What Physical Security Managers Need to Know About NERC CIP-014-4

Recently approved updates to physical security reliability standards will change how utilities identify critical transmission facilities. Will those changes bring more substations into the physical security program? Understanding the revised requirements can help security managers prepare for that possibility and coordinate with their engineering teams accordingly.

On Sept. 10, 2026, the Federal Energy Regulatory Commission (FERC) approved North American Electric Reliability Corp. (NERC) Reliability Standard CIP-014-4. The standard becomes effective on Oct. 1, 2028.

CIP-014 includes two assessment activities: 

• The engineering risk assessment determines which facilities are critical to grid reliability.

• The threat and vulnerability assessment (TVA) examines physical threats and vulnerabilities for facilities identified and verified as critical.

The standard adds and reorganizes requirements for the engineering risk assessment. These changes include more detailed study methods, consideration of nearby facilities and documentation of physical attack assumptions.

To accommodate the expanded engineering risk assessment process, the new standard renumbers the later security requirements.

Figure 1: NERC CIP-014-4 Requirements Renumbering. The changed numerical references for three key security requirements based on new standard.

The requirements for conducting the TVA, developing a physical security plan and obtaining third-party security reviews remains essentially the same.

Security managers should focus on understanding the following changes as they prepare for the work ahead.

Changes to the Engineering Risk Assessment

Engineers evaluate what could happen to the interconnected grid if an attack damages the station or takes it out of service. Could the damage destabilize the grid, split it into uncontrolled sections or cause a cascading outage? These consequences are what the standard uses to identify critical stations.

The screening criteria that determine which facilities enter the engineering risk assessment remain substantively unchanged. These include characteristics such as operating at 500-kV or higher. Meeting a screening criterion alone does not establish that a station requires a TVA and physical security plan. However, two changes to the engineering risk assessment are drawing the attention of security managers and are worth noting.

Nearby Stations and Substations: For each station entering the engineering risk assessment, the owner must also identify any nearby existing bulk electric system (BES) transmission stations and substations. R2 sets the distance at 1,500 feet, measured between the nearest fence lines. Facilities owned by another utility are included.

The engineering risk assessment must account for damage an attack could cause to nearby facilities. Engineers model the resulting electrical faults to both facilities, such as short circuits, and evaluate the combined effect on the grid. That combined effect could cause the original station undergoing the engineering risk assessment to qualify as critical.

Being within 1,500 feet of a station undergoing an engineering risk assessment does not, by itself, require a nearby station to have a TVA or physical security plan. Those requirements apply only if the nearby station separately meets the screening criteria and is identified and verified as critical.

Although the technical rationale discusses line of sight, it is not an additional screening condition. The 1,500-foot distance determines which nearby facilities must be included in the engineering risk assessment, regardless of whether there is an unobstructed line of sight.

Attack Assumptions and an Earlier Role for Security Personnel: The new R3.3.3 requirement directs the owner to document the type of credible, high-severity physical attack considered in the engineering risk assessment. Engineers use that attack description to select and justify the electrical faults, such as short circuits, simulated in the study. Depending on the engineers’ approach, physical security managers might be asked to help identify the attack and explain why it is credible. A single documented justification might apply to multiple stations.

Physical security personnel can also review the engineering attack assumptions when preparing the TVA. The engineering risk assessment and TVA serve different purposes, but reviewing and documenting material differences helps maintain a defensible basis for both documents.

Implementation and Engineering Risk Assessment Timelines

Applicable U.S. transmission owners must complete their first engineering risk assessment under R5 by Oct. 1, 2028. Before completing their first assessment, they must identify the facilities to study and establish the required engineering methods under R1-R3. Where facilities are jointly owned, owners must also coordinate and document their responsibilities under R4.

The subsequent requirements follow their own deadlines:

• R6 — Engineering verification. Complete engineering verification by an unaffiliated third party within 90 calendar days after completing the R5 engineering risk assessment.

• R8 — Threat and vulnerability assessment and R9 — Physical security plan. The TVA must support the physical security plan. The plan must be developed within 120 calendar days after completing R6 engineering verification.

• R10 — Third-party security review. Complete the unaffiliated third-party security review of the TVA and physical security plan within 90 calendar days after completing the physical security plan.

• Implementation. Implement security enhancements according to the timeline documented in the physical security plan.

Engineering verification could coincide with the engineering risk assessment. The third-party security review may occur while the TVA and physical security plan are being developed. Deadlines for requirements subsequent to R5 depend on when the preceding activities are completed.

The recurring engineering risk assessment interval changes from 30 or 60 months to 36 calendar months. The engineering risk assessment must also consider facilities planned to enter service within 36 months, up from 24 months previously.

Under R5.2, an owner can keep a previously identified station classified as critical without repeating the engineering risk assessment for that station. The station remains subject to the TVA, physical security plan and third-party security review requirements.

What Remains the Same?

The substantive requirements for the TVA, physical security plan and unaffiliated third-party security review carry forward with the new requirement numbers.

The physical security plan development deadline remains 120 calendar days after completing engineering verification. The plan must address the threats and vulnerabilities identified in the TVA. It must also include provisions for evaluating evolving threats and corresponding security measures.

CIP-014-4 still does not prescribe a universal package of fences, barriers, cameras or other equipment. Utilities select security or resilience measures that collectively provide the required functions: deter, detect, delay, assess, communicate and respond. The TVA and physical security plan still remain subject to unaffiliated third-party security review.

While this post focuses on transmission stations and substations, the TVA, physical security plan and third-party security review requirements also apply to primary control centers identified under the standard.

Will More Substations Be Identified as Critical?

The effect of the regulatory updates will vary by utility. Grid conditions, nearby facilities and planned system changes will all influence results.

Some utilities may need to study conditions they did not previously examine, such as damage affecting nearby stations. Those additional engineering studies could identify more critical facilities. Utilities that already study those conditions may see little change under the revised methodology.

It is difficult to estimate how much the number of critical substations may change. It seems probable that the changes are more likely to increase the number of critical substations than reduce them.

Physical security managers can prepare by asking planning teams whether the revised engineering risk assessment could identify additional critical facilities and when results are expected. Those conversations can also clarify whether engineers need input on physical attack scenarios. Early coordination helps security managers anticipate the staffing, budget and scheduling needs for additional TVAs and physical security plans. It also gives planning, operations and security teams a shared basis for sequencing work.