FERC Approves Revised CIP-014-4 Standard for Physical Security

PDF

On September 10, 2026, FERC issued an order approving NERC’s proposed revisions to the NERC CIP-014-4 (Physical Security) standard, along with the associated implementation plan, VRFs, and VSLs. In response to reports of increased physical attacks on electric substations in late 2022, NERC had filed an evaluation report with FERC in April 2023. In its CIP-014 Report, NERC recommended a holistic approach that “pairs physical security controls with complementary reliability and resiliency measures—such as response readiness and spare-equipment strategies—to mitigate the impact of physical attacks, rather than adopting minimum protections applicable to all Bulk-Power System transmission stations, substations, and primary control centers.” On July 16, 2026, NERC filed a petition for FERC approval with clarifying revisions to CIP-014-3. This order approves NERC’s petition.

The updated CIP-014-4 will become effective on the first day of the calendar quarter 24 months after the approval order takes effect (i.e., publication in the Federal Register). Under NERC’s approved implementation plan, the initial risk assessments required under Requirement R5 must be completed on or before that effective date, with subsequent risk assessments due no later than 36 months after that effective date.

Among other updates, key revisions in CIP-014-4 include:

• Applicability: Updated to include jointly owned transmission stations and substations.
• Requirement R1 requires a transmission owner to review and, if necessary, update its list of applicable transmission stations/substations at least once every 36 months
• Requirement R2 would require each transmission owner with an applicable transmission station or transmission substation identified under Requirement R1 to “identify proximate existing Bulk Electric System (BES) [t]ransmission station(s) and BES [t]ransmission substation(s), irrespective of ownership, within 1500 feet or 457 meters (the shortest distance, measured substation fence line to substation fence line).” The list of proximate facilities will inform the risk assessment required by Requirement R5.
• Requirement R3 would require each transmission owner to maintain “a documented risk assessment methodology for evaluating the loss of each applicable [t]ransmission station or [t]ransmission substation identified in Requirement R1.” The methodology would include three elements:
  • Documented criteria for assessing “instability, uncontrolled separation, or [c]ascading within an Interconnection,” with “technically justified thresholds identifying unacceptable generation and load loss;”
  • (2) A “provision that steady-state and dynamic simulations shall each be performed using at a minimum one System peak Load case and one System Off-Peak Load case;” and
  • (3) detailed specifications for simulations at applicable and proximate stations and substations, including assumptions regarding “[p]rior loss of communication and Protection Systems,” faults, and clearing times.
• Requirement R4 would require transmission owners with jointly owned applicable transmission stations or substations to coordinate to determine and document individual and joint responsibilities.
• Requirement R5 would consolidate the risk assessment periodicity—30 calendar months for transmission owners that previously identified a critical facility, or 60 calendar months for those that did not—into a single 36-calendar-month cycle. As NERC identifies, the 36-month cycle shortens the maximum reassessment interval from 60 months to 36 months, requiring more frequent reevaluation of facilities that may have become critical due to changed system conditions. Additionally, the single 36-month cycle harmonizes the CIP-014-4 risk assessment schedule with two other recurring cycles: (1) the cycle under Requirement R1 for updating the list of applicable facilities and (2) the annual planning-assessment cycle under Reliability Standard TPL-001. This avoids potential confusion arising from gaps between models and study horizons. Requirement R5 would further require that proximate stations and substations identified under Requirement R2 be included in the risk assessment.

To view the FERC order, click here. 

To view NERC’s petition for approval, click here.