module

Within the Walls

At Fortress, everything we build is focused on helping you succeed.

Welcome back to the Fortress Customer Newsletter and our Q4 update. Supply chain regulation takes center stage this quarter with Executive Order 14421 - National Emergency to Secure the U.S. Bulk-Power System, signed August 26, gives DOE authority to block foreign-made bulk-power equipment tied to covered foreign entities. That authority extends to equipment already installed, not just new purchases. For most utilities, the first step is an inventory of country-of-origin exposure across the transformers, breakers, relays, and inverters already in the field. DOE’s implementing rules are expected around year end, and the utilities that have done that inventory work will be in a much better position when they are published. If you want help scoping it, your account team can walk through it with you. Our regulatory section covers the order in detail, along with CIP-014-4, PRC-029-2, and NERC’s new computational load standards.

Also in this issue: a safety minute on QR code scams, Q3 threat intelligence including Cl0p’s mass exploitation of PTC Windchill across industrial suppliers, a look at the new Vendor Risk Profile and the upcoming Command Center, and a customer story on getting remediation over the finish line. And if there’s a topic you’d like to see in a future issue, let our Customer Success team know.

At the same time, we are focused on helping you better communicate the value of your program, connecting your activities to measurable outcomes, including dollar-based risk reduction and return on investment.

Our commitment is to identify, deliver, and communicate value so your program's impact is clearly understood and realized across your organization, without you having to carry that burden alone.

Mary Nettleton

Executive Vice President of Customer Success · Fortress Information Security

Safety Minute

Think Before You Scan a QR Code

QR codes are everywhere: parking meters, restaurant tables, event check-ins, and even emails. Scanning one is quick, but a malicious code can lead to a fake sign-in or payment page. You may not know where it leads until it opens, so take a moment to check.

Before You Scan

Look for signs that a sticker has been placed over the original code, especially in public places
Be cautious with QR codes in unexpected emails or texts. A familiar logo does not guarantee the code is legitimate
When possible, use an organization’s official app or type its website address yourself

After You Scan

Check the web address before entering a password, payment details, or other personal information
Watch for misspelled company names, unusual web addresses, and pages that pressure you to act immediately
If the page asks for work credentials, stop and use your usual sign-in method instead

If You Think You Scanned a Malicious Code

Close the page and report it to the security team, especially if it came through a work message If you entered your password, change it promptly and let the security team know A ten-second check can prevent a much longer cleanup.

Industry & Regulatory Highlights

On August 26, 2026, EO 14421 declared a national emergency under IEEPA, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power equipment tied to a Covered Foreign Entity where the transaction poses an undue security risk. No countries are named. Covered Foreign Entity status applies automatically to countries or persons under a U.S. arms embargo or ITAR sanctions regime, or by DOE determination.

Scope (69 kV and Above)

Transformers, reactors, capacitors, HV circuit breakers, protective relaying, turbines, and grid inverters, plus associated software, firmware, and remote access
Local distribution is excluded
DOE may impose conditions on installed equipment, including isolation, disconnection, replacement, or removal

Key Dates

September 9, 2026: DOE RFI published (91 FR 57322); comments were due October 9
~December 24, 2026: DOE implementing rules due
~February 22, 2027: FAR Council recommendations due

What Utilities Should Be Doing Now

Treat installed fleets as in scope: inventory transformers, breakers, relaying, and turbines for country-of-origin exposure, since the order reaches equipment already in service.
Protect in-flight procurement: flag pending transmission and inverter purchases and document timing, contracting milestones, equipment status, reliability constraints, replacement options, and possible mitigation.
Track the prequalified vendor list: align sourcing with DOE's list and Covered Foreign Entity determinations once published.

On September 10, 2026, FERC approved CIP-014-4, replacing CIP-014-3 effective October 1, 2028. The revision addresses inconsistent approaches to identifying which transmission stations, substations, and primary control centers are critical to BPS operation.

Areas Requiring Gap Assessment

Transmission station criticality methodology
Instability and uncontrolled separation assumptions
Third-party verification procedures
Documentation supporting inclusion and exclusion decisions

What Utilities Should Be Doing Now

Launch a gap assessment: test prior inclusion and exclusion determinations against the new criticality methodology and verification requirements.
Update threat scenarios: reconcile physical security plans with ballistic, drone/UAS, sabotage, and coordinated attack scenarios.
Assign joint ownership: bring NERC compliance, transmission planning, physical security, and enterprise risk into one workstream.
Sequence to the effective date: prioritize sites likely to change criticality status.

On September 30, 2026, FERC approved PRC-029-2 under Docket RD26-10, revising the frequency and voltage ride-through requirements of PRC-029-1 in response to Order No. 909.

What Changed

Narrow exception for VSC-HVDC-connected IBRs with choppers, conditioned on a hardware capability floor
Clarified hardware limitation exemption under R4, including long-lead projects designed before PRC-029-1 requirements were known
Clarified acceptable evidence for documenting legacy hardware limitations
IBRs in service by the PRC-029-1 effective date must document exemptions within 12 months of that date

What Utilities Should Be Doing Now

Inventory exposure: identify owned IBR assets and third-party IBR PPAs subject to the standard, and calendar exemption documentation deadlines.
Validate settings: compare dynamic models against field inverter settings, firmware versions, and plant controller behavior.
Engage OEMs and counterparties: confirm OEMs can supply settings, firmware history, and control logic, and review PPA and interconnection language assigning compliance responsibility.
Assess firmware provenance: evaluate inverter OEM supply chains alongside the July 2026 FCC Covered List action on foreign-produced inverters.

On September 19, 2026, NERC announced that the Phase I Computational Load standards (Project 2026-02) passed initial ballot. The project addresses reliability risk from data centers, AI compute clusters, and cryptocurrency facilities. NERC targets Board adoption and FERC filing in Q4 2026.

What Is in Phase I

Three new standards, CLO-001-1, CLO-002-1, and CLO-003-1, plus FAC revisions
Two new registered functions: Computational Load Owner (CLO) and Computational Load Operator (CLOP)
Core focus on voltage and frequency ride-through behavior

What Utilities Should Be Doing Now

Update interconnection studies: model abrupt load loss, rapid ramping, and restoration scenarios.
Secure rights in agreements: require telemetry, operational contacts, dynamic models, ride-through, staged restoration, and emergency curtailment provisions.
Clarify obligations: identify customers likely to register as CLO or CLOP and define the split of responsibilities.
Coordinate pipeline assumptions: align with transmission planning, balancing authorities, and reliability coordinators.

On September 24, 2026, DOE announced intent to fund 31 projects across 26 states under SPARK, the third round of GRIP, with $1.9B in federal funding and $5.25B in total including cost share. Selections favor capacity gains within existing rights of way: more than 1,500 miles reconductored or rebuilt, GETs across nearly 21,000 miles, and more than 23 GW of added capacity.

Why It Matters for Non-Recipients

SPARK sets a benchmark for lower-footprint capacity additions. Regulators may ask why advanced conductors, dynamic line ratings, and similar options were not evaluated before conventional rebuilds, affecting prudence reviews and cost recovery.

What Utilities Should Be Doing Now

Screen transmission plans: identify reconductoring, advanced conductor, and GET candidates and refresh cost-benefit cases.
Prepare a regulatory rationale: document why conventional rebuilds are preferred where SPARK-type options are not selected.
Secure new OT assets: treat DLR sensors, power-flow controllers, and optimization software as connected OT, assessing vendor cyber posture, country of origin, and remote access paths before deployment, consistent with EO 14421.

H.R. 7266

Rural & Municipal Utility Cybersecurity Act

Passed out of the House Energy & Commerce Committee unanimously on March 5, 2026. This bipartisan bill reauthorizes the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program and authorizes $250 million over five years to help rural co-ops and small municipal utilities deploy advanced cybersecurity technologies and participate in threat information-sharing programs.

H.R. 7272

Pipeline Cybersecurity Preparedness Act

Sponsored by Reps. Randy Weber (R-TX) and Debbie Dingell (D-MI) and advanced out of the House Energy & Commerce Committee on March 5, 2026, this bill directs the Department of Energy to establish policies, procedures, and programs to enhance the cyber and physical security of the nation's pipeline infrastructure, in consultation with federal agencies and industry stakeholders.

H.R. 7305

Energy Threat Analysis Center (ETAC) Expansion

Sponsored by Reps. Laurel Lee (R-FL) and Greg Landsman (D-OH) and cleared the House Energy & Commerce Committee on March 5, 2026, this bill expands DOE's organizational mandate to formally assign energy emergency and security functions, including cybersecurity, infrastructure resilience, emerging threats, and emergency response.

On October 1, 2026, DOE CESER announced a $100M Rural and Municipal Utility Advanced Cybersecurity (RMUC) partnership funding not-for-profits that support cooperatives, municipal utilities, and small IOUs. On September 14, CESER named Frenos, Raptor Dynamix, and Bastazo as SENTRY award recipients, covering energy risk quantification, ICS/OT security, and counter-drone capability.

Why It Matters

DOE's SENTRY framework links NIST CSF and C2M2 maturity data to OT attack paths and reliability indices such as SAIDI and SAIFI, previewing how boards and regulators may expect cyber risk to be expressed.

What Utilities Should Be Doing Now

Pursue or benchmark RMUC support: eligible utilities should identify not-for-profit partners; others should benchmark against DOE-listed capabilities.
Converge cyber and physical operations: connect SOC, OT monitoring, physical security, drone detection, and substation alarm workflows.
Quantify in operational terms: link control gaps, including supplier and product vulnerabilities, to reliability indices and restoration time.
Track H.R. 7266: the Rural and Municipal Utility Cybersecurity Act would extend RMUC through FY2030.

On September 14, 2026, EPA finalized a partial repeal of the 2024 Carbon Pollution Standards, eliminating most requirements, including CCS-based limits for existing coal and new gas units. EPA also proposed rescinding the remaining power-sector GHG findings and Section 111 standards. That proposal is not yet in effect, and litigation is expected.

Utility action: update compliance matrices and IRP scenarios to reflect the final repeal only, retain regulatory-change scenarios given expected litigation, avoid terminating projects still supported by state requirements, permits, or corporate commitments, and track the 45-day comment period once the proposal publishes.

Threat Intel Updates & Highlights

What we saw this quarter.

223

Cybersecurity incidents affecting the US critical infrastructure supply chain, identified by Fortress during Q3.

75Data breachesVarying from ransomware to data exposures.

19Vendor breach surveysBreach-outreach surveys sent to affected vendors.

4were related torollup updates and critical severity vulnerabilities within US CI supply chains

144were related tothreat activity targeting organizations within US CI supply chains

6,602

Across All Industries

Overall, Fortress observed 6,602 cybersecurity incidents across all industries during Q3 — the full-spectrum backdrop against which supply-chain risk is now measured.

Industrial energy infrastructure at night — Threat Focus

Iranian PLC Campaign Targets Multiple Vendors

AA26-097A updated July 22: Siemens, Schneider, Rockwell targeted. Energy sector specifically named
Multiple state water systems hit with PLC passwords and IPs changed to lock out operators
AA26-231A: AI-generated Snap7 scripts probing exposed Siemens S7 PLCs in water and energy

Cisco ISE Zero-Day Leads Edge Device Surge

CVE-2026-76460 (CVSS 10.0): one unauthenticated API request yields root on ISE with no workaround
Added to CISA KEV Sept 16 with a 3-day deadline and forensic triage requirement
Cisco FMC, SonicWall SMA1000, NetScaler, BIG-IP APM also exploited

Cl0p Mass-Exploits PTC Windchill PLM

CVE-2026-12569 pre-auth RCE in Windchill/FlexPLM
0-day in June, followed by PoC and mass exploitation starting July 20
40+ victims named, including GE, Shell, and Philips. CAD, designs, and BOM data stolen
Windchill is embedded across OEMs and industrial suppliers in the utility supply chain

Recommendations

Take OT off the internet wherever possible

Inventory Rockwell, Siemens S7, and Schneider PLCs
Remove public exposure, change default passwords, and find undocumented cellular modems

Harden network devices

Apply AA26-194A router hygiene: disable Cisco Smart Install, replace default SNMP strings, and enforce unique device credentials

Patch and hunt at the edge

Prioritize Cisco ISE, Check Point, SonicWall SMA, NetScaler, and BIG-IP APM
Restrict management interfaces and run compromise assessments

Drive vendor outreach

Identify suppliers running Windchill/FlexPLM and OEMs named by Cl0p
Require authentication and rate limiting on customer-facing APIs

Fortress Platform Updates

Enhancements: AI Monitoring Results You Can Trust

Enhancements: AI Monitoring Results You Can Trust
Available now in AI Monitoring - Available to all AI Monitoring customers
More precise findings, clearer reasons, cleaner reports.
This quarter we made a broad set of quality improvements to AI Monitoring reports so every finding is better supported and easier to act on:

Sharper findings: Fourth-party breach results focus on incidents caused by a supplier, with a plain-language reason each incident was accepted or rejected. Exposed cloud storage is reported only after confirming the bucket belongs to your vendor, and credential exposure findings look for evidence the credentials are the vendor's. Breach history is now listed in full.
Clearer write-ups: Board of directors results state whether the board holds governance, risk and compliance responsibilities and name the relevant committees. MFA and login checks weigh all available evidence together, and quality certifications like ISO 9001, ISO 14001, AS9100 and NADCAP now count as compliance evidence.
Faster foreign ownership checks on large companies with complex ownership structures.

Check out our interactive demo to see how it works!

Enhancements: First-and Third-Party Manufacturing Locations

Available now in AI Monitoring - Available to all AI Monitoring customers
Know where your vendors, and their suppliers, make things.
Manufacturing location checks are now automated and run across any vendor, split into two views of risk. The first covers locations the vendor operates themselves. The second is new: many vendors don't make anything themselves, but the suppliers they rely on do. AI Monitoring now identifies a vendor's significant third-party suppliers, finds where they manufacture, and scores the risk by country.

Upcoming: Configurable Risk Scoring Bands

Coming soon in Cyber GRC Risk Register
Your scoring model, your bands.
Risk Register administrators will be able to set their own risk scoring bands instead of using static ones. A new Risk Matrix Score tab lets admins adjust the lower and upper bounds for each risk level, with labels and colors staying in sync with your severity settings. Validation ensures every score from 1 to 25 is covered with no gaps or overlaps. On save, you choose whether new bounds apply to existing risks or only going forward, and a change history is kept for auditing.

Upcoming November 2026: The Command Center Action Queue

Launching November 2026 in Fortress Command - Available to Cloud customers - Contact your Account Representative to enable it
Know what needs your attention, and act on it.
The Action Queue, the first release of the new Command Center, brings escalations, breaches, findings, and overdue assessments into one prioritized list with the most urgent items at the top.

AI summaries: each item explains what happened and where things stand, so you don't need to open five records.
Act in place: reassign to a teammate, escalate to the vendor, or review and update a finding without leaving the page.
Filters and bulk actions to focus your day, plus full activity history on any item.

Once enabled, you can launch Fortress Command directly from the Fortress Platform.

Upcoming Early 2027: Fortress Assistant

Launching early 2027 in Fortress Command
Any record, any metric, any answer about your program. Just ask.
Fortress Assistant is an AI assistant built into Fortress Command. Ask in plain language and get answers from your program data: a specific vendor or engagement, how many findings are past due, where your assessments stand. Open it as a floating window, dock it as a sidebar, or go full screen. It picks up the page you're on, and it can be set up to recognize your team's own terminology.

Client Success Story

Elevating Decision Confidence with AIM Premium Evidence

A Fortress client asked for an AIM Premium report to quickly understand a critical vendor’s cybersecurity posture. The assessment surfaced a significant finding that warranted deeper discussion, and the client requested a follow-up call to review the details.

Our AIM Team went the extra mile—expanding the analysis and compiling additional, corroborating evidence beyond the original request. We clearly articulated the risk, the affected controls, and the potential business impact, providing transparent rational and traceable documentation the client could take to stakeholders.

What we delivered:

A consolidated evidence pack with source references and control mapping to clarify the “why” behind the finding.
A decision-ready summary that outlined remediation options, potential compensating controls, and stakeholder talking points.

Impact:

Clarity and confidence: The enhanced evidence package put all the relevant facts on the table.

Actionable decision-making: With a complete view of the risk, the client moved forward with informed business decisions.

By pairing AIM Premium with above-and-beyond evidence gathering, we transformed a single finding into decision‑grade insight—helping the client act swiftly and decisively.

Within the Walls

In This Edition

Safety Minute