CIP-014-4: A Risk-Based Approach to Substation Physical Security

Physical security at a transmission substation is no longer simply a question of fences, cameras, barriers, and access control.

The more important question is:

What happens to the power system if this facility is lost?

And, increasingly:

How should that consequence influence where a utility invests its limited security and resilience resources?

Those questions are at the center of the newly approved NERC Reliability Standard CIP-014-4, Physical Security.

On September 10, 2026, the Federal Energy Regulatory Commission (FERC) approved CIP-014-4. The revised standard is intended to create a more consistent and technically rigorous approach for identifying transmission facilities whose loss could result in instability, uncontrolled separation, or cascading conditions on the Bulk-Power System. The new standard becomes effective October 1, 2028.

For utilities, however, CIP-014-4 should be viewed as more than another compliance requirement.

It creates an opportunity to better connect power-system modeling, asset criticality, physical-security assessment, resilience planning, and capital prioritization.

That transition—from identifying critical facilities to understanding and managing their risk—is where the greatest value may ultimately lie.

Why Was CIP-014-4 Needed?

The existing CIP-014 framework already required applicable transmission owners to identify facilities whose loss following a physical attack could create significant reliability consequences.

The issue was not the objective of the standard. It was the consistency of the assessment.

Following increased reports of physical attacks against electric substations, FERC directed NERC to evaluate whether the existing physical-security requirements remained adequate.

NERC's review found that entities were using inconsistent approaches when conducting physical-security risk assessments. According to NERC, the lack of specificity in the previous requirement language contributed to differences in methodologies and, in some cases, insufficient technical studies or justification supporting assessment decisions.

CIP-014-4 addresses this issue by making the analytical expectations considerably clearer.

The implication is important.

Determining that a substation is critical cannot rely only on statements such as:

“This is a major station.”

“This facility serves a large amount of load.”

“This transformer would be difficult to replace.”

Or:

“An outage at this location would create operational challenges.”

Those observations may be relevant, but they are not enough.

A defensible risk assessment should demonstrate how the loss of the facility propagates through the power system and what consequences result.

That requires a structured methodology.

How CIP-014-4 Physical Security Changes Substation Risk Assessment

Several elements of the revised standard are particularly important from a risk-assessment perspective.

A More Structured Assessment Cycle

CIP-014-4 establishes a common 36-calendar-month cycle for the periodic risk assessment.

Under the previous framework, reassessment intervals could differ depending on whether critical facilities had previously been identified. The revised approach creates a common cycle and requires more regular reconsideration of facilities as system conditions change.

This matters because asset criticality is not permanent.

A substation that is not particularly critical today may become significantly more important several years from now because of changes such as load growth, generator retirement, transmission expansion, new interconnections, changing power flows, or the addition of large electrical loads.

Physical-security criticality therefore needs to be treated as a dynamic characteristic of the system, not as a permanent asset label.

Nearby Substations Can No Longer Be Considered Only in Isolation

One of the most notable changes under CIP-014-4 is the requirement to identify certain existing Bulk Electric System transmission stations and substations located within 1,500 feet, or 457 meters, measured fence line to fence line, of an applicable facility.

These proximate facilities are then incorporated into the required risk assessment.

This introduces an important risk concept: correlated and common-cause failure.

Traditional criticality assessments often begin by asking:

What happens if Substation A is unavailable?

But physical-security scenarios may require a different question:

What happens if Substation A and a nearby Substation B are affected by the same event?

Those are fundamentally different scenarios.

A facility that appears manageable as an individual contingency may create a substantially different system response when the event also affects neighboring infrastructure.

That means utilities need to think beyond component-by-component criticality and toward scenario-based system risk.

Figure 1. From asset-level criticality to scenario-based system risk

The Risk-Assessment Methodology Must Be Explicit

Another important change is the requirement for a documented risk-assessment methodology.

The methodology must include defined criteria for evaluating instability, uncontrolled separation, or cascading within an Interconnection, along with technically justified thresholds for unacceptable generation and load loss.

CIP-014-4 also requires both steady-state and dynamic simulations, using at minimum a system peak-load case and a system off-peak-load case.

This moves the process closer to an engineering framework in which the methodology is established before the result is interpreted.

A strong assessment process should follow a traceable sequence:

Scenario → Assumptions → Simulation → Consequence Metrics → Acceptance Criteria → Criticality Decision

This traceability is essential.

Without it, two engineering teams could analyze the same substation and reach different conclusions simply because they applied different assumptions, system conditions, modeling boundaries, or consequence thresholds.

A documented methodology also creates a better foundation for independent verification and for repeating the assessment as grid conditions evolve.

Why Both Steady-State and Dynamic Analysis Matter

A physical-security scenario can create consequences that are not fully represented by a single power-flow calculation.

Steady-state analysis may identify conditions such as thermal overloads, unacceptable bus voltages, transmission loading issues, or the need for significant redispatch.

Dynamic analysis addresses another set of questions.

Will the system remain stable following the event?

Could additional equipment trip?

Could voltage or frequency response create broader system consequences?

Could protection-system operation contribute to cascading?

This distinction is particularly important for facilities that play a significant role in transferring power across the network.

A substation should not be considered critical merely because it contains expensive equipment, nor should it be considered non-critical simply because an initial power-flow solution converges.

Criticality depends on how the interconnected system responds following the loss.

Compliance Is Only the First Layer

CIP-014-4 is fundamentally intended to determine whether facilities meet specific physical-security requirements.

But once critical facilities have been identified, utility leadership faces another question:

Which risks should be addressed first?

That question cannot be answered by criticality alone.

Imagine three substations that all satisfy the criteria for further physical-security consideration.

Substation A creates a high system consequence but already has strong physical protections.

Substation B has somewhat lower immediate grid consequences but significant physical vulnerabilities.

Substation C produces a moderate initial disturbance but contains equipment with extremely long replacement times and limited system restoration alternatives.

Calling all three facilities simply “critical” does not tell decision makers where the next dollar should be invested.

This is where utilities need to extend criticality assessment into risk assessment.

Moving From Criticality to Risk

For broader utility decision-making, a physical-security risk model can conceptually consider:

Risk = Threat × Vulnerability × Consequence

The purpose is not to create artificial precision around the probability of an intentional physical attack.

Threat likelihood can be difficult to quantify and can change over time.

Instead, the framework creates a disciplined way to evaluate scenarios and understand which factors are driving risk.

For each scenario, utilities can ask:

How severe would the system consequence be?

How vulnerable is the facility to the scenario?

What existing controls reduce the likelihood of successful damage?

How quickly could the system recover?

What alternatives exist for restoring service?

What uncertainty exists in each assumption?

And most importantly:

Which mitigation produces the greatest reduction in risk?

Figure 2. Risk pathway for transmission-substation physical security

Recovery Time Can Change the Risk Significantly

Two substations may create similar immediate electrical consequences but very different long-term impacts.

Suppose both experience the loss of a large power transformer.

At one facility, alternate transmission paths, switching capability, mobile equipment, or an available spare transformer may allow the system to recover relatively quickly.

At another facility, replacing the transformer could involve long manufacturing lead times, special transportation requirements, limited spare-equipment availability, and significant site preparation.

The initiating event may be similar.

The total consequence is not.

This is why physical security and resilience should not be treated as separate programs.

A mature framework should evaluate both:

How can the event be prevented?

and

How can the consequences be reduced if prevention fails?

Potential risk-reduction measures therefore extend beyond barriers and surveillance.

They may include system reconfiguration, redundancy, spare-equipment strategies, mobile substations, restoration plans, protection changes, operational procedures, or transmission upgrades.

The objective is not simply to make a site harder to attack.

It is to make the power system less vulnerable to the consequences of losing that site.

Risk Assessment Should Drive Investment Prioritization

Physical-security resources are finite.

Utilities cannot apply the maximum level of protection to every transmission facility.

The investment question should therefore move beyond:

How much security does this facility have?

toward:

How much risk reduction will an additional investment provide?

Consider two proposed projects.

Project 1 costs $8 million and reduces the vulnerability of a heavily protected facility modestly.

Project 2 costs $3 million but eliminates a major recovery bottleneck at another critical station.

The first project may provide more physical infrastructure.

The second may provide greater risk reduction per dollar invested.

That distinction is central to risk-informed capital planning.

An effective prioritization framework can evaluate four dimensions:

System ConsequenceHow severe is the system response following facility loss?

Vulnerability How susceptible is the facility to the relevant physical-security scenarios?

Recovery Exposure How difficult and time-consuming would restoration be?

Mitigation Effectiveness How much does the proposed investment reduce the modeled risk?

Together, these factors create a stronger basis for comparing security projects across a portfolio.

Figure 3. Risk-informed physical-security investment prioritization

Data Integration May Be One of the Hardest Parts

The calculations themselves are only one part of the challenge.

A meaningful physical-security risk assessment requires information that typically exists across multiple utility organizations.

Power-system planning teams maintain network models, load forecasts, generation assumptions, contingency studies, and stability models.

Asset-management teams maintain transformer information, condition data, replacement strategies, and spare-equipment inventories.

Security organizations maintain physical-security assessments, site configurations, controls, and threat information.

Operations teams understand switching capabilities, alternate supply paths, restoration strategies, and operating constraints.

GIS teams maintain station boundaries, location information, and spatial relationships among facilities.

The challenge is connecting all of this information into a single traceable chain:

Facility → Scenario → System Model → Consequence → Recovery → Mitigation → Decision

Without that integration, utilities can end up with technically sophisticated analyses that remain disconnected from investment decisions.

What Should Utilities Do Before 2028?

CIP-014-4 becomes effective on October 1, 2028, and the initial risk assessment required under the revised framework must be completed according to the approved implementation plan.

That may appear to provide significant preparation time.

But developing a repeatable methodology can require coordination among transmission planning, protection, security, operations, asset management, compliance, GIS, and enterprise risk functions.

The highest-value work can therefore begin well before the compliance deadline.

Utilities can use the implementation period to establish their facility population, identify proximate substations, define consequence thresholds, prepare consistent peak and off-peak study cases, develop dynamic-analysis procedures, document modeling assumptions, establish data ownership, plan third-party verification, and determine how assessment results will feed into capital planning.

The objective should not be to produce a one-time study for October 2028.

The objective should be to build a repeatable risk-assessment capability that can be refreshed as the transmission system changes.

Beyond “Critical” and “Not Critical”

One of the broader lessons from CIP-014-4 is that binary classifications have limitations.

For compliance purposes, utilities ultimately need to determine whether facilities meet applicable criteria.

For investment planning, however, the world is rarely binary.

Two critical substations can have dramatically different risk profiles.

A facility's risk may depend on its system role, neighboring facilities, physical vulnerabilities, equipment configuration, protection systems, restoration alternatives, replacement lead times, and existing controls.

Rather than stopping at:

Critical / Not Critical

utilities can build a portfolio view based on:

Criticality → Vulnerability → Consequence → Recovery → Mitigation Effectiveness → Residual Risk

This creates a much stronger foundation for security and resilience decisions.

CIP-014-4 Can Become More Than a Compliance Exercise

The immediate purpose of CIP-014-4 is clear: strengthen the consistency and technical rigor of physical-security assessments for critical Bulk-Power System transmission facilities.

But the larger opportunity is broader.

The same analytical framework can help utilities answer questions such as:

Which substations create the largest system consequences?

Which combinations of nearby facilities create correlated risk?

Which facilities are most difficult to recover?

Where would additional redundancy provide greater value than additional physical protection?

Which security projects generate the greatest reduction in risk?

And where should the next capital dollar be invested?

Those are not merely compliance questions.

They are risk-management and investment decisions.

The most effective implementation of CIP-014-4 will therefore not end with a list of critical facilities.

It will establish a transparent connection between engineering models, physical-security scenarios, system consequences, resilience, uncertainty, and investment priorities.

That is the difference between performing a physical-security assessment and building a risk-informed infrastructure protection program.

How Forward Thinking Can Help

Forward Thinking supports power utilities in developing quantitative and risk-informed approaches for infrastructure decision-making, including:

risk-assessment frameworks, asset and system criticality models, consequence modeling, probabilistic risk analysis, risk-register development, resilience assessment, investment prioritization, and decision-support tools.

For utilities preparing for CIP-014-4, the opportunity is to use the new requirements as the foundation for a repeatable methodology that connects transmission engineering analysis with risk and investment decisions.

Preparing for CIP-014-4 or strengthening your transmission and substation risk-assessment framework? Contact Forward Thinking to discuss a risk-informed approach tailored to your utility's system, data, and decision-making needs.