New NERC Reliability Standard for Physical Security Approved

Image courtesy of Mark Turnauckas under Attribution 2.0 Generic Deed, resized to 700 x 391 pixels.

On 9/10/26, the Federal Energy Regulatory Commission (FERC) gave the greenlight to new NERC Reliability Standard CIP-014-4.  The updated recommendations come on the heels of multiple substation attacks that have occurred over the past several years, and it aims to enhance reliability by ensuring critical facilities are identified and proactively monitored to identify potential issues.

This is important stuff from an emergency preparedness perspective, so I thought I’d use today’s blog post to give you a quick summary.

Snapshot of NERC Reliability Standard CIP-014-4

The main goal of this regulatory framework is to enhance the physical security of transmission stations, substations, and their associated primary control centers.  Essentially, the updated NERC Reliability Standard mandates that the organizations responsible for the grid’s operation implement a rigorous risk-based approach to physical security

The standard is structured around the following 6 key requirements (sequentially, R1 through R6):

• Requirement R1: Mandates that transmission owners perform periodic risk assessments to identify their “critical” facilities.
• Requirement R2: Mandates that the identification process outlined by R1 be verified by an unaffiliated third party to ensure objectivity and accuracy.
• Requirement R3: States that transmission owners and operators must identify which control centers are necessary for the operation of the facilities identified in R1, ensuring the “brain” of the station is protected alongside the physical infrastructure.
• Requirement R4: Requires a comprehensive evaluation of potential physical threats to the identified facilities based on the unique physical characteristics of each site.
• Requirement R5: Mandates the development and implementation of a documented physical security plan, which typically includes items like perimeter fencing, monitoring systems (CCTV), access control, and coordination with law enforcement.
• Requirement R6: Requires that the vulnerability assessment and physical security plan be reviewed by an unaffiliated third party.

There’s no doubt about NERC’s mission here – by enforcing these 6 requirements, Reliability Standard CIP-014-4 aims to boost the reliability and resilience of electrical service across the continent.  And from my perspective, I love it!