NERC CIP-014: Why You Need A Security Assessment & Plan

After the April 2013 attack on Pacific Gas and Electric Company’s (PG&E) Metcalf substation, the Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability Corporation (NERC) to ramp up physical security around electric substations. The resulting NERC CIP-014 Standard is an important step forward in proactively protecting electrical transmission assets across the nation from potential threats.

Traditionally, electrical substations are encompassed by a 7- or 8-foot-tall chain-link fence covered in a two-inch mesh. These fences serve as a physical barrier between the community’s public land and the substation, marking the station’s intended perimeter rather than acting as a deterrent from would-be trespassers. These fences are designed to protect the public from the station, not the station from the public. And because electrical substations are typically unmanned, these low-security fences are easy targets for trespassers to enter and attack the station, and escape virtually unnoticed.

After the Metcalf attack, the conversation of substation security highlighted the need for improved security standards. Under the CIP-014 guidelines, owners have until October 2015 to demonstrate compliance with Requirement 1, performing a risk assessment for critical substations.

Assessing Your Substation

Before deciding which plan of action is right for securing your substation, it’s important to evaluate the potential threats and vulnerabilities of physical attacks on your site. Remember, each station is different and provides a unique set of variables and a dynamic environment to consider. These factors can include climate, size of station and whether the substation is located in an urban or rural area. It’s also important to consider the variety of threats and vulnerabilities you might face, including vandalism, theft, weather and sabotage. If you’re not sure where to start, let us help!

Developing Your Plan

An effective, CIP-014 compliant security plan should address four basic security concepts:

• Deter – drive a potential threat to a softer and more accessible target
• Detect – identify a potential threat that may try to access the station
• Delay – slow that potential threat from reaching critical infrastructure
• Respond – react to a threat with law enforcement coordination and asset recovery

While some utilities may determine that greater redundancy is appropriate for greater security at their most important facilities, many owners and operators are focusing on an enhanced and hardened perimeter for substations — a relatively new design approach for the electrical transmission industry.

Hardening and improving the perimeter security at a substation can help transmission owners and operators achieve all four security concepts while also holistically enhancing their electrical substations.

What’s Next

Once you’ve determined that a hardened perimeter is the strategic security tactic you’d like to implement, the first step is to determine the look, feel and operation of the perimeter system. There’s not a one-size-fits-all approach, which makes planning for these general logistics a key process. One utility may prefer a solid perimeter with 100 percent opacity or a ballistic rating, while another determines a steel mesh with anti-cut and anti-climb properties is the right fit. Other physical changes may include adding intrusion detection, lighting or employing security forces.

Next week, I’ll walk through exactly what’s necessary to secure the perimeter of your substation, starting with the preliminary design and continuing through construction. In the meantime, download the project profile below for a peek at how a successful security program comes together, from planning to implementation.