FERC Approves CIP-014-4 and Adds a 1,500-Foot Neighbor Rule to Substation Physical Security

The Federal Energy Regulatory Commission approved NERC Reliability Standard CIP-014-4 at its monthly open meeting on September 10, 2026. The standard governs physical security at transmission stations, transmission substations and their primary control centers. NERC filed the petition on July 16, 2026 in Docket No. RD26-9-000. Applicability does not change. A station qualifies at 500 kV or higher. It also qualifies between 200 kV and 499 kV if it connects at 200 kV or higher to three or more other stations. That second path needs an aggregate weighted value above 3,000. Stations critical to an Interconnection Reliability Operating Limit and stations essential to Nuclear Plant Interface Requirements also qualify. What changes is the analysis inside that population. A transmission owner must now identify every other bulk electric system transmission station within 1,500 feet, or 457 meters. The distance runs fence line to fence line. Ownership of the neighbor does not matter. NERC traces the rewrite to the 2022 gunfire attacks on substations in Moore County, North Carolina and in the Pacific Northwest.

Before and After

FERC directed NERC in December 2022 to study whether CIP-014-3 was adequate. NERC reported back in April 2023. It found that registered entities used inconsistent approaches to physical security risk assessments. It blamed the requirement language, not a lack of effort.

CIP-014-4 answers that with prescription. Requirement R2 is new and creates the 1,500-foot proximity identification. Requirement R3 forces a documented risk assessment methodology with written criteria for instability, uncontrolled separation and cascading. According to the filing summary, the methodology must run both steady-state and dynamic simulations. Each run needs at least one system peak load case and one off-peak case. Requirement R5 sets the cycle at least once every 36 calendar months and folds proximate stations into the assessment. Requirement R6 keeps the unaffiliated third-party check and puts a clock on it. The verifier must be a registered Planning Coordinator, Transmission Planner or Reliability Coordinator, or an entity with transmission planning experience. Verification closes within 90 calendar days of the risk assessment. If the verifier recommends adding or removing a station, the owner has 60 calendar days to accept the change or to document a technical basis for refusing it.

Enforcement Reality

The violation risk factors show where the audit pressure lands. R1 identification and R5 risk assessment both carry a High violation risk factor. R2 proximity identification and R6 third-party verification carry Medium. The measures attached to each requirement ask for dated written or electronic evidence. A transmission owner that does the work and leaves the file undated still collects a finding.

Two limits sit on the edge of the standard. Facilities inside a protected area under 10 C.F.R. 73.2 that fall within a security plan accepted by the Nuclear Regulatory Commission are exempt, as are facilities covered by a Canadian Nuclear Safety Commission plan. And the standard sets no calendar date of its own. Section 5 defers the effective date to the implementation plan. NERC asked for 24 months, enough time to determine applicability, run assessments and procure unaffiliated verifiers. The order approves the text. The clock starts later.

Why It Matters

The neighbor rule moves the unit of analysis off the fence line. A transmission owner used to study its own station in isolation. Under R2 it has to find every bulk electric system station within 457 meters and study the pair, including stations another company owns and operates. Shared corridors, adjacent switchyards and utility-boundary sites now generate work for both owners. R4 turns a jointly owned station into a documented split of responsibility.

The simulation language is the quieter change. Requiring both steady-state and dynamic runs, across a peak case and an off-peak case, removes the cheapest way to pass a risk assessment. A station that looks survivable at summer peak behaves differently at 3 a.m. with fewer units online and weaker voltage support. That is the condition under which the 2022 attacks happened.

The population of protected stations still turns on the same aggregate weighted value table. A 200 kV to 299 kV line counts 700. A 300 kV to 499 kV line counts 1,300. Nothing in this order pulls a distribution substation or a data center interconnection into scope. Entities hoping the physical security standard would follow load growth onto lower-voltage assets got a sharper version of the standard they already had.

Sources

• NERC: FERC Approves Reliability Standard for Physical Security
• NERC Reliability Standard CIP-014-4, Physical Security (standard text, requirements and Attachment 1)
• White & Case: Summary of FERC Meeting Agenda for September 2026 (item E-1, Docket No. RD26-9-000)

Related Coverage

• NERC CIP-003-9 Requires Utility Vendor Remote Access Controls: NERC CIP standard for utility security
• NERC MOD-026-2 Requires Solar and Battery Owners to Prove Voltage: NERC standard for grid stability
• RTOs Advance FERC Order 2222 Compliance: FERC order compliance for grid security
• FERC Launches Rulemaking on Data Center Grid Interconnection: FERC rulemaking on grid interconnection