure virtualization demands architecture, patching, isolated management systems, monitoring, and skilled staff. Larger utilities may have more capacity for that work than smaller municipal or cooperative systems, leaving uneven protection across the grid.

FERC did not make the grid virtual. It admitted that virtual operations had outgrown a hardware-only rulebook. Now accountability must follow the shared infrastructure too.

At The Calibre Brief from Calibre Code USA, should utilities self-document cybersecurity exceptions, or report each one promptly to an external reliability authority? Comment below, like and subscribe on YouTube, and follow the podcast.