Topic starter
11/07/2026 8:37 pm
TL;DR: The NERC 2025 ERO Reliability Risk Priorities Report says cyber and physical security complexity is now one of the most urgent threats to the North American bulk power system as interconnected digital systems, AI-driven loads, and siloed controls expand the attack surface, according to AlertEnterprise. Unified identity, access, and resilience controls are becoming a reliability requirement, not just a security preference.
Editorial analysis by NHI Mgmt Group, based on content published by AlertEnterprise: “Cyber & Physical Security: A Critical Reliability Risk”.
Key questions
Q: What breaks when cyber and physical access are governed separately in critical infrastructure?
A: Separate governance usually breaks at the handoff points.
Q: Why do AI-driven loads increase reliability risk for critical infrastructure?
A: AI-driven loads increase reliability risk because they expand the number of connected systems, trust relationships and identities that support operations.
Q: How can utilities tell whether converged access governance is working?
A: It is working when cyber, physical and operational access decisions produce one consistent outcome across onboarding, access review and offboarding.
Practitioner guidance
- Define a converged access governance model Create one ownership model for cyber, physical and operational identity decisions so that account approval, badge issuance and privileged access are assessed together.
- Map shared access paths across critical operations Inventory where workforce, contractor, service and operational identities can reach facilities, digital systems and control environments, then document the overlaps.
- Test offboarding across all security domains Validate that account disablement, badge revocation and contractor termination all remove access in the same control window.
Bottom line: The article frames cyber-physical convergence as a reliability issue because fragmented access governance leaves critical infrastructure with blind spots across cyber, physical and operational domains.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:05 pm
Cyber-physical convergence is now an identity governance problem, not just a security architecture problem. The article's most important shift is that access decisions now cross environments that were once managed separately. When identity, badge and operational access are governed in silos, no single team owns the true blast radius. For utilities, the practitioner conclusion is that converged identity governance is becoming part of reliability engineering.
A question worth separating out:
Q: Which teams should own cyber-physical convergence risk?
A: Accountability should sit with the teams that can see the whole access path, not just one part of it. In practice that means security, identity, physical security and operational owners sharing a governance model with clear decision rights. If each team only owns its own control, convergence risk stays fragmented and unresolved.
👉 Read our full editorial: Cyber and physical security convergence is now a grid reliability issue