NERC CIP-006: physical security for BES cyber systems, explained

CIP-006 applies to Balancing Authorities, Distribution Providers that own certain load-shedding, special protection, under-voltage/under-frequency load-shedding, or Transmission Protection Systems, Generator Operators and Owners, Interchange Coordinators/Authorities, Reliability Coordinators, and Transmission Operators and Owners. The substantive obligations attach to High and Medium Impact BES Cyber Systems — categorized under the separate CIP-002 process — plus their associated Physical Access Control Systems (PACS) and, for several parts, Electronic Access Control or Monitoring Systems (EACMS) and Protected Cyber Assets (PCA).

Requirement R1 requires "one or more documented physical security plan(s) that collectively include all of the applicable requirement parts in CIP-006-6 Table R1 — Physical Security Plan." The ten parts scale obligations by impact rating and connectivity:

Part 1.10 traces to a FERC directive and a NERC-petitioned interpretation (Docket No. RD10-13-000) that identified encryption and circuit monitoring as acceptable alternatives when physical cable protection isn't feasible — entities should not assume cabling restriction is the only compliant option.

Requirement R2 requires a documented visitor control program with three parts, scoped to High and Medium Impact systems with External Routable Connectivity:

• Part 2.1 — "Require continuous escorted access of visitors ... within each Physical Security Perimeter, except during CIP Exceptional Circumstances."
• Part 2.2 — "Require manual or automated logging of visitor entry into and exit from the Physical Security Perimeter that includes date and time of the initial entry and last exit, the visitor's name, and the name of an individual point of contact," except during Exceptional Circumstances.
• Part 2.3 — "Retain visitor logs for at least ninety calendar days."

Requirement R3 requires "maintenance and testing of each Physical Access Control System and locally mounted hardware or devices at the Physical Security Perimeter at least once every 24 calendar months to ensure they function properly," for High Impact systems and Medium Impact systems with External Routable Connectivity. Unlike the 90-day log retention in R1 and R2, this is a recurring functional-test cycle, not a records-retention window — a badge reader that logs correctly but hasn't been functionally tested in over two years is a gap under R3 even if its access logs look complete.

Per CIP-006-6's Compliance section, "the applicable entity shall retain evidence of each requirement in this standard for three calendar years" — the same retention period used across the CIP suite (see CIP-010 and CIP-011). This three-year evidence window is separate from, and longer than, the 90-day log retention that R1 Part 1.9 and R2 Part 2.3 require for the underlying access and visitor logs themselves — entities need a process to preserve or summarize 90-day logs into evidence that survives for the full three-year compliance retention period.

CIP-006-6 is the standard enforced today, but a successor is already locked in. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), approving 11 modified CIP Reliability Standards together as part of NERC's Project 2016-02 virtualization package — published in the Federal Register on 24 March 2026 at 91 FR 13957, naming "CIP-006-7.1 (Cyber Security—Physical Security of BES Cyber Systems)" alongside CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3. The order itself states "this final action is effective May 26, 2026."

Per NERC's implementation plan, the revised standards take effect on the later of 1 April 2026 or "the first day of the first calendar quarter that is 24 months after" the order's effective date. NERC's own July 2026 Standards, Compliance, and Enforcement Bulletin confirms the resulting literal date, listing "CIP-006-7.1 – Cyber Security — Physical Security of BES Cyber Systems" among standards for which "the revised standards will become effective July 1, 2028." The package's substantive driver is the same across all 11 standards: four new NERC Glossary terms (Cyber System, Management Interface, Shared Cyber Infrastructure, Virtual Cyber Asset) and revisions to existing defined terms, needed so the CIP suite applies cleanly to virtualized infrastructure. This guide found no indication that CIP-006's R1-R3 substantive physical-security obligations change beyond that scoping update — confirm exact redlined wording against NERC's and FERC's own published CIP-006-7.1 text before compliance planning.