When the North American Electric Reliability Corp. (NERC) implemented the CIP-014 standard in 2015, the intent was to protect the nation’s most critical electric substations from physical attacks. But the new reliability standard could conceivably do much more.
At minimum, it has gotten more utilities thinking about substation security design — and rethinking how they want to approach it. They’ve learned a couple of lessons in the process.
Lesson #1: A “5 Percent Solution” May Not Be Enough
CIP-014, one of the newer elements in the NERC Critical Infrastructure Protection standards, directly affects roughly 5 percent of substations in the transmission grid. These are the ones that, if damaged or taken offline, pose the greatest risk of destabilizing the grid.
As utilities complete physical security audits and begin making the upgrades needed to comply with CIP-014, many have looked beyond these mission-critical substations and asked an important question: Should we stop there?
After all, a security breach in a “less critical” substation still has the potential to affect hundreds, perhaps thousands, of customers and cost millions in lost revenue to the supported service territory. Upgrades in physical, electronic and cybersecurity can be a small price to pay to protect these assets. Utilities that look at the bigger picture are deciding that investments in security and reliability improvements can deliver a return on investment far beyond CIP-014 compliance.
Lesson #2: Security Improvement Programs Are More Complex Than Anticipated
Until relatively recently, chain-link fences and “Danger: High Voltage” signs were deemed enough to prevent unauthorized persons from entering a substation. Today’s security solutions are vastly more sophisticated, and the threats they address are a constantly moving target.
Those realities — along with the convergence of operating technology, information technology and physical access — make substation security projects more challenging to implement than typical compliance-driven projects. Some utilities, in fact, have quietly acknowledged the difficulty of integrating and managing these programs. Achieving CIP-014 compliance, much less developing comprehensive security solutions, takes time and expertise that most utilities do not have readily available in-house.
Both of these lessons are valuable, and the utilities that have learned them are absolutely correct. CIP-014 compliance should be just one part of a utility’s long-term security and reliability strategy. And these strategies are indeed challenging to implement, for all the reasons cited above. But they are also vital to the future of our power grid.
There is a path to overcoming these challenges. Burns & McDonnell, for example, has bundled its substation security knowhow in a comprehensive package of services known as Station Defender. We help utilities comply with CIP-014, as well as think beyond it toward the development of an integrated security program.
Our Station Defender suite of services begins with a security assessment and recommendation that structures the blueprint for the security program, then develops the scope, schedule and budget for design and implementation. We oversee the installation of the entire security program from start to finish, using our efficient EPC (engineer-procure-construct) project delivery model, which leads to faster implementation and fewer obstacles to completion. The work is completed by an integrated project team experienced in utility-hardening systems.
The result is more than CIP-014 compliance: It’s a security program that meets the utility’s needs while maintaining a sense of scope and perspective. That’s a lesson no one wants to learn the hard way.
Your critical assets need protection now more than ever. Station Defender addresses every component of your security strategy.
