What Does FERC’s Approval of CIP-014-4 Change for Substation Physical Security?
The revised NERC physical security standard changes how transmission owners find and assess critical substations. It still leaves the level of protection to the owner, which makes the specification the place where performance is decided.
It changes who must look and how often, not how much protection is required. CIP-014-4, approved by FERC on September 10, 2026, moves transmission owners to a single 36-month assessment cycle, brings jointly owned stations into scope and requires owners to identify other stations within 1,500 feet. It does not set a minimum level of physical protection, so the protection level remains a project decision that has to be written into design and procurement documents.
On September 10, 2026, the Federal Energy Regulatory Commission issued an order approving NERC Reliability Standard CIP-014-4 in Docket No. RD26-9-000, together with its implementation plan, and retired CIP-014-3. The order was published in the Federal Register on September 15. According to the Commission's meeting summary, the standard continues to require applicable transmission owners to perform a periodic risk assessment, identify critical substations, evaluate threats and develop a physical security plan, with modifications that tighten assessment timelines and clarify applicability.
For anyone who designs, specifies or procures protective construction for the grid, the revision is worth reading for what it adds and, just as closely, for what it declines to add.
What changes
- One assessment cycle. Requirement R5 replaces the earlier 30- and 60-month periods with a single 36-calendar-month cycle, aligned with the transmission planning cycle under TPL-001.
- Jointly owned stations. Applicability now reaches jointly owned transmission stations and substations, and Requirement R4 requires co-owners to coordinate with one another and document individual and joint responsibilities.
- A 1,500-foot proximity rule. Requirement R2 requires owners to identify other bulk electric system stations and substations within 1,500 feet (457 meters), irrespective of ownership. The order explains that the distance is drawn from a DHS-DOJ bomb threat stand-off card.
- A fixed start. CIP-014-4 takes effect October 1, 2028, and the initial risk assessment under R5 must be completed on or before that date, with later assessments within 36 months.
What does not change
The order does not establish a minimum level of physical protection. NERC's 2023 CIP-014 report recommended against a uniform baseline for all bulk-power system facilities, and the approved standard follows that recommendation. Owners still decide, through their own threat and vulnerability evaluation, what a physical security plan must resist and for how long.
That is a defensible regulatory choice. Substations vary widely in setting, configuration and consequence, and a single national baseline would be too much for some sites and too little for others. But it moves the hard question somewhere else. If the standard does not say how much protection is enough, the owner's design basis and the construction documents have to.
Why the 1,500-foot rule matters to designers
The proximity requirement is the most consequential change for site planning. It acknowledges that a single event can affect neighboring stations regardless of who owns them, and it borrows its distance from blast standoff guidance rather than from electrical criteria. That is a built-environment idea: consequence depends on distance, and distance has to be planned before it can be protected.
For owners, the practical effect is that a station's risk assessment can no longer stop at its own fence. Adjacent stations, shared approaches and common access roads fall into the analysis. For designers, it reinforces a principle already familiar from military antiterrorism criteria: standoff is the cheapest protection when it is available and the most expensive to recover once it has been given away. The same reasoning appears in Certanet's discussion of industrial standoff zones.
Jointly owned stations are an interface problem
Shared facilities are where security plans most often fail, because each party assumes the other covers the gap. The new requirement to document individual and joint responsibilities is a governance fix, but it has a physical counterpart. A wall built by one owner, a gate maintained by another and a control building operated by a third must perform as one system. That is the weakest-link problem applied to the grid, and it should be resolved in the drawings, not only in a memorandum of understanding.
Turning a security plan into a specification
Because CIP-014-4 leaves protection performance to the owner, the physical security plan is only as strong as the requirements written to carry it out. A defensible specification for substation protective work should state:
- the threat the element is meant to resist, in terms a test standard can verify, such as UL 752 for ballistic resistance or ASTM F2656 for vehicle impact;
- the protected assets, their exposure lines and the standoff assumed in the design;
- the tested assembly, including joints, supports, gates and penetrations, not only the panel or block;
- the evidence required at submittal and at acceptance, including test reports for the assembly as built;
- maintenance and inspection responsibilities after turnover, assigned by name of role or organization.
Specifications written this way give the unaffiliated third-party reviewer something concrete to verify and give the owner a record that holds up after an incident.
Reference material on hardened wall and barrier systems illustrates one category of products owners evaluate when a plan calls for ballistic or forced-entry resistance; any such product should be judged against the requirements above, not the reverse.
The link above goes to Amidon, which is affiliated with Certanet. About and disclosure.
The timeline is shorter than it looks
An October 2028 effective date sounds distant. It is not, once the sequence is laid out. Owners must complete their first assessment under the revised standard on or before the effective date, identify critical stations, evaluate threats, write plans and then design, procure and build the physical measures those plans require. For many utilities, the design and procurement work implied by the first assessment will fall in 2027 and 2028 budgets, which are being set now.
The sensible response is to treat the next 24 months as a requirements-writing period. Owners that define performance criteria, standoff assumptions and acceptance evidence before the assessment results arrive will be able to move from plan to construction without improvising specifications under deadline pressure.
The broader signal
CIP-014-4 is a modest revision, and that is its message. Regulators have chosen to tighten process (who assesses, how often, how far from the fence) while leaving performance to engineering judgment. That places responsibility on the people who write specifications and on the test standards they cite. The gap between a compliant assessment and a protected substation is closed in the construction documents, and that is where owners should focus their effort.
Recommended citation
Certanet Research, “What Does FERC’s Approval of CIP-014-4 Change for Substation Physical Security?” Certanet, October 12, 2026, https://certanet.com/articles/cip-014-4-substation-physical-security.html.