[UPDATE October 30] Notice the close alignment between this INGAA guideline and the NAESB CS Addendum standard]
I'm presenting the NAESB CS Addendum standard to NERC NPCC TFIST on Nov 3 during the NPCC Fall Conference (the day before the conference officially begins) https://github.com/rjb4standards/Presentations/raw/refs/heads/master/NPCC-TFIST-PRESENTATION.pptx
IT'S OFFICIAL THE CYBERSECURITY PROCUREMENT CONTRACT ADDENDUM HAS PASSED THE EXECUTIVE COMMITTEE VOTE WITH A SUPER MAJORITY TO MAKE IT A NAESB STANDARD. Next step, Member Ratification with a deadline of December 1.
[UPDATE October 22] The fourth recommendation considered by the WEQ EC, 2026 WEQ Annual Plan Item 1.b, was voted out of the WEQ Cybersecurity Subcommittee (CSS) and the WEQ Business Practices Subcommittee (BPS) on September 15, 2026, and proposes a new standardized contract addendum and related FAQ document that could be used to define timelines for vendor notifications regarding vulnerability identification and mitigation measures for cybersecurity issues. Three sets comments were submitted during the formal comment period ending on October 15, 2026, and a late set of comments incorporating recommended changes from the formal comments was developed by the subcommittees. The WEQ EC considered the recommendation as modified by the late comments of the subcommittee during the meeting and a motion was made to adopt the recommendation as revised by the late formal comments and errata provided by the chair of the WEQ CSS during the meeting. In total, 15 votes in support, 5 votes in abstention, and 0 votes in opposition were cast. [Vote 4]. The revised recommendation and attachments can be found through the following hyperlinks:
CS Addendum: Attachment 1 (as revised by the WEQ EC): https://naesb.org/pdf4/weq_ec102126a2.docx
FAQ Attachment 2: https://naesb.org/pdf4/weq_2026_api_1b_rec_091426_attachment2.docx
Efforts to harmonize this procurement language with existing cybersecurity regulations affecting product manufacturers, i.e. EU CRA Annex I, US FDA, NERC CIP, and US EO 14028 and 14421, were considered throughout this initiative in order to avoid introducing variation from existing regulatory expectations already applicable to product manufacturers.
[UPDATE October 16] The NAESB cybersecurity sub-committee has considered comments received from industry and has approved a final recommendation, with comments included. Thanks to all those that provided comments that helped improve this CS Addendum language.
https://naesb.org/pdf4/weq_ec102126w5.docx
I highly recommend reading PJM's comments for this proposal: https://naesb.org/pdf4/weq_bps_css101626w3.docx
This now goes to the WEQ Executive Committee for consideration as a NAESB WEQ standard. The final recommendation materials will be available here: https://naesb.org/committee_activities.asp
UPDATE September 14, 2026] The NAESB cybersecurity subcommittee has completed the cybersecurity procurement contract addendum and the final recommendation is available for public review. This "CS Addendum" sets cybersecurity expectations for product vendors and product users (critical infrastructure operators) aimed at protecting critical infrastructure operations through modern product cybersecurity transparency and trust best practices, aligned with FERC Order 912 and NERC CIP-013-4 requirements.
Critical infrastructure operators attach this CS Addendum to RFP's, RFI's and Procurement contracts to set cybersecurity expectations with product suppliers.
The final recommendation is now subject to a 30-day public review and comment period that closes on October 15 and is followed by an Executive Committee vote to proceed with creating a formal, voluntary NAESB standard. NAESB standards are filed with FERC.
Efforts to harmonize this procurement language with existing cybersecurity regulations affecting product manufacturers, i.e. EU CRA Annex I, US FDA, NERC CIP, and US EO 14028 and 14421, were considered throughout this initiative in order to avoid introducing variation from existing regulatory expectations already applicable to product manufacturers.
https://naesb.org/pdf4/weq_2026_api_1b_rec_091426_attachment1.docx
[UPDATE September 3, 2026] The comment period has closed and feedback has been incorporated into a revised proposed procurement contract addendum. Consensus has been reached up through section 3.2 romanette vi. A meeting is scheduled for September 14 to complete the review and publish a recommendation for the consensus procurement contract addendum by September 15 where it will be subject to a 30 day member review before the Executive Committee votes on the status of the proposal, https://naesb.org/pdf4/weq_bps_css091426w2.docx
Careful consideration was given to existing laws and regulations setting cybersecurity practice expectations on manufacturers to provide timely vulnerability reporting and attestation of Secure by Design best practices, i.e. EU CRA and FDA Final Guidance to medical device manufacturers, in order to leverage existing common practices that manufacturers already need to comply with and avoid extraneous, burdensome work.
[UPDATE August 27. 2026] The proposed NAESB Procurement Contract Language, scheduled for a vote on September 3, is well aligned with Executive Order 14421. FOCI information is provided in the "Company Information" item found in the Vendor Response File (VRF) identified in Exhibit A. Details of a Vendor Response File are provided in this article: https://www.energycentral.com/intelligent-utility/post/advice-for-software-vendors-to-prepare-for-omb-m-22-18-requirements-and-zi1Y7M8FADm8mma
The NAESB cybersecurity committee met earlier today to review and revise the proposed Cybersecurity Terms and Conditions Procurement Contract Addendum document aimed at improving product cybersecurity trust and transparency for critical infrastructure operators that require more timely visibility into product cyber risks and assurances that product vendors are building secure products following effective "Secure By Design" and "Secure by Demand" best practices identified by NIST and CISA.
https://www.naesb.org/pdf4/weq_bps_css081826reqcom_a1.docx
NAESB is an ANSI Standards Development Organization (SDO) responsible for developing business practice standards for the North American Natural Gas and Electric Industries that frequently become FERC regulations.
Efforts to harmonize this procurement language with existing cybersecurity regulations affecting product manufacturers, i.e. EU CRA and US EO 14028, were considered throughout the initiative in order to avoid introducing variation from existing regulatory expectations already applicable to product manufacturers.
This public review of the proposed procurement contract language is open for comment until September 1. All responses received will be reviewed by the subcommittee during its next scheduled meeting taking place on Thursday, September 3, 2026 from 2:30 pm to 4:00 pm Central and inform the process going forward.
Please submit comments to the NAESB office ([email protected]). All interested parties, regardless of membership status within NAESB, are eligible to submit informal comments for consideration.
Microsoft CoPilot provides an easy to read summary of expectations based on this procurement contract language: https://copilot.microsoft.com/shares/mR1v3fniaeekQpxo3xR9y
Microsoft CoPilot example SAGScore and explanation: https://copilot.microsoft.com/shares/JBfS7tEs7Cv3HadndUZfq
https://files-us-east-1.t-cdn.net/files/gR6X8MAkKdePC6wuxGYxB