Related Files
Status
A 45-day formal comment period for draft three of CIP-014-4 Physical Security is open through 8 p.m. Eastern, Monday, July 21, 2025.
Additional ballots for the standard and implementation plan, as well as a non-binding poll of the associated Violation Risk Factors and Violation Severity Levels will be conducted July 11 - 21, 2025.
Background
Due to an increase in reports of physical attacks on electric substations, the Federal Energy Regulatory Commission (FERC) issued the December 2022 Order in Docket
No. RD23-2-000 directing NERC to evaluate the effectiveness of the Physical Security Reliability Standard CIP-014-3 in mitigating the risks to the Bulk-Power System (BPS) associated with physical attacks. In the report filed in response to a FERC directive, NERC staff identified continuing inconsistency in registered entity CIP-014-3 risk assessments to most appropriately identify critical infrastructure. FERC directed NERC to evaluate whether the physical security protection requirements in NERC's Reliability Standards are adequate to address the risks associated with physical attacks on BPS Facilities, including the adequacy of the required risk assessment in CIP-014-3 Requirement R1. In the report, NERC found that CIP-014-3 required revision to assure adequate and consistent approach in evaluating instability as well as the identification of infrastructure critical to the operation of the BPS.
This project is identified as a NERC Board of Trustees priority work plan item and expected to be submitted to the board by the end of 2025.
Standard(s) Affected – CIP-014-3
Purpose/Industry Need
As the intent of CIP-014-3 is to identify and physically protect those Transmission stations, Transmission substations, and their associated primary control centers that are critical to the reliable and secure operation of the BPS, registered entity approaches for the risk assessment must be reasonably consistent and substantiated with sufficient technically based rationale. As highlighted in the report, there continues to be confusion within industry as to how to adequately evaluate instability. Therefore, this project includes refinement of CIP-014 risk assessments to assure critical sites are identified and physically protected.
Subscribe to this project's observer mailing list
Select "NERC Email Distribution Lists" from the "Service" drop-down menu and specify “Project 2023-06 CIP-014 Observer List" in the Description Box.
