CIP-014 — Physical Security

Description

CIP-014 addresses physical security risk assessments and security plans for certain transmission stations and substations whose compromise could significantly affect the reliable operation of the Bulk Electric System. It requires identification of applicable facilities, risk assessment, evaluation of potential threats and impacts, development and implementation of physical security plans, and periodic review.

Implications

• Transmission owners and operators may need to protect selected high-consequence facilities against physical attack, including coordinated or prolonged attacks.
• Security planning must be based on realistic threats, facility characteristics, criticality, recovery time, and interdependencies.
• Measures can affect capital planning, site design, staffing, surveillance, communications, spare equipment, and restoration strategy.
• Physical security must be integrated with cyber protection, law enforcement coordination, emergency management, and system planning.

Common Compensating Controls

• Layered defense: perimeter barriers, hardened structures, ballistic or blast mitigation where justified, locked control houses, and protected relay/control equipment.
• Video surveillance, analytics, intrusion detection, lighting, alarm monitoring, and documented response procedures.
• Access control, visitor management, two-person access, patrols, tamper detection, and secure key/credential management.
• Redundant protection and control paths, spare transformers and critical equipment, alternate control capability, and restoration plans.
• Threat intelligence, law-enforcement coordination, periodic risk reassessment, exercises, and post-event improvement actions.

Specific applicability and required measures depend on the current standard, facility assessment, and approved physical security plan.