1. On July 16, 2026, the North American Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability Organization (ERO), submitted a petition seeking approval of proposed Reliability Standard CIP-014-4 (Physical Security). NERC also requests approval of the associated implementation plan, violation risk factors, and violation severity levels, as well as the retirement of the currently effective Reliability Standard CIP-014-3.^[1] For the reasons discussed below, pursuant to section 215(d)(2) of the Federal Power Act (FPA),^[2] we grant the requested approvals.

I. Background

A. Section 215 and Mandatory Reliability Standards

2. Section 215 of the FPA provides that the Commission may certify an ERO, the purpose of which is to establish and enforce Reliability Standards, subject to Commission review and approval.^[3] Once approved, the Reliability Standards may be enforced by the ERO, subject to Commission oversight, or by the Commission independently.^[4] Pursuant to section 215 of the FPA, the Commission established a process to select and certify an ERO ^[5] and subsequently certified NERC as the ERO.^[6]

B. Physical Security Reliability Standards

3. In Order No. 802, issued in November 2014, the Commission approved the Physical Security Reliability Standard CIP-014-1.^[7] The stated purpose of the currently effective version of the Physical Security Reliability Standard is to “identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in instability, uncontrolled separation, or Cascading within an Interconnection.” ^[8] The Physical Security Reliability Standard applies to ( printed page 58431) transmission owners that own a transmission station or substation that meets any of the criteria identified in the Applicability section of the standard: (1) transmission facilities operated at 500 kV or higher; (2) transmission facilities that are operating between 200 kV and 499 kV at a single station or substation, where the station or substation is connected at 200 kV or higher voltages to three or more other transmission stations or substations and that exceeds an “aggregated weighted value” as defined in the standard; (3) transmission facilities at a single station or substation location that are identified by its reliability coordinator, planning coordinator, or transmission planner as critical to the derivation of interconnection reliability operating limits and their associated contingencies; and (4) transmission facilities identified as essential to meeting nuclear plant interface requirements.^[9]

4. The Physical Security Reliability Standard requires applicable transmission owners to perform risk assessments on a periodic basis to identify the applicable transmission stations, substations, and control centers. The transmission owner must have an unaffiliated third party verify the risk assessment. Applicable entities must then conduct an evaluation of the potential threats and vulnerabilities of a physical attack to each transmission station, substation and control center identified in the risk assessment, followed by the development and implementation of a documented physical security plan. The evaluation and physical security plan are also subject to unaffiliated, third-party review.^[10]

C. December 2022 Order and CIP-014 Report

5. Reports of physical attacks on electric substations increased in late 2022. In response, on December 15, 2022, the Commission directed NERC to evaluate the effectiveness of Physical Security Reliability Standard CIP-014-3 in mitigating risk to the Bulk-Power System from physical attacks.^[11] The Commission directed NERC to study three concerns. First, NERC was to assess “the adequacy of the Applicability criteria set forth in the Physical Security Reliability Standard CIP-014-3.” ^[12] Second, NERC was to examine “the required risk assessment set forth in the Physical Security Reliability Standard,” including possible “parameters or criteria regarding how applicable entities should conduct the required risk assessment.” ^[13] Third, NERC was to consider “whether a minimum level of physical security protections should be required for all Bulk-Power System transmission stations and substations and primary control centers.” ^[14] The Commission cited several recent incidents, including the December 3, 2022 physical attacks on substations in Moore County, North Carolina and the November 2022 incidents at several Pacific Northwest substations.^[15]

6. NERC filed its evaluation report on April 14, 2023 to address the Commission's directive.^[16] In the CIP-014 Report, NERC found that the CIP-014 Applicability criteria are meeting the objective “[to focus] limited industry resources on risks to the reliable operation of the [Bulk-Power System] associated with physical security incidents at the most critical facilities” and are “broad enough to capture the subset of applicable facilities that [transmission owners] should identify as `critical.' ” ^[17] Therefore, NERC did not recommend expanding those criteria.^[18]

7. NERC did, however, identify concerns with the Requirement R1 risk assessment. NERC determined that “registered entities have inconsistent approaches to performing the risk assessment and they did not always meet the technical rigor expected for other planning horizon study assessment-related Reliability Standards, such as TPL-001.” ^[19] NERC further explained:

The language within CIP-014-3 does not prescribe a specific method on how each risk assessment of the entity's Transmission station(s) and Transmission substation(s) shall be performed. As such, specific components that comprise any supporting analytics are neither defined nor listed.^[20]

According to NERC, “in certain instances, registered entities failed to provide sufficient technical studies or justification for study decisions resulting in noncompliance.” ^[21] NERC determined that “the inconsistent approach to performing the risk assessment is largely due to a lack of specificity in the requirement language as to the nature and parameters of the risk assessment.” ^[22]

8. In the CIP-014 Report, NERC also addressed whether to require a minimum level of physical security for all Bulk-Power System transmission stations, transmission substations, and their associated primary control centers. NERC concluded that a “bright line set of minimum physical security protections, while potentially preventing some forms of attack, does not account for the [design basis threat] process nor does it guarantee the protections will safeguard against more sophisticated or coordinated attacks.” ^[23] NERC explained that “[e]ffective physical security plans should align with the risks intended to be mitigated” and “should include responsive or adaptive controls, site-specific attributes, and a viable threat assessment from expert security professionals,” rather than a fixed, one-size-fits-all baseline applied uniformly across all applicable facilities.^[24] Therefore, NERC recommended a holistic approach that pairs physical security controls with complementary reliability and resiliency measures—such as response readiness and spare-equipment strategies—to mitigate the impact of physical attacks, rather than adopting minimum protections applicable to all Bulk-Power System transmission stations, substations and primary control centers.^[25]

9. Subsequently, NERC initiated a Standard Authorization Request and commenced Project 2023-06 (Risk Assessment Refinement) to develop clarifying revisions to CIP-014-3.^[26] On July 16, 2026, NERC filed its petition with these revisions for approval as proposed Reliability Standard CIP-014-4.

II. NERC's Petition

10. In NERC's petition, NERC explains that proposed Reliability Standard CIP-014-4 would revise the applicability language to reflect the inclusion of jointly owned transmission stations and ( printed page 58432) transmission substations. Further, existing Applicability subsections have been relocated, without substantive revision, to a new Attachment 1 to improve organization.^[27]

11. NERC explains that proposed Reliability Standard CIP-014-4, Requirement R1 would require a transmission owner to review and, if necessary, update its list of applicable transmission stations and transmission substations at least once every 36 calendar months, including both existing facilities and facilities planned to be in service within 36 calendar months. NERC explains that the 36-calendar month risk assessment cycle would align with the annual cycle for performing planning assessments under Reliability Standard TPL-001 to avoid confusion from gaps between models and study horizons that sometimes occurs under the current version of CIP-014.^[28]

12. NERC states that proposed Requirement R2 would require each transmission owner with an applicable transmission station or transmission substation identified under Requirement R1 to “identify proximate existing Bulk Electric System (BES) [t]ransmission station(s) and BES [t]ransmission substation(s), irrespective of ownership, within 1500 feet or 457 meters (the shortest distance, measured substation fence line to substation fence line).” ^[29] NERC explains that the list of proximate facilities identified under Requirement R2 is used to inform the risk assessment required under the proposed Requirement R5.^[30]

13. NERC explains that proposed Requirement R3 would require each transmission owner to maintain “a documented risk assessment methodology for evaluating the loss of each applicable [t]ransmission station or [t]ransmission substation identified in Requirement R1.” The proposed methodology would include three elements: (1) “[d]ocumented criteria for assessing instability, uncontrolled separation, or [c]ascading within an Interconnection,” with “technically justified thresholds identifying unacceptable generation and load loss;” ^[31] (2) “[a] provision that steady-state and dynamic simulations shall each be performed using at a minimum one System peak Load case and one System Off-Peak Load case;” ^[32] and (3) detailed specifications for simulations at applicable and proximate stations and substations, including assumptions regarding “[p]rior loss of communication and Protection Systems,” faults, and clearing times.^[33]

14. According to NERC, proposed Requirement R4 would require transmission owners with jointly owned applicable transmission stations or transmission substations to coordinate with one another to determine and document their individual and joint responsibilities under Requirements R3 and R5.^[34]

15. NERC explains that the proposed Requirement R5 would consolidate the risk assessment periodicity—30 calendar months for transmission owners that previously identified a critical facility, or 60 calendar months for those that did not—into a single 36-calendar-month cycle. NERC identifies two principal benefits of this change. First, for transmission owners that have not previously identified a critical transmission station or transmission substation, the 36-month cycle shortens the maximum reassessment interval from 60 months to 36 months, requiring more frequent reevaluation of facilities that may have become critical due to changed system conditions.^[35] Second, NERC explains that the single 36-month cycle harmonizes the CIP-014-4 risk assessment schedule with two other recurring cycles: the Requirement R1 cycle for updating the Attachment 1 list of applicable facilities, and the annual planning-assessment cycle under Reliability Standard TPL-001.^[36] According to NERC, this alignment avoids confusion arising from gaps between models and study horizons that can occur under the current multi-tiered version of CIP-014. Proposed Requirement R5 would further require that proximate stations and substations identified under Requirement R2 be included in the risk assessment.

16. NERC states that proposed Requirements R6 through R10 would carry forward, without substantive revision, the requirements previously numbered R2 through R6 in Reliability Standard CIP-014-3.^[37]

17. NERC requests that proposed Reliability Standard CIP-014-4 become effective on the first day of the first calendar quarter that begins 24 calendar months after the Commission's approval order takes effect.^[38] Reliability Standard CIP-014-3 would be retired immediately before the effective date of Reliability Standard CIP-014-4.^[39] Under the proposed implementation plan, the initial risk assessment required under Requirement R5 must be completed on or before the effective date. Subsequent risk assessments must follow no later than 36 calendar months after that effective date.^[40]

III. Notice of Filing

18. Notice of NERC's July 16, 2026, petition was published in the Federal Register , 91 FR 46418 (July 23, 2026), with interventions and protests due on or before August 17, 2026. Ameren Missouri, Ameren Illinois Company, and Ameren Transmission Company of Illinois all filed timely motions to intervene.

IV. Determination

A. Procedural Matters

19. Pursuant to Rule 214 of the Commission's Rules of Practice and Procedure, 18 CFR 385.214 (2025), the timely unopposed motions to intervene serve to make the entities that filed them parties to this proceeding.

B. Substantive Matters

20. We determine that proposed Reliability Standard CIP-014-4 improves the reliability of the Bulk-Power System by providing a consistent approach for identifying and assessing transmission stations, transmission substations, and primary control centers critical to the operation of the Bulk-Power System. Moreover, the modifications to Reliability Standard CIP-014-4 refine and strengthen the physical security framework for critical transmission facilities by tightening assessment timelines, clarifying applicability thresholds, and improving verification and oversight processes.

21. Accordingly, pursuant to section 215(d)(2) of the FPA, we approve the proposed Reliability Standard CIP-014-4 as just, reasonable, not unduly discriminatory or preferential, and in the public interest. We also approve the ( printed page 58433) associated implementation plan (including an effective date of October 1, 2028), violation risk factors and violation severity levels. We further approve the retirement of the currently effective Reliability Standard CIP-014-3, effective immediately before Reliability Standard CIP-014-4 takes effect.

V. Information Collection Statement

22. The FERC-725U information collections requirements are subject to review by the Office of Management and Budget (OMB) under section 3507(d) of the Paperwork Reduction Act of 1995. OMB's regulations require approval of certain information collection requirements imposed by agency rules. Upon approval of a collection of information, OMB will assign an OMB control number and expiration date. Respondents subject to the filing requirements will not be penalized for failing to respond to these collections of information unless the collections of information display a valid OMB control number. The Commission solicits comments on the need for this information, whether the information will have practical utility, the accuracy of the burden estimates, ways to enhance the quality, utility, and clarity of the information to be collected or retained, and any suggested methods for minimizing respondents' burden, including the use of automated information techniques.

23. The Commission bases its paperwork burden estimates on the additional paperwork burden for transmission owners presented by Reliability Standard CIP-014-4. Reliability Standards are objective-based and allow entities to choose compliance approaches best tailored to their systems. While transmission operators are applicable entities for Reliability Standard CIP-014-4, there were no changes to their burden based on the revisions. The number of transmission owners (TO) that are subject to mandatory compliance with Reliability Standard CIP-014-4, in the table below, are based on the NERC Compliance Registry as of July 21, 2026, and good faith estimates provided by NERC to Commission staff.

24. Based on these assumptions, we estimate the following change in reporting burden ^[41] and costs: ^[42]

25. Titles: FERC-725U, Mandatory Reliability Standards for the Bulk Power System; CIP-014 Reliability Standard.

Action: Revisions to Existing Collections of Information in FERC-725U (CIP-014).

OMB Control Nos: 1902-0274 (FERC-725U).

Respondents: Transmission owners.

Frequency of Responses: Annually.

Necessity of the Information: This order approves modifications to Reliability Standard CIP-014-4 that refine and strengthen the physical security framework for critical transmission facilities by tightening assessment timelines, clarifying applicability thresholds, and improving verification and oversight processes. Key changes include more objective risk-assessment requirements, clarifying language to the Applicability section, increased rigor around third-party verification and review, and expanded threat and vulnerability evaluation requirements. Overall, the revisions aim to provide clearer technical guidance, improve consistency among entities, and ensure more timely, accountable, and risk-based protection of facilities whose loss could cause instability, uncontrolled separation, or cascading within an Interconnection.

Internal review: The Commission has reviewed the proposed Reliability Standard and made a determination that its action is necessary to implement section 215 of the FPA. The Commission has assured itself, by means of its internal review, that there is specific, objective support for the burden estimates associated with the information requirements.

26. Interested persons may obtain information on the reporting requirements by contacting the Federal Energy Regulatory Commission, Office of the Executive Director, 888 First Street NE, Washington, DC 20426 [Attention: Kayla Williams, email: DataClearance@ferc.gov, phone: (202) 502-6468].

27. Comments concerning the information collections and requirements approved for retirement in this order and the associated burden estimates, should be sent to the Commission (identified by Docket No. RD26-9-000 as appropriate), using the following methods. Electronic filing through www.ferc.gov is preferred. Electronic Filing should be filed in acceptable native applications and print-to-PDF, but not in scanned or picture format. For those unable to file electronically, comments may be filed by U.S. Postal Service mail or by hand (including courier) delivery: Mail via U.S. Postal Service Only: Addressed to: Federal Energy Regulatory Commission, Secretary of the Commission, 888 First Street NE, Washington, DC 20426. Hand (including courier) delivery: Deliver to: Federal Energy Regulatory Commission, 12225 Wilkins Avenue, Rockville, MD 20852. ( printed page 58434)

VI. Document Availability

28. In addition to publishing the full text of this document in the Federal Register , the Commission provides all interested persons an opportunity to view and/or print the contents of this document via the internet through the Commission's Home Page ( www.ferc.gov).

29. From the Commission's Home Page on the internet, this information is available on eLibrary. The full text of this document is available on eLibrary in PDF and Microsoft Word format for viewing, printing, and/or downloading. To access this document in eLibrary, type the docket number excluding the last three digits of this document in the docket number field.

30. User assistance is available for eLibrary and the Commission's website during normal business hours from the Commission's Online Support at (202) 502-6652 (toll free at 1-866-208-3676) or email at ferconlinesupport@ferc.gov, or the Public Reference Room at (202) 502-8371, TTY (202) 502-8659. Email the Public Reference Room at public.referenceroom@ferc.gov.

The Commission orders:

Proposed Reliability Standard CIP-014-4, its associated implementation plan (including an effective date of October 1, 2028), violation risk factors, and violation severity levels, and the proposed retirement of Reliability Standard CIP-014-3 immediately prior to the effective date of proposed Reliability Standard CIP-014-4 are hereby approved, as discussed in the body of this order.