Texas Grid Cybersecurity: What ERCOT and PUCT Rules Mean for Your Organization

• PUCT. Certifies and oversees ERCOT. Under PURA 39.151(d), ERCOT “is directly responsible and accountable to the commission,” and the PUCT approves ERCOT protocols before they take effect.
• ERCOT. The independent system operator for the ERCOT power region. Market participants “shall observe all scheduling, operating, planning, reliability, and settlement policies, rules, guidelines, and procedures established by the independent system operator in ERCOT” (PURA 39.151(j)).
• Texas RE. The NERC Regional Entity for the ERCOT region. It handles NERC compliance monitoring and enforcement, which is distinct from PUCT enforcement of state rules. See our NERC CIP guide.

Cybersecurity monitor program

Under PURA 39.1516, the PUCT and ERCOT contract with a cybersecurity monitor to “manage a comprehensive cybersecurity outreach program for monitored utilities,” meet regularly on emerging threats, “review self-assessments voluntarily disclosed by monitored utilities,” and “report to the commission on monitored utility cybersecurity preparedness.”

• Each monitored utility must name one or more points of contact who can answer the cybersecurity monitor’s questions about its cyber and physical security activities (16 TAC 25.367(m)(3)).
• The monitor can “request, but not to require, information,” and self-assessments are voluntary.
• The statute “does not grant enforcement authority to the cybersecurity monitor.”
• The rule also runs a broader cybersecurity coordination program, open to all electric utilities, munis and co-ops, with guidance on best practices, information sharing and supply chain topics such as “software integrity and authenticity,” vendor risk management and “vendor remote access” (16 TAC 25.367; PURA 31.052).

Emergency Operations Plan

• File with the PUCT by March 15 every year. File the full plan and an executive summary at least once every three years. In the years between, file an update: a revised plan if you made a change that materially affects your emergency response, or an attestation if you did not.
• Include a cyber security annex and a physical security incident annex.
• Conduct or take part in at least one drill each calendar year, and notify PUCT staff at least 30 days before at least one drill.
• Give status updates on request during a TDEM State Operations Center activation.

ERCOT incident notice

A Market Participant must notify ERCOT as soon as practicable after it determines there is a Cybersecurity Incident on its computer network or system that interfaces with an ERCOT network or system. ERCOT defines a Cybersecurity Incident as “a malicious or suspicious act that compromises or disrupts a computer network or system that could foreseeably jeopardize the reliability or integrity of the ERCOT System or ERCOT’s ability to perform the functions of an independent organization” under PURA. Agents that transact with ERCOT for a Market Participant must report their incidents to it, and it reports them to ERCOT. Each Market Participant must also name and keep current a Cybersecurity Contact for communications with ERCOT (Nodal Protocols Section 16.18).

A proposed revision, NPRR1334, would expand notice to vendor systems that interface with ERCOT and to incidents on a Market Participant’s or its vendor’s systems that “could foreseeably jeopardize” the Market Participant’s own reliable operation. It is proposed, not adopted, and was tabled at ERCOT’s Protocol Revision Subcommittee on June 10, 2026.

Vendor attestations (Lone Star Infrastructure Protection Act)

ERCOT market participants must attest to compliance with Bus. and Com. Code Ch. 117. They must report purchases of critical electric grid equipment or services from listed foreign-adversary-linked companies and attest that the purchase will not give those companies access or control (PURA 39.360).

• General PUCT penalty. Up to $25,000 per violation, and each day a violation continues or occurs counts as its own violation (PURA 15.023(b)).
• Higher caps. Up to $1,000,000 per violation, counted for each day, for violations of a voluntary mitigation plan or of the weatherization sections, PURA 35.0021 or 38.075 (15.023(b-1)). Up to $1 million for each violation when a market participant fails to submit required PURA 39.360 reports or attestations to ERCOT, or knowingly submits false information (15.023(b-2), added by SB 2368 in 2025).
• NERC matters. Handled by Texas RE and NERC. See our NERC CIP guide.

You keep the compliance decisions, and your own staff keep the ERCOT and PUCT contact roles. ALCON DTS supports the IT and security side of your program, working alongside your compliance team.

Our Security Monitoring (SIEM) service and our Backup and Disaster Recovery service are each quoted on their own. The exact controls in your environment depend on your ALCON DTS plan and any project work, and our expert team will show you which controls are in place today and which would add coverage. Your organization keeps control of its compliance program, and ALCON DTS supports the IT and security side.

• NERC CIP. Applies to NERC-registered entities with BES assets, alongside state rules. See our NERC CIP guide.
• DOE-417. Federal electric emergency incident reporting has its own criteria and timelines. See the DOE-417 Form Instructions.
• Texas Grid Security Commission. Texas is studying new grid resilience standards (SB 75, 2025). Its role is to recommend resilience standards and an all-hazards plan to the legislature, due by December 1, 2026 (PURA 44.005, 44.007).
• Texas Electric Grid Security Council. An advisory body for best security practices (PURA 39.917).
• Weather emergency preparedness. 16 TAC 25.55 sets weatherization duties for ERCOT, generation entities and transmission service providers in ERCOT.
• Energy and Utilities overview. Rules by type of organization, including Texas breach notice and the SB 2610 safe harbor. See Energy and Utilities.

• Texas Utilities Code, Chapter 39 (Texas Constitution and Statutes)
• Texas Utilities Code, Chapter 31 (Texas Constitution and Statutes)
• Texas Utilities Code, Chapter 15 (Texas Constitution and Statutes)
• Texas Utilities Code, Chapter 44 (Texas Constitution and Statutes)
• 16 TAC 25.367, Cybersecurity Monitor (PUCT)
• 16 TAC 25.53, Electric Service Emergency Operations Plans (PUCT)
• 16 TAC 25.55, Weather Emergency Preparedness (PUCT)
• Nodal Protocols, current (Section 2 definitions and Section 16.18) (ERCOT)
• NPRR928, Cybersecurity Incident Notification (ERCOT)
• NPRR1334, Revision to Cybersecurity Incident Notification (proposed) (ERCOT)
• SB 2368 bill analysis, 89th Legislature (Texas Legislature Online)
• DOE-417 Form Instructions (U.S. Department of Energy)
• About Texas RE (Texas RE)
• Key Players: Regional Entities (NERC)

Last reviewed: October 27, 2026

This page is general information about Texas grid cybersecurity rules, not legal advice for your situation.