Industries

Energy and Utilities: Cybersecurity Rules and IT Support

Energy organizations work with a mix of federal and Texas security rules. Which ones apply depends on what you own, what you operate and where you connect to the grid.

Talk with ALCON DTSSee which rules apply

Electric co-ops and munis, solar and storage operators, retail electric providers and oil and gas companies each face a different mix of federal and Texas rules. Some are mandatory, such as NERC CIP for registered entities and the Texas Emergency Operations Plan. Others are voluntary, such as DOE’s Cybersecurity Capability Maturity Model. ALCON DTS supports the IT and security side of energy and utility organizations, working alongside your compliance team.

This page answers:

At a glance

  • Federal grid rules: NERC CIP Reliability Standards, mandatory for NERC-registered entities with Bulk Electric System assets. See our NERC CIP guide.
  • Federal penalty: currently up to $1,584,648 per violation, per day (18 CFR 385.1602)
  • Texas grid rules: PUCT cybersecurity monitor program, Emergency Operations Plan with a cyber security annex and a yearly March 15 filing, and ERCOT incident notice. See our Texas grid guide.
  • Pipelines: TSA Security Directive Pipeline-2021-02G, for operators TSA has notified
  • Voluntary: DOE’s Cybersecurity Capability Maturity Model (C2M2) Version 2.1
  • Federal incident reporting: CIRCIA reporting is not required yet. The final rule is under review.
  • Last reviewed: October 27, 2026
Who it covers

Which rules apply to your organization?

Start with what you own and operate. Many energy organizations fit more than one group below.

Electric co-ops and munis

  • NERC CIP, if you are NERC-registered. Mandatory NERC CIP Reliability Standards apply to NERC-registered entities that own or operate Bulk Electric System assets. NERC and its Regional Entities enforce them under FERC oversight. The maximum civil penalty is currently $1,584,648 per violation, per day. See our NERC CIP guide.
  • PUCT cybersecurity monitor program. Munis and co-ops that own or operate ERCOT transmission at 60 kV or more must take part (16 TAC 25.367). Transmission and distribution utilities must take part too.
  • Emergency Operations Plan. Texas electric utilities, munis and co-ops keep an Emergency Operations Plan with a cyber security annex and a physical security incident annex, and file with the PUCT by March 15 each year: the full plan at least once every three years, and an update or attestation in the years between (16 TAC 25.53).

Solar and storage

  • NERC registration for inverter-based resources. Since May 15, 2026, NERC requires registration for entities that own and operate certain non-BES inverter-based resources with an aggregate nameplate capacity of 20 MVA or more, connected at 60 kV or more. NERC has not yet set CIP compliance dates for these newly registered resources.
  • NERC CIP, if your facility is part of the Bulk Electric System. Generating resources at 100 kV or above can be included, depending on size. See our NERC CIP guide.
  • Emergency Operations Plan. Power generation companies in Texas keep an Emergency Operations Plan with a cyber security annex and file with the PUCT by March 15 each year: the full plan at least once every three years, and an update or attestation in the years between (16 TAC 25.53).

Retail electric providers

  • Emergency Operations Plan. Retail electric providers keep an Emergency Operations Plan with a cyber security annex and file with the PUCT by March 15 each year: the full plan at least once every three years, and an update or attestation in the years between (16 TAC 25.53).
  • ERCOT incident notice. If you are an ERCOT Market Participant, you must notify ERCOT of cybersecurity incidents affecting systems that interface with ERCOT.
  • Customer data. Texas breach notice rules apply to any business holding sensitive personal information. See Rules for everyone below.

Oil and gas

  • TSA pipeline directive. TSA Security Directive Pipeline-2021-02G applies to operators of critical pipeline systems or facilities that TSA has notified. It is effective May 3, 2026 and expires May 2, 2027. TSA says an operator that delegates to, or shares responsibility with, a managed security service provider “retains sole responsibility” under the directive for compliance with its TSA-approved Cybersecurity Implementation Plan.
  • TSA proposed rule. TSA’s “Enhancing Surface Cyber Risk Management” rule is proposed, not final.

Not sure which group you are in? We will walk through what you run today and share the rules on this page that are worth reviewing with your compliance team.

Talk with ALCON DTS

Rules for everyone

Which rules apply across the energy sector?

  • CIRCIA (federal incident reporting). CISA published its proposed rule on April 4, 2024, and the final rule is under review. CISA says: “Until the effective date of the final rule, organizations are not required to submit covered cyber incident or ransom payment reports under CIRCIA.” CIRCIA reporting rules are still being finalized; we can help you prepare an incident response plan now.
  • DOE-417 (electric emergency reporting). Balancing Authorities, Reliability Coordinators, “some Generating Entities, and Electric Utilities” must file with DOE when the reporting criteria are met, including for certain cyber events. Check the DOE-417 Form Instructions for the criteria and timelines.
  • C2M2 (voluntary). DOE’s Cybersecurity Capability Maturity Model Version 2.1 (June 2022) is voluntary, and DOE offers “voluntary, no-cost self-evaluations” for U.S. energy sector organizations.
  • Texas breach notice (Bus. and Com. Code Sec. 521.053). Notify affected individuals without unreasonable delay and “not later than the 60th day” after you determine a breach occurred. If the breach involves “at least 250 residents of this state,” notify the Texas Attorney General “not later than the 30th day.”
  • Texas SB 2610 safe harbor (Bus. and Com. Code Ch. 542). For a qualifying Texas business, a cybersecurity program “implemented and maintained” in compliance with Sec. 542.004 can bar exemplary damages in a lawsuit over a breach. The safe harbor covers exemplary damages only, and the chapter does not change other legal duties, such as Texas breach notice (Sec. 542.003, 542.005). See Texas SB 2610 Cybersecurity Safe Harbor.
  • NIST Cybersecurity Framework. A common way to organize a security program. See our NIST Cybersecurity Framework guide.
How we help

How can ALCON DTS help you?

ALCON DTS supports the IT and security side of energy and utility organizations, working alongside your compliance team. Your organization keeps its compliance decisions and its regulatory contacts. Our expert team helps organize evidence, document vendor risk, and strengthen identity, patching and logging for corporate IT systems.

General illustrations of IT and security support, not a list of regulatory requirements.
Area How ALCON DTS supports you
Identity and remote access MFA and identity controls for corporate IT and remote access tools, with vendor access documentation
Patching and logging Patch management for IT systems, and logging for IT environments through our Security Monitoring (SIEM) service
Incident response Incident response planning, and tabletop exercise support for IT scenarios
Recovery Recovery planning for IT systems, with our Backup and Disaster Recovery service
Vendor risk Vendor inventories, questionnaires and vendor risk documentation
Emergency Operations Plan Drafting support for the IT portions of your cyber security annex, and drill support for IT scenarios
C2M2 Support gathering evidence and organizing a voluntary C2M2 self-evaluation

Our Security Monitoring (SIEM) service and our Backup and Disaster Recovery service are each quoted on their own. The exact controls in your environment depend on your ALCON DTS plan and any project work, and our expert team will show you which controls are in place today and which would add coverage. Your organization keeps control of its compliance program, and ALCON DTS supports the IT and security side. ALCON DTS does not operate grid assets or operational technology.

Questions

Frequently asked questions

No. NERC CIP is mandatory only for NERC-registered entities with Bulk Electric System assets. See our NERC CIP guide.

No. The final rule has not been published, and CISA says organizations are not required to submit CIRCIA reports until the final rule takes effect.

Yes. Their Emergency Operations Plan must include a cyber security annex. The PUCT filing is due by March 15 each year, with the full plan at least once every three years (16 TAC 25.53).

No. DOE’s C2M2 is voluntary, and DOE offers no-cost self-evaluations for U.S. energy sector organizations.

No. Your own staff keep those roles. Our expert team supports them on the IT and security side.
Services

Related services

Next step

Talk with ALCON DTS about cybersecurity for energy and utilities

Want a clearer picture of your IT security? Our expert team will walk through your environment with you, show you the controls in place today and suggest next steps for the IT side of your program.

Talk with ALCON DTSCall 512-892-6900