The U.S. Federal Energy Regulatory Commission (FERC) approved the North American Electric Reliability Corporation’s (NERC) proposed Reliability Standard CIP-014-4, tightening requirements for identifying and assessing transmission stations and substations whose loss could cause instability, uncontrolled separation or cascading across an interconnection. The standard revises applicability provisions to include jointly owned transmission facilities and establishes a single 36-calendar-month cycle for updating applicable facilities and conducting risk assessments.
In a Federal Register notice published Tuesday, FERC also approved retiring the existing CIP-014-3 standard immediately before CIP-014-4 takes effect.
Under CIP-014-4, transmission owners would be required to identify nearby Bulk Electric System transmission stations and substations within 1,500 feet or 457 meters of applicable facilities and maintain documented methodologies for assessing the consequences of losing those facilities. The methodology must include technically justified thresholds for instability, uncontrolled separation or cascading, steady-state and dynamic simulations using peak and off-peak load cases, and specified assumptions covering communication and protection-system losses, faults and clearing times.
FERC approved an implementation plan setting Oct. 1, 2028, as the effective date, while estimating that 344 transmission owners would face an annual reporting and recordkeeping burden of 3,440 hours at a total cost of $286,862.
NERC’s proposed Reliability Standard CIP-014-4 revises applicability language to include jointly owned transmission stations and substations while reorganizing existing applicability subsections into a new Attachment 1 for improved clarity. Requirement R1 establishes a 36-calendar-month review cycle requiring transmission owners to review and update their list of applicable transmission stations and substations, encompassing both existing facilities and those planned to enter service within 36 months. This cycle aligns with the annual planning assessment cycle under Reliability Standard TPL-001 to eliminate confusion from gaps between models and study horizons that occur under the current CIP-014.
Requirement R2 mandates that transmission owners identify proximate Bulk Electric System transmission stations and substations, regardless of ownership, located within 1500 feet (457 meters) of applicable facilities, measured fence line to fence line. This list of proximate facilities informs the risk assessment required under Requirement R5. Requirement R3 requires transmission owners to maintain a documented risk assessment methodology that includes three key elements: documented criteria for assessing instability, uncontrolled separation, and cascading effects with technically justified thresholds; a provision that both steady-state and dynamic simulations be performed using minimum peak and off-peak load cases; and detailed simulation specifications including assumptions regarding loss of communication, protection systems, faults, and clearing times.
Requirement R4 addresses jointly owned applicable facilities by requiring coordination between transmission owners to determine and document their individual and joint responsibilities. More significantly, Requirement R5 consolidates the existing two-tiered risk assessment periodicity (30 months for previously identified critical facilities, 60 months for others) into a single 36-calendar-month cycle. This change reduces the maximum reassessment interval for facilities that had not previously been identified as critical, requiring more frequent reevaluation in response to changed system conditions, while harmonizing the CIP-014-4 schedule with both the Requirement R1 facility list update cycle and the TPL-001 planning assessment cycle.
Requirements R6 through R10 carry forward the substantive provisions previously numbered R2 through R6 in CIP-014-3 without material revision. NERC has requested an effective date of the first calendar quarter beginning 24 months after Commission approval, with CIP-014-3 retiring immediately prior. Under the implementation plan, transmission owners must complete their initial risk assessment under Requirement R5 by the effective date, with subsequent assessments due no later than 36 calendar months thereafter.
Under Section 215 of the Federal Power Act, the Federal Energy Regulatory Commission can certify an Electric Reliability Organization (ERO) to develop and enforce mandatory reliability standards, subject to Commission oversight, and has designated the North American Electric Reliability Corporation (NERC) as the ERO. FERC approved the first Physical Security Reliability Standard, CIP-014-1, in November 2014 under Order No. 802. The standard is intended to identify and protect transmission stations, substations and associated primary control centers whose damage or loss from a physical attack could cause instability, uncontrolled separation, or cascading across an electrical interconnection.
The Physical Security Reliability Standard mandates that applicable transmission owners, mainly those operating high-voltage facilities (500 kV and above, or 200–499 kV substations meeting specified interconnectivity or criticality thresholds, including nuclear interface facilities), conduct periodic risk assessments with unaffiliated third-party verification to identify vulnerable transmission stations, substations, and control centers. Covered entities must then evaluate potential physical attack threats and vulnerabilities at each identified facility and develop a documented physical security plan, which also requires independent third-party review before implementation.
Following a surge in physical attacks on electric substations in late 2022, including incidents in Moore County, North Carolina (December 2022) and the Pacific Northwest (November 2022), the Commission directed NERC on Dec. 15, 2022, to evaluate whether the Physical Security Reliability Standard CIP-014-3 adequately mitigates risks to the Bulk-Power System. NERC was tasked with three key assessments: reviewing the sufficiency of the standard’s Applicability criteria; examining the required risk assessment process and proposing improved parameters or methodologies for conducting such assessments; and determining whether minimum physical security protections should be mandated across all Bulk-Power System transmission stations, substations, and primary control centers.
NERC filed its evaluation report on April 14, 2023, addressing the Commission’s directive. NERC concluded that the CIP-014 Applicability criteria adequately meet their objective of focusing resources on risks at the most critical facilities and are sufficiently broad to capture the appropriate subset of applicable facilities. As a result, NERC recommended no expansion of those criteria.
However, NERC identified significant concerns with the Requirement R1 risk assessment process, finding that registered entities employ inconsistent approaches lacking the technical rigor expected in comparable planning horizon study standards such as TPL-001. The root cause is insufficient specificity in the CIP-014-3 language, which does not prescribe a particular methodology or define specific analytical components. This lack of clarity has led certain entities to provide insufficient technical studies or justification for their assessment decisions, resulting in noncompliance.
Regarding minimum physical security protections across all Bulk-Power System facilities, NERC rejected a uniform baseline approach, reasoning that fixed minimum protections neither account for site-specific design basis threat processes nor defend against sophisticated or coordinated attacks. NERC instead recommended a holistic, adaptive strategy pairing security controls tailored to identified risks with complementary reliability and resiliency measures such as response readiness and spare-equipment strategies. This recommendation prompted NERC to initiate Project 2023-06 to clarify CIP-014-3 requirements, culminating in the filing of proposed Reliability Standard CIP-014-4 on July 16, 2026.
Under section 215(d)(2) of the Federal Power Act, the Commission approves proposed Reliability Standard CIP-014-4 as just, reasonable, not unduly discriminatory or preferential, and in the public interest. The Commission also approves the associated implementation plan with an effective date of October 1, 2028, along with the violation risk factors and violation severity levels. Reliability Standard CIP-014-3 is approved for retirement, effective immediately before CIP-014-4 takes effect.
The FERC-725U information collection requirements are subject to Office of Management and Budget review under the Paperwork Reduction Act of 1995. The Commission’s paperwork burden estimates are based on the additional burden imposed on transmission owners by CIP-014-4, calculated using the NERC Compliance Registry as of July 21, 2026, and good faith estimates provided by NERC. While transmission operators are applicable entities under CIP-014-4, the standard’s objective-based design allows entities to select compliance approaches tailored to their systems, and there were no changes to the transmission operator burden from the revisions.
The notice identified that respondents face no penalty for non-compliance unless a valid OMB control number is displayed. The Commission solicits public comments on the information’s necessity and practical utility, the accuracy of burden estimates, and suggestions for enhancing data quality and minimizing respondent burden through automated information techniques.
The Commission’s paperwork burden estimates reflect the additional burden imposed on transmission owners by Reliability Standard CIP-014-4. Since Reliability Standards are objective-based and allow entities to select compliance approaches suited to their systems, transmission operators, though applicable entities, experienced no increase in burden from the revisions. The number of transmission owners subject to mandatory compliance is based on the NERC Compliance Registry as of July 21, 2026, supplemented by good faith estimates provided by NERC to Commission staff.
Based on these assumptions, FERC estimates that the change to the annual reporting and recordkeeping requirements under Reliability Standard CIP-014 will affect 344 transmission owners (TOs). Each respondent is expected to submit one response requiring 10 hours of work and costing $833.90, resulting in a total estimated burden of 3,440 hours and $286,862 annually. The estimated annual cost is $833.90 per transmission owner.
Transmission owners are the respondents to the information collection requirements, with responses required annually. The Commission has determined this information is necessary to implement the modifications to Reliability Standard CIP-014-4, which refine and strengthen the physical security framework for critical transmission facilities by tightening assessment timelines, clarifying applicability thresholds, and improving verification and oversight processes.
Key revisions include more objective risk-assessment requirements, clarified language in the Applicability section, increased rigor around third-party verification and review, and expanded threat and vulnerability evaluation requirements. These changes aim to provide clearer technical guidance, improve consistency among entities, and ensure timely, accountable, and risk-based protection of facilities whose loss could cause instability, uncontrolled separation, or cascading within an Interconnection. The Commission conducted an internal review and determined that its action is necessary to implement section 215 of the Federal Power Act, and has assured itself of specific, objective support for the associated burden estimates.
