IBR standards advance; station-control cybersecurity takes priority
P&C Engineering Brief · October 3–9, 2026. Primary-source facts and editorial engineering implications. Prepared for owner review.
1. NERC advances IBR planning and operating standards
On October 8, the NERC Board adopted proposed revisions to FAC-011-5, TOP-003-9 and TPL-001-6 concerning IBR modelling, operating data and IBR/DER planning assessments. EOP-012-4 adds Canadian-specific cold-weather provisions. Board adoption does not itself establish an Ontario compliance deadline.
Engineering implication: Retain model versions with as-left inverter, plant-controller and relay settings. Verify operational telemetry and mode indications; use approved studies to determine any protection-setting changes.
2. Legacy Hitachi Energy RTU500 cybersecurity advisory
CISA republished the advisory October 6. Findings concern end-of-life CMU 9.x firmware; 11.x and earlier are considered likely affected. Supported versions are reported unaffected. CVE-2026-8065 and CVE-2026-8066 permit arbitrary firmware upload and file overwrite respectively. The advisory recommends 12.7.8, 13.9.1 or the latest applicable version.
Engineering implication: Inventory hardware, firmware and spares. Follow vendor-supported upgrade paths and approved change control. Back up configurations, then validate controls, interlocks, point maps, SOE timing, alarms and redundancy.
3. openPDC and openHistorian service-console exposure
CISA published ICSA-26-281-02 on October 8, following GPA's July disclosure. Unsafe deserialization affects openPDC 2.9.481 and earlier and openHistorian 2.8.584 and earlier. Console access on default port 8500 can permit code execution with service privileges; authentication depends on configuration. Fixes are openPDC 2.9.482+ and openHistorian 2.8.585+.
Engineering implication: Restrict console access and apply least privilege. After a controlled upgrade, verify PMU mappings, IEEE C37.118 stream continuity, timestamp alignment, quality flags and historian completeness.
4. Hydro One proposes its 2028–2032 investment plan
Hydro One filed its joint transmission and distribution application October 7 under OEB proceeding EB-2026-0164 for January 2028–December 2032. Proposed work includes approximately 1,400 km of transmission-line upgrades and smart outage detection, isolation and restoration devices on 90% of major distribution lines. Investments and rates remain subject to OEB review.
Engineering implication: Review filing evidence for actual protection and automation scopes. Automated restoration warrants coordination checks across alternate feeds, setting-group validation, control-authority and interlock tests, and loss-of-communications tests. The announcement does not establish any particular process-bus design.