What does the FERC-725B update mean for grid operators' cybersecurity paperwork?

The order that expanded monitoring

A federal notice appeared on October 13, 2026. It describes an update to the paperwork collection tied to critical infrastructure protection standards. The Federal Energy Regulatory Commission published the notice to satisfy the Paperwork Reduction Act of 1995. The act requires agencies to seek public comment before renewing information collections. This particular collection carries the identifier FERC-725B and OMB control number 1902-0248.

The update stems from Order RD26-6-000, issued on August 10, 2026. That order approved Critical Infrastructure Protection Reliability Standard CIP-015-2 and retired CIP-015-1. The North American Electric Reliability Corporation filed the petition on June 18, 2026. NERC asked for approval of the standard, an implementation plan, violation risk factors, and violation severity levels. The filing appeared in the Federal Register at 91 FR 38413 on June 25, 2026. Interventions and protests were due by July 20, 2026. Three companies filed timely motions to intervene: Ameren Illinois Company, Ameren Transmission Company of Illinois, and Union Electric Company. Under Rule 214 of the Commission's Rules of Practice and Procedure, those motions made them parties to the proceeding.

The previous standard required internal network security monitoring inside the electronic security perimeter. The new version extends that monitoring to electronic access control or monitoring systems and physical access control systems located outside the perimeter. NERC explained the revision closes a gap. An attacker could use compromised EACMS or PACS outside the perimeter to reach operational technology inside it. The Commission had directed this extension in Order No. 907 and clarified it in Order No. 907-A.

The entities and hours behind the new paperwork

The Commission estimates 360 entities will face increased paperwork under CIP-015-2. The NERC Compliance Registry identified approximately 1,706 unique U.S. entities subject to mandatory CIP compliance as of August 2026. Only a subset sees new burden.

Those 360 respondents fall into six categories: Distribution Provider, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator, and Transmission Owner. Each respondent files six responses per year.

Each response takes an estimated 14 hours. The hourly cost is $135.51. That figure blends three occupational rates. Legal occupations at the 90th percentile cost $256.49 per hour. Electrical engineers at the mean cost $92.32 per hour. Office and administrative support at the 90th percentile costs $57.73 per hour. The Bureau of Labor Statistics published those numbers on June 12, 2026.

The agency defines burden as the total time, effort, or financial resources expended by persons to generate, maintain, retain, or disclose information to a federal agency.

The comment window and how to respond

Comments are due December 14, 2026. That gives 63 days from publication. Submit them by email to DataClearance@FERC.gov. You must specify Docket No. RD26-6-000 in your email. If electronic filing is not possible, use U.S. Postal Service mail addressed to the Secretary of the Commission at 888 First Street NE, Washington, DC 20426. Hand delivery or courier goes to 12225 Wilkins Avenue, Rockville, MD 20852.

It asks for input on four points. Whether the collection is necessary for its functions and has practical utility. Whether the burden and cost estimates are accurate, including the methodology and assumptions. Ways to enhance quality, utility, and clarity. Ways to minimize burden through automated collection techniques or other information technology.

Kayla Williams handles questions. Reach her at DataClearance@FERC.gov or (202) 502-6468. The docket is viewable at the Commission's eLibrary. The document spans three pages, numbered 64921 through 64923. It carries document number 2026-20880.

What this means for compliance teams

The notice does not state how many of the 1,706 registered entities already meet the new monitoring requirements. It does not describe the technical steps for extending INSM to EACMS and PACS. It does not report whether any entity has suffered a breach due to the previous gap. The notice exists solely to satisfy the Paperwork Reduction Act before the updated collection takes effect.

Compliance teams at the 360 affected entities should review the new monitoring scope. The expansion covers systems outside the electronic security perimeter. That change may require new sensors, new log aggregation, and new alerting workflows. The 14-hour per-response estimate assumes the work is done by a mix of legal, engineering, and administrative staff. Actual effort will vary by organization size and existing tooling.

The comment period is the only formal chance to challenge the burden estimates. After December 14, 2026, the Commission may approve the collection without further public input. Entities that believe the 14-hour figure is low should submit data supporting a higher number. Entities that believe the scope is unnecessary should explain why. The Commission must consider all comments before renewing the OMB control number.