Quebec’s energy regulator adopted CIP-015-1 and its Quebec annex on Hydro-Québec’s application in D-2026-097, August 24, 2026. The Quebec scope covers the main transmission network and specified distributor facilities. No interested party opposed adoption; the Régie questioned the coordinator’s risk assessment.
The standard addresses organizations that balance electricity supply and demand, distributors with covered protection or restoration equipment, generating-station owners and operators, reliability coordinators, and transmission owners and operators. Those categories do not make every system subject to every requirement.
The technical phrase “external routable connectivity” means a cyber system can be reached by another device outside its security boundary through two-way communications routed across that boundary. It does not necessarily mean unrestricted internet access.
High-impact cyber systems are covered with or without those connections; medium-impact systems must have them. Internal monitoring looks for unusual activity within the protected network.
Compliance requires documented processes. Operators must select network data feeds using a risk-based rationale, use them to detect unusual activity, evaluate the findings and determine further action. Subject to the standard’s exceptional-circumstances provisions, relevant monitoring data must be retained until that action is complete and protected against unauthorized deletion or alteration. This particular retention duty does not require keeping data unrelated to detected anomalies.
The annex exempts generating facilities rated at 300 megavolt-amperes or less only if none of their units can synchronize with a neighbouring grid, along with their step-up substations.
The coordinator considered simultaneous attacks on multiple smaller plants unlikely and their reliability impact limited, citing geographical dispersion, differing cybersecurity arrangements and the grid’s ability to withstand lost generation. The coordinator identified 34 additional plants, with about 5,149 megawatts installed, affected by the proposed 300-MVA rather than 75-MVA cutoff.
The Régie accepted the explanation, but said changing numbers and locations of small plants and modernized systems could alter the analysis. The threshold must be reassessed and justified whenever this exemption is proposed for a new or revised standard.
The adoption decision sets October 1, 2029 for specified control and backup-control centres, and October 1, 2031 for other covered externally routable systems.
A September 9 follow-up, D-2026-101, found the French and English texts filed August 31 reflected the adoption ruling. That document-conformity finding does not establish that operators have already completed the future cybersecurity requirements.
