Key takeaways
- CIP-014-3 is the standard enforced today, but a successor is already locked in.
- Don't assume a small identified-facility count means light compliance burden.
NERC CIP-014-3, "Physical Security," is the mandatory, FERC-approved Reliability Standard requiring utilities to identify and protect the small subset of Transmission stations, Transmission substations and their associated primary control centers whose loss to a physical attack could most damage grid reliability. Per its own Purpose clause, it exists "to identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in instability, uncontrolled separation, or Cascading within an Interconnection." Unlike CIP-006, which governs physical access control for BES Cyber Systems generally, CIP-014 targets a narrow, risk-assessed population of the grid's most structurally critical transmission facilities. CIP-014 traces to FERC Order No. 802, issued in November 2014 after reported physical attacks on electric substations; the currently effective version, CIP-014-3, reflects a 19 January 2022 revision approved by FERC via Letter Order on 16 June 2022 (Docket No. RD22-3-000).
Who must comply
CIP-014 applies to Transmission Owners that own a Transmission station or Transmission substation meeting any of four bright-line criteria mirroring CIP-002-5.1's Medium Impact threshold: facilities operated at 500 kV or higher; facilities operating between 200-499 kV at a single station connected at 200 kV or higher to three or more other stations, with an "aggregate weighted value" (summed per a voltage-based weighting table) exceeding 3000; facilities identified by a Reliability Coordinator, Planning Coordinator or Transmission Planner as critical to Interconnection Reliability Operating Limits; and facilities essential to Nuclear Plant Interface Requirements. Transmission Operators are also applicable, but only once notified under Requirement R3 that they operate a primary control center for an identified facility. Facilities within a protected area covered by an NRC- or Canadian Nuclear Safety Commission-approved security plan are exempt. The standard's own guidance notes the Standard Drafting Team "expects this population will be small" — many Transmission Owners that meet the applicability criteria will not identify any qualifying facility at all.
The six requirements, in sequence
CIP-014-3's requirements form a linear pipeline, each gated on the prior one's completion:
| Req. | VRF | What it requires | Key timeline |
|---|---|---|---|
| R1 | High | Risk assessment (transmission analysis) identifying facilities whose loss could cause instability, uncontrolled separation or Cascading, plus identification of each facility's primary control center | Subsequent assessments every 30 months (if a prior one found a critical facility) or 60 months (if not) |
| R2 | Medium | Unaffiliated third-party verification of the R1 assessment, with confidentiality procedures for sensitive information | Verification within 90 days of R1; additions/removals addressed within 60 days of verification |
| R3 | Lower | Notify the Transmission Operator of a primary control center identified in R1/verified in R2 (or its removal) | Within 7 calendar days of R2 completion |
| R4 | Medium | Evaluate potential threats and vulnerabilities, considering unique facility characteristics, prior attack history, and intelligence/threat warnings | No fixed deadline, but feeds R5 |
| R5 | High | Develop and implement a documented physical security plan: deter/detect/delay/assess/communicate/respond measures, law enforcement contact info, an execution timeline, and provisions for evolving threats | Developed within 120 calendar days of R2 completion |
| R6 | Medium | Unaffiliated third-party review of the R4 evaluation and R5 plan | Within 90 days of R5 completion; recommended changes addressed within 60 days |
R2 and R6's "unaffiliated" requirement is strict: the verifying or reviewing entity cannot be a corporate affiliate or an internal functional division of the Transmission Owner or Operator, though a governmental entity may use another governmental entity within the same political subdivision. R6 reviewers specifically must hold a Certified Protection Professional (CPP) or Physical Security Professional (PSP) certification (if a private firm), or come from an ERO-approved organization, a governmental agency, or an entity with demonstrated law enforcement, government or military physical security expertise. Per the Compliance section, Transmission Owners and Operators must retain evidence for each requirement for three calendar years.
CIP-014-4 is already approved — a 2028 compliance clock
CIP-014-3 is the standard enforced today, but a successor is already locked in. Reports of physical attacks on electric substations increased sharply in late 2022 — including the 3 December 2022 attacks in Moore County, North Carolina and November 2022 incidents at several Pacific Northwest substations — prompting FERC, in a December 2022 order, to direct NERC to evaluate whether CIP-014-3's Applicability criteria, risk-assessment requirements, and the case for a mandatory minimum physical-security baseline needed strengthening. NERC's resulting April 2023 evaluation report found the Applicability criteria "broad enough to capture the subset of applicable facilities" and did not recommend expanding them, and recommended against a fixed minimum baseline — reasoning that "[e]ffective physical security plans should align with the risks intended to be mitigated" rather than a one-size-fits-all floor. It did, however, flag that "registered entities have inconsistent approaches to performing the risk assessment" because CIP-014-3's Requirement R1 "does not prescribe a specific method" or define the components of supporting analysis.
NERC's Project 2023-06 (Risk Assessment Refinement) addressed that specificity gap, and on 10 September 2026 FERC approved the result as CIP-014-4 (Docket No. RD26-9-000, 91 FR 58430), finding it "improves the reliability of the Bulk-Power System by providing a consistent approach for identifying and assessing" critical facilities. Six requirements become ten (three new), though the underlying R2-R6 obligations carry forward essentially unchanged as new R6-R10:
- R1 moves facility-list review to a single 36-calendar-month cycle (covering existing facilities and those planned within 36 months), explicitly aligned with the annual planning-assessment cycle under Reliability Standard TPL-001 "to avoid confusion from gaps between models and study horizons."
- R2 (new) requires each Transmission Owner to "identify proximate existing Bulk Electric System (BES) Transmission station(s) and BES Transmission substation(s), irrespective of ownership, within 1500 feet or 457 meters (the shortest distance, measured substation fence line to substation fence line)" — a distance NERC selected based on the Department of Homeland Security/Department of Justice "Bomb Threat Stand-Off Card." This proximate-facility list feeds the new R5 risk assessment.
- R3 (new) requires a documented risk-assessment methodology with technically justified thresholds for instability, uncontrolled separation or Cascading, and specified simulation parameters — steady-state and dynamic simulations at both a system peak and off-peak load case, accounting for factors such as prior loss of communication and Protection Systems, faults, and clearing times.
- R4 (new) requires Transmission Owners with jointly owned applicable facilities to coordinate and document individual and joint responsibilities under R3 and R5.
- R5 consolidates R1's former 30/60-month periodicity into a single 36-month cycle for every Transmission Owner — shortening the maximum reassessment interval for entities that previously found no critical facility from 60 months to 36 — and folds in the R2 proximate-facility list.
- R6 through R10 carry forward CIP-014-3's R2 through R6 "without substantive revision," per FERC's order.
Per FERC's approval, CIP-014-4 "become[s] effective on the first day of the first calendar quarter that begins 24 calendar months after the Commission's approval order takes effect," which the order's own text sets at 1 October 2028 — the date at which CIP-014-3 retires immediately beforehand. Under the approved implementation plan, the initial risk assessment required under the new Requirement R5 must be completed on or before that effective date, with subsequent assessments following no later than every 36 calendar months after.
A workable starting point
Don't assume a small identified-facility count means light compliance burdenThe Standard Drafting Team expects most Transmission Owners to identify few or no qualifying facilities, but R2 through R6's unaffiliated-third-party verification, threat evaluation, physical security plan, and third-party review obligations are substantial for any facility that is identified. Track the R1→R2→R3→R4/R5→R6 dependency chain as a single pipeline, since every downstream deadline (R2's 90 days, R3's 7 days, R5's 120 days, R6's 90 days) is measured from the prior step's completion date, not from a fixed calendar date. Start mapping proximate facilities within 1,500 feet now, ahead of CIP-014-4's R2Even though CIP-014-4 isn't enforceable until 1 October 2028, identifying which BES stations and substations — regardless of ownership — sit within that radius of an already-identified critical facility is independent groundwork that doesn't require waiting for the compliance date. Verify reviewer credentials carefully for R6The CPP/PSP certification requirement is specific to privately engaged security firms; a governmental agency or demonstrated law-enforcement/military entity does not need that certification, but still must be genuinely unaffiliated with the Transmission Owner or Operator. Treat CIP-014-4's consolidated 36-month cycle as a scheduling change worth planning for early, particularly for Transmission Owners currently on the 60-month track for having found no critical facility — that cadence shortens once CIP-014-4 takes effect.
SoftWSP's OT asset assessments can help document the risk assessment, third-party verification, and physical security plan evidence CIP-014 requires: see OT Snapshot.
This guide quotes NERC's own published text of CIP-014-3 and the Federal Register text of FERC's order approving CIP-014-4; it is not a substitute for the full standard, NERC's implementation plan, or compliance/legal advice. CIP-014-3 remains the enforceable standard as of this guide's publication — CIP-014-4 is approved but not yet mandatory.
Sources
- NERC: CIP-014-3 — Physical Security (currently effective standard, full text: Purpose, Applicability, Requirements R1-R6 with Measures, Compliance, Violation Severity Levels, Guidelines and Technical Basis, Version History)
- Federal Register: Order Approving Reliability Standard CIP-014-4, 91 FR 58430 (FERC, Docket No. RD26-9-000, issued 2026-09-10, published 2026-09-15) — approves CIP-014-4, its implementation plan (effective 1 October 2028), VRFs/VSLs, and CIP-014-3's retirement
Frequently asked questions
What is NERC CIP-014-3, and who must comply?
CIP-014, "Physical Security," is the mandatory, FERC-approved NERC Reliability Standard requiring utilities to identify and protect the small subset of Transmission stations, Transmission substations and their associated primary control centers whose loss to a physical attack could be most damaging to grid reliability. Per its own Purpose clause, it exists "to identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in instability, uncontrolled separation, or Cascading within an Interconnection." It applies to Transmission Owners whose facilities meet bright-line criteria mirroring CIP-002-5.1's Medium Impact threshold — 500 kV or higher; 200-499 kV facilities connected to three or more other stations with an aggregate weighted value exceeding 3000; facilities identified as critical to Interconnection Reliability Operating Limits; or facilities essential to Nuclear Plant Interface Requirements — plus Transmission Operators that are notified they operate an affected primary control center. Facilities within an NRC- or Canadian Nuclear Safety Commission-approved security plan's protected area are exempt. The currently effective version, CIP-014-3, reflects a 19 January 2022 revision approved by FERC via Letter Order on 16 June 2022 (Docket No. RD22-3-000).
What do CIP-014-3's six requirements actually require?
R1 (VRF High) requires each applicable Transmission Owner to perform an initial and subsequent risk assessments — a transmission analysis identifying which facilities, if rendered inoperable or damaged, could cause instability, uncontrolled separation or Cascading — repeated at least every 30 calendar months if a prior assessment identified a critical facility, or every 60 calendar months if it did not, plus identification of the primary control center operating each identified facility. R2 (VRF Medium) requires an unaffiliated third party to verify that risk assessment within 90 calendar days, with any recommended additions or removals addressed (adopted or technically justified) within 60 days. R3 (VRF Lower) requires notifying the relevant Transmission Operator within 7 calendar days of R2's completion. R4 (VRF Medium) requires evaluating potential threats and vulnerabilities, considering the facility's unique characteristics, prior attack history, and intelligence or threat warnings from sources such as law enforcement or the Electricity Information Sharing and Analysis Center. R5 (VRF High) requires developing and implementing a physical security plan — covering deter/detect/delay/assess/communicate/respond measures, law enforcement contact information, an execution timeline, and provisions for evolving threats — within 120 calendar days of R2's completion. R6 (VRF Medium) requires an unaffiliated third party (holding a Certified Protection Professional or Physical Security Professional certification, or otherwise ERO-approved, governmental, or law-enforcement/military-qualified) to review the R4 evaluation and R5 plan within 90 days. Evidence for all six requirements must be retained for three calendar years.
Is CIP-014-3 already being replaced, and what changes under CIP-014-4?
Yes — CIP-014-4 is already FERC-approved, though CIP-014-3 remains the enforceable standard today. CIP-014 originated from FERC Order No. 802 (November 2014), issued after physical attacks on electric substations; a further wave of attacks in late 2022 (including the December 2022 Moore County, North Carolina incident) led FERC to direct NERC, in a December 2022 order, to re-evaluate CIP-014-3's effectiveness. NERC's resulting April 2023 report found the Applicability criteria adequate but flagged "inconsistent approaches to performing the risk assessment" due to a lack of specificity in Requirement R1, which fed NERC's Project 2023-06 revision. On 10 September 2026, FERC approved Reliability Standard CIP-014-4 (Docket No. RD26-9-000, published in the Federal Register at 91 FR 58430), expanding six requirements to ten (three new). Requirement R1 moves to a single 36-calendar-month facility-list review cycle aligned with the TPL-001 annual planning cycle; new Requirement R2 requires identifying proximate Bulk Electric System stations and substations within 1,500 feet (457 meters) of an identified facility — a distance NERC based on the DHS/DOJ Bomb Threat Stand-Off Card; new Requirement R3 requires a documented risk-assessment methodology with technically justified instability thresholds and specified steady-state/dynamic simulation scenarios; new Requirement R4 requires coordination between Transmission Owners that jointly own an applicable facility; Requirement R5 consolidates the 30/60-month periodicity into a single 36-month cycle incorporating proximate facilities; and Requirements R6-R10 carry forward CIP-014-3's R2-R6 without substantive revision. Per FERC's order, CIP-014-4 takes effect 1 October 2028, with CIP-014-3 retiring immediately beforehand; the initial Requirement R5 risk assessment must be completed on or before that effective date, with subsequent assessments following at least every 36 calendar months after.
In this cluster
