What FERC approved
On September 10, 2026, the Federal Energy Regulatory Commission approved NERC Reliability Standard CIP-014-4 in Docket No. RD26-9-000. The order was published in the Federal Register on September 15. FERC approved the standard together with its implementation plan, violation risk factors and violation severity levels, and approved the retirement of CIP-014-3 immediately before the new version takes effect.
The implementation plan carries an effective date of October 1, 2028. Under that plan, the initial risk assessment has to be complete on or before the effective date, with subsequent risk assessments following no later than 36 calendar months after it.
CIP-014 has not changed in purpose. It still asks a Transmission Owner to identify which of its stations matter enough that losing them could destabilize the grid, study the physical threats those stations face, and protect them in proportion. The underlying obligation is an executive one, and version four does not soften it. What version four does is remove room for interpretation.
The three changes that matter
| Change | What it replaces | Practical effect |
|---|---|---|
| One 36-month cycle for identification and risk assessment | Split timelines that ran on different clocks | Aligns physical-security review with transmission planning assessments; fewer dates to track, less room to fall between them |
| Proximity identification within 1,500 feet (457 meters), fence line to fence line, irrespective of ownership | No equivalent obligation | Brings neighboring stations into the picture, including ones the owner does not control |
| A documented risk assessment methodology with specified simulation cases | Broad latitude in how the assessment was performed | Steady-state and dynamic simulations must each use at least one system peak load case and one off-peak case; similar facts should now produce similar answers |
An unaffiliated third party still has to verify the risk assessment, within 90 calendar days of its completion. Where stations are jointly owned, the owners have to coordinate and document who is responsible for what.
Why October 1, 2028 is the wrong date to plan against
Read plainly, the order gives owners just over two years. Read against how substation work actually happens, it gives them less than that, because the deadline attaches to the assessment and not to the remedy.
The standard schedules the study. The grid schedules the construction.
A risk assessment that finds a gap does not resolve itself with a document. It resolves with siting work, engineering, procurement, permitting, and an outage window on an energized station that the system operator has to agree to. Any one of those runs in quarters; together they routinely run in years. An owner who begins the assessment in mid-2028 to meet an October 2028 date will finish the study on time and then discover that the earliest window to act on it is well into the following cycle.
The useful way to read the order is backwards from the physical work rather than forwards from the filing. If a station is likely to be identified, the assessment is worth starting now, not because the regulator says so but because the answer has a construction tail attached to it.
The proximity rule is a coordination problem, not an engineering one
The 1,500-foot provision is the genuinely new obligation, and it is the one most likely to produce surprises. It requires identifying proximate bulk-power transmission stations and substations within 1,500 feet or 457 meters of an applicable station, measured as the shortest distance from fence line to fence line — and it applies irrespective of ownership.
That means an owner can be obligated to account for a facility it does not own, cannot modify, and may have no standing commercial relationship with. The engineering question is straightforward. The question of who studies what, who pays for it, what gets shared between two utilities about the vulnerabilities of adjacent sites, and how any of that is handled without creating a new disclosure risk — that is slower, and it is a legal and commercial conversation before it is a technical one. Utilities that already have mutual-assistance or shared-corridor agreements in place will find this easier than those starting from nothing.
It is also a quiet acknowledgment of something operators have said for years: two substations close enough to share a sightline can share an attacker.
What this signals to readers who are not transmission owners
Most people reading about grid security do not own a substation. This order is still worth their attention, for three reasons.
- Physical security of the grid is moving from discretionary to scheduled. Successive versions of CIP-014 have narrowed judgment and fixed intervals. That trend is now explicit in the text, and it is reasonable to expect the identified population of critical stations to grow at some owners rather than shrink.
- Siting decisions near transmission are about to get more scrutiny. Anyone siting a data center, a storage project, or an industrial load near an existing bulk-power station should expect the proximity language to come up, because the neighbor now has an obligation that references the site.
- Rate cases will carry this. Work driven by a mandatory reliability standard tends to arrive in front of state commissions as a cost recovery question. Ratepayer advocates and state staff have two years to understand the standard before that happens, which is a better position than reading it for the first time in a filing.
For owners who want to test where their own program sits against the revised cycle before the studies start, the CIP-014 readiness scorecard walks the same sequence the standard does.