CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
A. Introduction

1.

Title:

Cyber Security — Physical Security of BES Cyber Systems

2.

Number:

CIP-006-6

3.

Purpose:To manage physical access to Bulk Electric System (BES) Cyber Systems by
specifying a physical security plan in support of protecting BES Cyber
Systems against compromise that could lead to misoperation or
instability in the BES.

4.

Applicability:

4.1.

Functional Entities: For the purpose of the requirements contained
herein, the following list of functional entities will be collectively referred to as“Responsible Entities.” For requirements in this standard where a specific functional
entity or subset of functional entities are the applicable entity or entities, thefunctional entity or entities are specified explicitly.

4.1.1 Balancing Authority
4.1.2 Distribution Provider that owns one or more of the following Facilities, systems,
and equipment for the protection or restoration of the BES:
4.1.2.1 Each underfrequency Load shedding (UFLS) or undervoltage Load shedding(UVLS) system that:
4.1.2.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.1.2.2 Each Special Protection System (SPS) or Remedial Action Scheme (RAS)
where the SPS or RAS is subject to one or more requirements in a NERC or
Regional Reliability Standard.
4.1.2.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.1.2.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3 Generator Operator
4.1.4 Generator Owner
4.1.5 Interchange Coordinator or Interchange Authority
4.1.6 Reliability Coordinator

Page 1 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
4.1.7 Transmission Operator
4.1.8 Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above
are those to which these requirements are applicable. For requirements in thisstandard where a specific type of Facilities, system, or equipment or subset of
Facilities, systems, and equipment are applicable, these are specified explicitly.

4.2.1

Distribution Provider: One or more of the following Facilities, systems
and equipment owned by the Distribution Provider for the protection or
restoration of the BES:

4.2.1.1 Each UFLS or UVLS System that:
4.2.1.1.1 is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2 performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation,of 300 MW or more.
4.2.1.2 Each SPS or RAS where the SPS or RAS is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.3 Each Protection System (excluding UFLS and UVLS) that applies toTransmission where the Protection System is subject to one or more
requirements in a NERC or Regional Reliability Standard.
4.2.1.4 Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2

Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.

4.2.3

Exemptions: The following are exempt from Standard CIP-006-6:

4.2.3.1 Cyber Assets at Facilities regulated by the Canadian Nuclear Safety
Commission.
4.2.3.2 Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters.
4.2.3.3

The systems, structures, and components that are regulated by the
Nuclear Regulatory Commission under a cyber security plan pursuant to 10
C.F.R. Section 73.54.

4.2.3.4 For Distribution Providers, the systems and equipment that are not included
in section 4.2.1 above.

Page 2 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
4.2.3.5 Responsible Entities that identify that they have no BES Cyber Systems
categorized as high impact or medium impact according to the CIP-002-5.1
identification and categorization processes.
5.

Effective Dates:
See Implementation Plan for CIP-006-6.

6.

Background:Standard CIP-006 exists as part of a suite of CIP Standards related to cyber security,
which require the initial identification and categorization of BES Cyber Systems andrequire a minimum level of organizational, operational and procedural controls to
mitigate risk to BES Cyber Systems.
Most requirements open with, “Each Responsible Entity shall implement one or more
documented [processes, plan, etc.] that include the applicable items in [Table
Reference].” The referenced table requires the applicable items in the procedures forthe requirement’s common subject matter.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any
particular naming or approval structure beyond what is stated in the requirements.
An entity should include as much as it believes necessary in its documented
processes, but it must address the applicable requirements in the table.
The terms program and plan are sometimes used in place of documented processes
where it makes sense and is commonly understood. For example, documented
processes describing a response are typically referred to as plans (i.e., incident
response plans and recovery plans). Likewise, a security plan can describe an
approach involving multiple procedures to address a broad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of
its policies, plans and procedures involving a subject matter. Examples in thestandards include the personnel risk assessment program and the personnel training
program. The full implementation of the CIP Cyber Security Standards could also bereferred to as a program. However, the terms program and plan do not imply any
additional requirements beyond what is stated in the standards.
Responsible Entities can implement common controls that meet requirements for
multiple high and medium impact BES Cyber Systems. For example, a single training
program could meet the requirements for training personnel across multiple BES
Cyber Systems.
Measures for the initial requirement are simply the documented processes
themselves. Measures in the table rows provide examples of evidence to show
documentation and implementation of applicable items in the documented
processes. These measures serve to provide guidance to entities in acceptable records
of compliance and should not be viewed as an all-inclusive list.

Page 3 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
Throughout the standards, unless otherwise stated, bulleted items in therequirements and measures are items that are linked with an “or,” and numbered
items are items that are linked with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and
UVLS. This particular threshold of 300 MW for UVLS and UFLS was provided in Version
1 of the CIP Cyber Security Standards. The threshold remains at 300 MW since it isspecifically addressing UVLS and UFLS, which are last ditch efforts to save the Bulk
Electric System. A review of UFLS tolerances defined within regional reliability
standards for UFLS program requirements to date indicates that the historical value of
300 MW represents an adequate and reasonable threshold value for allowable UFLS
operational tolerances.
“Applicable Systems” Columns in Tables:
Each table has an “Applicable Systems” column to further define the scope of systems
to which a specific requirement row applies. The CSO706 SDT adapted this conceptfrom the National Institute of Standards and Technology (“NIST”) Risk Management
Framework as a way of applying requirements more appropriately based on impact
and connectivity characteristics. The following conventions are used in the“Applicable Systems” column as described.
High Impact BES Cyber Systems – Applies to BES Cyber Systems categorized ashigh impact according to the CIP-002-5.1 identification and categorization
processes.

Medium Impact BES Cyber Systems – Applies to BES Cyber Systems categorized as
medium impact according to the CIP-002-5.1 identification and categorization
processes.

Medium Impact BES Cyber Systems without External Routable Connectivity –Only applies to medium impact BES Cyber Systems without External Routable
Connectivity.

Medium Impact BES Cyber Systems with External Routable Connectivity – Only
applies to medium impact BES Cyber Systems with External Routable Connectivity.
This also excludes Cyber Assets in the BES Cyber System that cannot be directly
accessed through External Routable Connectivity.

Electronic Access Control or Monitoring Systems (EACMS) – Applies to eachElectronic Access Control or Monitoring System associated with a referenced highimpact BES Cyber System or medium impact BES Cyber System. Examples may
include, but are not limited to, firewalls, authentication servers, and log
monitoring and alerting systems.

Physical Access Control Systems (PACS) – Applies to each Physical Access Control
System associated with a referenced high impact BES Cyber System or medium
impact BES Cyber System.

Page 4 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
Protected Cyber Assets (PCA) – Applies to each Protected Cyber Asset associatedwith a referenced high impact BES Cyber System or medium impact BES Cyber
System.



Locally mounted hardware or devices at the Physical Security Perimeter –Applies to the locally mounted hardware or devices (e.g. such as motion sensors,
electronic lock control mechanisms, and badge readers) at a Physical Security
Perimeter associated with a referenced high impact BES Cyber System or medium
impact BES Cyber System with External Routable Connectivity, and that does notcontain or store access control information or independently perform accessauthentication. These hardware and devices are excluded in the definition of
Physical Access Control Systems.

Page 5 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
B. Requirements and Measures

R1.

Each Responsible Entity shall implement one or more documented physical security plan(s) that collectively include all of
the applicable requirement parts in CIP-006-6 Table R1 – Physical Security Plan. [Violation Risk Factor: Medium] [TimeHorizon: Long Term Planning and Same Day Operations].

M1. Evidence must include each of the documented physical security plans that collectively include all of the applicablerequirement parts in CIP-006-6 Table R1 – Physical Security Plan and additional evidence to demonstrate implementationof the plan or plans as described in the Measures column of the table.

CIP-006-6 Table R1 – Physical Security PlanPart

Applicable Systems

1.1

Medium Impact BES Cyber Systems
without External Routable Connectivity
Physical Access Control Systems (PACS)
associated with:

High Impact BES Cyber Systems,orMedium Impact BES Cyber
Systems with External Routable
Connectivity

Requirements
Define operational or procedural
controls to restrict physical access.

Measures
An example of evidence may include,
but is not limited to, documentationthat operational or procedural controls
exist.

Page 6 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1 – Physical Security Plan
Part
1.2

Applicable Systems
Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Requirements

MeasuresUtilize at least one physical access
control to allow unescorted physicalaccess into each applicable Physical
Security Perimeter to only thoseindividuals who have authorized
unescorted physical access.

An example of evidence may include,
but is not limited to, language in thephysical security plan that describes
each Physical Security Perimeter andhow unescorted physical access iscontrolled by one or more different
methods and proof that unescorted
physical access is restricted to only
authorized individuals, such as a list of
authorized individuals accompanied byaccess logs.

Page 7 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

CIP-006-6 Table R1 – Physical Security Plan
Part
1.3

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Requirements

Measures

Where technically feasible, utilize two
or more different physical access
controls (this does not require twocompletely independent physicalaccess control systems) to collectively
allow unescorted physical access into
Physical Security Perimeters to only
those individuals who have authorized
unescorted physical access.

An example of evidence may include,
but is not limited to, language in thephysical security plan that describes
the Physical Security Perimeters andhow unescorted physical access iscontrolled by two or more different
methods and proof that unescorted
physical access is restricted to only
authorized individuals, such as a list of
authorized individuals accompanied byaccess logs.

Page 8 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

CIP-006-6 Table R1– Physical Security Plan
Part
1.4

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Requirements

Measures

Monitor for unauthorized accessthrough a physical access point into a
Physical Security Perimeter.

An example of evidence may include,
but is not limited to, documentation ofcontrols that monitor for unauthorizedaccess through a physical access point
into a Physical Security Perimeter.

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Page 9 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1– Physical Security Plan
Part
1.5

Applicable Systems

Requirements

MeasuresIssue an alarm or alert in response todetected unauthorized access througha physical access point into a Physical
Security Perimeter to the personnel
identified in the BES Cyber Security
Incident response plan within 15
minutes of detection.

An example of evidence may include,
but is not limited to, language in thephysical security plan that describes
the issuance of an alarm or alert in
response to unauthorized accessthrough a physical access control intoa Physical Security Perimeter andadditional evidence that the alarm oralert was issued and communicated as
identified in the BES Cyber Security
Incident Response Plan, such as
manual or electronic alarm or alertlogs, cell phone or pager logs, or otherevidence that documents that thealarm or alert was generated andcommunicated.

Physical Access Control Systems (PACS) Monitor each Physical Access Control
associated with:
System for unauthorized physicalaccess to a Physical Access Control
 High Impact BES Cyber
System.
Systems, orAn example of evidence may include,
but is not limited to, documentation ofcontrols that monitor for unauthorized
physical access to a PACS.

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

1.6

Medium Impact BES Cyber
Systems with External Routable
Connectivity

Page 10 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1– Physical Security Plan
Part
1.7

Applicable Systems

Requirements

Physical Access Control Systems (PACS) Issue an alarm or alert in response toassociated with:
detected unauthorized physical accessto a Physical Access Control System to High Impact BES Cyberthe personnel identified in the BES
Systems, orCyber Security Incident response plan Medium Impact BES Cyberwithin 15 minutes of the detection.
Systems with External Routable
Connectivity

Measures
An example of evidence may include,
but is not limited to, language in thephysical security plan that describes
the issuance of an alarm or alert in
response to unauthorized physicalaccess to Physical Access Control
Systems and additional evidence thatthe alarm or alerts was issued andcommunicated as identified in the BES
Cyber Security Incident Response Plan,such as alarm or alert logs, cell phoneor pager logs, or other evidence thatthe alarm or alert was generated andcommunicated.

Page 11 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1 – Physical Security Plan
Part
1.8

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Requirements

MeasuresLog (through automated means or bypersonnel who control entry) entry ofeach individual with authorized
unescorted physical access into each
Physical Security Perimeter, withinformation to identify the individualand date and time of entry.

An example of evidence may include,
but is not limited to, language in thephysical security plan that describes
logging and recording of physical entry
into each Physical Security Perimeterand additional evidence todemonstrate that this logging has
been implemented, such as logs ofphysical access into Physical Security
Perimeters that show the individual
and the date and time of entry into
Physical Security Perimeter.

Page 12 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1 – Physical Security Plan
Part
1.9

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Requirements

Measures

Retain physical access logs of entry ofindividuals with authorized unescorted
physical access into each Physical
Security Perimeter for at least ninety
calendar days.

An example of evidence may include,
but is not limited to, dated
documentation such as logs of physicalaccess into Physical Security
Perimeters that show the date andtime of entry into Physical Security
Perimeter.

Page 13 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
CIP-006-6 Table R1 – Physical Security PlanPart

Applicable Systems

Requirements

Measures1.10

High Impact BES Cyber Systems andtheir associated:

Restrict physical access to cabling andother nonprogrammable communication
components used for connection
between applicable Cyber Assets within
the same Electronic Security Perimeter inthose instances when such cabling andcomponents are located outside of a
Physical Security Perimeter.

An example of evidence may include,
but is not limited to, records of the
Responsible Entity’s implementationof the physical access restrictions (e.g.,cabling and components secured
through conduit or secured cabletrays) encryption, monitoring, or
equally effective logical protections.



PCA

Medium Impact BES Cyber Systems
at Control Centers and theirassociated:


PCA

Where physical access restrictions tosuch cabling and components are not
implemented, the Responsible Entity
shall document and implement one ormore of the following:

encryption of data that transits
such cabling and components; ormonitoring the status of thecommunication link composed ofsuch cabling and components andissuing an alarm or alert in
response to detected
communication failures to thepersonnel identified in the BES
Cyber Security Incident response
plan within 15 minutes ofdetection; or

an equally effective logicalprotection.

Page 14 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
R2.

Each Responsible Entity shall implement one or more documented visitor control program(s) that include each of theapplicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon:
Same Day Operations.]

M2.

Evidence must include one or more documented visitor control programs that collectively include each of the applicablerequirement parts in CIP-006-6 Table R2 – Visitor Control Program and additional evidence to demonstrate implementation as
described in the Measures column of the table.

CIP-006-6 Table R2 – Visitor Control Program
Part
2.1

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Require continuous escorted access ofvisitors (individuals who are provided
access but are not authorized forunescorted physical access) withineach Physical Security Perimeter,
except during CIP Exceptional
Circumstances.

An example of evidence may include,
but is not limited to, language in avisitor control program that requires
continuous escorted access of visitors
within Physical Security Perimeters andadditional evidence to demonstratethat the process was implemented,
such as visitor logs.

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Page 15 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

CIP-006-6 Table R2 – Visitor Control Program
Part

2.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA
2.3

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PCA

Requirements

Measures

Require manual or automated logging
of visitor entry into and exit from the
Physical Security Perimeter that
includes date and time of the initialentry and last exit, the visitor’s name,and the name of an individual point ofcontact responsible for the visitor,
except during CIP Exceptional
Circumstances.

An example of evidence may include,
but is not limited to, language in avisitor control program that requires
continuous escorted access of visitors
within Physical Security Perimeters andadditional evidence to demonstratethat the process was implemented,
such as dated visitor logs that include
the required information.

Retain visitor logs for at least ninety
calendar days.

An example of evidence may include,
but is not limited to, documentation
showing logs have been retained for atleast ninety calendar days.

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PCA

Page 16 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
R3.

Each Responsible Entity shall implement one or more documented Physical Access Control System maintenance and testing
program(s) that collectively include each of the applicable requirement parts in CIP-006-6 Table R3 – Maintenance and Testing
Program. [Violation Risk Factor: Medium] [Time Horizon: Long Term Planning].

M3.

Evidence must include each of the documented Physical Access Control System maintenance and testing programs thatcollectively include each of the applicable requirement parts in CIP-006-6 Table R3 – Maintenance and Testing Program andadditional evidence to demonstrate implementation as described in the Measures column of the table.

CIP-006-6 Table R3 – Physical Access Control System Maintenance and Testing Program
Part

Applicable Systems

Requirement

Measures3.1

Physical Access Control Systems (PACS)
associated with:

Maintenance and testing of each
Physical Access Control System andlocally mounted hardware or devices at
the Physical Security Perimeter at least
once every 24 calendar months toensure they function properly.

An example of evidence may include,
but is not limited to, a maintenanceand testing program that provides fortesting each Physical Access Control
System and locally mounted hardware
or devices associated with eachapplicable Physical Security Perimeterat least once every 24 calendar months
and additional evidence todemonstrate that this testing wasdone, such as dated maintenancerecords, or other documentation
showing testing and maintenance has
been performed on each applicabledevice or system at least once every 24
calendar months.

High Impact BES Cyber Systems, orMedium Impact BES Cyber Systems
with External Routable Connectivity

Locally mounted hardware or devices
at the Physical Security Perimeterassociated with:

High Impact BES Cyber Systems, orMedium Impact BES Cyber Systems
with External Routable Connectivity

Page 17 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
C. Compliance1. Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority” (CEA)
means NERC or the Regional Entity in their respective roles of monitoring and enforcing
compliance with the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity isrequired to retain specific evidence to demonstrate compliance. For instances where
the evidence retention period specified below is shorter than the time since the lastaudit, the CEA may ask an entity to provide other evidence to show that it wascompliant for the full time period since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as identified
below unless directed by its CEA to retain specific evidence for a longer period of time
as part of an investigation:
 Each Responsible Entity shall retain evidence of each requirement in this standard
for three calendar years.
 If a Responsible Entity is found non-compliant, it shall keep information related to
the non-compliance until mitigation is complete and approved or for the time
specified above, whichever is longer.
 The CEA shall keep the last audit records and all requested and submitted
subsequent audit records.
1.3. Compliance Monitoring and Assessment Processes:
Compliance Audits
Self-Certifications
Spot Checking
Compliance Investigations
Self-Reporting
Complaints
1.4. Additional Compliance Information:
None

Page 18 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
2. Table of Compliance Elements
R#

R1

Time
HorizonLong Term
Planning

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

MediumN/A

Moderate VSL
N/AHigh VSL
N/A

Same-Day
Operations

Severe VSL
The Responsible Entity
did not document or
implement physicalsecurity plans. (R1)ORThe Responsible Entity
did not document or
implement operationalor procedural controls
to restrict physicalaccess. (1.1)
OR
The Responsible Entity
has documented andimplemented physicalaccess controls, but atleast one control does
not exist to restrict
access to Applicable
Systems. (1.2)
OR
The Responsible Entity
has documented andimplemented physicalPage 19 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL
access controls, but atleast two different
controls do not exist to
restrict access to
Applicable Systems.
(1.3)
OR
The Responsible Entity
does not have a process
to monitor for
unauthorized accessthrough a physicalaccess point into a
Physical Security
Perimeter. (1.4)
OR
The Responsible Entity
does not have a process
to alert for detected
unauthorized accessthrough a physicalaccess point into a
Physical Security
Perimeter or tocommunicate such
alerts within 15 minutes
to identified personnel.

Page 20 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL(1.5)
OR
The Responsible Entity
does not have a process
to monitor each PhysicalAccess Control System
for unauthorized
physical access to a
Physical Access Control
Systems. (1.6)
OR
The Responsible Entity
does not have a process
to alert forunauthorized physicalaccess to PhysicalAccess Control Systems
or to communicate such
alerts within 15 minutes
to identified personnel.
(1.7)
OR
The Responsible Entity
does not have a process
to log authorized
physical entry into each

Page 21 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL
Physical Security
Perimeter with
sufficient information to
identify the individualand date and time ofentry. (1.8)
OR
The Responsible Entity
does not have a process
to retain physical accesslogs for 90 calendar
days. (1.9)
OR
The Responsible Entity
did not document or
implement physicalaccess restrictions,encryption, monitoringor equally effective
logical protections forcabling and othernonprogrammablecommunication
components used forconnection between
applicable Cyber Assets
within the same

Page 22 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
HorizonR2

Same-Day
Operations

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

MediumN/A

Moderate VSL

N/AHigh VSL

N/A

Severe VSL
Electronic Security
Perimeter in thoseinstances when suchcabling and components
are located outside of a
Physical Security
Perimeter. (1.10)
The Responsible Entity
has failed to include or
implement a visitor
control program that
requires continuous
escorted access ofvisitors within any
Physical Security
Perimeter. (2.1)
OR
The Responsible Entity
has failed to include or
implement a visitor
control program that
requires logging of theinitial entry and last exit
dates and times of thevisitor, the visitor’sname, and the point ofPage 23 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL

Moderate VSLHigh VSL

Severe VSL
contact. (2.2)
OR
The Responsible Entity
failed to include or
implement a visitor
control program toretain visitor logs for atleast ninety days. (2.3)

R3Long Term
Planning

MediumThe
Responsible
Entity has
documented
andimplemented amaintenanceand testing
program for
Physical AccessControl
Systems andlocally
mountedhardware or
devices at the
PhysicalSecurity
Perimeter, but

The Responsible Entity
has documented andimplemented amaintenance andtesting program for
Physical Access Control
Systems and locallymounted hardware or
devices at the Physical
Security Perimeter, but
did not complete
required testing within
25 calendar months but
did complete required
testing within 26
calendar months. (3.1)

The Responsible Entity
has documented andimplemented amaintenance andtesting program for
Physical Access Control
Systems and locallymounted hardware or
devices at the Physical
Security Perimeter, but
did not complete
required testing within
26 calendar months but
did complete required
testing within 27
calendar months. (3.1)

Page 24 of 32

The Responsible Entity
did not document or
implement a
maintenance andtesting program for
Physical Access Control
Systems and locallymounted hardware or
devices at the Physical
Security Perimeter. (3.1)
OR
The Responsible Entity
has documented andimplemented amaintenance andtesting program for
Physical Access Control
Systems and locallyCIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-006-6)
Lower VSL
did not
completerequired
testing within
24 calendar
months but did
completerequired
testing within
25 calendar
months. (3.1)

Moderate VSLHigh VSL

Page 25 of 32

Severe VSL
mounted hardware or
devices at the Physical
Security Perimeter, but
did not complete
required testing within
27 calendar months.
(3.1)

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems
D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

None.

Version History
VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify therequirements and to bring thecompliance elements into conformancewith the latest guidelines for developing
compliance elements of standards.

Change Tracking
3/24/06

Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
responsible entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.
3

12/16/09

Updated Version Number from -2 to -3
In Requirement 1.6, deleted thesentence pertaining to removing
component or system from service inorder to perform testing, in response to
FERC order issued September 30, 2009.

3

12/16/09

3

3/31/10

Approved by the NERC Board ofTrustees.
Approved by FERC.

4

1/24/11

Approved by the NERC Board ofPage 26 of 32

CIP-006-6 — Cyber Security — Physical Security of BES Cyber Systems

VersionDate

ActionChange Tracking

Trustees.
5

11/26/12

Adopted by the NERC Board ofTrustees.

5

11/22/13

FERC Order issued approving CIP-006-5.

6

11/13/14

Adopted by the NERC Board ofTrustees.

6

1/21/16

FERC order issued approving CIP-006-6.
Docket No. RM15-14-000

Modified tocoordinate withother CIP
standards and torevise format touse RBS
Template.

Addressed FERC
directives from
Order No. 791.

Page 27 of 32

Guidelines and Technical Basis
Guidelines and Technical Basis
Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. As specified in the exemption section 4.2.3.5, this standard does not apply to
Responsible Entities that do not have High Impact or Medium Impact BES Cyber Systems under
CIP-002-5.1’s categorization. In addition to the set of BES Facilities, Control Centers, and othersystems and equipment, the list includes the set of systems and equipment owned byDistribution Providers. While the NERC Glossary term “Facilities” already includes the BES
characteristic, the additional use of the term BES here is meant to reinforce the scope of
applicability of these Facilities where it is used, especially in this applicability scoping section.
This in effect sets the scope of Facilities, systems, and equipment that is subject to thestandards.
General:While the focus of this Reliability Standard has shifted away from the definition andmanagement of a completely enclosed “six-wall” boundary, it is expected that in many
instances a six-wall boundary will remain a primary mechanism for controlling, alerting, andlogging access to BES Cyber Systems. Taken together, these controls outlined below will
effectively constitute the physical security plan to manage physical access to BES Cyber
Systems.
Requirement R1:
Methods of physical access control include:

Card Key: A means of electronic access where the access rights of the card holder are
predefined in a computer database. Access rights may differ from one perimeter toanother.

Special Locks: These include, but are not limited to, locks with “restricted key” systems,
magnetic locks that can be operated remotely, and “man-trap” systems.



Security Personnel: Personnel responsible for controlling physical access who may reside
on-site or at a monitoring station.

Page 28 of 32

Guidelines and Technical BasisOther Authentication Devices: Biometric, keypad, token, or other equivalent devices that
control physical access into the Physical Security Perimeter.

Methods to monitor physical access include:

Alarm Systems: Systems that alarm to indicate interior motion or when a door, gate, or
window has been opened without authorization. These alarms must provide for
notification within 15 minutes to individuals responsible for response.



Human Observation of Access Points: Monitoring of physical access points by security
personnel who are also controlling physical access.

Methods to log physical access include:Computerized Logging: Electronic logs produced by the Responsible Entity’s selected access
control and alerting method.

Video Recording: Electronic capture of video images of sufficient quality to determine
identity.



Manual Logging: A log book or sign-in sheet, or other record of physical access maintainedby security or other personnel authorized to control and monitor physical access.

The FERC Order No. 706, Paragraph 572, directive discussed utilizing two or more different andcomplementary physical access controls to provide defense in depth. It does not require two or
more Physical Security Perimeters, nor does it exclude the use of layered perimeters. Use of
two-factor authentication would be acceptable at the same entry points for a non-layered
single perimeter. For example, controls for a sole perimeter could include either a combinationof card key and pin code (something you know and something you have), or a card key andbiometric scanner (something you have and something you are), or a physical key incombination with a guard-monitored remote camera and door release, where the “guard” hasadequate information to authenticate the person the guard is observing or talking to prior topermitting access (something you have and something you are). The two-factor authentication
could be implemented using a single Physical Access Control System but more than one
authentication method must be utilized. For physically layered protection, a locked gate incombination with a locked control-building could be acceptable, provided no single
authenticator (e.g., key or card key) would provide access through both.
Entities may choose for certain PACS to reside in a PSP controlling access to applicable BES
Cyber Systems. For these PACS, there is no additional obligation to comply with Requirement
Parts 1.1, 1.6 and 1.7 beyond what is already required for the PSP.
The new requirement part CIP-006-6, Requirement R1, Part 1.10 responds to the directive
found in FERC Order No. 791, Paragraph 150. The requirement intends to protect cabling andnonprogrammable communication components that are within an ESP, but extend outside of aPSP. This protection, similar to the FERC Approved NERC Petition on the interpretation on CIP006-2 from PacifiCorp, must be accomplished either by physically protecting the cabling andcomponents that leave a PSP (such as by conduit or secured cable trays) or through dataencryption, circuit monitoring, or equally effective logical protections. It is intended that the

Page 29 of 32

Guidelines and Technical Basis
physical protections reduce the possibility of tampering or allowing direct access to thenonprogrammable devices. Conduit, secured cable trays, and secured communication closets
are examples of these types of protections. These physical security measures should be
implemented in such a way that they would provide some mechanism to detect or recognizethat someone could have tampered with the cabling and non-programmable components. This
could be something as simple as a padlock on a communications closet where the entity would
recognize if the padlock had been cut off. Alternatively, this protection may also be
accomplished through the use of armored cabling or via the stainless steel or aluminum tube
protecting the fiber inside an optical ground wire (OPGW) cable. In using any of these methods,
care should be taken to protect the entire length of the cabling including any termination points
that may be outside of a defined PSP.
This requirement part only covers those portions of cabling and nonprogrammablecommunications components that are located outside of the PSP, but inside the ESP. Where
this cabling and non-programmable communications components exist inside the PSP, thisrequirement part no longer applies.
The requirement focuses on physical protection of the communications cabling andcomponents as this is a requirement in a physical security standard and the gap in protection
identified by FERC in Order 791 is one of physical protections. However, the requirement part
recognizes that there is more than one way to provide protection to communication cablingand nonprogrammable components. In particular, the requirement provides a mechanism forentities to select an alternative to physical security protection that may be chosen in a situation
where an entity cannot implement physical security or simply chooses not to implement
physical security. The entity is under no obligation to justify or explain why it chose logicalprotections over physical protections identified in the requirement.
The alternative protective measures identified in the CIP-006-6 R1, Part 1.10 (encryption andcircuit monitoring) were identified as acceptable alternatives in NERC petition of the PacifiCorp
Interpretation of CIP-006-2 which was approved by FERC (RD10-13-000). If an entity chooses toimplement an “an equally effective logical protection” in lieu of one of the protection
mechanisms identified in the standard, the entity would be expected to document how theprotection is equally effective. NERC explained in its petition of the PacifiCorp Interpretation of
CIP-006-2 that the measures are relevant to access or physical tampering. Therefore, the entity
may choose to discuss how its protection may provide detection of tampering. The entity may
also choose to explain how its protection is equivalent to the other logical options identified in
the standard in terms of the CIA triad (confidentiality, integrity, and availability). The entity
may find value in reviewing their plans prior to implementation with the regional entity, butthere is no obligation to do so.
The intent of the requirement is not to require physical protection of third party components,
consistent with FERC Order 791-A. The requirement allows flexibility in that the entity has
control of how to design its ESP and also has the ability to extend its ESP outside its PSP via thelogical mechanisms specified in CIP-006-6 Requirement 1, Part 1.10 such as encryption (which isan option specifically identified in FERC Order 791-A). These mechanisms should provide
sufficient protections to an entity’s BES Cyber Systems while not requiring controls to be

Page 30 of 32

Guidelines and Technical Basis
implemented on third-party components when entities rely on leased third-party
communications.
In addition to the cabling, the components in scope of this requirement part are thosecomponents outside of a PSP that could otherwise be considered a BES Cyber Asset orProtected Cyber Asset except that they do not meet the definition of Cyber Asset because they
are nonprogrammable. Examples of these nonprogrammable components include, but are notlimited to, unmanaged switches, hubs, patch panels, media converters, port savers, andcouplers.
Requirement R2:
The logging of visitors should capture each visit of the individual and does not need to captureeach entry or exit during that visit. This is meant to allow a visitor to temporarily exit the
Physical Security Perimeter to obtain something they left in their vehicle or outside the area
without requiring a new log entry for each and every entry during the visit.
The SDT also determined that a point of contact should be documented who can provide
additional details about the visit if questions arise in the future. The point of contact could be
the escort, but there is no need to document everyone that acted as an escort for the visitor.
Requirement R3:
This includes the testing of locally mounted hardware or devices used in controlling, alerting or
logging access to the Physical Security Perimeter. This includes motion sensors, electronic lockcontrol mechanisms, and badge readers which are not deemed to be part of the Physical AccessControl System but are required for the protection of the BES Cyber Systems.
Rationale:
During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:
Each Responsible Entity shall ensure that physical access to all BES Cyber Systems is restricted
and appropriately managed. Entities may choose for certain Physical Access Control Systems(PACS) to reside in a Physical Security Perimeter (PSP) controlling access to applicable BES Cyber
Systems. For these PACS, there is no additional obligation to comply with Requirement R1,
Parts 1.1, 1.6 and 1.7 beyond what is already required for the PSP.
Regarding Requirement R1, Part 1.10, when cabling and other nonprogrammable components
of a Control Center’s communication network cannot be secured in a PSP, steps must be taken
to ensure the integrity of the BES Cyber Systems. Exposed communication pathways outside ofa PSP necessitate that physical or logical protections be installed to reduce the likelihood that
man-in-the-middle attacks could compromise the integrity of their connected BES Cyber Assets
or PCAs that are required to reside within PSPs. While it is anticipated that priority
consideration will be given to physically securing the cabling and nonprogrammable

Page 31 of 32

Guidelines and Technical Basis
communications components, the SDT understands that configurations arise when physicalaccess restrictions are not ideal and Responsible Entities are able to reasonably defend their
physically exposed communications components through specific additional logical protections.
Rationale for Requirement R2:
To control when personnel without authorized unescorted physical access can be in any
Physical Security Perimeters protecting BES Cyber Systems or Electronic Access Control orMonitoring Systems, as applicable in Table R2.
Rationale for Requirement R3:
To ensure all Physical Access Control Systems and devices continue to function properly.

Page 32 of 32