NERC Obligations for Federally Funded Generation Assets

Foreword

Foreword

The energy industry has not yet absorbed one of the most consequential developments of the Infrastructure Investment and Jobs Act and Inflation Reduction Act era. New generation assets are being financed at scale by entities that have never carried NERC compliance obligations. Federal grants are flowing to municipal utilities, electric cooperatives, tribal utilities, and developers that historically operated below NERC's Bulk Electric System thresholds or sat behind utility off-takers that absorbed the registration burden. Some of these new assets will be connected to the Bulk Electric System. Some will trigger registration as Generator Owners and Generator Operators. Some will carry CIP obligations the recipient was not prepared to administer. The federal grant discipline and the NERC discipline run in parallel on the same assets, with different agencies and different consequences. Neither regime accommodates the other. Both apply.

This is the eighth reference in the Energy Compliance, Inc. Grant Funding Series and the fourth of the long-form authority whitepapers. The audience is the people responsible for both halves of this intersection: the grants administrator at a public power utility planning a federally funded generation addition; the development VP at a community choice aggregator preparing to take title to BES-connected solar; the chief compliance officer at an electric cooperative who registered for the first time because a federally funded battery project pushed the entity over the threshold; the energy office director at a state agency whose grant flows to subrecipients that may unknowingly trigger NERC obligations.

Thirty years inside the energy regulatory and operational world taught me that the most expensive compliance failures happen at the seams between regimes. Each regime is internally coherent. Each has its own standards, its own examination process, its own enforcement record. At the seam, where two regimes apply to the same facility, the failure pattern repeats. The entity treats the familiar regime carefully and treats the unfamiliar one as someone else's problem. Grant recipients new to NERC assume the consulting engineer will handle the NERC obligations. NERC-registered entities new to federal grants assume the grants team will figure out the award. Both assumptions end the same way. The federal auditor finds the NERC gap, the NERC auditor finds the grant gap, and the entity pays twice.

This reference walks through the intersection. It assumes you know one regime reasonably well and the other less well. The chapters run from NERC registration triggers and BES classification through CIP, PRC, FAC and EOP-012 obligations to a documentation architecture and audit coordination that serve both regimes.

This reference is a bridge document between two regulatory communities that now operate on the same assets and need to learn to coordinate. Energy Compliance, Inc. works at this intersection, and the substance below is the substance of that work.

Rob Smith

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

A federal grant does not exempt a generation project from NERC, and NERC registration does not wait for the grant to close. When a funded asset meets the registration criteria, both regimes apply at once, with different examiners, timelines, and consequences. The recipient is the only party positioned to integrate them.

The core points of this reference:

• Registration follows the asset, not the funding. Generating resources connected at 100 kV or above with more than 20 MVA individual or 75 MVA aggregate gross nameplate are BES under Inclusion I2, and dispersed resources such as solar, wind and storage plants that aggregate above 75 MVA to a 100 kV or higher common point are BES under Inclusion I4 (Chapter 2).
• The threshold dropped for inverter-based plants. Since Revision 8 of the Registry Criteria took effect on June 27, 2024, owners and operators of non-BES inverter-based resources of 20 MVA or more aggregate, connected at 60 kV or above, register as Category 2 Generator Owners and Generator Operators. NERC listed them on the Compliance Registry effective May 15, 2026 (Chapter 1).
• Ride-through moved. FERC Order No. 909 approved PRC-029-1, which set ride-through requirements for inverter-based resources, and PRC-024-4, which now covers synchronous units, type 1 and type 2 wind, and synchronous condensers. PRC-029-2 replaced PRC-029-1 effective October 1, 2026 (Chapter 5).
• Cold weather is EOP-012, not EOP-011. Generator cold weather preparedness now sits in EOP-012-3, effective October 1, 2025. Units entering commercial operation on or after October 1, 2027 must meet the new-unit freeze protection requirement or declare a constraint (Chapter 7).
• Most funded generation is low impact for CIP. Low impact obligations live in CIP-003-9, which added vendor electronic remote access controls effective April 1, 2026. The medium impact criteria for generation turn on 1,500 MW thresholds or designations by the planner or Reliability Coordinator (Chapter 4).
• The federal side has its own clock. The single audit threshold is $1,000,000 in federal expenditures under 2 CFR 200.501, and DOE applies the same $1,000,000 threshold to for-profit recipients through a class deviation. Grant records are kept three years from the final financial report under 2 CFR 200.334, while NERC evidence retention is set standard by standard (Chapters 9 and 10).
• Build one register, not two. A single integrated compliance register, a coordinated calendar, a named integrated lead, and documents tagged to the requirements they satisfy in both regimes carry most of the load (Chapters 8, 9 and 11).

Chapter 1

When a Federally Funded Project Triggers NERC Registration

The first move this reference asks you to make is to accept that federal grant funding does not exempt a project from NERC registration, and that NERC registration does not pause for grant administration. The two regimes apply concurrently once a funded asset meets the registration criteria. A grants team that has built the post-award backbone described in EC-WP-905 has done excellent work on the federal side. That work does not satisfy NERC. Meanwhile, the reliability compliance team that runs the entity's existing NERC program may have no visibility into the new asset, because it came in through the grants channel. The trigger has to be identified when it occurs, not after the asset is energized and the Regional Entity comes asking.

1.1 The Registration Concept

NERC registers the owners, operators, and users of the Bulk Power System that meet the Statement of Compliance Registry Criteria, Appendix 5B to the NERC Rules of Procedure (Revision 8, effective June 27, 2024). For generation, the criteria rely on the Bulk Electric System definition in the NERC Glossary of Terms and in Appendix 2 to the Rules of Procedure. That definition sets a 100 kV baseline and then applies a list of inclusions and exclusions, which Chapter 2 walks through. Elements can also be included or excluded case by case through the BES exception procedure in Section 509 and Appendix 5C of the Rules of Procedure.

Registration is functional. An entity registers for every function it performs. The function types in Appendix 5B are Balancing Authority, Distribution Provider (including the UFLS-Only Distribution Provider), Frequency Response Sharing Group, Generator Operator, Generator Owner, Planning Authority/Planning Coordinator, Reliability Coordinator, Regulation Reserve Sharing Group, Reserve Sharing Group, Resource Planner, Transmission Owner, Transmission Operator, Transmission Planner, and Transmission Service Provider. Each function carries its own set of applicable Reliability Standards.

A new federally funded generation asset usually means Generator Owner registration for the entity that owns and maintains it and Generator Operator registration for the entity that operates it. Often that is the same entity.

1.2 The Thresholds for Generation

Two BES inclusions do most of the work for funded generation: Inclusion I2 for conventional generating units and Inclusion I4 for dispersed resources. Chapter 2 sets out both tests in full. Most utility-scale solar, wind and battery projects are dispersed resources, so I4 is usually the inclusion that matters. Exclusions also apply. A radial system that only includes generation not identified in I2, I3 or I4, with an aggregate capacity of 75 MVA or less, is excluded under E1.

Federal energy grants fund generation across a wide range of sizes. Some projects are clearly below the thresholds and some are clearly above. A meaningful number sit near them, where the configuration, the point of interconnection, or an exception request decides the answer. Recipients that did not evaluate the threshold during application development tend to find out when the interconnection studies finish and the configuration is locked.

Update, October 2026: Category 2 Generator Owners and Operators Revision 8 of Appendix 5B added Category 2 Generator Owners and Generator Operators: entities that own or operate non-BES inverter-based generating resources that have or contribute to an aggregate nameplate capacity of 20 MVA or more, connected through a system designed primarily for delivering that capacity to a common point of connection at 60 kV or above. Regional Entities processed these registrations in batches from August 2025 through April 2026, and NERC listed Category 2 entities on the Compliance Registry effective May 15, 2026. NERC's GO/GOP compliance dates document (Revision 1.5, August 2026) shows May 15, 2026 compliance dates for Category 2 IBRs under BAL-001-TRE, IRO-010-5, MOD-032-2, PRC-012-2, PRC-017-1, TOP-003-6.1, VAR-001-5 and VAR-002-4.1. PRC-029-2 and PRC-030-1 name non-BES IBRs at this threshold in their own applicability. The CIP and EOP standards are listed as requiring modification before they apply to Category 2. A funded 30 MVA inverter-based solar plant delivering to a 69 kV common point, which would never have been BES, now brings its owner and operator onto the Compliance Registry as Category 2 entities.

1.3 When the Trigger Occurs in the Project Lifecycle

Registration is something you do ahead of operation, not after. The obligations, meanwhile, build up during construction and interconnection. The interconnection agreement with the host transmission provider references the obligations the new asset will carry. The interconnection studies set the technical parameters for operation. Protection settings, ride-through capability, and telemetry to the host operator are all specified during the interconnection process.

The entity that will register has to build its compliance program before the asset goes into service. A program built after energization starts life with gaps, and the first audit will find them. The grant timeline and the NERC timeline need to be coordinated from the start of construction.

1.4 Identifying the Trigger Early

My recommended practice is simple. The grants team flags every application that involves potentially BES-connected or Category 2 generation as needing a NERC compliance evaluation during application development. The evaluation answers four questions: will the project trigger registration, which functions apply, which obligations attach, and what will those obligations cost. The answers feed the application's management plan and budget.

Projects that skip this step usually meet the NERC implications during interconnection studies. By then the engineering and procurement choices are made. Some of those choices affected the registration trigger or the compliance scope and can no longer be changed. The compliance program has to be fitted around the configuration instead of informing it, and cost and complexity rise.

1.5 Recipients New to NERC

Some federally funded projects are owned by entities with no NERC registration history: municipal utilities that previously took service from a larger utility, cooperatives whose generation sat below the thresholds, tribal utilities developing first-of-kind generation, and community choice aggregators acquiring generation directly. Each may be meeting NERC registration for the first time.

The learning curve for these entities is steep. They have to establish a compliance organization, identify and qualify compliance personnel, build the documentation architecture, write operating procedures, train operators, and produce the evidence the Regional Entity will examine at the first audit. The work is substantial. Done well, it produces a sustainable program. Done poorly, it produces the first audit findings.

1.6 Recipients Already Registered

Entities that already run NERC programs have an easier path on registration and a harder one on integration. The new asset joins an existing portfolio. The program has to absorb it, update the registration, fold it into existing procedures, and keep meeting the cross-asset obligations the entity already carries.

Integration friction shows up in specific places. The new asset's technology may strain procedures written for the existing fleet, especially when an entity with synchronous units adds its first inverter-based plant. Its protection settings may interact with adjacent assets. Its telemetry has to be integrated into the entity's SCADA and energy management systems. Document the integration work, because that documentation is what supports the asset's place in the entity's compliance posture.

The registration trigger depends on classification. Chapter 2 walks through the BES analysis in detail.

Chapter 2

BPS Connectivity and BES Classification for Funded Assets

The BES definition determines whether a generation asset is subject to the NERC Reliability Standards that apply to BES Facilities. The definition appears in the NERC Glossary of Terms and in Appendix 2 to the Rules of Procedure, and its application is not always obvious. Federal grant recipients building new generation have to work the classification question with the care the definition demands. The answer drives the registration decision, the applicable standards, and the scope of the compliance program. Get it wrong in one direction and you miss a trigger. Get it wrong in the other and you build a program for an asset that does not need one.

2.1 The Core Elements

The core definition covers all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher, excluding facilities used in the local distribution of electric energy. The inclusions then add specific categories: transformers with the primary terminal and at least one secondary terminal at 100 kV or higher (I1), generating resources (I2), Blackstart Resources identified in the Transmission Operator's restoration plan (I3), dispersed power producing resources (I4), and static or dynamic reactive devices connected at 100 kV or higher (I5). The exclusions carve out radial systems (E1), behind-the-meter generation serving retail load (E2), local networks (E3), and reactive devices installed for the sole benefit of a retail customer (E4).

2.2 Generation Inclusions

For a conventional plant, Inclusion I2 applies: units connected at 100 kV or above with gross individual nameplate above 20 MVA, or a plant with gross aggregate nameplate above 75 MVA. The BES portion runs from the generator terminals through the high side of the step-up transformer.

For a solar, wind or battery plant built from many small units, Inclusion I4 applies. The test is aggregate gross nameplate above 75 MVA delivered through a system designed primarily for that purpose to a common point of connection at 100 kV or above. The individual resources are BES, and so is the collector system from the point where the resources aggregate above 75 MVA to the common point of connection. The classification turns on technical facts, so work it from the one-line diagram, not from the project description in the grant application.

2.3 Inverter-Based Resources

Solar, storage and most modern wind interconnect through inverters. NERC's standards have moved toward inverter-based resources specifically, with ride-through requirements, model verification, and disturbance monitoring written for them. The most significant recent changes are PRC-029-2 for ride-through, PRC-028-1 for disturbance monitoring, PRC-030-1 for unexpected IBR event mitigation, and MOD-026-2 for model verification. Chapter 5 covers them. NERC has also issued alerts on IBR performance and modeling, including a Level 3 Essential Actions alert in May 2025.

Inverter-based resources connected at BES voltages that meet I2 or I4 are BES Facilities even though the technology differs from synchronous generation. Inverter-based resources below the BES thresholds but at or above the Category 2 threshold are registered as well. The specific obligations can differ, but the registration trigger applies either way.

2.4 Aggregation and the Collector System

Many funded projects aggregate many generating units at a common collection point. Aggregation is where classification mistakes happen. Individual inverters far below 20 MVA can add up to a plant above 75 MVA under I4, or above 20 MVA under the Category 2 criteria. The analysis requires the collector system topology, the point of interconnection, and the nameplate data for each inverter or turbine. When facilities from more than one owner share a system that delivers their combined capacity to a common point at 60 kV or above, WECC's Category 2 guidance treats all of them as Category 2 assets and requires every owner and operator to register.

Aggregation also shapes how the asset interfaces with the host system. A 100 MVA solar project with many inverter blocks and a common collector substation behaves differently from a single 100 MVA synchronous unit. The interconnection studies, protection settings and operating procedures all reflect the aggregated configuration. In your compliance program, treat the plant, its collector system and its main power transformer as one compliance object while keeping the individual inverter inventory current underneath it.

2.5 Behind-the-Meter Configurations

Some funded projects place generation behind a retail meter. Such projects may affect BES operations through net flows without the generation itself being BES. Exclusion E2 removes behind-the-meter generation serving retail load when the net capacity provided to the BES does not exceed 75 MVA and standby, back-up and maintenance power is provided by a Balancing Authority, under a binding obligation with a Generator Owner or Generator Operator, or under terms approved by the applicable regulatory authority. Check each condition against your configuration.

Aggregations of distributed resources that are dispatched together do not fit neatly into either inclusion. If your project is one, get the Regional Entity's view in writing before you finalize the design.

2.6 Storage Facilities

Storage raises its own classification questions because it acts as both load and generation. Classify it against the same inclusions as generation, using gross nameplate. Where storage is paired with generation at a common point of interconnection, the nameplate math for the hybrid plant can push a site over the 75 MVA or 20 MVA line even when neither component would cross it alone. Confirm the treatment of your configuration with the Regional Entity. Storage operations also introduce considerations that conventional generation does not, such as state of charge and charging behavior during system events, so the compliance program addresses storage specifically.

2.7 The BES Exception Process

Section 509 and Appendix 5C of the Rules of Procedure set out the procedure for requesting an exception from the BES definition: either excluding an Element the definition would include or including one it would exclude. The request goes to the Regional Entity, which evaluates it and sends a recommendation to NERC for decision. The procedure requires specified supporting information and technical analysis. Appendix 5A also requires an entity to start the BES exception process before it seeks a registration change on that basis.

The exception process is not routine. Most classifications resolve by applying the definition. The process exists for facts at the edges of the definition, where the standard application produces a result inconsistent with the reliability considerations behind it. If you are considering an exception request, talk to the Regional Entity early about the process and the documentation it expects.

2.8 Documenting the Classification Decision

Write the classification analysis down. Identify the asset, the operating voltage, the gross nameplate of each unit and of the plant, the aggregation configuration, the technology type, and the specific inclusions and exclusions applied. Reference the interconnection studies, the engineering design documents, and any communications with NERC, the Regional Entity, or the host transmission provider on the classification.

That document supports the registration decision and belongs in the compliance program file. The first audit may examine it. A classification reached without supporting analysis is itself a weakness an auditor will notice.

Chapter 3

Registration Pathways and the Functional Model (GO, GOP, TO, TOP, RC, BA, DP)

The NERC functional model sorts registered entities by the functions they perform, and each function carries its own applicable standards. A federally funded generation asset typically triggers the Generator Owner and Generator Operator functions for the entity that owns and operates it. Larger or more complex projects can trigger others.

3.1 Generator Owner

Appendix 5B defines the Generator Owner as the entity that owns and maintains generating Facilities (Category 1 GO), or that owns and maintains non-BES inverter-based generating resources meeting the 20 MVA and 60 kV criteria (Category 2 GO). Generator Owner obligations center on design, maintenance, and configuration: the PRC standards for protection systems and ride-through, the FAC standards for facility ratings and interconnection, MOD standards for model data and verification, and, for BES assets, the CIP standards for cyber security.

A grant recipient that owns federally funded BES-connected or Category 2 generation registers as a Generator Owner. The registration identifies the entity and its functions, and the Regional Entity uses it to drive compliance monitoring across the applicable standards.

3.2 Generator Operator

The Generator Operator is the entity that operates generating Facilities and performs the functions of supplying energy and Interconnected Operations Services (Category 1 GOP), or that operates non-BES inverter-based generating resources meeting the Category 2 criteria (Category 2 GOP). Generator Operator obligations are operational: communication and coordination with the host Reliability Coordinator, Balancing Authority and Transmission Operator, data provision, response to system events, and the operational standards in the COM, EOP, IRO, TOP and VAR families that apply to the function.

In many funded projects the recipient is both owner and operator. Where a third-party operator runs the asset under a service agreement, the functions can separate. Separating them by contract does not move the regulatory obligation on its own. Appendix 5B provides that an entity will not be registered for responsibilities transferred by written agreement to another entity registered for the appropriate function, and Sections 507 and 508 of the Rules of Procedure provide the Joint Registration Organization and Coordinated Functional Registration structures for allocating compliance responsibility. Where no Generator Operator has been named, WECC's Category 2 guidance has the Generator Owner register as both until that changes.

3.3 Transmission Owner and Transmission Operator

Most funded generation does not trigger Transmission Owner or Transmission Operator registration, because the recipient does not own or operate transmission. Some projects, however, include substations, collector lines or tie lines that may be classified as transmission. Facilities treated as part of the generating facility are usually covered under the Generator Owner registration. Facilities classified as transmission Elements of the BES can require Transmission Owner registration.

If your project includes substantial new substation or interconnection facilities, analyze the classification of those facilities specifically. The answer sets the registration scope and the applicable standards.

3.4 Reliability Coordinator and Balancing Authority

Funded generation projects do not typically trigger Reliability Coordinator or Balancing Authority registration. Those functions are performed by entities coordinating operations across large footprints, and the funded asset operates inside an existing footprint. Its Generator Operator coordinates with the host Reliability Coordinator and Balancing Authority through the normal mechanisms. Entities that already perform those functions absorb the new asset into their existing footprint and program. Note that a new Reliability Coordinator, Transmission Operator or Balancing Authority must also be certified, not just registered, under Appendix 5A.

3.5 Distribution Provider

Appendix 5B describes the Distribution Provider as the entity that provides and operates the wires between the transmission system and the end-use customer, and sets specific registration criteria for it, including a system serving more than 75 MW of peak load directly connected to the BES and ownership of certain protection systems. A funded project that includes distribution investments should check those criteria. The UFLS-Only Distribution Provider category applies to entities whose only qualifying assets are underfrequency load shedding protection systems.

3.6 Planning Coordination

The Planning Coordinator, Transmission Planner and Resource Planner functions belong to entities that plan the system. New generation does not usually trigger those registrations, but it creates data obligations toward them. The Generator Owner provides modeling data under MOD-032 and verifies its dynamic models under MOD-026-2, which took effect April 1, 2026 and retired MOD-026-1 and MOD-027-1. MOD-032-2 is also one of the standards with a May 15, 2026 compliance date for Category 2 IBRs.

3.7 Registration Mechanics

Under Appendix 5A, an entity starts registration by submitting a completed registration application to the Regional Entity for each region where it performs or intends to perform its functions. NERC assigns a NERC ID if the entity does not have one, and an entity performing more than one function uses a single NERC ID. The Regional Entity evaluates the submission and asks for corrections if it is incomplete. For the Category 2 initiative, WECC asked entities to submit an asset verification form, the interconnection agreement, operating or third-party agreements, operating one-line diagrams to the point of interconnection, and nameplate data for each inverter or turbine through a secure channel such as an extranet or CORES.

Registration is not something you can postpone until it is convenient. Appendix 5A allows a Regional Entity, NERC, or an Applicable Governmental Authority to initiate the registration process itself. Disputes about whether an entity meets the criteria go to a NERC-led Registration Review Panel. Start the application before commercial operation.

3.8 Coordination With the Host Transmission Provider

The funded asset interconnects with a host transmission provider that is itself registered as a Transmission Owner and usually a Transmission Operator. The host's interconnection process produces the technical parameters that govern the asset's operation. The host's compliance program covers the host's facilities, and the new asset's program covers the asset. The two meet at the point of interconnection.

The interface includes data exchange, protection coordination, voltage and frequency support, outage coordination, and incident response. Document each element in the interconnection agreement and in the operating procedures both parties maintain. Misalignment at the interface creates compliance gaps for one or both entities.

Chapter 4

CIP Applicability for Funded BPS Assets

The Critical Infrastructure Protection standards govern cyber security for BES Cyber Systems. The family now runs from CIP-002 through CIP-015 and covers categorization, security management controls, personnel and training, electronic security perimeters, physical security of BES Cyber Systems, system security management, incident reporting and response planning, recovery plans, configuration change management and vulnerability assessments, information protection, communications between Control Centers, supply chain risk management, physical security of certain transmission stations and substations, and, since FERC Order No. 907 approved CIP-015-1 in June 2025, internal network security monitoring. Funded generation that is BES carries CIP obligations that need to be designed in, not bolted on.

Two scope points come first. CIP applies to BES Cyber Systems, so the question begins with BES classification. And NERC's GO/GOP compliance dates document lists the CIP standards as requiring modification before they apply to Category 2 inverter-based resources, so a Category 2 asset that is not BES carries no CIP compliance date today. Watch for that to change.

4.1 CIP-002 Categorization

CIP-002 requires the Responsible Entity to identify its BES Cyber Systems and categorize them as high, medium, or low impact using the criteria in Attachment 1. The categorization drives which requirements in the rest of the family apply.

For generation, the medium impact criteria are specific. Criterion 2.1 covers commissioned generation at a single plant location with an aggregate highest rated net Real Power capability over the preceding 12 months of 1,500 MW or more in a single Interconnection, limited to shared systems that could, within 15 minutes, adversely affect units totaling 1,500 MW or more. Criterion 2.3 covers generation the Planning Coordinator or Transmission Planner designates as necessary to avoid an Adverse Reliability Impact. Criterion 2.6 covers generation identified as critical to the derivation of Interconnection Reliability Operating Limits. Criterion 2.11 covers Control Centers used to perform Generator Operator functions for 1,500 MW or more in a single Interconnection. Generation resources that meet no high or medium impact criterion fall to low impact under criterion 3.3.

Most federally funded generation will be low impact. The exception to watch is a central operations center that controls a growing portfolio of funded and unfunded sites: once the Generator Operator Control Center reaches 1,500 MW in one Interconnection, criterion 2.11 makes it medium impact.

FERC approved CIP-002-8 in March 2026 (Docket RD25-8-000), revising medium impact criterion 2.12 to cover Control Centers that Transmission Operators operate or Transmission Owners own, with a 6,000 aggregate weighted value threshold, revising the Control Center definition, and retiring CIP-002-7. Check the implementation plan for the date that applies to you.

Perform the CIP-002 categorization during design and document it. The documentation supports the program scope and identifies the applicable requirements.

4.2 Identifying BES Cyber Systems

The CIP-002 analysis requires an inventory of the programmable electronic devices that perform reliability functions for the asset: plant controllers, SCADA components, protective relays with programmable interfaces, communication systems supporting reliability functions, and similar devices. For new generation, the inventory takes shape during engineering design, as the generation control system, plant communications and protective relaying are procured. The compliance program captures that inventory and applies the categorization.

4.3 Low Impact Obligations Under CIP-003-9

Low impact obligations are set by CIP-003, now at CIP-003-9. The Responsible Entity documents cyber security policies and implements the elements in Attachment 1:

• Section 1, cyber security awareness.
• Section 2, physical security controls.
• Section 3, electronic access controls, permitting only necessary inbound and outbound routable access and authenticating dial-up connectivity.
• Section 4, Cyber Security Incident response, including a plan, a process for determining whether an incident is reportable and notifying the E-ISAC, a test at least once every 36 calendar months, and updates within 180 calendar days of a test or actual incident.
• Section 5, Transient Cyber Asset and Removable Media malicious code risk mitigation.
• Section 6, vendor electronic remote access, with methods to determine, disable, and detect malicious communications in vendor remote access. CIP-003-9 took effect April 1, 2026.

Low impact obligations are real, but they are narrower than medium and high. The program documents the policies, controls, awareness, and incident response, and the Regional Entity examines them through audits, spot checks and self-certifications.

4.4 Medium and High Impact Considerations

A funded project that meets a medium impact criterion takes on a much larger set of obligations: electronic security perimeters, personnel risk assessments and access management, configuration baselines and change management, vulnerability assessments, security event monitoring, information protection, supply chain risk management, and, where external routable connectivity exists, internal network security monitoring under CIP-015-1. The implementation requires real technical and process investment.

If a project may meet a medium impact criterion, deal with categorization early in design. Control system architecture choices can decide whether the categorization stays low or moves to medium, and the cost difference is large enough to justify the analysis.

4.5 Supply Chain Risk Management

CIP-013-2 requires a documented supply chain cyber security risk management plan for high and medium impact BES Cyber Systems, covering the procurement and supplier security topics the standard lists. It does not apply to low impact systems.

Suppliers are not NERC-registered entities, so the obligation runs to you, not to them. Your procurement contracts are how you obtain the vendor notifications, coordination and disclosures your plan requires. CIP-003-9 Section 6 still governs vendor remote access, and the federal procurement standards in 2 CFR 200.317 through 200.327 still govern the purchase. Capture the supply chain documentation in the same procurement file.

4.6 Incident Response and Reporting

For high and medium impact systems, CIP-008-6 requires a Cyber Security Incident response plan and notification of the E-ISAC and, for U.S. entities, the National Cybersecurity and Communications Integration Center or its successor. Initial notification is due within one hour of determining that a Reportable Cyber Security Incident occurred and by the end of the next calendar day after determining that an incident was an attempt to compromise an applicable system, with updates within seven calendar days of new information. For low impact assets, the incident response obligations are in CIP-003-9 Attachment 1, Section 4, described above.

Either way, fold the new asset's systems into the entity's overall incident response framework and exercise the plan through drills or tabletops on the required cycle.

4.7 Information Protection, Personnel and Access

CIP-011 governs BES Cyber System Information, and CIP-004 governs personnel risk assessment, training, access management and revocation. Both apply to high and medium impact systems. For a low impact asset they do not apply as such, but the same discipline is good practice for protection settings, network diagrams and control system documentation.

Where they do apply, note the overlap with grant records. A federal grant file that contains engineering drawings, protection settings or network configurations may hold BCSI. Handle those records so they satisfy both the federal records rules and the CIP information protection program.

Chapter 5

The PRC Family for Funded Generation (PRC-024, PRC-029, PRC-019, PRC-005)

The Protection and Control standards govern the protection systems that detect and clear faults and the behavior of generating resources during system disturbances. For new generation, the most consequential are the ride-through standards (PRC-024-4 for synchronous units and PRC-029-2 for inverter-based resources), PRC-019 for coordination of voltage controls and protection, and PRC-005 for protection system maintenance. PRC-028-1 and PRC-030-1 now add disturbance monitoring and event mitigation for inverter-based plants. A funded asset must meet these from commercial operation forward, and the technical work that establishes compliance happens during design and commissioning.

Update, October 2026: Ride-Through Split by Technology

FERC Order No. 909 (Docket RM25-3-000, published July 29, 2025) approved PRC-029-1, Frequency and Voltage Ride-through Requirements for Inverter-Based Resources, and PRC-024-4, which drops inverter-based resources from its scope and retires PRC-024-3. PRC-029-2 replaced PRC-029-1 effective October 1, 2026. PRC-029-2 applies to Generator Owners of BES IBRs and of non-BES IBRs meeting the Category 2 threshold, and it allows a limited exemption for existing IBRs with documented hardware limitations. WECC's implementation timeline shows exemption requests due October 1, 2027. Category 2 Generator Owners should confirm their own dates in the PRC-029-2 implementation plan.

5.1 PRC-024-4 for Synchronous Generation

PRC-024-4 applies to frequency, voltage and volts-per-hertz protection on synchronous generators, their step-up transformers, the high side of unit auxiliary transformers, type 1 and type 2 wind resources, and synchronous condensers. Its purpose is to ensure that protection does not cause tripping during defined frequency and voltage excursions. It is a settings standard: the Generator Owner sets protection so it does not trip inside the no-trip zones the standard defines.

For a synchronous unit, the protection coordination study confirms that the protection will not trip the unit during excursions inside those zones. Document the settings, the analysis behind them, and the commissioning verification.

5.2 PRC-029-2 for Inverter-Based Resources

PRC-029-2 goes further than PRC-024 did for inverters. It requires the Generator Owner to ensure that the design and operation of each IBR adheres to frequency and voltage ride-through requirements, so the plant stays connected and avoids tripping or momentary cessation during disturbances. Compliance depends on both the inverter's capability and the plant's protection and control settings.

For a funded IBR project now in design, that means writing the PRC-029-2 ride-through performance into the inverter and plant controller specifications, verifying it at commissioning, and keeping the evidence. Disturbance monitoring under PRC-028-1 supplies the data that shows how the plant actually performed, and PRC-030-1 requires the Generator Owner to analyze and mitigate unexpected IBR events. Procurement documentation for the inverters belongs in both the grant file and the NERC file.

5.3 PRC-019 Coordination of Voltage Controls and Protection

PRC-019-2 requires Generator Owners and Transmission Owners to coordinate generating unit voltage regulating controls, limit functions, equipment capabilities and protection system settings. The coordination keeps voltage regulation from pushing the unit into protective relay operation under normal conditions, and keeps protection from interfering with the voltage support the system needs.

The coordination is verified at a maximum of every five calendar years under Requirement R1, and within 90 calendar days after identifying or implementing systems, equipment or setting changes that affect it under Requirement R2. For a synchronous unit, the analysis looks at the interaction among the voltage regulator settings, field forcing limits, over- and under-excitation limiters, volts-per-hertz protection, loss-of-field protection and the other applicable elements. For an inverter-based plant, it covers the inverters' voltage and reactive power controls, the inverter protection settings, and plant-level control. The details differ, but the principle is the same. Perform it during commissioning and document the result.

5.4 PRC-005 Protection System Maintenance

PRC-005-6 requires a Protection System Maintenance Program covering Protection Systems, Automatic Reclosing and Sudden Pressure Relaying, with maintenance intervals and activities defined by component type. Some components can go long intervals. Others need more frequent attention.

For new funded generation, establish the maintenance program before commercial operation. It identifies the applicable components, the intervals, the procedures, the responsible personnel, and the documentation. The first maintenance cycle runs on the standard's intervals after commercial operation, with results documented and kept.

The program runs for the life of the asset. The grant may pay for the initial protection system installation, but the maintenance is the Generator Owner's obligation under PRC-005 for as long as the asset operates. Mind the evidence retention section too. PRC-005-6 requires the current program document and superseded versions since the last audit. Where a maintenance interval is longer than the audit cycle, keep the most recent performance; where it is shorter, keep every performance since the previous scheduled audit.

5.5 Coordinating PRC With the Grant

The PRC obligations operate independently of the federal award. The grant did not relax them, and they do not adjust for the grant. The recipient operates under both.

There are coordination points. Grant funds that pay for protection equipment are subject to the cost principles. The procurement of that equipment is subject to the federal procurement standards. The installation and commissioning records support both grant compliance and NERC compliance. The documentation architecture in EC-WP-905 can carry the NERC PRC documentation: the settings files, coordination studies, commissioning records and maintenance procedures become part of one integrated compliance file.

Chapter 6

FAC Standards and Interconnection Compliance

The Facilities standards govern interconnection requirements, interconnection studies, facility ratings, vegetation management, and the System Operating Limit framework. For new generation, the relevant standards are FAC-001 for facility interconnection requirements, FAC-002 for interconnection studies, FAC-003 for vegetation management on certain generator lines, FAC-008 for facility ratings, and FAC-011 and FAC-014 for System Operating Limits. Together they define the technical interface with the host system.

6.1 FAC-001 Facility Interconnection Requirements

FAC-001-4 requires each Transmission Owner to document its facility interconnection requirements, keep them current, and make them available on request. It also applies to a Generator Owner that has agreed to a study of a third party interconnecting to its existing facility. The Transmission Owner's requirements must include procedures for coordinated studies, for notifying those responsible for affected systems, and for confirming that new facilities are within a Balancing Authority Area.

For federally funded generation, the host's requirements drive interconnection design and operation. Review them, design the asset to satisfy them, and document how you did. The interconnection agreement memorializes how they apply to your project.

6.2 FAC-002 Interconnection Studies

FAC-002-4 requires the Transmission Planner and Planning Coordinator to study the reliability impact of interconnecting new generation, and requires each Generator Owner seeking to interconnect to coordinate and cooperate on those studies, including by providing data. The studies evaluate the new facility's steady-state, short-circuit and dynamic effects and identify needed upgrades and operating considerations.

The study process itself is set by the transmission provider's tariff. FERC Order No. 2023, issued July 28, 2023, replaced the serial, first-come, first-served process with a first-ready, first-served cluster study process: a cluster study, cluster restudies where needed, and a facilities study before the interconnection agreement. Order No. 2023 also tightened modeling data requirements for non-synchronous generators and introduced ride-through capability requirements after interconnection. The studies inform the interconnection agreement, the facility ratings, the protection settings, and the operating procedures.

Grant recipients participate by providing the data the studies need, reviewing results, and resolving issues. The results shape the technical configuration and the budget. Network upgrades identified in the studies can carry costs large enough to change the project's economics.

6.3 FAC-008 Facility Ratings

FAC-008-5 requires each Generator Owner to have documentation for determining the Facility Ratings of its generating facilities, from the generator terminals to the high side of the main step-up transformer, and to establish ratings consistent with that methodology. Accurate ratings matter because the system is operated within them, and operating outside them risks equipment damage and cascading problems.

Generator ratings reflect the actual capability of the equipment, the manufacturer's data, and any operating limitations. Provide them to the host Transmission Operator and the other entities that use them. Update them when equipment or limitations change, and track the conditions that would require an update.

6.4 FAC-003 Vegetation Management

FAC-003-5 applies to Generator Owners for overhead lines that extend more than one mile (1.609 km) beyond the fenced area of the generating station switchyard to the point of interconnection with the Transmission Owner, or that lack a clear line of sight from the switchyard fence to that point, and that operate at 200 kV or higher, have been identified by the Planning Coordinator or Transmission Planner as critical, or operate below 200 kV and are identified by WECC as an element of a Major WECC Transfer Path. Many generator tie lines will not meet those conditions. Some will.

Evaluate FAC-003 applicability for any new tie line during design. Where it applies, establish the vegetation management program before energization: inspection cycles, work plans, documentation, and coordination with landowners and right-of-way holders.

6.5 System Operating Limits

System Operating Limits are the operating boundaries the system must stay within. FAC-011 governs the Reliability Coordinator's SOL methodology, and FAC-014 governs how SOLs are established and communicated. Generation projects do not usually perform SOL analysis unless they also have transmission or planning functions. The asset contributes through its capability data, dispatch characteristics, and limitations, which feed the host's determinations, and its operation respects the SOLs set by the Reliability Coordinator and Transmission Operator.

6.6 Interconnection Agreement Provisions

The interconnection agreement memorializes the NERC compliance interface. It typically addresses facility ratings, protection settings, voltage and frequency support obligations, telemetry, outage coordination, event response, and dispute resolution. Review it for the compliance obligations it creates, carry those obligations into the program, and treat the agreement as a primary reference for the life of the asset.

6.7 Network Upgrades and Cost Allocation

Interconnection studies may identify network upgrades on the host's facilities. Who pays for them, and whether any of the payment comes back through credits or refunds, depends on the transmission provider's tariff and the interconnection agreement. The amounts can be substantial and can affect the grant budget.

If your application anticipates major upgrades, put the estimated costs in the budget and read the tariff's cost allocation terms before the budget is final. The schedule should reflect the study timeline and the upgrade construction timeline.

Chapter 7

Cold Weather Preparedness for New Generation (EOP-012)

Cold weather preparedness for generating units now sits in EOP-012, Extreme Cold Weather Preparedness and Operations. The requirements grew out of system events including the February 2021 cold weather event in Texas and the South Central United States, which FERC, NERC and Regional Entity staff reviewed in their joint report. Federally funded generation entering service now has to build cold weather preparedness into design, operations, and the compliance program from the beginning.

Update, October 2026: EOP-012-3 Replaces the EOP-011 Approach Earlier versions of this paper placed generator cold weather obligations in EOP-011. Those obligations now appear in EOP-012, which applies to Generator Owners and Generator Operators. FERC approved EOP-012-3 on September 18, 2025 (Docket RD25-7-000), effective October 1, 2025, retiring EOP-012-2. EOP-011-4 remains in force but applies to Balancing Authorities, Reliability Coordinators, Transmission Operators, and certain Distribution Providers and Transmission Owners identified in Transmission Operator plans, not to generators. NERC's GO/GOP compliance dates document lists the EOP standards as requiring modification before they apply to Category 2 IBRs.

7.1 The Standard's Scope

EOP-012-3 carries forward the freeze protection, planning, training and corrective action structure of earlier versions with modifications, and adds a periodic review requirement. As FERC's approval order describes it:

• Extreme Cold Weather Temperature. Requirement R1 clarifies how the Generator Owner calculates the unit's Extreme Cold Weather Temperature, allows judgment on missing or invalid data if the handling is documented, and carries a compliance abeyance period while NERC monitors the formula.
• New units. Under Requirement R2, units entering commercial operation on or after October 1, 2027 must meet the freeze protection measures for new generation or declare a Generator Cold Weather Constraint. The option to use a corrective action plan instead was removed.
• Corrective actions. After a Generator Cold Weather Reliability Event, the corrective action plan must be developed before the first December after the event, with fleet reviews of similar equipment within 12 months and set timelines for completing corrective actions. Extensions require approval from the Compliance Enforcement Authority.
• Constraints. Attachment 1 lists known constraints and allows case-by-case constraints. The Compliance Enforcement Authority validates each declaration, and under Requirement R9 the Generator Owner reviews validated constraints at least every 36 calendar months.

For a funded project with a 2027 or later commercial operation date, the new-unit requirement is the one that matters most. Settle it during design, when the freeze protection scope can still be specified and bought.

7.2 Cold Weather Preparedness Plans

The cold weather preparedness plan documents how the unit prepares for and operates in cold weather. It addresses freeze protection of critical components, operating protocols in cold weather, staffing, fuel considerations where they apply, maintenance, and coordination with the host operators.

For a funded project, develop the plan during design and commissioning. The engineering design specifies the freeze protection components and the winterization approach. Commissioning verifies them. The operations team trains on the plan before commercial operation.

7.3 Equipment Capability

The unit's Extreme Cold Weather Temperature and the freeze protection measures are technical and need close coordination with the equipment vendors. Specify the cold weather capability the unit must have in the procurement documents, verify it at commissioning, and document the verification. If a vendor's equipment has a known low-temperature limitation, find out before contract award whether it is a constraint you would need to declare.

7.4 Training

Personnel who implement the cold weather plan receive training on it. Cover the plan, cold weather operating procedures, early indicators of trouble, response actions, and coordination protocols. Document the training and refresh it on a set cycle. For a funded project, build the training program before commercial operation, whether operations are in house or contracted.

7.5 Inspections and Maintenance

Cold weather plans typically include pre-season inspections of freeze protection systems, checks during cold weather operation, and maintenance to correct what the inspections find. Run these within the broader plant maintenance program, with the cold weather components tracked and documented separately enough that you can produce them on request.

7.6 Fuel and Energy Availability

For fuel-burning generation, fuel supply, storage, quality and supplier coordination during constrained conditions are part of cold weather preparedness. For solar and storage, fuel security does not apply directly, but energy availability does: snow and ice on panels, battery state of charge and heating loads, and temperature limits on inverters and battery systems. The plan should reflect the asset's own energy availability profile.

7.7 Coordination With Host Operators

Cold weather operations require coordination with the host Reliability Coordinator, Balancing Authority and Transmission Operator: reporting unit availability and cold weather limitations, receiving notice of anticipated system stress, and responding to system events. Write the communication paths, reporting cadence and response expectations into the operating procedures before winter. Recipients new to NERC operations should give this relationship particular attention, because it is foundational to operating compliantly during stress events.

7.8 Documenting Cold Weather Events

When a cold weather event occurs, document the unit's response: timing, operating conditions, performance, any limitations, any incidents, and actions taken. That record supports the corrective action process under EOP-012-3, any post-event review, and any compliance examination. Under Requirement R6, that record is what the Corrective Action Plan rests on, and it is what the Compliance Enforcement Authority reviews if you need an extension.

The NERC standards are one regime. The federal award terms are another. Chapter 8 covers how they overlay on the same asset.

Chapter 8

The Dual Compliance Overlay: Federal Award Terms and NERC Reliability Standards

A federally funded BES-connected or Category 2 generation asset operates under two regimes that do not coordinate with each other and that hold the recipient responsible to both. The award terms and the Uniform Guidance govern documentation, reporting, and program compliance on the federal side. The Reliability Standards govern the reliability obligations of the registered functions. The federal side tests your records against the award terms and the cost principles, while the NERC side tests them against each standard's requirements and its Evidence Retention section. A strong program in one regime can sit next to gaps in the other. The dual compliance overlay is the framework for managing both at once.

8.1 The Two Regimes Do Not Coordinate

The awarding agency does not consult NERC on award decisions. NERC does not consult the awarding agency on enforcement. The regimes have separate statutory foundations, separate regulatory architectures, and separate enforcement traditions. The recipient is the integrating party, and its compliance program is what makes the two coherent in practice.

A federal finding on a NERC-relevant matter does not automatically reach NERC, and a NERC finding does not automatically reach the awarding agency. You cannot rely on one regime to backstop a gap in the other. Overlapping documentation helps, but each regime still has to be satisfied on its own terms.

8.2 Where the Regimes Overlap

Some areas overlap substantially:

• Procurement. Major equipment purchases under the award follow the federal procurement standards in 2 CFR 200.317 through 200.327, including the procurement record requirements of 200.318(i). For high and medium impact BES Cyber Systems, the same purchases fall under the CIP-013 supply chain plan, and for low impact assets CIP-003-9 Section 6 governs vendor remote access. One procurement record can serve both regimes if it addresses each regime's requirements explicitly.
• Personnel. Labor charged to the award must be documented under the cost principles for compensation in 2 CFR 200.430. Where CIP-004 applies, the same people need personnel risk assessments, training and access management records. The files have to satisfy both.
• Construction and commissioning. Construction records support cost reasonableness for the grant and support facility ratings, commissioning, and configuration evidence for NERC. Photographs, daily logs, commissioning test results and engineering certifications serve each regime.

8.3 Where They Do Not

Other areas belong to one regime only. Federal financial reporting under 2 CFR 200.328 and performance reporting under 200.329 are federal-only. NERC self-certifications are NERC-only. Davis-Bacon prevailing wage compliance, where the program statute requires it and the award incorporates the Appendix II clause, is federal-only, though it touches contractor coordination. CIP incident reporting to the E-ISAC is NERC-only.

These areas need dedicated attention in each regime. An entity with a strong grant program and no NERC program has unique exposure in the NERC-only areas, and the reverse is equally true. The overlay identifies the non-overlap areas and assigns each one.

8.4 The Sequencing Question

The two timelines do not line up. The federal timeline runs from award date through the period of performance, the reporting cadence, and closeout. The NERC timeline runs from registration and commercial operation through each standard's compliance dates, the audit cycle, and the life of the asset.

Sequencing takes deliberate coordination. Construction under the award may start before the NERC program is built. If the project also claims IRA tax credits, the beginning-of-construction and placed-in-service dates that matter for the credit are a third set of milestones that may or may not match the NERC registration and commercial operation dates. The grant may close out years before the asset's first NERC audit, and the NERC obligations continue long after closeout.

Capture every timeline in one compliance calendar and flag the dependencies. Schedule activities that serve both regimes once, with documentation that serves both. Schedule regime-specific activities separately.

8.5 Roles and Responsibilities

The overlay needs clear ownership. The grants administrator usually owns federal compliance, and the reliability compliance officer usually owns NERC compliance. Those two roles must coordinate. Some entities create one integrated role for federally funded BES-connected assets. Others keep separate roles with explicit coordination protocols: shared documentation systems where appropriate, joint status reviews at key milestones, escalation paths for issues that affect both regimes, and unified reporting to senior leadership and the board. The protocols prevent the gaps that open when each role works alone.

8.6 Budget Implications

Both regimes cost money. Federal compliance carries the administrative load of reporting, subrecipient monitoring, the single audit, and closeout. NERC compliance carries program operation, the audit cycle, standard-specific testing and reporting, and personnel and training.

Applications for BES-connected or Category 2 generation should reflect NERC compliance costs where the program allows: the program build, staffing or contractor support, documentation systems, and training. Check allowability under the cost principles and the program's terms. Projects that did not budget for NERC compliance discover the cost after the award, and then either absorb it elsewhere or run an under-resourced program.

8.7 Reporting to Stakeholders

Boards, lenders, insurers and rating agencies may want visibility into both regimes. Integrated reporting draws on the overlay and presents the entity's posture across both. It also supports risk management, because risks in one regime often have implications in the other. A NERC concern that affects availability may affect grant performance reporting. A grant disallowance that changes the project's financing may affect funding for the NERC program. The integrated view surfaces those connections.

The overlay needs a documentation architecture underneath it. Chapter 9 describes one.

Chapter 9

Documentation Architecture That Serves Both Regimes

The documentation architecture for a federally funded BES-connected asset combines the federal backbone described in EC-WP-905 with the NERC compliance documentation. In my judgment, the combined architecture is not twice the work of either regime alone. It is closer to one and a half times, because many documentation activities serve both regimes when they are designed to. The architecture is built around shared records where the regimes overlap and parallel records where they do not. It lives in a working register, is operated by named people, and is reviewed at coordinated milestones across the life of the asset.

9.1 The Integrated Compliance Register

The integrated compliance register extends the Compliance Obligation Matrix from EC-WP-905 to include NERC obligations alongside the federal ones. Every obligation from both regimes is captured with the same fields: obligation description, source citation, responsible owner, evidence type, evidence location, review frequency, most recent review date and outcome, next review date, and risk rating.

The register treats all obligations as one set instead of two lists. That supports cross-regime coordination, surfaces dependencies and conflicts, and produces one working document for management and board reporting.

Flag the obligations that serve both regimes. A quarterly review that satisfies a NERC operational requirement and feeds a federal performance report can be done once, with documentation that serves both. Without the flag, the same activity gets done twice.

9.2 Shared Evidence Categories

• Construction and commissioning records. Logs, photographs, test results and engineering certifications show cost reasonableness for the grant and equipment performance for the PRC and FAC standards. Keep them in one place with cross-references to each regime's requirements.
• Procurement records. The files show compliance with 2 CFR 200.317 through 200.327 and support the CIP-013 plan where it applies. They include the procurement method rationale, supplier selection, contract documents, and cost or price analysis. Organized well, one file satisfies both.
• Operations records. Plant logs, dispatch records, outage and event records, and performance data support federal performance reporting and NERC operational compliance. Keep them in the plant systems with appropriate retention and access controls.

9.3 Parallel Evidence Categories

Some evidence serves only one regime. Federal financial reports, single audit submissions to the Federal Audit Clearinghouse, and closeout packages are federal-only. NERC self-certifications, mitigation plans, and responses to Regional Entity audits are NERC-only. Keep these separate, because the review pathways and documentation conventions differ. Federal documents follow the federal templates and systems. NERC documents follow the standards and the Regional Entity's submission systems.

9.4 Document Retention

Retention rules differ. Under 2 CFR 200.334, federal award records are kept for three years from the date the final financial report is submitted, longer if litigation, claims or audit findings are pending or the agency extends the period in writing, and records for federally funded equipment are kept for three years after final disposition. NERC retention is set in the Evidence Retention section of each standard and varies. PRC-005-6, for example, requires the current maintenance program and superseded versions since the last audit, and it states that where its retention period is shorter than the time since the last audit, the Compliance Enforcement Authority may ask for other evidence covering the full period.

For documents that serve both regimes, the longer period governs. Because NERC obligations continue for the life of the asset, plan on keeping the commissioning, settings and ratings records well past grant closeout. Track retention by document category in the records management system.

9.5 Access Controls

The architecture holds sensitive content. Where CIP-011 applies, BES Cyber System Information carries specific protection requirements. Grant records can hold sensitive financial, personnel and proprietary technical information. Role-based access is the usual framework, with additional handling for CIP-sensitive material such as restricted storage, logged access, and controlled disposal. Grant-sensitive documents may need similar but distinct handling.

9.6 Coordination With Information Systems

The architecture connects to many systems: financial records in the general ledger, procurement records in the procurement system, operations records in the plant historian and SCADA, and configuration data in configuration management tools. Identify the system of record for each document type and the path from the register to it.

That design pays off in examinations. A single auditor verifying a payroll charge traces from the register to the payroll system to the support. A NERC auditor verifying a protection setting change traces from the register to the configuration management system to the support.

9.7 Documentation Quality Standards

Set documentation quality to the higher of the two regimes' expectations. Where one regime is more demanding, follow it. Contemporaneous records, clear attribution, complete source references and appropriate signatures are the consistent expectations. Build them into templates and review checklists.

Chapter 10

Audit Coordination: Federal Single Audit and NERC Audit

The federal single audit under 2 CFR 200 Subpart F tests the entity's major federal programs for each fiscal year it crosses the expenditure threshold, while the NERC compliance audit tests the asset's evidence requirement by requirement on a schedule the Regional Entity sets from its risk assessment. A federally funded BES-connected or Category 2 asset is subject to both. An entity that prepares for both coordinates preparation, responses and corrective actions to reduce duplication and strengthen the credibility of its overall posture. Audit coordination is the practical expression of the dual compliance overlay.

10.1 The Federal Single Audit

Under 2 CFR 200.501, a non-Federal entity that expends $1,000,000 or more in federal awards during its fiscal year must have a single or program-specific audit for that year. The 2024 revision of the Uniform Guidance raised the threshold from $750,000. Subpart F does not apply to for-profit organizations, but DOE applies similar audit requirements to for-profit recipients under 2 CFR 910.501, and its class deviation in Policy Flash 2025-02 sets the for-profit threshold at the same $1,000,000.

The auditee procures an independent auditor. The audit examines internal control and compliance with the requirements applicable to each major program. The reporting package goes to the Federal Audit Clearinghouse within 30 calendar days after the auditee receives the auditor's report or nine months after the end of the audit period, whichever is earlier, and findings are reported in the schedule of findings and questioned costs.

For funded generation, the single audit examines the federal compliance posture, not the NERC compliance. It may touch NERC matters incidentally, for example when the cost of NERC compliance staff is charged to the award. The audit runs on the recipient's fiscal year at the entity level, and the Schedule of Expenditures of Federal Awards drives major program selection.

10.2 The NERC Compliance Audit

Each Regional Entity runs a risk-based compliance monitoring program that includes Compliance Audits, under Section 403 of the Rules of Procedure and Appendix 4C. Only Balancing Authorities, Reliability Coordinators and Transmission Operators have a fixed audit cycle of at least once every three years. For a Generator Owner or Generator Operator, the Regional Entity sets audit frequency and scope from its risk assessment of the entity, and it may also conduct unscheduled audits, spot checks, self-certifications and other monitoring.

The audit examines compliance with the applicable standards. The audit team requests evidence requirement by requirement, and the entity produces it from its documentation architecture. Noncompliance identified in an audit goes through NERC's enforcement process, where penalties and sanctions follow the Sanction Guidelines in Appendix 4B.

10.3 Coordinating Documentation and Scheduling

The integrated architecture from Chapter 9 supports both audits. Documents that serve both regimes are organized so either auditor can retrieve them on demand. The recipient does not run two document systems that need reconciling before each audit.

Coordinate the schedule too. Where you can, keep the two audits' preparation from landing on the same people at the same time. Single audit fieldwork tends to follow fiscal year close, so plan NERC audit preparation around that window when the Regional Entity's notice allows it.

10.4 Coordinating Findings Resolution

A finding in one audit can matter to the other. A single audit finding on procurement controls may point to a supply chain weakness under CIP-013. A NERC finding on access documentation may point to a weakness in how labor charged to the award is documented. Consider cross-regime implications when resolving any finding.

A corrective action for one regime often helps the other. Stronger procurement documentation supports both the grant and the CIP supply chain program. Write the corrective action plan to capture both benefits.

10.5 Audit Defense Posture

Both audits run on cooperation and good faith engagement. The auditor is not an adversary, but a professional conducting a regulated review with defined procedures. Engage cooperatively, produce evidence promptly, and address substantive concerns directly.

Cooperation does not mean capitulation. You can disagree with an auditor's interpretation and defend your position in the proper forum. Do it through substantive engagement, not delay or obfuscation. The documentation architecture is what makes the defense possible.

10.6 Engagement With Counsel

Either audit may call for counsel at some stage. Significant grant findings often involve general counsel and outside counsel familiar with the Uniform Guidance. Significant NERC findings often involve reliability counsel familiar with NERC enforcement. Counsel does not change the underlying compliance posture, but protects procedural rights and keeps responses calibrated.

10.7 Reporting and Lessons Learned

Report audit results from both regimes to senior leadership and the board in one integrated view, and track every finding to closure. The same reporting serves lenders, insurers and other stakeholders who need visibility into both regimes.

Capture the lessons and fold them into the program. A finding that recurs across cycles marks a weakness that was never fixed.

Chapter 11

Practical Implementation Patterns

The implementation patterns below are built for federally funded BES-connected generation. None of them are exotic, and none require extraordinary resources. They require deliberate decisions about staffing, structure, calendar and coordination, made at the project's outset. In my view, entities that adopt them run the dual compliance overlay with manageable friction, and entities that do not run with friction that compounds and eventually surfaces as findings, missed deadlines, or operational problems.

11.1 Pattern 1: A Named Integrated Compliance Lead

Appoint one named lead responsible for both federal grant compliance and NERC compliance on the funded asset. The lead may carry other duties, but the asset has a single integrated lead, not a grants administrator and a reliability compliance officer who happen to sit near each other.

The lead understands both regimes at a working level, coordinates the specialists in each, and produces the integrated reporting to leadership. The lead is the institutional memory of the asset's compliance posture, so turnover in either specialist role does not break the tracking. This model works especially well for entities new to both NERC and federal grants, because one person builds fluency in both instead of two people each learning one. Cross-regime issues surface earlier and land with someone who understands both sides.

11.2 Pattern 2: A Coordinated Calendar

Keep one calendar for both regimes. It runs from the start of construction through the life of the asset and includes federal reporting dates, single audit dates, closeout dates, NERC compliance dates and implementation plan milestones, self-certifications, Regional Entity audit notices, and the coordination milestones between the two.

Make it visible to the lead and the specialists. Flag dependencies. Manage peak periods by adjusting schedules. The calendar is what keeps a federal closeout deadline from arriving in the same week as a NERC self-certification. Review it monthly with the lead and quarterly with senior leadership.

11.3 Pattern 3: Cross-Trained Staff

Cross-train the people in each function. Grants administrators learn enough NERC to recognize when an action has NERC implications, and NERC staff learn enough about federal grants to recognize the reverse. Cross-training does not produce expertise in the other regime. It produces awareness of the seams. A few hours of formal training plus everyday work alongside the other team goes a long way. Entities that keep the two functions rigidly separate produce friction at the seams.

11.4 Pattern 4: Lifecycle Folders With Cross-Regime Tagging

Organize documents by the asset's lifecycle (design, construction, commissioning, operations, decommissioning) instead of by regime, and tag each document with the requirements it satisfies. A commissioning test record might be tagged to PRC-029-2, FAC-002, and federal cost reasonableness at the same time. The structure supports retrieval for either regime and scales as the volume grows over the asset's life.

11.5 Pattern 5: Joint Reviews at Project Milestones

Hold joint compliance reviews at key milestones: start of construction, completion of major construction phases, commissioning, commercial operation, the first quarter of operation, and the first annual review. The integrated lead runs each review with both teams. Confirm that documentation is current, that both regimes' obligations are being met, that open issues are moving, and that the calendar reflects actual project status. Issues caught at a milestone get fixed before they compound through the next phase.

11.6 Pattern 6: Procurement Templates for Both Regimes

Maintain procurement templates that satisfy both regimes at once: federal procurement standards language, the Appendix II contract provisions and other federal flow-downs, CIP-013 supply chain provisions where they apply, CIP-003-9 vendor remote access terms for low impact assets, and any program-specific provisions. One template, tailored per procurement, produces files that satisfy both regimes without duplicate work. The procurement function maintains the templates with input from the integrated lead, and changes in either regime trigger an update.

11.7 Pattern 7: Incident Response Protocols for Both Regimes

Write incident protocols that cover both regimes. A cyber security incident may trigger CIP reporting and a notice to the federal program officer. A construction safety incident may trigger federal performance reporting and NERC operational considerations. A protection system misoperation has NERC implications and may affect federal performance reporting. The protocols list the triggering events, the reporting paths and timelines, and the documentation. The integrated lead is in the loop on any incident with cross-regime implications.

11.8 Pattern 8: A Lessons Learned Record

Keep a lessons learned record that captures cross-regime insights as the asset moves through its lifecycle. The integrated lead maintains it. Record the issues that surfaced, the decisions made, and the improvements implemented, with enough context to be useful later. The record supports continuity through staff transitions, informs the next project, and builds institutional knowledge across the portfolio. For an entity's first federally funded BES-connected asset, this discipline is especially valuable, because that asset becomes the foundation of the institution's expertise.

11.9 Closing the Patterns

These patterns are not exhaustive. Every project develops its own variations. They are the foundation. Adopt them on purpose, at the project's outset, and write each one into the compliance program file so it survives personnel transitions.

My view is that federally funded generation will be a significant share of new asset additions over the next decade, and the capability to run the dual compliance overlay well is becoming a competitive asset in its own right. Entities that build it early can take on more federal funding with confidence. Entities that postpone it face the same work later, under more pressure.

Glossary

Glossary

Applicable Governmental Authority. FERC within the United States, and the governmental authority with subject matter jurisdiction over reliability in Canada and Mexico, as defined in Appendix 2 to the NERC Rules of Procedure.

BES Cyber System. One or more programmable electronic devices that perform reliability functions for BES Facilities, identified and categorized as high, medium or low impact under CIP-002.

BES Cyber System Information (BCSI). Information about BES Cyber Systems that CIP-011 requires entities with high and medium impact systems to identify and protect.

BES exception procedure. The process in Section 509 and Appendix 5C of the NERC Rules of Procedure for including or excluding an Element from the BES case by case.

Bulk Electric System (BES). Unless modified by the listed inclusions and exclusions, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher, excluding facilities used in local distribution.

Bulk Power System (BPS). Facilities and control systems necessary for operating an interconnected transmission network, and electric energy from generation needed to maintain transmission system reliability, excluding local distribution facilities.

Category 2 Generator Owner / Generator Operator. An entity that owns and maintains, or operates, non-BES inverter-based generating resources that have or contribute to an aggregate nameplate capacity of 20 MVA or more, connected through a system designed primarily for delivering that capacity to a common point of connection at 60 kV or above.

Compliance Enforcement Authority (CEA). The entity, usually the Regional Entity, that monitors and enforces compliance with a Reliability Standard for a registered entity.

Coordinated Functional Registration (CFR). A registration under Section 508 of the Rules of Procedure in which two or more entities divide compliance responsibility for a function by agreement.

Dispersed power producing resources. Resources such as solar, wind and battery units that aggregate through a collector system to a common point of connection, addressed by BES Inclusion I4.

E-ISAC. The Electricity Information Sharing and Analysis Center, which receives Cyber Security Incident notifications under CIP-003 and CIP-008.

Extreme Cold Weather Temperature. The unit-specific temperature a Generator Owner calculates under EOP-012-3 Requirement R1 as the basis for its freeze protection measures.

Generator Owner (GO). The entity that owns and maintains generating Facilities (Category 1) or qualifying non-BES inverter-based resources (Category 2).

Generator Operator (GOP). The entity that operates generating Facilities and supplies energy and Interconnected Operations Services (Category 1), or operates qualifying non-BES inverter-based resources (Category 2).

Inverter-based resource (IBR). A generating or storage resource that connects to the grid through power electronic inverters, such as solar, battery storage and most modern wind.

Joint Registration Organization (JRO). A registration under Section 507 of the Rules of Procedure in which a lead entity registers for a function on behalf of other parties and accepts their compliance responsibility.

NERC Compliance Registry. The list NERC maintains of the Bulk Power System owners, operators and users that are subject to approved Reliability Standards.

Regional Entity. One of the organizations to which NERC delegates compliance monitoring, enforcement and registration within a region.

Ride-through. In plain terms, a generating resource staying connected and operating through defined voltage and frequency disturbances. FERC approved a NERC Glossary definition of the term with PRC-029-1.

Schedule of Expenditures of Federal Awards (SEFA). The schedule of federal award expenditures prepared by the auditee for the single audit, used to determine major programs.

Single audit. The entity-wide audit required by 2 CFR 200 Subpart F for a non-Federal entity that expends $1,000,000 or more in federal awards in a fiscal year.

Statement of Compliance Registry Criteria. Appendix 5B to the NERC Rules of Procedure, which sets the criteria for registering each function type. Revision 8 took effect June 27, 2024.

Uniform Guidance. OMB's Guidance for Federal Financial Assistance at 2 CFR Part 200, covering administrative requirements, cost principles and audit requirements for federal awards.

How Energy Compliance Can Help

How Energy Compliance Can Help

Integrated compliance lead support. We provide the integrated compliance lead function described in Pattern 1 on an interim or ongoing basis, support the documentation architecture build, conduct the cross-regime milestone reviews, and help build in-house capacity over time.

NERC registration. BES classification and Category 2 analysis, registration applications to the Regional Entity, and the program build that has to be in place before commercial operation.

Compliance program management and RSAW production. Standing up and running the NERC program for a newly registered Generator Owner and Generator Operator, including the RSAW narratives and evidence the first audit will ask for.

Post-Award Compliance Administration. The Compliance Obligation Matrix, reporting cadence, subrecipient monitoring, and single audit readiness under 2 CFR 200.

Grant post-award administration support. SEFA preparation, single audit corrective action plans, procurement policy and subaward drafting, and grant-file reviews.

Audit Defense. Single audit preparation, OIG response, finding remediation, and corrective action plan drafting and execution, and on the NERC side, audit preparation and response for the Regional Entity.

IRA Bonus Credit Documentation. Prevailing wage, apprenticeship, domestic content, energy community, and direct pay and transferability documentation for projects that carry federal awards and IRA credits together.

Grant Readiness and Application Engineering. Pre-application diagnostics, application strategy, narrative engineering, and federal cross-cutting compliance design, including the NERC compliance evaluation Chapter 1 recommends at application stage.

Engineering Firm Partnership. Co-delivery structures for engineering firms that want owner-side compliance delivered alongside their technical scope.

WattOps Compliance. For a funded generator registered as GO and GOP, WattOps Compliance is EC's NERC compliance evidence platform, at wattopscompliance.com. We will run one standard at one of your facilities through it at no cost. CIP standards are excluded from that offer.

RenewOps. For the plant's operating data, RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module.

Send me the project you are most worried about, and I will tell you where I would start. Website: energycomplianceinc.com · Email: [email protected] · Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education:

• MBA, Energy Management, University of Mary
• MSL, Compliance Law, Fordham Law University
• BAS, Energy Management, Bismarck State College
• BAS, Mechanical Engineering, Metallurgy minor, University of Florida
• BAS, Criminology, St. Petersburg College (State Law Enforcement Certification)
• AAS, Power Plant Technology, Bismarck State College
• AAS, Electrical Transmission System Technology, Bismarck State College

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

The views expressed in this publication do not represent the views of any federal or state agency, NERC, or any Regional Entity.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is a senior-led professional services firm serving registered entities and federally funded energy projects. The firm advises on NERC Reliability Standards, RTO and ISO market frameworks, Texas Public Utility Commission matters, post-award compliance administration under 2 CFR 200, Inflation Reduction Act bonus credit documentation, federal grant application engineering, and engineering firm partnership structures for owner-side compliance delivery.

Our position is compliance-first. EC engineers the documentation, audit trail and obligation matrix that survive post-award scrutiny, because that is where most funded energy projects fail, not at the award decision. A senior practitioner oversees every engagement. The firm does not bring five people to a meeting that needs one. Work that should be automated is automated, and work that needs senior judgment gets it. Most consulting in this space is built for billable hours. The firm is built for outcomes.

EC also builds its own tools: WattOps Compliance, our NERC compliance evidence platform, and RenewOps, our renewable operations monitoring and analytics platform.

The Grant Funding Series is one of several series the firm publishes for the people doing the work. The substance in the reference is the substance in the engagement. The difference is whether the firm carries the workload with you or you carry it yourself. The firm is based in Bloomington, Minnesota, and serves clients nationwide.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

Sources and Authorities

Sources and Authorities

NERC Rules of Procedure and registration

• NERC, Rules of Procedure, including Section 403 (Required Attributes of Regional Entity Implementation of the Compliance Monitoring and Enforcement Program), Section 501 (Scope of the Organization Registration and Organization Certification Programs), Sections 507 and 508 (Joint Registration Organizations and Coordinated Functional Registration), and Section 509 (Exceptions to the Definition of the Bulk Electric System), effective November 28, 2023. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
• NERC, Rules of Procedure Appendix 2, Definitions Used in the Rules of Procedure (including the Bulk Electric System definition), effective June 27, 2024. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• NERC, Rules of Procedure Appendix 4B, Sanction Guidelines, effective January 19, 2021. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4b.pdf
• NERC, Rules of Procedure Appendix 4C, Compliance Monitoring and Enforcement Program, effective May 19, 2022. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• NERC, Rules of Procedure Appendix 5A, Organization Registration and Certification Manual, effective June 27, 2024. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-5a.pdf
• NERC, Rules of Procedure Appendix 5B, Statement of Compliance Registry Criteria, Revision 8, effective June 27, 2024. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-5b.pdf
• NERC, Rules of Procedure index listing Appendix 5C, Procedure for Requesting and Receiving an Exception from the Application of the NERC Definition of Bulk Electric System (effective January 19, 2021). https://www.nerc.com/who-we-are/rules-of-procedure
• NERC, Reliability Standards Compliance Dates for Generator Owners and Generator Operators, Revision 1.5 (August 4, 2026). https://nerc.com/pa/Stand/202401%20Rules%20of%20Procedure%20Definitions%20Alignment%20GO/ComplianceDatesforGOs_GOPS.pdf
• WECC, Frequently Asked Questions, IBR Registration Initiative, Category 2 GO and GOP Registration Process (2026). https://www.wecc.org/sites/default/files/documents/program/2026/faq-ibr-registration-initiative-category-2-go-and-gop-registration-process.pdf

NERC Reliability Standards

• NERC, CIP-002-5.1a, Cyber Security, BES Cyber System Categorization (Attachment 1, Impact Rating Criteria). https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-002-5.1a.pdf
• NERC, CIP-003-9, Cyber Security, Security Management Controls (Attachment 1, Sections 1 through 6). https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-003-9.pdf
• NERC, CIP-008-6, Cyber Security, Incident Reporting and Response Planning. https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-008-6.pdf
• NERC, CIP-013-2, Cyber Security, Supply Chain Risk Management. https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-013-2.pdf
• NERC, EOP-011-4, Emergency Operations. https://www.nerc.com/globalassets/standards/reliability-standards/eop/eop-011-4.pdf
• NERC, FAC-001-4, Facility Interconnection Requirements. https://www.nerc.com/globalassets/standards/reliability-standards/fac/fac-001-4.pdf
• NERC, FAC-002-4, Facility Interconnection Studies. https://www.nerc.com/globalassets/standards/reliability-standards/fac/fac-002-4.pdf
• NERC, FAC-003-5, Transmission Vegetation Management. https://www.nerc.com/globalassets/standards/reliability-standards/fac/fac-003-5.pdf
• NERC, FAC-008-5, Facility Ratings. https://www.nerc.com/globalassets/standards/reliability-standards/fac/fac-008-5.pdf
• NERC, MOD-026-2, Verification and Validation of Dynamic Models and Data, effective April 1, 2026. https://www.nerc.com/globalassets/standards/reliability-standards/mod/mod-026-2.pdf
• NERC, Project 2020-06, MOD-026-2 Implementation Plan (retirement of MOD-026-1 and MOD-027-1). https://www.nerc.com/globalassets/standards/projects/2020-06/final-ballot---mod-026/2020-06-mod-026-2-implementation-plan-clean_102025.pdf
• NERC, PRC-005-6, Protection System, Automatic Reclosing, and Sudden Pressure Relaying Maintenance. https://www.nerc.com/pa/Stand/Reliability%20Standards/PRC-005-6.pdf
• NERC, PRC-019-2, Coordination of Generating Unit or Plant Voltage Regulating Controls with Generating Unit or Plant Capabilities and Protection. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-019-2.pdf
• NERC, PRC-024-4, Frequency and Voltage Protection Settings for Synchronous Generators, Type 1 and Type 2 Wind Resources, and Synchronous Condensers. https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-024-4.pdf
• NERC, PRC-029-2, Frequency and Voltage Ride-through Requirements for Inverter-Based Resources, effective October 1, 2026 (retires PRC-029-1). https://www.nerc.com/globalassets/standards/reliability-standards/prc/prc-029-2.pdf
• NERC, Project 2025-05, PRC-029-2 Implementation Plan (August 2026). https://www.nerc.com/globalassets/standards/projects/2025-05/final-posting/project-2025-05-implementation-plan_-7.26.2026-clean-version.pdf
• WECC, PRC-028, PRC-029 and PRC-030 Timelines (2026). https://www.wecc.org/sites/default/files/documents/meeting/2026/PRC-28%20-29%20and%2030%20Timelines.pdf
• NERC, Level 3 Alert, Essential Actions, IBR Performance and Modeling (May 20, 2025), NYSRC copy. https://www.nysrc.org/wp-content/uploads/2025/06/5.3.1-Level-3-Alert-Essential-Actions-IBR-Performance-and-Modeling-Attachment-5.3.1.pdf

FERC orders and reports

• FERC, Order No. 909, final rule approving Reliability Standards PRC-029-1 and PRC-024-4 and the Glossary definition of Ride-through, Docket No. RM25-3-000, 90 FR 35599 (July 29, 2025). https://www.govinfo.gov/content/pkg/FR-2025-07-29/html/2025-14304.htm
• FERC, order approving Reliability Standard EOP-012-3, Extreme Cold Weather Preparedness and Operations, Docket No. RD25-7-000 (September 18, 2025), FR Doc. 2025-18393. https://public-inspection.federalregister.gov/2025-18393.pdf
• FERC, Order Approving Extreme Cold Weather Reliability Standard EOP-012-2 and Directing Modification (also approving the EOP-011-4 implementation date), Docket Nos. RD24-5-000 and RD24-1-000, 187 FERC ¶ 61,204 (June 27, 2024), 89 FR 55239 (July 3, 2024). https://www.govinfo.gov/content/pkg/FR-2024-07-03/pdf/2024-14668.pdf
• FERC, Order No. 907, final rule approving Reliability Standard CIP-015-1, Cyber Security, Internal Network Security Monitoring, Docket No. RM24-7-000 (June 26, 2025), FR Doc. 2025-12309. https://www.govinfo.gov/content/pkg/FR-2025-07-02/html/2025-12309.htm
• FERC, order approving Reliability Standard CIP-002-8, Docket No. RD25-8-000 (March 19, 2026), FR Doc. 2026-05715. https://www.govinfo.gov/content/pkg/FR-2026-03-24/pdf/2026-05715.pdf
• FERC, Explainer on the Interconnection Final Rule (Order No. 2023, July 28, 2023). https://www.ferc.gov/explainer-interconnection-final-rule
• FERC, NERC and Regional Entity Staff Report, The February 2021 Cold Weather Outages in Texas and the South Central United States (November 2021). https://www.ferc.gov/sites/default/files/2021-12/Cold%20Weather%20Report_%202021_120821.pdf

Federal grant regulations

• OMB, Guidance for Federal Financial Assistance, 2 CFR Part 200, eCFR, last amended October 1, 2024, including Sections 200.317 through 200.327, 200.328, 200.329, 200.334, 200.430, 200.501, 200.512, and Appendix II. https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
• DOE, Financial Assistance Regulations, 2 CFR Part 910, including Section 910.501 (audit requirements for for-profit organizations). https://www.ecfr.gov/current/title-2/subtitle-B/chapter-IX/part-910
• DOE, PF 2025-02, Class Deviation to 2 CFR 910.501 Audit Requirements for For-Profit Organizations (October 2, 2024). https://www.energy.gov/node/4845564