Substation security: NERC CIP-014 in plain English.

Who it applies to

CIP-014-3 applies to Transmission Owners that own a station or substation meeting any one of four criteria, and to Transmission Operators once a Transmission Owner notifies them (section 4). The four criteria, in plain terms:

• 500 kV and above. Transmission Facilities operated at 500 kV or higher (a generating plant’s collector bus does not count).
• 200 to 499 kV, heavily connected. A single station at 200–499 kV connected at 200 kV or more to three or more other stations, where the connections’ “aggregate weighted value” exceeds 3000 (each line weighted 700 at 200–299 kV and 1300 at 300–499 kV).
• Critical to operating limits. Facilities identified by the Reliability Coordinator, Planning Coordinator or Transmission Planner as critical to deriving Interconnection Reliability Operating Limits.
• Nuclear interface. Facilities identified as essential to meeting Nuclear Plant Interface Requirements.

Facilities inside a Nuclear Regulatory Commission protected area and covered by an NRC-approved security plan are exempt. Meeting a criterion only means the owner must run the risk assessment; the heavier obligations apply only to stations that the verified assessment identifies as critical.

Distribution substations. CIP-014 is written for transmission stations that meet its criteria. The federal definition of the Bulk-Power System excludes facilities used in the local distribution of electric energy (18 CFR 39.1), so distribution sites fall outside it; state rules may apply to them instead.

The six requirements, in plain English

1. R1. Risk assessmentTransmission analyses of the stations that meet the criteria, existing and those planned within 24 months, to find any whose loss could result in instability, uncontrolled separation or cascading. Repeat at least every 30 calendar months if the last assessment found such a station, or every 60 months if it found none. Identify the primary control centre for each identified station.
2. R2. Unaffiliated third-party verificationA registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience, verifies the assessment within 90 calendar days. If the verifier recommends adding or removing a station, the owner has 60 days to change the list or document why not.
3. R3. Notify the operatorWhere the primary control centre is run by a separate Transmission Operator, notify that operator within 7 calendar days of the verification, and again if a station is later removed.
4. R4. Threat and vulnerability evaluationFor each identified station and its control centre, evaluate potential physical threats and vulnerabilities, considering the site’s characteristics, the history of attacks on similar facilities, and intelligence or threat warnings from law enforcement, the E-ISAC and government agencies.
5. R5. Physical security planWithin 120 calendar days of the verification: resiliency or security measures designed together to deter, detect, delay, assess, communicate and respond; law enforcement contact and coordination information; a timeline for the enhancements; and provisions to evaluate evolving physical threats.
6. R6. Unaffiliated third-party reviewA qualified reviewer (for example, an organisation with electric-industry physical security experience and at least one CPP- or PSP-certified reviewer, or a government agency with physical security expertise) reviews the R4 evaluation and the R5 plan within 90 days. The entity then has 60 days to adopt each recommendation or document why not.

Records are kept for three years. The standard also requires procedures, such as non-disclosure agreements, to protect sensitive information shared with the verifier and reviewer, and to protect the information developed under the standard from public disclosure (Parts 2.4 and 6.4). That is why this page covers requirements and process only.

What changes with CIP-014-4

FERC approved CIP-014-4 on 10 September 2026 (Docket RD26-9-000), effective 1 October 2028; CIP-014-3 stays in force until then. In outline:

• One cycle. Applicable stations identified, and the risk assessment repeated, at least every 36 months, replacing the 30- and 60-month cycles.
• Nearby stations. Owners identify nearby Bulk Electric System stations within 1,500 feet, fence line to fence line.
• A written method. A documented risk assessment method with technically justified thresholds and peak and off-peak cases.
• Joint ownership. Joint owners coordinate and document who is responsible for what.
• Same back half. The old R2 to R6 carry forward as R6 to R10 with the same 90-, 7-, 120-, 90- and 60-day timings.

Who enforces it

NERC and the Regional Entities are the compliance enforcement authorities, under FERC oversight, through section 215 of the Federal Power Act. Penalties may be monetary or non-monetary and must bear a reasonable relation to the seriousness of the violation (18 CFR 39.7).

What BSJ is not. BSJ Ventures is not a CIP-014 verifier or reviewer and does not perform physical security assessments of utility sites. This guide is a plain reading of the published standard.

Questions people ask

Does CIP-014 apply to every substation?

No. It applies to Transmission Owners whose stations meet one of four criteria: 500 kV and above; 200 to 499 kV stations connected to three or more other stations with an aggregate weighted value over 3000; stations critical to Interconnection Reliability Operating Limits; and stations essential to Nuclear Plant Interface Requirements. Distribution facilities are outside the federal Bulk-Power System.

How often is the CIP-014 risk assessment done?

Under CIP-014-3, at least every 30 calendar months if the last verified assessment identified a critical station, and at least every 60 months if it did not. From 1 October 2028, CIP-014-4 sets a single 36-month cycle.

Who can verify a CIP-014 risk assessment?

An unaffiliated third party that is a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning or analysis experience. Verification is due within 90 calendar days of completing the assessment.

What must a CIP-014 physical security plan contain?

Resiliency or security measures designed together to deter, detect, delay, assess, communicate and respond; law enforcement contact and coordination information; a timeline for the enhancements; and provisions to evaluate evolving physical threats. It is due within 120 calendar days of the verification, and an unaffiliated third party reviews it within 90 days.

When does CIP-014-4 take effect?

FERC approved CIP-014-4 on 10 September 2026 in Docket RD26-9-000, with an effective date of 1 October 2028. CIP-014-3 remains in force until then.

Primary sources

• NERC Reliability Standard CIP-014-3, Physical Security, approved by FERC 16 June 2022 (Docket RD22-3-000), effective 16 June 2022.
• NERC Reliability Standard CIP-014-4, adopted by the NERC Board 17 June 2026.
• FERC, Order Approving Reliability Standard CIP-014-4, Docket RD26-9-000, issued 10 September 2026, 91 FR 58430 (15 September 2026).
• 18 CFR Part 39 (sections 39.1 and 39.7), eCFR, current as of 12 October 2026.

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency or maker named here.