FERC Approves New Reliability Standard for Bulk-Power System Physical Security
On September 10, 2026, the Federal Energy Regulatory Commission (FERC) issued an order (CIP Order) approving the North American Electric Reliability Corporation's (NERC) revised physical security standard CIP-014-4. The new standard seeks to improve the identification, assessment, and protection of transmission facilities whose loss could threaten Bulk-Power System (BPS) reliability. The CIP Order also approves the implementation plan, violation risk factors, severity levels, and the retirement of an earlier version of the reliability standard, CIP-014-3. The CIP Order reaffirms FERC's commitment to protect the integrity of the BPS, particularly during the current period when large loads, including power for data centers, are straining BPS capabilities.
Purpose: In Order No. 802, FERC adopted the initial version of CIP-014. FERC stated that the purpose of the reliability standard was to "identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in instability, uncontrolled separation, or [c]ascading" within the BPS.
Application: CIP-014 applies to specified high-voltage and otherwise critical transmission stations, substations, and associated primary control centers. Covered transmission owners must conduct periodic risk assessments, obtain unaffiliated third-party verification, evaluate physical threats and vulnerabilities, and implement documented security plans.
Review warranted: Following increased reports of substation attacks in late 2022, FERC directed NERC to review CIP-014-3. NERC found the applicability criteria sufficiently broad but determined that entities used inconsistent risk assessment methods because the standard lacked sufficient technical specificity. FERC directed NERC to evaluate the adequacy of the applicability criteria, whether the risk assessment included the appropriate criteria, and whether all BPS transmission systems should have a minimum level of security protections.
Principal CIP-014-4 changes: The approved changes to CIP-014-4 stem from NERC's evaluation. The updated standard broadens the applicability to include "jointly-owned transmission stations and transmission substations." Requirement R1 establishes a 36-calendar-month cycle for covered entities to review applicable facilities, including those planned to enter service within that period. R2 requires identification of BPS facilities within 1,500 feet that are also subject to the risk assessment. R3 through R5 require the documentation of a risk assessment methodology, the development of technical simulation criteria, coordination for jointly owned facilities, and the establishment of a unified 36-month risk assessment cycle. NERC declined to adopt a uniform minimum level of physical protection for all covered facilities.
Implementation and approval: CIP-014-4 becomes effective October 1, 2028, with the initial assessment under R5 due by that date. Before then, transmission owners and operators must determine applicability, develop criteria, draft methodologies, perform assessments, and identify unaffiliated third parties for risk assessment verification. Affected transmission owners and operators should initiate these compliance tasks as soon as practicable, as their programs must be approved and finalized on or before the October 1, 2028 effective date. In our previous alerts regarding Executive Order 14421 (see the August 31, 2026 alert and September 14, 2026 alert), we noted that the Department of Energy's (DOE) intention to prohibit certain transactions involving foreign-based BPS electric equipment would necessitate close coordination with NERC. The CIP Order underscores the importance of that coordination as NERC continues an active program to protect, in this case, the physical integrity of the BPS. Stakeholders should be mindful of assessing the interplay between DOE's prohibited transaction effort regarding BPS equipment and how that effort may be facilitated or slowed by NERC's separate BPS initiatives.
DWT will continue to monitor and report on developments regarding the CIP Order and Executive Order 14421.
+++
Nicholas Giannasca is a partner and Samin Peirovi is an associate in DWT's Washington, D.C. office. Caroline Cilek is an associate in the firm's Portland office. If you have any questions or need assistance, please contact the authors or another member of our energy team. To stay informed, sign up for our alerts.