CIP-014-4 Approved: The New Physical Security Risk Assessment and the 2028 Clock
By Patrick Miller
FERC approved Reliability Standard CIP-014-4 on September 10, 2026 in Docket No. RD26-9-000, and the version number understates the change. CIP-014-3 had six requirements. CIP-014-4 has ten, three of them new. The risk assessment now needs a documented methodology, mandatory dynamic simulations, and a neighboring substation in the model. All of it has to be finished by October 1, 2028.
Overview
FERC approved Reliability Standard CIP-014-4, Physical Security, on September 10, 2026. It came out of the Commission's open meeting as item E-1 in Docket No. RD26-9-000, twelve pages, five commissioners, signed by the Secretary. That's a different posture than CIP-015-2 got a month earlier, which arrived as a two page delegated letter order. Physical security still draws a full Commission order.
The order approves the standard, the implementation plan with an effective date of October 1, 2028, the violation risk factors and violation severity levels, and the retirement of CIP-014-3 immediately before the new version takes effect. NERC filed the petition on July 16, 2026, notice ran in the Federal Register a week later, three Ameren entities intervened, and nobody protested, so the substance of the order is mostly a recitation of what NERC filed. The order itself published on September 15 at 91 FR 58430.
What's inside the standard is a bigger change than the version number suggests. CIP-014-3 had six requirements. CIP-014-4 has ten. Almost every internal cross-reference moved, three of the requirements are new, and the one that most entities have been treating as a planning exercise now comes with a documented methodology, mandatory dynamic simulations, and a neighbor's substation in the model.
What FERC Asked For, and What It Got
The path here starts with two sets of attacks in late 2022. Six substations in Oregon and Washington were attacked that November, five of them causing power disruptions. On December 3, a ballistic attack on two substations in Moore County, North Carolina targeted transformer radiators and circuit breakers, forced five undamaged substations down alongside them, and left roughly 42,000 customers without power during a cold spell.
On December 15, 2022, FERC directed NERC to study three things:
Whether the CIP-014-3 applicability criteria were adequate
Whether the risk assessment itself needed parameters or criteria
Whether a minimum level of physical security should be required at all bulk power system transmission stations, substations, and primary control centers
NERC answered in April 2023. On the first question, it found the criteria were broad enough already and didn't recommend expanding them. On the third, it declined the bright line, arguing that a fixed baseline wouldn't account for a design basis threat process and wouldn't hold up against a more sophisticated or coordinated attack. What it recommended instead was a holistic approach pairing physical security controls with resilience measures like spare equipment and response readiness.
That leaves the second question. The report found that registered entities had inconsistent approaches to the risk assessment and didn't always meet the technical rigor expected elsewhere in planning standards, and that the inconsistency traced back to a lack of specificity in the requirement language itself. Project 2023-06 was scoped to fix that, and only that.
So the one thing Moore County produced, almost four years later, is a rewritten risk assessment. The applicability criteria are unchanged, and there is still no minimum protection requirement for substations that fall outside CIP-014.
How It Got Here
The drafting team formed in November 2023 with the original goal of getting to the NERC Board by the end of 2024. It took until June 2026.
| Date | Action |
|---|---|
| June 21, 2023 | Standards Committee approved the Standard Authorization Request for posting |
| July 26 to August 24, 2023 | Standard Authorization Request posted for comment |
| November 2023 | Drafting team formed |
| January 17, 2024 | Revised Standard Authorization Request accepted |
| May 20 to July 3, 2024 | Formal comment period with ballot, draft 1 |
| September 23 to November 6, 2024 | Formal comment period with additional ballot, draft 2 |
| June 6 to July 21, 2025 | Formal comment period with additional ballot, draft 3 |
| March 31 to May 14, 2026 | Formal comment period with additional ballot, draft 4 |
| May 28 to June 8, 2026 | Final ballot. 80.55 quorum, 80.05 weighted segment value |
| June 17, 2026 | Adopted by the NERC Board of Trustees |
| July 16, 2026 | Petition for approval filed with FERC, Docket No. RD26-9-000 |
| July 23, 2026 | Notice published at 91 Fed. Reg. 46418, interventions due August 17 |
| September 10, 2026 | FERC order approving CIP-014-4, 196 FERC ¶ 61,184 |
| October 1, 2028 | Effective date. CIP-014-3 retires immediately prior |
The final ballot closed June 8, 2026 at 80.05 weighted segment value on a quorum of 80.55, with 160 affirmative votes, 43 negative, and 33 abstentions out of a pool of 293. Every negative came with a comment attached (which isn't always the case). Transmission owners in Segment 1 were the least persuaded of any segment that cast a negative, at 76.2 percent affirmative. They are the ones who have to run the studies.
Ten Requirements Where There Were Six
The old R1 is now split across four requirements, and everything downstream shifted by four.
| CIP-014-4 | Was in CIP-014-3 | What it covers |
|---|---|---|
| R1 | Part of R1 | Identify each applicable transmission station and substation meeting the Attachment 1 criteria, existing or planned to be in service within 36 calendar months, at least once every 36 calendar months |
| R2 | New | Identify proximate BES transmission stations and substations within 1,500 feet or 457 meters, fence line to fence line, irrespective of ownership |
| R3 | New | Maintain a documented risk assessment methodology covering instability thresholds, steady state and dynamic simulations on peak and off-peak cases, and fault specifications at applicable and proximate stations |
| R4 | New | Coordinate and document individual and joint responsibilities under R3 and R5 for jointly owned stations and substations |
| R5 | Part of R1 | Perform the risk assessment at least once every 36 calendar months using the R3 methodology, including proximate stations identified under R2, and identify the primary control center |
| R6 | R2 | Unaffiliated third party verification of the risk assessment, within 90 calendar days of completion |
| R7 | R3 | Notify the transmission operator that controls an identified primary control center, within seven calendar days |
| R8 | R4 | Evaluate potential threats and vulnerabilities of a physical attack at each identified facility |
| R9 | R5 | Develop and implement a documented physical security plan, within 120 calendar days of completing R6 |
| R10 | R6 | Unaffiliated third party review of the R8 evaluation and the R9 security plan, within 90 calendar days |
R6 through R10 carry forward without substantive revision. They're the old R2 through R6, same obligations, new numbers. If you have procedures, RSAW responses, or internal documents that cite CIP-014 requirement numbers, all of them need a pass.
The applicability criteria themselves didn't change. They moved into a new Attachment 1 for readability, and the applicability language picked up jointly owned stations and substations, which is what R4 exists to sort out.
The Substation Next Door
The new R2 is the requirement I expect to generate the most work. Each transmission owner with an applicable station identified under R1 has to identify proximate bulk electric system transmission stations and substations within 1,500 feet or 457 meters, fence line to fence line, irrespective of ownership. The drafting team took the distance from the Department of Homeland Security and Department of Justice Bomb Threat Stand-Off Card, August 2025 version, which gives evacuation and shelter-in-place distances for various improvised explosive device sizes.
Those proximate stations then get pulled into the R5 risk assessment. Under R3, Part 3.3.2, faults get applied at the neighbor either simultaneously with or following the fault at your own station, and the neighbor's protection and communications are assumed to work normally, so it gets normal clearing rather than delayed. The technical rationale says every substation identified under R2 has to be studied in at least one combination with its applicable station, with some guidance on when to group two close neighbors together and when to run them individually.
A neighbor's assessment cannot pull your substation into scope, and yours cannot pull in theirs. R1 reaches only stations a transmission owner owns or jointly owns under the Attachment 1 criteria, and R8 through R10 attach to what your own R5 assessment identifies. The technical rationale states that R2 stations exist to inform the R5 assessment and the R6 verification and are not intended to be subject to R7 through R10. A proximate station is modeled as collateral damage to the station assumed to be under attack. Nothing in the standard allocates cost between adjacent owners either, and the R4 coordination requirement applies to joint ownership rather than adjacency. The only outside party that can put a station into applicability is a reliability coordinator, planning coordinator, or transmission planner, through the unchanged Attachment 1 criterion on interconnection reliability operating limits.
The exposure R2 creates is your own. Adding a proximate station with simultaneous or sequential faults makes the modeled event more severe, which raises the odds that your station comes out of R5 as critical and lands you in R8 through R10.
What you will need is model data and clearing assumptions for a facility you don't own, which for a lot of entities means a conversation with a neighboring transmission owner or a planning coordinator. The standard doesn't obligate them to hand it over, and it doesn't require the two of you to reach the same conclusion. Two owners 1,400 feet apart can run separate studies on different methodologies and disagree about what the pair does to the Interconnection.
The Attack Scenario Moves Into the Study
NERC told FERC in 2023 that a minimum protection baseline wouldn't work partly because it couldn't account for a design basis threat, so CIP-014-4 relocated that concept rather than dropping it.
R3, Part 3.3.1 requires the simulation to assume prior loss of communication and Protection Systems at the station under study, with delayed remote clearing unless you can technically substantiate otherwise. The technical rationale explains that the "prior loss" wording is deliberate, because a scenario where the fault happens first would let breakers operate in the few cycles before protection is lost. Part 3.3.3 then requires a documented justification for the faults being simulated, naming the type of credible high severity physical attack considered and the fault type selected from it. A single justification can cover multiple locations.
The drafting team was fairly direct about the design choice.
Accordingly, there's no threat scenario written into the standard, only a requirement that you write one down, per location or per group of locations, and then defend it. Each transmission owner now supplies the design basis threat that NERC declined to publish. The drafting team described the three phase fault as the prevalent assumption across the industry, and noted that specific locations or scenarios may merit a different fault type or a progression of multiple faults. Part 3.3.3 requires the reasoning behind whichever you select.
Where the Thresholds Land
R3, Part 3.1 requires documented criteria for assessing instability, uncontrolled separation, or cascading, including technically justified thresholds for unacceptable generation and load loss. On its face that's wide open. The technical rationale narrows it more than the requirement language does.
It names the Recommended Interconnection Resource Loss Protection Criteria from Attachment A of BAL-003-2, taken from the latest approved Frequency Response Annual Analysis, as an example of a technically justified threshold for generation loss. It then sets the tolerance in one direction only. Using values lower than the RLPC recommendations is also technically justifiable. Using values higher than the RLPC recommendations would require additional justification.
RLPC becomes the practical default and the burden of proof falls on anyone who wants a looser number. The count runs across the Interconnection rather than stopping at the transmission owner's footprint, so generation and load lost on neighboring systems come into it.
One Cycle Instead of Two
CIP-014-3 ran two reassessment clocks. Thirty months if you'd previously identified a critical station, sixty months if you hadn't. CIP-014-4 collapses both into a single thirty six month cycle, aligned with the R1 list update and with the annual planning assessment cycle under TPL-001.
FERC's order frames this as a tightening, since the entities that never identified a critical facility go from sixty months to thirty six. That's true and it's the larger population. The other half of the trade is that entities who did identify one go from thirty months to thirty six, which the order doesn't mention. The net effect is more frequent reassessment across the fleet, and slightly less frequent reassessment at the places that already know they matter.
What Has to Be Finished by October 1, 2028
The implementation plan sets one date for initial performance. The initial risk assessment under R5 has to be completed on or before the effective date, with subsequent assessments no later than thirty six months after. Nothing else phases in.
R5 depends on three other requirements being done first. You need the Attachment 1 list from R1, the proximate station list from R2, and the documented methodology from R3, all in place before you can run the assessment that has to be finished by October 1, 2028. Then R6 gives you ninety days after completion for an unaffiliated third party to verify it, and if the verifier recommends adding or removing a station you have sixty days to act or document why you didn't. The usual caution about relying on the work of others applies here too. The verifier's work becomes your evidence and the accountability stays with you, not the verifier.
The drafting team felt that entities need time to determine applicability, develop criteria, write or revise methodologies, perform assessments, and procure unaffiliated third parties for verification. Procurement is the item entities most often underestimate. The pool of verifiers with transmission planning or analysis experience isn't large, and everybody is working against the same date.
October 1, 2028 is also the effective date for CIP-015-1, which we wrote about in August. Internal network security monitoring and a rebuilt physical security risk assessment are enforceable on the same day. This will draw on different teams but probably with the same budget cycles and the same set of approvals. Nothing here is urgent in a next quarter sense. The methodology work can start now since everything else depends on it, it needs no procurement and doesn’t require an outage window.
![One Incident, Several Reports: What GAO's Panel & CISA's Town Halls Say About Harmonization [Updated]](https://images.squarespace-cdn.com/content/v1/5f80bdfaeeac37068ed8c60e/1785335419831-X41D7GN7VRFMIJ472YFX/Policy+Pulse.png)
