Registered entities must report to NERC on the cyber assets present on their systems and the potential impact of adding security monitoring software.