On September 10, 2026, FERC approved a new version of a Reliability Standard proposed by the North American Electric Reliability Corporation (NERC), Reliability Standard CIP-014-4 (CIP-014-4) (Physical Security). The original version, CIP-014-1, was approved by Order No. 802 in November 2014. The stated purpose of the currently effective version of the standard is to “identify and protect Transmission stations and Transmission substations (transmission facilities), and their associated primary control centers, that if rendered inoperable or damaged as a result of physical attack could result in instability, uncontrolled separation, or Cascading within and Interconnection.”  NERC explained in its petition that the new version of CIP-014 is intended to ensure an adequate and consistent approach for evaluating instability and identifying infrastructure that is critical to the operation of the Bulk Power System.

The development of the new version of CIP-014 dates back to 2022, when a growing number of physical attacks on electric substations prompted FERC to direct NERC to evaluate the effectiveness of CIP-014-3. Specifically, NERC was directed to assess (1) the adequacy of the Applicability criteria in CIP-014-3, and (2) the required risk assessment set forth in the standard. NERC filed its evaluation report on April 14, 2023, finding that the CIP-014 Applicability criteria are meeting the objective and are broad enough to capture the subset of applicable facilities that transmission owners should identify as ‘critical.’ However, NERC also found that the absence of language in CIP-014-3 prescribing a specific method on how the R1 risk assessment was to be performed was leading to registered entities having inconsistent approaches to performing risk assessments.

The changes found in CIP-014-4 are outlined below:

  • Requirement R1 requires a transmission owner to review and, if necessary, update its list of applicable transmission facilities at least once every 36 calendar months, including existing facilities and facilities planned to be in service within 36 months. NERC explained that this 36-month cycle aligns with the annual planning-assessment cycle under Reliability Standard TPL-001 to avoid confusion from gaps between models and study horizons that can occur under the current version of CIP-014.
  • Requirement R2 requires each transmission owner with an applicable transmission facility under R1 to identify proximate existing Bulk Electric System transmission facilities, irrespective of ownership, within 1500 feet (or 457 meters, measured as the shortest distance from substation fence line to substation fence line) of the applicable station.
  • Requirement R3 requires each owner to maintain a documented risk assessment methodology for evaluating the loss of each station or substation in R1, which would consist of three elements:
    • Documented criteria for assessing instability, uncontrolled separation, or Cascading within an Interconnection, with technically justified thresholds identifying unacceptable generation and load loss;
    • A provision for steady state and dynamic simulations, each to be performed using at a minimum one System peak and one System Off-Peak Load case; and
    • Detailed specifications for simulations at applicable and proximate transmission facilities, including assumptions regarding prior loss of communication and Protection Systems, faults, and clearing times.
  • Requirement R4 requires transmission owners with jointly owned applicable facilities to coordinate with one another to determine and document their responsibilities under R3 and R5.
  • Requirement R5 consolidates the risk assessment period into a single 36-calendar-month cycle, replacing the prior tiered structure of 30 calendar months for transmission owners that had previously identified a critical facility and 60 calendar months for those that had not. NERC stated this shortens the maximum reassessment interval for transmission owners without a previously identified critical facility from 60 months to 36 months, requiring more frequent reevaluation of facilities that may have become critical due to changed system conditions, while also harmonizing the schedule with the Requirement R1 applicability-list update cycle and the TPL-001 planning-assessment cycle. Additionally, proximate facilities under R2 must be included in the risk assessment.
  • Requirements R6 through R10 carry forward, without substantive revision, the previously numbered Requirements R2 through R6.

FERC approved the proposed Reliability Standard as well as the associated Implementation Plan, violation risk factors, and violation security levels. Reliability Standard CIP-014-4 will take effect on October 1, 2028, and CIP-014-3 will be retired immediately before that date.

A copy of FERC’s order, issued in Docket No. RD26-9-000, is available here.

*Peter Fasoli is not yet licensed to practice law in any jurisdiction; bar application pending in the District of Columbia.