August 2026 Summaries

NERC CIP-012-2 and CIP-003-9 are crucial standards that redefine data governance requirements for utilities, focusing on the protection and traceability of operational data within the Bulk Electric System (BES). Enforced from July 1, 2026, CIP-012-2 mandates utilities to demonstrate secure handling of real-time data exchanged between control centers, while CIP-003-9, effective from April 1, 2026, extends governance obligations to lower-impact BES systems, vendor remote access, and supply chain relationships. Both standards require utilities to provide concrete evidence of data movement and handling, emphasizing data lineage and provenance rather than merely relying on network diagrams or encryption. The deterministic lineage approach, which maps data movement through source code analysis rather than logs, is highlighted as a key compliance strategy, ensuring that utilities can produce a complete and repeatable audit trail. This governance model aligns with practices in other regulated industries, offering a more precise and efficient path for regulatory approval and audit readiness.