149 FERC ¶ 61,140

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

18 CFR Part 40

[Docket No. RM14-15-000; Order No. 802]

Physical Security Reliability Standard

(Issued November 20, 2014)

AGENCY: Federal Energy Regulatory Commission.

ACTION: Final rule.

SUMMARY: The Federal Energy Regulatory Commission (Commission) approves

Reliability Standard CIP-014-1 (Physical Security). The North American Electric 

Reliability Corporation, the Commission-certified Electric Reliability Organization, 

submitted Reliability Standard CIP-014-1 for Commission approval in response to a 

Commission order issued on March 7, 2014. The purpose of Reliability Standard CIP014-1 is to enhance physical security measures for the most critical Bulk-Power System 

facilities and thereby lessen the overall vulnerability of the Bulk-Power System against

physical attacks. In addition, the Commission directs NERC to develop one modification

to Reliability Standard CIP-014-1 and submit an informational filing.

EFFECTIVE DATE: This rule will become effective [INSERT DATE 60 days after 

publication in the FEDERAL REGISTER]. 

FOR FURTHER INFORMATION CONTACT:

Regis Binder (Technical Information) 

Office of Electric Reliability

Division of Reliability Standards and Security
Docket No. RM14

-15-000 - 2 -

Federal Energy Regulatory Commission 

888 First Street, NE 

Washington, DC 20426 

Telephone: (301) 665-1601 

Regis.Binder@ferc.gov

Matthew Vlissides (Legal Information) 

Office of the General Counsel 

Federal Energy Regulatory Commission 

888 First Street, NE 

Washington, DC 20426 

Telephone: (202) 502-8408 

Matthew.Vlissides@ferc.gov

SUPPLEMENTARY INFORMATION

:
149 FERC ¶ 61,140

UNITED STATES OF AMERICA

FEDERAL ENERGY REGULATORY COMMISSION

Before Commissioners: Cheryl A. LaFleur, Chairman;

 Philip D. Moeller, Tony Clark,

and Norman C. Bay.

Physical Security Reliability Standard Docket No. RM14-15-000

ORDER NO. 802

FINAL RULE

(Issued November 20, 2014)

1. Pursuant to section 215 of the Federal Power Act (FPA), the Commission 

approves Reliability Standard CIP-014-1 (Physical Security).

1

 The North American 

Electric Reliability Corporation (NERC), the Commission-certified Electric Reliability 

Organization (ERO), submitted Reliability Standard CIP-014-1 for Commission approval 

in response to a Commission order issued on March 7, 2014.2

 The purpose of Reliability 

Standard CIP-014-1 is to enhance physical security measures for the most critical BulkPower System facilities and thereby lessen the overall vulnerability of the Bulk-Power 

System facilities against physical attacks. In addition to approving Reliability Standard 

CIP-014-1, as discussed below, the Commission directs NERC to submit an 

 1 16 U.S.C. 824o.

2 Reliability Standards for Physical Security Measures, 146 FERC ¶ 61,166 (2014) 

(March 7 Order).
Docket No. RM14-15-000 - 2 -

informational filing and, pursuant to FPA section 215(d)(5), directs NERC to develop a

modification to Reliability Standard CIP-014-1.

3

I. Background

A. Section 215 and Mandatory Reliability Standards

2. Section 215 of the FPA requires the Commission to certify an ERO to develop 

mandatory and enforceable Reliability Standards, subject to Commission review and 

approval. Once approved, the Reliability Standards may be enforced in the United States 

by the ERO, subject to Commission oversight, or by the Commission independently.4

B. March 7 Order

3. In the March 7 Order, the Commission determined that physical attacks on the 

Bulk-Power System could adversely impact the reliable operation of the Bulk-Power 

System, resulting in instability, uncontrolled separation, or cascading failures. Moreover,

the Commission observed that the then current Reliability Standards did not specifically 

require entities to take steps to reasonably protect against physical security attacks on the 

Bulk-Power System. Accordingly, to carry out section 215 of the FPA and to provide for 

the reliable operation of the Bulk-Power System, the Commission directed NERC, 

pursuant to FPA section 215(d)(5), to develop and file for approval proposed Reliability 

 3 16 U.S.C. 824o(d)(5).

4 Id. 824o(e). 
Docket No. RM14-15-000 - 3 -

Standards that address threats and vulnerabilities to the physical security of critical 

facilities on the Bulk-Power System.

4. The March 7 Order indicated that the Reliability Standards should require owners 

or operators of the Bulk-Power System to take at least three steps to address the risks that 

physical security attacks pose to the reliable operation of the Bulk-Power System. 

Specifically, the March 7 Order directed that the Reliability Standards should require: 

(1) owners or operators of the Bulk-Power System to perform a risk assessment of their 

systems to identify their “critical facilities”; (2) owners or operators of the identified 

critical facilities to evaluate the potential threats and vulnerabilities to those identified 

facilities; and (3) those owners or operators of critical facilities to develop and implement 

a security plan designed to protect against attacks to those identified critical facilities 

based on the assessment of the potential threats and vulnerabilities to their physical 

security.

5. The March 7 Order stated that the risk assessment used by an owner or operator to 

identify critical facilities should be verified by an entity other than the owner or operator, 

such as by NERC, the relevant Regional Entity, a reliability coordinator, or another 

entity.5

 In addition, the March 7 Order indicated that the Reliability Standards should 

include a procedure for the verifying entity, as well as the Commission, to add or remove 

 5 March 7 Order, 146 FERC ¶ 61,166 at P 11.
Docket No. RM14-15-000 - 4 -

facilities from an owner’s or operator’s list of critical facilities.6 The March 7 Order 

further stated that the determination of threats and vulnerabilities and the security plan 

should be reviewed by NERC, the relevant Regional Entity, the reliability coordinator, or 

another entity with appropriate expertise. 

6. The March 7 Order stated that, because the three steps of compliance with the 

contemplated Reliability Standards could contain sensitive or confidential information 

that, if released to the public, could jeopardize the reliable operation of the Bulk-Power 

System, NERC should include in the Reliability Standards a procedure that will ensure 

confidential treatment of sensitive or confidential information but still allow for the 

Commission, NERC and the Regional Entities to review and inspect any information that 

is needed to ensure compliance with the Reliability Standards.7

7. The Commission directed NERC to submit the proposed Reliability Standards to 

the Commission for approval within 90 days of issuance of the March 7 Order 

(i.e., June 5, 2014).

C. NERC Petition

8. On May 23, 2014, NERC petitioned the Commission to approve Reliability 

Standard CIP-014-1 and its associated violation risk factors and violation severity levels, 

 6 Id.

7 Id. P 10.
Docket No. RM14-15-000 - 5 -

implementation plan, and effective date.8

 NERC maintains that the Reliability Standard 

is just, reasonable, not unduly discriminatory, or preferential, and in the public interest. 

In addition, NERC asserts that the proposed Reliability Standard complies with the 

Commission’s directives in the March 7 Order.

9. NERC explains that Reliability Standard CIP-014-1 “serves the vital reliability 

goal of enhancing physical security measures for the most critical Bulk-Power System 

facilities and lessening the overall vulnerability of the Bulk-Power System to physical 

attacks.”9

 NERC maintains that the “appropriate focus of the proposed Reliability 

Standard is Transmission stations and Transmission substations, which are uniquely 

essential elements of the Bulk-Power System.”10 The Reliability Standard is applicable 

to transmission owners that satisfy the Applicability Sections 4.1.1.1, 4.1.1.2, 4.1.1.3, or 

 8 NERC explains that, to meet the 90-day deadline in the March 7 Order, the 

NERC Standards Committee approved waivers to NERC’s Standard Processes Manual to 

shorten the comment and ballot periods for the Standards Authorization Request and draft 

Reliability Standard. NERC Petition at 13-14. Reliability Standard CIP-014-1 is not 

attached to this Final Rule. The complete text of Reliability Standard CIP-014-1 is 

available on the Commission’s eLibrary document retrieval system in Docket No. RM14-

15-000 and is posted on the ERO’s web site, available at http://www.nerc.com. 

9 NERC Petition at 15-16.

10 Id. at 18. NERC states that, although the terms “Transmission stations” and 

“Transmission substations” are sometimes used interchangeably, Reliability Standard 

CIP-014-1 uses the term “Transmission substation” to refer to a facility contained within 

a physical border (e.g., a fence or wall) that contains one or more autotransformers. Id. 

According to NERC, the term “Transmission station,” as used in Reliability Standard 

CIP-014-1, refers to a facility that functions as a switching station or switchyard but does 

not contain autotransformers. Id. at 18-19.
Docket No. RM14-15-000 - 6 -

4.1.1.4, and to transmission operators. NERC states that the transmission facilities 

covered by Applicability Sections 4.1.1.1 through 4.1.1.4 match the “Medium Impact” 

transmission facilities listed in Attachment 1 (Impact Rating Criteria), specifically, the 

“Medium Impact” facilities described in Sections 2.4, 2.5, 2.6, and 2.7, of Reliability 

Standard CIP-002-5.1,

11 According to NERC, the “standard drafting team determined 

that using the criteria for ‘Medium Impact’ Transmission Facilities set forth in Reliability 

Standard CIP-002-5.1 is an appropriate applicability threshold as the Commission has 

acknowledged that it is a technically sound basis for identifying Transmission Facilities, 

which, if compromised, would present an elevated risk to the Bulk-Power System.”12

10. Reliability Standard CIP-014-1 has six requirements. Requirement R1 requires 

applicable transmission owners to perform risk assessments on a periodic basis to identify 

their transmission stations and transmission substations that, if rendered inoperable or 

damaged, could result in widespread instability, uncontrolled separation, or cascading 

within an Interconnection. Requirement R1 also requires transmission owners to identify 

the primary control center that operationally controls each of the identified transmission 

stations or transmission substations.

11. Requirement R2 requires that each applicable transmission owner have an 

unaffiliated third party with appropriate experience verify the risk assessment performed 

 11 Id. at 25 (citing Reliability Standard CIP-002-5.1 (Cyber Security —

BES Cyber System Categorization), Attachment 1 (Impact Rating Criteria)). 

12 Id.
Docket No. RM14-15-000 - 7 -

under Requirement R1. Requirement R2 states that the transmission owner must either 

modify its identification of facilities consistent with the verifier’s recommendation or 

document the technical basis for not doing so. In addition, Requirement R2 requires each 

transmission owner to implement procedures for protecting sensitive or confidential 

information made available to third-party verifiers or developed under the Reliability 

Standard from public disclosure.

12. Requirement R3 requires the transmission owner to notify a transmission operator 

that operationally controls a primary control center identified under Requirement R1 of 

such identification to ensure that the transmission operator has notice of the identification 

so that it may timely fulfill its obligations under Requirements R4 and R5 to protect the 

primary control center.

13. Requirement R4 requires each applicable transmission owner and transmission 

operator to conduct an evaluation of the potential threats and vulnerabilities of a physical 

attack on each of its respective transmission stations, transmission substations, and 

primary control centers identified as critical in Requirement R1.

14. Requirement R5 requires each transmission owner and transmission operator to

develop and implement documented physical security plans that cover each of their

respective transmission stations, transmission substations, and primary control centers 

identified as critical in Requirement R1.

15. Requirement R6 requires that each transmission owner and transmission operator 

subject to Requirements R4 and R5 have an unaffiliated third party with appropriate 

experience review its Requirement R4 evaluation and Requirement R5 security plan. 
Docket No. RM14-15-000 - 8 -

Requirement R6 states that the transmission owner or transmission operator must either 

modify its evaluation and security plan consistent with the recommendation, if any, of the 

reviewer or document its reasons for not doing so. In addition, Requirement R6 requires 

each transmission owner to implement procedures for protecting sensitive or confidential 

information made available to third-party reviewers or developed under the Reliability 

Standard from public disclosure.

D. Notice of Proposed Rulemaking

16. On July 17, 2014, the Commission issued a Notice of Proposed Rulemaking

proposing to approve Reliability Standard CIP-014-1 as just, reasonable, not unduly 

discriminatory or preferential, and in the public interest.

13 In addition, the NOPR 

proposed to direct NERC to develop two modifications to the Reliability Standard. First, 

the NOPR proposed to direct NERC to develop a modification to allow applicable 

governmental authorities (i.e., the Commission and any other appropriate federal or 

provincial authorities) to add or subtract facilities from an applicable entity’s list of 

critical facilities under Requirement R1.14 Second, the NOPR proposed to direct NERC 

to modify the Reliability Standard to remove the term “widespread” as it appears in the

phrase “widespread instability” in Requirement R1.15 The NOPR also proposed to direct 

 13 Physical Security Reliability Standard, Notice of Proposed Rulemaking, 79 Fed. 

Reg. 42,734 (July 23, 2014), 148 FERC ¶ 61,040 (2014) (NOPR).

14 Id. P 23.

15 Id. P 29.
Docket No. RM14-15-000 - 9 -

NERC to submit two informational filings, one addressing the protection of “High 

Impact” control centers and the other addressing resiliency measures, to be submitted, 

respectively, within six months and one year following the effective date of a final rule in 

this proceeding.16

17. In response to the NOPR, the Commission received 33 sets of initial comments

and six sets of reply comments. We address below the issues raised in the NOPR and

comments. The Appendix to this final rule lists the entities that filed comments in 

response to the NOPR.

II. Discussion

18. Pursuant to FPA section 215(d)(2), we approve Reliability Standard CIP-014-1 as 

just, reasonable, not unduly discriminatory or preferential, and in the public interest. The 

Commission also approves the associated violation risk factors, violation severity levels, 

implementation plan, and effective date proposed by NERC (i.e., the “first day of the first 

calendar quarter that is six months beyond” the effective date of the final rule in this 

proceeding).

17 As discussed below, the Commission determines that Reliability Standard 

CIP-014-1 satisfies the directives in the March 7 Order concerning the development and 

submittal of physical security Reliability Standards. 

 16 Id. PP 35, 57.

17 NERC Petition, Exhibit B (Implementation Plan) at 1.
Docket No. RM14-15-000 - 10 -

19. In addition to approving Reliability Standard CIP-014-1, the Commission adopts 

in part the NOPR proposal directing NERC to develop and submit modifications to the 

Reliability Standard concerning the use of the term “widespread” in Requirement R1. 

The Commission determines that the term “widespread” is unclear with respect to the 

obligations it imposes on applicable entities; how it would be implemented by applicable

entities; and how it would be enforced. Accordingly, the Commission directs NERC, 

pursuant to FPA section 215(d)(5), to remove the term “widespread” from Reliability 

Standard CIP-014-1 or, alternatively, to propose modifications to the Reliability Standard 

that address the Commission’s concerns. We direct that NERC submit a responsive 

modification within six months from the effective date of this final rule.

20. The Commission does not adopt the NOPR proposal that would have required 

NERC to develop and submit modifications to Reliability Standard CIP-014-1 to allow 

applicable governmental authorities (i.e., the Commission and any other appropriate 

federal or provincial authorities) to add or subtract facilities from an applicable entity’s 

list of critical facilities under Requirement R1. We determine that the Commission’s 

enforcement authority under FPA section 215(e), and particularly the use of targeted 

auditing following implementation of Reliability Standard CIP-014-1, will allow us to

address the concerns raised in the NOPR.

21. With respect to the informational filings proposed in the NOPR, the Commission 

adopts the proposal to direct NERC to make an informational filing addressing whether

Reliability Standard CIP-014-1 provides physical security for all “High Impact” control 

centers, as that term is defined in Reliability Standard CIP-002-5.1, necessary for the 
Docket No. RM14-15-000 - 11 -

reliable operation of the Bulk-Power System. However, the Commission extends the 

deadline for that informational filing until two years following the effective date of

Reliability Standard CIP-014-1. The Commission, at this time, does not adopt the NOPR 

proposal to direct NERC to make an informational filing addressing resiliency. Instead, 

the Commission will continue to consider ways for industry to best inform the 

Commission of its current and future resiliency efforts, which could take the form of 

reports and/or technical conferences to address specific areas of concern (e.g., spare parts, 

fuel security, and advanced technologies).

22. We address below the following issues raised in the NOPR and in the comments: 

(A) removal of the term “widespread”; (B) applicable governmental authorities’ ability to 

add or subtract facilities from an entity’s list of critical facilities; (C) informational filing 

on “High Impact” control centers; (D) informational filing on resiliency; (E) third-party 

verification and review; (F) exclusion of generators from the applicability section of 

Reliability Standard CIP-014-1; (G) confidentiality; (H) other issues raised in comments; 

(I) violation risk factors and violation severity levels; and (J) implementation plan and 

effective date.
Docket No. RM14-15-000 - 12 -

A. Removal of the Term “Widespread”

March 7 Order

23. The March 7 Order stated that a critical facility is “one that, if rendered inoperable 

or damaged, could have a critical impact on the operation of the interconnection through 

instability, uncontrolled separation or cascading failures on the Bulk-Power System.”18

NERC Petition

24. Reliability Standard CIP-014-1 states that its purpose is to “identify and protect 

Transmission stations and Transmission substations, and their associated primary control 

centers, that if rendered inoperable or damaged as a result of a physical attack could 

result in widespread instability, uncontrolled separation, or Cascading within an 

Interconnection.”19 Requirement R1 states that the “initial and subsequent risk 

assessments shall consist of a transmission analysis or transmission analyses designed to 

identify the Transmission station(s) and Transmission substation(s) that if rendered 

inoperable or damaged could result in widespread instability, uncontrolled separation, or 

Cascading within an Interconnection.”

NOPR

25. The NOPR proposed to direct NERC to modify Reliability Standard CIP-014-1 to 

remove the term “widespread” as it appears in the phrase “widespread instability.” The 

 18 March 7 Order, 146 FERC ¶ 61,166 at P 6.

19 NERC Petition at 17.
Docket No. RM14-15-000 - 13 -

NOPR stated that the phrase “widespread instability” is undefined by NERC and is 

inconsistent with the March 7 Order’s explanation of “critical facility” and the definition 

of “reliable operation” in FPA section 215(a)(4).20

26. The NOPR stated that the use of “widespread instability” in Requirement R1 

could, depending on the meaning of “widespread,” narrow the scope (and number) of

identified critical facilities under Reliability Standard CIP-014-1 beyond what was 

contemplated in the March 7 Order. The NOPR also stated that the use of the term 

“widespread” could potentially render the Reliability Standard unenforceable or lead to 

an inadequate level of reliability by omitting facilities that are critical to the reliable 

operation of the Bulk-Power System.

Comments

27. NERC comments that it does not oppose the NOPR directive but that the 

modification should be developed through NERC’s standards development process and 

NERC should be allowed to propose alternative clarifying language “to ensure the 

proposed Reliability Standard remains focused on Interconnection impacts and not local 

 20 “[A facility] that, if rendered inoperable or damaged, could have a critical 

impact on the operation of the interconnection through instability, uncontrolled 

separation or cascading failures on the Bulk-Power System.” March 7 Order, 146 FERC 

¶ 61,166 at P 6; 16 U.S.C. 824o(a)(4) (“The term ‘reliable operation’ means operating the 

elements of the bulk-power system within equipment and electric system thermal, 

voltage, and stability limits so that instability, uncontrolled separation, or cascading 

failures of such system will not occur as a result of a sudden disturbance, including a 

cybersecurity incident, or unanticipated failure of system elements.”).
Docket No. RM14-15-000 - 14 -

impacts.”21 NERC states that the term “widespread” was used to focus applicable 

entities’ security efforts on facilities whose loss would have more than a local area 

impact.

28. SIA, Idaho Power, Pa PUC, SmartSenseCom, Foundation and Pepco support the 

NOPR proposal because they believe that the term “widespread” is vague or inconsistent 

with the definition of “reliable operation” in FPA section 215.

22 Pepco, for example, 

states that the term “widespread” is ambiguous, will require requests for clarification or 

interpretation and will expose applicable entities to “second-guessing” from auditors. 

KCP&L, while it does not state that it supports the proposal, acknowledges that the term 

“widespread” is vague and that the term “introduces interpretive language that may be 

problematic for compliance and enforcement interpretations as well as unintentionally 

narrow the scope of facilities.”23

29. Other commenters do not support the proposed directive largely because they 

contend that the proposal may have the unintended consequence of expanding the scope 

of Reliability Standard CIP-014-1 to include localized events that have no impact on an 

 21 NERC Comments at 19.

22 See SIA Comments at 2; Idaho Power Comments at 2; Pa PUC Comments at 5; 

Pepco Comments at 4-5; SmartSenseCom Comments at 7-8; Foundation Reply 

Comments at 7.

23 KCP&L Comments at 4.
Docket No. RM14-15-000 - 15 -

Interconnection.24 APS, SCE, SDG&E, and G&T Cooperatives also maintain that while 

the term “widespread” is not defined by NERC, it appears elsewhere in the Reliability 

Standards, including in NERC’s definition of “Cascading” and in the TPL Reliability 

Standards, and is understood by industry. Associations also state that the Commission 

should withdraw the NOPR proposal; however, Associations state that, in the alternative, 

the Commission should clarify that removal of the term “widespread” is not intended to 

bring within the scope of Reliability Standard CIP-014-1 “a substation or station unless 

the applicable Transmission Owner determines through technical studies and analyses 

that include the application of engineering judgment and practice that the loss of such 

facility would have a critical impact on the operation of the [bulk electric system] in the 

event the asset is rendered inoperable or damaged.”25 NARUC states that the proposal 

will add costs without necessarily improving reliability.

30. ITC, while agreeing that the term “widespread” is not well-defined and would 

render the Reliability Standard vague, contends that the definition of critical facility in 

Requirement R1 should be replaced by defining as critical all physical facilities that 

 24 See APS Comments at 3; SCE Comments at 3; SDG&E Comments at 4-5; TVA 

Comments at 9-10; Tallahassee Comments at 1; Oncor Comments at 3-4; Ohio PUC 

Comments at 4-5; BPA Comments at 3; NARUC Comments at 11; G&T Cooperatives 

Comments at 8-11; Southern Comments at 7-10.

25 Associations Comments at 14-15; see also APS Comments at 3-4, Southern 

Comments at 11.
Docket No. RM14-15-000 - 16 -

contain “High Impact” or “Medium Impact” BES Cyber Systems as those terms are 

defined in Reliability Standard CIP-002-5.1.

Commission Determination

31. The Commission adopts the NOPR proposal in part and directs NERC to remove 

the term “widespread” from Reliability Standard CIP-014-1 or, alternatively, to propose 

modifications to the Reliability Standard that address the Commission’s concerns. The 

differing views expressed in the comments validate the concern raised in the NOPR that 

the meaning of the term “widespread” is unclear and subject to interpretation. 

32. We stated in the March 7 Order that “the Reliability Standards that we are 

ordering today apply only to critical facilities that, if rendered inoperable or damaged, 

could have a critical impact on the operation of the interconnection through instability, 

uncontrolled separation or cascading failures on the Bulk-Power System.

26 We affirm the 

March 7 Order’s statement that “[m]ethodologies to determine these facilities should be 

based on objective analysis, technical expertise, and experienced judgment.”27

33. However, incorporating the undefined term “widespread” in Reliability Standard 

CIP-014-1 introduces excessive uncertainty in identifying critical facilities under 

Requirement R1.28 As the Commission stated in the March 7 Order, only an instability 

 26 March 7 Order, 146 FERC ¶ 61,166 at P 6 n.5.

27 Id. P 6.

28 See Version 5 Critical Infrastructure Protection Reliability Standards, Order 

No. 791, 78 Fed. Reg. 72,755 (Dec. 3, 2013), 145 FERC ¶ 61,160, at P 67 (2013), order 

(continued ...)
Docket No. RM14-15-000 - 17 -

that has a “critical impact on the operation of the interconnection” warrants finding that 

the facility causing the instability is critical under Requirement R1. The March 7 Order 

did not intend to suggest that the physical security Reliability Standards should address

facilities that do not have a “critical impact on the operation of the interconnection.” This 

understanding is, we believe, unintentionally absent in Requirement R1 because the 

requirement only deems a facility critical when, if rendered inoperable or damaged, it 

could result in widespread instability, uncontrolled separation, or Cascading within an 

Interconnection. The definition in Requirement R1 should not be dependent on how an 

applicable entity interprets the term “widespread” but instead should be modified to make 

clear that a facility that has a critical impact on the operation of an Interconnection is 

critical and therefore subject to Requirement R1. 

34. While some commenters contend that the meaning of the term “widespread” is 

well-understood by industry, we find that there is ample evidence in the record to support 

the conclusion that the term is susceptible to different interpretations by applicable 

entities. Notably, KCP&L states that, while it was a participant in the standards drafting 

process for Reliability Standard CIP-014-1, it agrees that the term requires interpretation. 

Moreover, KCP&L and Pepco share our concern that compliance enforcement authorities 

 

granting clarification in part and denying rehearing, Order No. 791-A, 146 FERC 

¶ 61,188 (2014) (directing removal or clarification “identify, assess and correct” 

language).
Docket No. RM14-15-000 - 18 -

may find it difficult to consistently enforce compliance with Requirement R1 without a 

clear understanding of the term’s meaning. 

35. Accordingly, pursuant to FPA section 215(d)(5), the Commission directs NERC to 

develop a modification to Reliability Standard CIP-014-1 that either removes the term 

“widespread” from Requirement R1 or, in the alternative, proposes changes that address 

the Commission’s concerns. Further, we direct that NERC submit a responsive 

modification within six months from the effective date of this final rule. We recognize 

that certain entities commented on how NERC could modify Reliability Standard CIP014-1 to address the Commission’s stated concerns.29 However, we conclude that it is 

appropriate to allow NERC to develop and propose a modification in the first instance. 

With respect to ITC’s more general comments regarding the scope of critical facilities in 

Requirement R1, we address the potential for applying the impact designations in 

Reliability Standard CIP-002-5.1 to Reliability Standard CIP-014-1, Requirement R1 in 

the section below regarding the NOPR’s proposed informational filing on “High Impact” 

control centers. 

 29 See, e.g., BPA Comments at 2; Ohio PUC Comments at 5; TVA Comments at 9, 

ITC Comments at 9.
Docket No. RM14-15-000 - 19 -

B. Applicable Governmental Authority’s Ability to Add or Subtract

Facilities from an Entity’s List of Critical Facilities

March 7 Order

36. In the March 7 Order, the Commission stated that:

[T]he risk assessment used by an owner or operator to identify critical 

facilities should be verified by an entity other than the owner or operator. 

Such verification could be performed by NERC, the relevant Regional 

Entity, a Reliability Coordinator, or another entity. The Reliability 

Standards should include a procedure for the verifying entity, as well as the 

Commission, to add or remove facilities from an owner’s or operator’s list 

of critical facilities....

30 

NERC Petition

37. Reliability Standard CIP-014-1 does not include a procedure that allows the 

Commission to add or subtract facilities from an applicable entity’s list of critical 

facilities under Requirement R1. Instead, NERC states that the Commission has the 

existing authority to enforce NERC Reliability Standards pursuant to FPA section 

215(e)(3).31 NERC explains that a transmission owner must be able to demonstrate that 

its method for performing its risk assessment under Requirement R1 “was technically 

sound and reasonably designed to identify its critical Transmission stations and 

Transmission substations.”32 NERC maintains that if “in the course of assessing an 

entity’s compliance with the proposed Reliability Standard, NERC, a Regional Entity or 

 30 March 7 Order, 146 FERC ¶ 61,166 at P 11.

31 NERC Petition at 37.

32 Id.
Docket No. RM14-15-000 - 20 -

[the Commission] finds that the entity’s transmission analysis was patently deficient and 

the Requirement R2 verification process did not cure those deficiencies, they could use 

their enforcement authority to compel Transmission Owners to re-perform the risk 

assessment using assumptions designed to identify the appropriate critical facilities.”33

NOPR

38. The NOPR stated that Reliability Standard CIP-014-1 does not include a 

procedure that allows the Commission to add or subtract facilities from an applicable 

entity’s list of critical facilities. The NOPR stated that if the Commission determined 

through an audit of an applicable entity, or through some other means, that a critical 

facility does not appear on the entity’s list of critical facilities, there is no provision in 

Reliability Standard CIP-014-1 to allow the Commission to require its inclusion. In the 

NOPR, the Commission proposed to direct NERC to modify the physical security 

Reliability Standard to “include a procedure that would allow applicable governmental 

authorities, i.e., the Commission and any other appropriate federal or provincial 

authorities, to add or subtract facilities from an applicable entity’s list of critical 

facilities.”34

 33 Id.

34 NOPR, 148 FERC ¶ 61,040 at P 23.
Docket No. RM14-15-000 - 21 -

Comments

39. NERC asserts that the Commission should not adopt the NOPR proposal. NERC 

maintains that the proposal is unnecessary because it duplicates existing Commission 

compliance monitoring and enforcement authority.35 Moreover, NERC contends that the 

NOPR’s concerns surrounding the use of existing compliance and enforcement methods 

to ensure compliance with Requirement R1 are unsubstantiated. NERC states that if the 

NOPR proposal is adopted, then the Commission must better justify the reasons for the 

directive and limit and clarify the scope and content of the proposed directive.

40. Pa PUC, Foundation, SmartSenseCom and Paschall state that they support the 

NOPR proposal.36 Other commenters do not oppose the proposal but maintain that it 

should be clarified or modified if adopted by the Commission.37 

41. The majority of commenters do not support the NOPR proposal for various legal 

and policy reasons.38 Associations’ comments are representative of this viewpoint in that 

 35 NERC Comments at 8 (“the Commission can use its broad enforcement 

authority to make certain that the applicable entity re-performs the risk assessment on 

whatever timeline the Commission deems appropriate or face penalties or sanctions under 

the FPA”).

36 Pa PUC Comments at 5; Foundation Comments at 3; SmartSenseCom 

Comments at 6; Paschall Comments at 2.

37 See G&T Cooperatives Comments at 3-8; ITC Comments at 12; NYPSC 

Comments at 5-7; Pepco Comments at 5-7; Idaho Power Comments at 1-2.

38 See Southern Comments at 2-7; Trade Associations Comments at 5-12; 

GridWise Comments at 3-9; Duke Comments at 3-5; NARUC Comments at 4; KCP&L 

Comments at 2-4; SDG&E Comments at 3-4; Oncor Comments at 2-3; Entergy 

(continued ...)
Docket No. RM14-15-000 - 22 -

they address: (1) the statutory authority to modify critical facility lists or otherwise allow 

the Commission (or any other governmental authority) an operational role in the 

performance of a Reliability Standard; (2) how the Commission would afford entities due 

process in determining whether to direct the addition or removal of facilities while still 

maintaining confidentiality; and (3) what constitutes “any other appropriate federal or 

provincial authorities” and the legal authority and advisability of delegating responsibility 

to another government entity. Like NERC, Associations contend that the Commission 

already possesses the compliance and enforcement authority to ensure that applicable 

entities comply with Requirement R1.39 Specifically, Associations state that the 

“Commission has sufficient existing enforcement authority under the FPA to take actions 

to address concerns raised in the NOPR regarding the sufficiency of decisions made to 

identify critical facilities under CIP-014-1 ... includ[ing] the use of traditional 

enforcement authority under Section 215(e)(3), including audits and investigations, 

 

Comments at 1; TAPS Comments at 3-9; APS Comments at 2-3; BPA Comments at 2; 

SCE Comments at 2; Ohio PUC Comments at 3-4; TVA Comments at 6-9; CEA 

Comments at 3-9; NU Utilities Comments at 1.

39 Associations Comments at 9; see also TAPS Comments at 5 (“If the 

Commission finds a Registered Entity’s risk assessment study to be inadequate because it 

lacks a critical facility, the Registered Entity will be in violation of [Requirement] R1 of 

the Physical Security standard ... [t]he Commission could then direct a specific method 

of compliance ... and impose daily penalties until the Registered Entity complies. If 

despite the threat of penalties, the Commission were concerned about the need for timely 

action, it could order the Registered Entity to come into compliance within a specified 

reasonable timeframe.”).
Docket No. RM14-15-000 - 23 -

which it has used on several occasions.”40 Associations also request a technical 

conference in two years that addresses the implementation of Reliability Standard CIP014-1.

Commission Determination

42. Based on our review of the comments, we determine not to adopt the NOPR 

proposal. 

43. We are persuaded by commenters that the NOPR directive would present NERC, 

as the entity that would have to develop the proposed modification, and the Commission, 

which would have to approve any NERC proposal, with a number of substantial policy 

issues. Ultimately, we believe that the NOPR proposal would require NERC and the 

Commission to expend resources that could be better applied elsewhere.

44. The Commission, instead, will focus its resources on carrying out compliance and 

enforcement activities to ensure that critical facilities are identified under Requirement 

R1. In its comments, NERC indicated that NERC staff will submit to the NERC Board

of Trustees a report three months following implementation of Requirements R1, R2 and 

R3 concerning the scope of facilities identified as critical, including the number of 

facilities identified as critical and their defining characteristics.41 NERC also committed

 40 Associations Comments at 9.

41 NERC Comment at 27-28. NERC’s post-implementation reports are further 

discussed below.
Docket No. RM14-15-000 - 24 -

to sending this report to Commission staff.

42 Based on the results reported by NERC, we 

expect Commission staff to audit a representative number of applicable entities to ensure 

compliance with Reliability Standard CIP-014-1. Depending on the audit findings, the 

Commission will determine if there is a need for any further action by the Commission

including, but not limited to, directing NERC to develop modifications to Reliability 

Standard CIP-014-1 to provide greater specificity to the methodology for determining 

critical facilities. At this time, we will not direct Commission staff to convene a technical 

conference on implementation of Reliability Standard CIP-014-1 in two-years’ time, as 

requested by Associations. We may revisit that proposal at a later time. 

C. Informational Filing on “High Impact” Control Centers

March 7 Order

45. The March 7 Order stated that a “critical facility is one that, if rendered inoperable 

or damaged, could have a critical impact on the operation of the interconnection through 

instability, uncontrolled separation or cascading failures on the Bulk-Power System.”43 

The March 7 Order, while not mandating that a minimum number of facilities be deemed 

critical under the physical security Reliability Standards, explained that the “Commission 

 42 Id. at 28.

43 March 7 Order, 146 FERC ¶ 61,166 at P 6.
Docket No. RM14-15-000 - 25 -

expects that critical facilities generally will include, but not be limited to, critical 

substations and critical control centers.”44

NERC Petition

46. NERC states that Reliability Standard CIP-014-1 addresses the protection of 

primary control centers, which NERC defines as facilities that “operationally control[] a 

Transmission station or Transmission substation when the electronic actions from the 

control center can cause direct physical actions at the identified Transmission station or 

Transmission substation, such as opening a breaker.”45 

47. NERC maintains that “[c]ontrol centers that provide back-up capability and 

control centers that cannot operationally control a critical Transmission station or 

Transmission substation do not present similar direct risks to Real-time operations if they 

are the target of a physical attack,” and thus they are not covered by Reliability Standard

CIP-014-1.

46 NERC explains that the destruction of a back-up control center would 

“have no direct reliability impact in Real-time as the entity can continue operation ... 

from its primary control center.”47 With respect to control centers that do not physically 

operate Bulk-Power System facilities, such as control centers operated by reliability 

 44 Id. P 6, n.6.

45 NERC Petition at 19.

46 Id.

47 Id. at 20.
Docket No. RM14-15-000 - 26 -

coordinators, NERC states that, while “certain monitoring and oversight capabilities 

might be lost as a result of a physical attack on such control centers, the Transmission 

Owner or Transmission Operator that operationally controls the critical Transmission 

station or Transmission substation would be able to continue operating its transmission 

system to prevent widespread instability, uncontrolled separation, or Cascading within an 

Interconnection.”48

48. NERC acknowledges that certain control centers categorized as “High Impact” or 

“Medium Impact” under Reliability Standard CIP-002-5.1 (Cyber Security —

BES Cyber System Categorization) would not be covered control centers under 

Reliability Standard CIP-014-1.

49 NERC explains that this situation:

reflects the different nature of cyber security risks and physical security 

risks at control centers ... [a] primary cyber security concern for control 

centers is the corruption of data or information and the potential for 

operators to take action based on corrupted data or information ... [and] 

[t]his concern exists at control centers that operationally control BulkPower System facilities and those that do not. As such, there is no 

distinction in CIP-002-5.1 between these control centers ... however, such 

a distinction is appropriate in the physical security context.50

49. NERC points out that Reliability Standard CIP-006-5 already requires physical 

security protections that are “designed to restrict physical access to locations containing 

 48 Id. at 20-21.

49 Reliability Standard CIP-002-5.1 (Cyber Security – BES Cyber System 

Categorization), Attachment 1 (Impact Rating Criteria). 

50 NERC Petition at 22 n.55.
Docket No. RM14-15-000 - 27 -

High and Medium Impact Cyber Systems,” which include control centers and backup 

control centers for reliability coordinators, balancing authorities, transmission operators 

and generation operators irrespective of their ability to operationally control Bulk-Power 

System facilities.51

NOPR

50. The NOPR proposed to direct NERC to make an informational filing within six 

months of the effective date of a final rule in this proceeding indicating whether the 

development of Reliability Standards that provide physical security for all “High Impact” 

control centers, as that term is defined in Reliability Standard CIP-002-5.1, is necessary 

for the reliable operation of the Bulk-Power System.

51. The NOPR stated that primary and back-up control centers of functional entities 

other than transmission owners and operators identified as “High Impact” may warrant

assessment and physical security controls under this Reliability Standard because a 

successful attack could prevent or impair situational awareness, especially from a widearea perspective, or could allow attackers to distribute misleading and potentially harmful 

data and operating instructions that could result in instability, uncontrolled separation, or 

cascading failures.

52. The NOPR stated that the proposed informational filing should address whether 

there is a need for consistent treatment of “High Impact” control centers for cybersecurity 

 51 Id. at 21.
Docket No. RM14-15-000 - 28 -

and physical security purposes through the development of Reliability Standards that 

afford physical protection to all “High Impact” control centers. The NOPR also stated

that the development of physical security protections for all “High Impact” control 

centers would not be without precedent because, as noted above, Reliability Standard 

CIP-006-5 already requires that “High Impact” control centers have some physical 

protections, including restrictions on physical access, to protect BES Cyber Assets. 

However, the NOPR further stated that the security measures required by Reliability 

Standard CIP-006-5 may not be comparable to those required by Reliability Standard 

CIP-014-1, and thus may not be sufficient to “deter, detect, delay, assess, communicate, 

and respond to potential threats and vulnerabilities” as required in Requirement R5 of 

Reliability Standard CIP-014-1. Further, the NOPR stated that Reliability Standard CIP006-5 does not require an “unaffiliated third party review” of the evaluation and security 

plan required by Reliability Standard CIP-014-1. 

Comments

53. NERC states that it does not oppose submitting an informational filing to address 

whether “High Impact” control centers warrant assessment and physical security controls 

under Reliability Standard CIP-014-1. However, NERC requests that the Commission 

modify the NOPR proposal to give NERC at least 12 months from the effective date of a

final rule in this proceeding to submit the informational filing.
Docket No. RM14-15-000 - 29 -

54. Other commenters, while not necessarily agreeing that all “High Impact” control 

centers should be subject to Reliability Standard CIP-014-1, support the NOPR proposal 

for various reasons.52 Associations state that the informational filing “will provide a 

more granular mapping of the strategic considerations embedded in the CIP standards ... 

as well as consideration of the issues relating to control centers not covered by CIP-014-

1.”53 MISO and SDG&E state that the informational filing could be a useful way for 

identifying areas of possible improvement in the future. Some commenters, including 

Associations, recommend that the Commission direct NERC to submit the informational 

filing as critical energy infrastructure information (CEII).

55. ITC supports the proposed informational filing but states that the Commission 

should widen the scope of the informational filing to assess the benefits of extending 

Reliability Standard CIP-014-1 to all “High Impact” and “Medium Impact” BES Cyber 

Assets. ITC states that the definition of “critical” assets is insufficiently comprehensive 

because it fails to provide physical security for facilities that contain crucial Cyber 

Assets. ITC further states that identifying critical facilities under Requirement R1 is 

unnecessary because applicable entities already have a list of facilities containing “High 

Impact” and “Medium Impact” Cyber Assets, which could also serve as the list of critical 

 52 See Associations Comments at 16; KCP&L Comments at 4; Foundation 

Comments at 7; SDG&E Comments at 5; Pa PUC Comments at 6; SCE Comments at 4; 

MISO Comments at 6-7.

53 Associations Comments at 16.
Docket No. RM14-15-000 - 30 -

facilities for the purposes of Reliability Standard CIP-014-1. SIA agrees that 

Requirement R1 should be modified to include all “High Impact” control centers.

56. Commenters opposed to the NOPR proposal contend that the informational filing 

is unnecessary or would be burdensome.54 Trade Associations state that Reliability 

Standard CIP-014-1 correctly focuses on the protection of primary control centers that 

operationally control transmission stations or substations identified under Requirement 

R1. Idaho Power states that Reliability Standard CIP-006-5 contains enough physical 

access controls to meet the expectations of “deter, detect, delay, assess, communicate, 

and respond” because there are extensive monitoring and alerting requirements that must 

be applied to all “High Impact” control centers. Reclamation states that Reliability 

Standard CIP-014-1 will capture all “High Impact” control centers as currently drafted. 

Pepco states that an informational filing would divert resources from implementation and 

compliance with Reliability Standard CIP-014-1.

Commission Determination

57. The Commission adopts the NOPR proposal and directs NERC to submit an 

informational filing that addresses whether there is a need for consistent treatment of 

“High Impact” control centers for cybersecurity and physical security purposes through 

the development of Reliability Standards that afford physical protection to all “High 

Impact” control centers. The Commission, however, modifies the NOPR proposal and 

 54 Trade Associations Comments at 12; Pepco Comments at 7.
Docket No. RM14-15-000 - 31 -

extends the due date for the informational filing to two years following the effective date 

of Reliability Standard CIP-014-1.

58. While we approve Reliability Standard CIP-014-1 in this final rule, including the 

Reliability Standard’s treatment of control centers, the Commission, for the reasons set 

forth in the NOPR, finds that NERC should assess whether all “High Impact” control 

centers should be protected under Reliability Standard CIP-014-1.55 We recognize that 

NERC and applicable entities will be in a better position to provide this assessment after 

implementation of Reliability Standard CIP-014-1 and Reliability Standard CIP-006-5, 

the latter of which provides some physical protection to “High Impact” control centers. 

Accordingly, the Commission directs NERC to submit the informational filing two years 

following the effective date of Reliability Standard CIP-014-1. The Commission, while 

not directing NERC to submit the informational filing as CEII, recognizes the concerns 

raised by commenters regarding confidentiality. The Commission expects NERC to 

prepare the informational filing and submit it in such a way as to protect any critical 

information from public disclosure. 

59. At this time, the Commission will not direct NERC to address in the informational 

filing whether all “High Impact” and “Medium Impact” BES Cyber Assets should be 

considered critical for the purposes of Reliability Standard CIP-014, Requirement R1. 

We are sympathetic to several points raised in ITC’s comments, which echo some of the 

 55 See NOPR, 148 FERC ¶ 61,040 at PP 35-39.
Docket No. RM14-15-000 - 32 -

statements in the NOPR. However, as stated in the NOPR, the basis for directing an 

informational filing regarding control centers is found in the March 7 Order, where the 

Commission stated that it “expects that critical facilities generally will include, but not be 

limited to, critical substations and critical control centers.”56 While NERC explained 

why not all “High Impact” control centers may be critical for the purposes of Reliability 

Standard CIP-014-1, we conclude that this issue requires close attention and should be 

addressed in the informational filing. The broader concerns raised by ITC regarding the 

scope of Requirement R1 can be evaluated by NERC and industry as part of the 

implementation process. As we noted above, the Commission will devote resources to 

compliance with and enforcement of Reliability Standard CIP-014-1 to ensure that all 

critical facilities are identified pursuant to Requirement R1. Should the Commission find 

through these efforts, or through the post-implementation reports and informational filing 

that NERC will submit, that Requirement R1 as currently written is not capturing all 

critical facilities, then the Commission will act upon that information.

D. Informational Filing on Resiliency

March 7 Order

60. In the March 7 Order, the Commission stated that the development of physical 

security Reliability Standards “will help provide for the resiliency and reliable operation 

of the Bulk-Power System. To that end, the proposed Reliability Standards should allow 

 56 NOPR, 148 FERC ¶ 61,040 at P 44 (quoting March 7 Order, 146 FERC 

¶ 61,166 at P 6 n.6).
Docket No. RM14-15-000 - 33 -

owners or operators to consider resiliency of the grid in the risk assessment when 

identifying critical facilities, and the elements that make up those facilities, such as 

transformers that typically require significant time to repair or replace. As part of this 

process, owners or operators may consider elements of resiliency such as how the system 

is designed, operated, and maintained, and the sophistication of recovery plans and 

inventory management.”57

NERC Petition

61. Reliability Standard CIP-014-1 mentions resiliency in Requirement R5, stating in 

Requirement R5.1 that the physical security plans that entities develop shall include, 

among other attributes: “Resiliency or security measures designed collectively to deter, 

detect, delay, assess, communicate, and respond to potential physical threats and 

vulnerabilities identified during the evaluation conducted in Requirement R4.” The 

NERC petition describes Requirement R5.1, with regard to resiliency, as referring to 

“steps an entity may take that, while not specifically targeted as hardening the physical 

security of the site, help to decrease the potential adverse impact of a physical attack ... 

including modifications to system topology or the construction of a new Transmission 

station ... that would lessen the criticality of the facility.”58 

 57 March 7 Order, 146 FERC ¶ 61,166 at P 7.

58 NERC Petition at 42.
Docket No. RM14-15-000 - 34 -

NOPR

62. The NOPR stated that the NERC petition describes resiliency measures that could 

be included in the required physical security plans. The NOPR also stated, however, that

specific resiliency measures are not required by Reliability Standard CIP-014-1, which is 

consistent with the March 7 Order. Instead, the NOPR noted that Reliability Standard

CIP-014-1 allows the security plans to be flexible in order to meet different threats and 

protect varying Bulk-Power System configurations. 

63. The NOPR stated that resiliency is as, or even more, important than physical 

security given that physical security cannot protect against all possible attacks. The 

NOPR also stated that, in the case of the loss of a substation, the Bulk-Power System may 

depend on resiliency to minimize the impact of the loss of facilities and restore blackedout portions of the Bulk-Power System as quickly as possible. The NOPR further stated 

that some entities may implement resiliency measures rather than security measures, such 

as by adding facilities or operating procedures that reduce or eliminate the importance of

existing critical facilities, which could significantly improve reliability and resiliency.

64. The NOPR stated that the NERC petition indicated that the NERC Board of 

Trustees expects NERC management to monitor and assess the implementation of

Reliability Standard CIP-014-1 on an ongoing basis, which would include: the number of 

assets identified as critical under the Reliability Standard; the defining characteristics of 

the assets identified as critical; the scope of security plans (i.e., the types of security and 

resiliency measures contemplated under the various security plans); the timelines 

included in the security plan for implementing the security and resiliency measures; and 
Docket No. RM14-15-000 - 35 -

industry progress in implementing the Reliability Standard. The NOPR also stated that 

NERC explained that this information could be used to provide regular updates to 

Commission staff.59 The NOPR proposed to rely on NERC’s ongoing assessment of 

Reliability Standard CIP-014-1’s implementation and to require NERC to make such 

information available to Commission staff upon request. 

65. In addition, the NOPR proposed to direct NERC to submit an informational filing 

that addresses the resiliency of the Bulk-Power System when confronted with the loss of 

critical facilities. The NOPR stated that the informational filing should explore what 

steps can be taken, in addition to those required by Reliability Standard CIP-014-1, to 

maintain the reliable operation of the Bulk-Power System when faced with the loss or 

degradation of critical facilities. The NOPR proposed to direct NERC to submit the 

informational filing within one year after the effective date of the final rule in this 

proceeding.60

 59 NOPR, 148 FERC ¶ 61,040 at P 56. 

60 NERC issued a report on severe impact resilience in 2012. See NERC, Severe 

Impact Resilience: Considerations and Recommendations (May 2012), available at 

http://www.nerc.com/comm/OC/SIRTF%20Related%20Files%20DL/SIRTF_Final_May

_9_2012-Board_Accepted.pdf. The NOPR stated that the proposed informational filing 

could draw on the report but should also reflect subsequent work and development on this 

topic, particularly including supply chain, transporting and other logistical issues for 

equipment such as large transformers. NOPR, 148 FERC ¶ 61,040 at P 57.
Docket No. RM14-15-000 - 36 -

Comments

66. NERC requests that the Commission not direct it to submit an informational filing 

on resiliency. NERC contends that an informational filing on resiliency would divert 

resources from NERC’s oversight of the implementation of Reliability Standard CIP-014-

1 and NERC’s efforts to assess the Reliability Standard’s effectiveness. NERC states that 

it will monitor and assess implementation of Reliability Standard CIP-014-1, as described 

in NERC’s petition, and will prepare two initial reports for the NERC Board of Trustees, 

the first report being submitted three months following implementation of Requirements 

R1, R2 and R3 and the second report being submitted three months after implementation 

of Requirements R4, R5 and R6. With respect to the second report, NERC states that 

“[g]iven the NOPR’s discussion of resiliency, this report will pay particular attention to 

the resiliency measures included in entities’ security plans.”61 NERC further states that it 

commits to provide both reports to Commission staff.

67. Pepco does not support the proposed informational filing because of the burden 

Pepco contends it would impose on NERC and registered entities, including diverting 

resources from the implementation of Reliability Standard CIP-014-1. Pepco asserts that 

resiliency is already addressed in Reliability Standard CIP-014-1.

 61 NERC Comments at 28.
Docket No. RM14-15-000 - 37 -

68. SDG&E, MISO and Idaho Power support directing NERC to submit the proposed 

informational filing on resiliency as a way of determining next steps for enhancing the 

reliability of the Bulk-Power System.62

69. Other commenters, including Associations, while generally agreeing that the issue 

of resiliency needs to be considered, recommend that the Commission convene a 

technical conference rather than require NERC to submit an informational filing because, 

they maintain, a technical conference would be more effective.63

Commission Determination

70. The Commission determines not to adopt the NOPR proposal requiring NERC to 

submit an informational filing concerning resiliency of the Bulk-Power System. While 

commenters expressed differing views on whether an informational filing is needed, the 

comments recognized the importance of Bulk-Power System resiliency. In addition, 

NERC committed to providing the Commission with two reports following 

implementation of Reliability Standard CIP-014-1, which, NERC indicates, will address 

the issue of resiliency. 

71. Rather than require NERC to submit an informational filing at this time, the 

Commission will review the NERC reports and will consider ways for industry to best 

 62 See SDG&E Comments at 5; MISO Comments at 6-7; Idaho Power Comments 

at 4; see also Paschall Comments at 2.

63 See Associations Comments at 17; KCP&L Comments at 6-7; SCE Comments 

at 4; Trade Associations Comments at 13-14; GridWise Comments at 3.
Docket No. RM14-15-000 - 38 -

inform the Commission of its current and future resiliency efforts, which could take the 

form of reports and/or technical conferences to address specific areas of concern (e.g., 

spare parts, fuel security, and advanced technologies).

E. Third-Party Verification and Review

March 7 Order

72. In the March 7 Order, the Commission stated that “the risk assessment used by an 

owner or operator to identify critical facilities should be verified by an entity other than 

the owner or operator ... [and] [s]imilarly, the determination of threats and vulnerabilities 

and the security plan should also be reviewed by NERC, the relevant Regional Entity, the 

Reliability Coordinator, or another entity with appropriate expertise.”64 

NERC Petition

73. Requirement R2 of Reliability Standard CIP-014-1 requires transmission owners 

to have their risk assessments verified by an unaffiliated third party. Requirement R6, 

likewise, requires each transmission owner and transmission operator to have their 

vulnerability and threat assessment(s) along with their security plan(s) for any critical 

facilities reviewed by an unaffiliated third party. 

74. Regarding how an applicable entity is supposed to address any recommendations 

by a third-party verifier, Reliability Standard CIP-014-1, in Requirement R2.3, states that 

the transmission owner must either (a) “modify its identification ... consistent with the 

 64 March 7 Order, 146 FERC ¶ 61,166 at P 11.
Docket No. RM14-15-000 - 39 -

recommendation” or (b) “document the technical basis for not modifying the 

identification in accordance with the recommendation.” Similarly, Requirement R6.3 

sets forth the procedure for considering any recommendations from the reviewing entity 

as to the threat assessments and security plans: the applicable entity must either 

(a) “modify its evaluation or security plan(s) consistent with the recommendation” or 

(b) “document the reason(s) for not modifying the evaluation or security plan(s) 

consistent with the recommendation.”

75. NERC states that “[r]equiring documentation of the technical basis for not 

modifying the identification in accordance with the recommendation will help ensure that 

a Transmission Owner meaningfully considers the verifier’s recommendations and 

follows those recommendations unless it can technically justify its reasons for not doing 

so. To comply with Part 2.3, the technical justification must be sound and based on 

acceptable approaches to conducting transmission analyses.”65 The NERC petition 

contains a similar explanation for the third-party review (Requirement R6) of the threat 

assessments and security plans mandated in Requirements R4 and R5.66

NOPR

76. The NOPR proposed to approve the third-party verification and review method

proposed by NERC in Requirements R2 and R6. The NOPR stated that failure to provide 

 65 NERC Petition at 36.

66 Id. at 50.
Docket No. RM14-15-000 - 40 -

a written, technically justifiable reason for rejecting a third-party recommendation would 

render the applicable entity non-compliant. With that understanding, the NOPR proposed

to approve NERC’s proposed third-party verification and review in Requirements R2 and 

R6 of Reliability Standard CIP-014-1 as an equally efficient and effective alternative to 

the directive in the March 7 Order. 

Comments

77. NERC states that it supports the NOPR proposal. NERC states that third-party 

verification and review will provide another layer of expertise and independence to the 

identification of critical assets, the evaluation of threats and vulnerabilities, and the 

development of effective security plans. NERC reiterates that an applicable entity’s 

failure to provide a reasonable, written explanation for declining to follow a third-party 

recommendation would constitute non-compliance.

78. MISO, Reclamation, KCP&L, ITC, and G&T Cooperatives support the NOPR 

proposal but each suggest modifications or request clarification of Reliability Standard 

CIP-014-1.67 

79. MISO states that entities like itself, that are both reliability coordinators and 

planning coordinators, may be subject to substantial, simultaneous demands by many 

transmission owners for concurrent verification of risk assessments. MISO notes that 

Requirement R2.2 requires applicable entities to have their risk assessment verified 

 67 See also Paschall Comments at 2; Foundation Comments at 7.
Docket No. RM14-15-000 - 41 -

within 90 days of completion of the risk assessment. MISO states that firm adherence to 

the 90-day deadline could undermine the protections in Reliability Standard CIP-014-1 

by requiring verifying entities (e.g., MISO) to conduct hurried or shorter-than-optimal 

assessments. Accordingly, MISO seeks clarification that NERC has the discretion to 

extend the implementation deadline, especially with respect to the 90-day verification 

deadline in Requirement R2.2. Likewise, G&T Cooperatives, NIPSCO and KCP&L state

that there should be flexibility regarding the 90-day deadline because of the limited pool

of qualified third-party verifiers.

80. Reclamation states that transmission owners should have discretion to make 

decisions regarding third-party recommendations based on cost and risk analyses. 

Reclamation also states that Requirement 2.1 should be modified to require that thirdparty verifications be conducted by a transmission owner’s planning coordinator or 

transmission planner. If the transmission owner is also the planning coordinator and 

transmission planner, then Reclamation states that the verification should be conducted 

by the reliability coordinator.

81. KCP&L states that NERC should develop a pre-approved list of qualified thirdparty contractors or require third parties to register with NERC. KCP&L also seeks 

clarification that an independent system operator (ISO) or regional transmission operator 

(RTO) concurrent with its role as reliability coordinator could provide third-party review 

services. KCP&L states that it does not oppose having an RTO that is also a reliability 

coordinator or planning coordinator serve as a third-party reviewer but would not support 
Docket No. RM14-15-000 - 42 -

a mandate requiring a specific third-party reviewer. KCP&L also seeks clarification of 

the meaning of the phrase “unaffiliated third-party.”

82. ITC states that the Commission should “confirm that the verification of a 

responsible entity’s risk assessment, threat assessment, and security plan, as specified in 

Requirements R2 and R6, constitutes full compliance by that responsible entity with 

respect to the risk assessment and security plan.”68

83. NIPSCO, TVA and Idaho Power do not support the NOPR proposal. NIPSCO 

contends that third-party verification is “inconsistent with the approach to entity selfassessment applied in other Reliability Standards” and notes that the Version 5 CIP 

Reliability Standards do not include a provision for third-party review.69 NIPSCO also 

contends that the use of third parties could raise confidentiality concerns. Idaho Power 

maintains that the proposal should not be adopted because it does not require third parties 

to include a written or technical justification with their recommendations. Idaho Power 

also states that “if a third-party verification and review process is incorporated in to the 

Standard, it should clearly describe the specific methodology and performance criteria to 

be applied.”70 TVA states that FPA section 215 does not contemplate the use of thirdparty verifiers and reviewers acting in an enforcement role. TVA also contends that 

 68 ITC Comments at 10.

69 NIPSCO Comments at 2.

70 Idaho Power Comments at 3-4.
Docket No. RM14-15-000 - 43 -

Reliability Standard CIP-014-1 does not contain any qualification criteria that third-party 

verifiers and reviewers must meet. TVA further states that using third-party verifiers and 

reviewers could compromise the confidentiality of critical information.

Commission Determination

84. We adopt the NOPR proposal and approve the third-party verification and review 

provisions found in Requirements R2 and R6 of Reliability Standard CIP-014-1. These 

provisions, as stated by NERC, provide an important, independent layer of expertise in 

the identification, assessment and protection of critical facilities.

85. We disagree with the arguments raised in the comments submitted by NIPSCO, 

TVA and Idaho Power. The use of third-party verification and review in Reliability 

Standard CIP-014-1 is not inconsistent with other Commission-approved Reliability 

Standards merely because third-party review is not used in other Reliability Standards. 

NIPSCO is correct that the Version 5 CIP Reliability Standards do not include third-party 

review provisions. However, as NIPSCO acknowledges, the Version 5 CIP Reliability 

Standards contain bright-line criteria that guide the determinations made by applicable 

entities in identifying BES Cyber Assets.

71 By contrast, Reliability Standard CIP-014-1 

contains no such criteria and instead requires applicable entities to develop their own 

 71 We also note that in Order No. 706, the Commission directed NERC to develop 

an external review procedure for the identification of critical assets by responsible 

entities. See Mandatory Reliability Standards for Critical Infrastructure Protection, 

Order No. 706, 122 FERC ¶ 61,040, at PP 322-329, order on reh’g, Order No. 706-A, 

123 FERC ¶ 61,174 (2008), order on clarification, Order No. 706-B, 126 FERC ¶ 61,229 

(2009), order on clarification, Order No. 706-C, 127 FERC ¶ 61,273 (2009).
Docket No. RM14-15-000 - 44 -

analysis. In addition, the threat evaluation in Requirement R4 and security plan in 

Requirement R6 involve areas of expertise that applicable entities in the electric industry 

may not possess and thus would strongly benefit from the experience of qualified third 

parties. 

86. Similarly, we disagree with TVA that the use of third-party verifiers and reviewers 

is inconsistent with FPA section 215. As discussed above, we reject TVA’s view that 

third-party verifiers and reviewers will be acting in an enforcement capacity. These third 

parties will have no authority to determine whether an applicable entity has violated a 

requirement of Reliability Standard CIP-014-1, require compliance, or issue penalties. 

Moreover, as stated in the NOPR, an applicable entity in some cases could be found to be 

in violation of a requirement even if the applicable entity’s actions were verified by a 

third party.72 We also determine that the requirements in Reliability Standard CIP-014-1 

(i.e., Requirements R2.1 and R6.1) establishing the qualifications for third-party verifiers 

and reviewers are sufficient. As discussed below, as Reliability Standard CIP-014-1 is 

implemented, we are satisfied that NERC and Regional Entities will provide additional 

assistance to applicable entities to identify qualified third-party verifiers and reviewers if 

the need arises. We are also satisfied that Requirements R2.4 and R6.4 provide adequate 

protection against the disclosure of sensitive or confidential information.

 72 NOPR, 148 FERC ¶ 61,040 at P 23.
Docket No. RM14-15-000 - 45 -

87. In response to Idaho Power’s concern, we expect that third-party verifiers and 

reviewers will articulate a reasonable basis for their recommendations. The absence of 

such a basis for a recommendation could justify an applicable entity’s decision to decline 

to adopt the recommendation. We also see no reason to include in Reliability Standard 

CIP-014-1 “specific methodology and performance criteria” for third-party verification 

and review beyond what is already contained in the requirements and compliance 

measures recited in the Reliability Standard.

88. With respect to the other comments, there is no evidence in the record to support 

the conclusion that an insufficient number of qualified third-party verifiers and reviewers 

exists such that applicable entities will be unable to meet the 90-day deadline in 

Requirements R2 and R6. To the extent an applicable entity requires additional time to 

comply, that situation should be addressed on a case-by-case basis.73 Reclamation has 

not explained why Requirement R2.1 should be modified to require that a transmission 

owner use its planning coordinator or transmission planner as a verifier, and thus we 

reject that proposal. In addition, addressing Reclamation’s second point, while risk and 

cost could be aspects of an applicable entity’s technical justification for declining to 

follow a third-party recommendation, ultimately there must be a sufficient objective basis 

 73 For similar reasons, we reject Entergy’s suggestion that Reliability Standard 

CIP-014-1 include language providing for flexibility concerning delays in compliance 

with deadlines contained in the Reliability Standard due to acts of nature. See Entergy 

Comments at 1.
Docket No. RM14-15-000 - 46 -

in the justification document from which to determine that the applicable entity acted 

reasonably in declining to follow the recommendation.

89. With respect to KCP&L’s comments, there may be value in NERC developing a 

list of qualified third-party verifiers and reviewers or otherwise requiring some form of 

registration process for third-party verifiers and reviewers. The Commission, however, 

will not direct NERC to do so at this time. We expect that NERC could, as Reliability 

Standard CIP-014-1 is implemented, pursue or, if necessary, propose such an effort if 

warranted. Indeed, Reliability Standard CIP-014-1 appears to contemplate such a role for 

NERC by indicating in Requirement R6.1 that an entity is qualified to serve as a reviewer 

if “approved by the ERO.” In addition, we see no reason why an ISO or RTO could not 

serve as a third-party verifier or reviewer provided it satisfies the qualifications stated in 

Requirements R2.1 and R6.1. We also conclude that the term “unaffiliated third party” is 

sufficiently clear. As NERC stated in its petition, “the term ‘unaffiliated’ means that the 

selected verifying entity cannot be a corporate affiliate (i.e., the verifying entity cannot be 

an entity that corporately controls, is controlled by or is under common control with, the 

Transmission Owner). The verifying entity also cannot be a division of the Transmission 

Owner that operates as a functional unit.”74 KCP&L does not indicate what, in this 

explanation, is ambiguous or requires clarification.

 74 NERC Petition at 34-35.
Docket No. RM14-15-000 - 47 -

90. With respect to ITC’s comment, third-party verification under Requirement R2 

adds an important layer of expertise and independence in the identification of critical 

facilities. However, verification under Requirement R2 is not intended to and, indeed, 

cannot cure an applicable entity’s failure to comply with Requirement R1 if it is 

determined by the compliance enforcement authority that the applicable entity failed to 

do so, a situation that ITC concedes could happen.75 We anticipate that a properly 

verified critical facility list will normally result in compliance with Requirement R1, but 

the Commission cannot foreclose the possibility that that may not be the case.

76

F. Generators

March 7 Order

91. The March 7 Order did not direct NERC to make the physical security Reliability 

Standards applicable to specific functional entity types. The March 7 Order stated that 

“some of the requirements imposed by these newly proposed Reliability Standards may 

 75 ITC Comments at 9 (“ITC further doesn’t disagree that, in extremely dire 

circumstances, a risk assessment which has been verified by a third-party may 

nonetheless be so deficient (and the third-party review be similarly inadequate) that it 

could be considered non-compliant.”); see also NERC Petition at 37 (“If, in the course of 

assessing an entity’s compliance with the proposed Reliability Standard, NERC, a 

Regional Entity, or FERC finds that the entity’s transmission analysis was patently 

deficient and that the Requirement R2 verification process did not cure those 

deficiencies, they could use their enforcement authority to compel Transmission Owners 

to re-perform the risk assessment using assumptions designed to identify the appropriate 

critical facilities.”).

76 See Order No. 706, 122 FERC ¶ 61,040 at P 320 (denying “safe harbor” for 

good faith compliance with CIP Reliability Standards).
Docket No. RM14-15-000 - 48 -

best be performed by the owner and other activity may best be performed by the 

operator,” and that NERC should clearly indicate which entity is responsible for each 

requirement.77 With regard to the applicable types of facilities, the Commission stated 

that it “is not requiring NERC to adopt a specific type of risk assessment, nor is the 

Commission requiring that a mandatory number of facilities be identified as critical 

facilities under the Reliability Standards.”78 

NERC Petition

92. In explaining why the Reliability Standard does not include generator owners and 

generator operators as applicable entities, the standard drafting team found that:

it was not necessary to include Generator Operators and Generator Owners 

in the Reliability Standard. First, Transmission stations or Transmission 

substations interconnecting generation facilities are considered when 

determining applicability. Transmission Owners will consider those 

Transmission stations and Transmission substations that include a 

Transmission station on the high side of the Generator Step-up transformer 

(GSU) using Applicability Section 4.1.1.1 and 4.1.1.2 ... Second, the 

transmission analysis or analyses conducted under Requirement R1 should 

take into account the impact of the loss of generation connected to 

applicable Transmission stations or Transmission substations. 

Additionally, the [March 7] order does not explicitly mention generation 

assets and is reasonably understood to focus on the most critical 

Transmission Facilities.79

 77 March 7 Order, 146 FERC ¶ 61,166 at P 6, n.4.

78 Id. P 6.

79 NERC Petition, Exhibit A (Proposed Reliability Standard) at 23. The standard 

drafting team provided the following example: “a Transmission station or Transmission 

substation identified as a Transmission Owner facility that interconnects generation will 

be subject to the Requirement R1 risk assessment if it operates at 500 kV or greater or if 

(continued ...)
Docket No. RM14-15-000 - 49 -

93. NERC explains that generator owners and generator operators were not included 

in the applicability section because, “while the loss of a generator facility due to a 

physical attack may have local reliability effects, the loss of the facility is unlikely to 

have the widespread, uncontrollable impact” contemplated for loss of a critical facility in 

the March 7 Order.80 NERC maintains that a “generation facility does not have the same 

critical functionality as certain Transmission stations and Transmission substations due to 

the limited size of generating plants, the availability of other generation capacity 

connected to the grid, and planned resilience of the transmission system to react to the 

loss of a generation facility.”81

NOPR

94. The NOPR proposed to approve the applicability section of the Reliability 

Standard CIP-014-1 without the inclusion of generator owners and generator operators. 

The NOPR stated that omitting generator owners and generator operators from the 

applicability section is consistent with the March 7 Order. The NOPR affirmed the 

statement in the March 7 Order that the “number of facilities identified as critical will be 

relatively small compared to the number of facilities that comprise the Bulk-Power 

 

it is connected at 200 kV – 499 kV to three or more other Transmission stations or 

Transmission substations and has an ‘aggregate weighted value’ exceeding 3000 

according to the table in Applicability Section 4.1.1.2.” Id. at 23.

80 NERC Petition at 22.

81 Id.
Docket No. RM14-15-000 - 50 -

System.”82 The NOPR proposed to accept NERC’s justification for excluding generator 

owners and operators because it is in keeping with the March 7 Order’s focus on 

protecting the most critical facilities. The NOPR stated that, according to NERC, a 

generation facility “does not have the same critical functionality as certain Transmission 

stations and Transmission substations due to the limited size of generating plants, the 

availability of other generation capacity connected to the grid, and planned resilience of 

the transmission system to react to the loss of a generation facility.”83 The NOPR also 

noted that Requirement R1 mandates a transmission analysis that accounts for 

transmission owner- or transmission operator-owned substations that connect generating 

stations to the Bulk-Power System with step-up transformers. 

95. While proposing to accept the applicability section of the proposed Reliability 

Standard, the NOPR stated that NERC’s proposed omission of generator owners and 

generator operators could potentially exempt substations owned or operated by 

generators. The NOPR sought comment on the potential reliability impact of excluding 

generator owned or operated substations.

Comments

96. NERC states that it supports the NOPR proposal to approve the applicability 

criteria in Reliability Standard CIP-014-1 without the inclusion of generator owners and 

 82 NOPR, 148 FERC ¶ 61,040 at P 44 (quoting March 7 Order, 146 FERC 

¶ 61,166 at P 12).

83 NOPR, 148 FERC ¶ 61,040 at P 45 (quoting NERC Petition at 22).
Docket No. RM14-15-000 - 51 -

generator operators. NERC, reiterating the justification in the NERC petition, states that 

the loss of a generation facility is unlikely to result in critical impacts on the Bulk-Power 

System. 

97. Associations, Trade Associations, Reclamation, G&T Cooperatives, KCP&L, 

Idaho Power, and APS also support the NOPR proposal.84 Associations’ comments are 

representative of the comments supportive of the NOPR proposal in that Associations 

state that generation facilities will be considered in Reliability Standard CIP-014-1, even

without generator owners and generator operators included in the applicability criteria,

because all generators interconnected to applicable transmission stations or substations 

will be in included in the transmission analysis under applicability sections 4.1.1.1 and 

4.1.1.2.

98. Paschall states, without elaboration, that generation facilities should be included 

within the scope of Reliability Standard CIP-014-1. Foundation comments that it 

supports Reliability Standard CIP-014-1, as modified in the NOPR, and also advocates 

for the inclusion of certain generation facilities in a second stage physical security 

Reliability Standard (discussed in Section H below).

 84 Associations Comments at 16-17; Trade Associations Comments at 12-13; 

Reclamation Comments at 1; G&T Cooperatives Comments at 13-14; KCP&L 

Comments at 5; Idaho Power Comments at 3; APS Comments at 4-5.
Docket No. RM14-15-000 - 52 -

Commission Determination

99. We adopt the NOPR proposal and approve the applicability criteria in Reliability 

Standard CIP-014-1 without the inclusion of generator owners and generator operators. 

As the Commission stated in the NOPR, we agree with NERC that a generation facility 

“does not have the same critical functionality as certain Transmission stations and 

Transmission substations due to the limited size of generating plants, the availability of 

other generation capacity connected to the grid, and planned resilience of the 

transmission system to react to the loss of a generation facility.” 

100. Paschall provides a conclusory statement that generation facilities should be 

included in Reliability Standard CIP-014-1, but does not provide a rationale for this 

position. Thus, we find Paschall’s comments unpersuasive.

G. Confidentiality

March 7 Order

101. The March 7 Order stated that:

All three steps of compliance with the Reliability Standard described above could 

contain sensitive or confidential information that, if released to the public, could 

jeopardize the reliable operation of the Bulk-Power System. Guarding sensitive or 

confidential information is essential to protecting the public by discouraging 

attacks on critical infrastructure. Therefore, NERC should include in the 

Reliability Standards a procedure that will ensure confidential treatment of 

sensitive or confidential information but still allow for the Commission, NERC 

and the Regional Entities to review and inspect any information that is needed to 

ensure compliance with the Reliability Standards.85

 85 March 7 Order, 146 FERC ¶ 61,166 at P 10.
Docket No. RM14-15-000 - 53 -

NERC Petition

102. Reliability Standard CIP-014-1 includes two requirements addressing the concerns 

over confidentiality. Requirements R2.2 and R6.4, which are substantially the same, 

state that “[e]ach Transmission Owner shall implement procedures, such as the use of 

non- disclosure agreements, for protecting sensitive or confidential information made 

available to the unaffiliated third party [verifier or reviewer] and to protect or exempt 

sensitive or confidential information developed pursuant to this Reliability Standard from 

public disclosure.”

Comments

103. Associations, GridWise, Duke, Seattle, ITC, and Trade Associations state that the 

Commission should explicitly address the issue of confidentiality in the final rule. 

Associations state that the Commission should state that any data produced or collected 

by an RTO in accordance with a requirement of Reliability Standard CIP-014-1 are

protected and should not be made available to a market monitor pursuant to a RTO tariff 

or market monitor agreement. Associations state that, at a minimum, a market monitor 

should have to make a filing with the Commission explaining the need for such 

information and indicating how the market monitor would protect such information from 

disclosure. GridWise and ITC state that they share Associations’ concerns regarding 

confidentiality.

104. Trade Associations and Seattle comment that the final rule should contain an 

explicit statement that Reliability Standard CIP-014-1 is intended to preempt any state or 

local public disclosure laws. SWTDUG’s reply comments question the Commission’s 
Docket No. RM14-15-000 - 54 -

legal authority to preempt state or local public disclosure laws, as suggested by Trade 

Associations and Seattle, without further Congressional action.

105. Duke comments that the Commission should take all necessary steps to protect the 

confidential information related to the activities of applicable entities, the Commission, 

NERC and Regional Entities in performance of their obligations under Reliability 

Standard CIP-014-1. Duke states that, pursuant to the Commission’s regulations, the 

“disposition of each violation or alleged violation that relates to a Cybersecurity Incident 

or that would jeopardize the security of the Bulk-Power System if publicly disclosed shall 

be nonpublic unless the Commission directs otherwise.”86 Duke recommends 

interpreting this provision to include violations of Reliability Standard CIP-014-1 or to

revise the regulation to do so. Duke also maintains that: (1) the risk assessment required 

under Requirement R1; (2) the third-party verification performed under Requirement R2; 

(3) the notification provided to transmission operators under Requirement R3; (4) the 

evaluation of threats and vulnerabilities performed under Requirement R4; (5) the 

development of physical security plans performed under Requirement R5; and (6) the 

third-party review performed under Requirement R6 all qualify as CEII. In addition, 

Duke states that this information is also exempt from the Freedom of Information Act 

under the (b)(4) exemption for “trade secrets and commercial or financial information 

obtained from a person and privileged or confidential.” 

 86 18 CFR 39.7(b)(4).
Docket No. RM14-15-000 - 55 -

Commission Determination

106. In the March 7 Order, the Commission recognized that compliance with the 

contemplated physical security Reliability Standards would likely require the 

development or sharing of confidential or sensitive material that, if disclosed to the 

public, could jeopardize the reliable operation of the Bulk-Power System. As a result, the 

Commission directed NERC to include adequate procedures in the Reliability Standards

to prevent the dissemination of confidential or sensitive information. 

107. We find that NERC has included sufficient safeguards in Reliability Standard CIP014-1 to ensure that confidential or sensitive information produced in compliance with 

the Reliability Standard will not be publicly disclosed. Reliability Standard CIP-014-1 

includes requirements regarding the sharing of information between applicable entities 

and third-party verifiers and reviewers in Requirements R2.4 and R6.4. Moreover, the 

“Compliance” section of Reliability Standard CIP-014-1 provides: “Confidentiality: To 

protect the confidentiality and sensitive nature of the evidence for demonstrating 

compliance with this standard, all evidence will be retained at the Transmission Owner’s 

and Transmission Operator’s facilities.”

108. The Commission will take all necessary and appropriate steps, as provided for in

our governing statutes and regulations, to preserve an applicable entity’s confidential or 

sensitive information when the public disclosure of such information could jeopardize the 

reliable operation of the Bulk-Power System. However, we decline to address in this 

final rule issues of preemption or the specific mechanism for treating confidential or 

sensitive information. Moreover, we find that it would be inappropriate to address 
Docket No. RM14-15-000 - 56 -

Associations’ request concerning the disclosure of information related to compliance with 

Reliability Standard CIP-014-1 to market monitors pursuant to a market monitor 

agreement or RTO tariff. No such agreements or tariffs are before us in this rulemaking 

proceeding.

H. Other Issues

109. Entergy seeks clarification as to whether the requirement in Reliability Standard 

CIP-014-1, Requirement R5 that an applicable entity “shall develop and implement a 

documented physical security plan(s) that covers their respective Transmission station(s), 

Transmission substation(s), and primary control center(s) . . . [and] shall be developed 

within 120 calendar days following the completion of Requirement R2 and executed 

according to the timeline specified in the physical security plan(s)” means that the actions 

called for in the security plan must be completed within 120 days. We see no ambiguity 

in Requirement R5 as the requirement only states that the security plan, not the actions 

called for in the plan, must be developed within 120 calendar days.

110. Reclamation proposes that the term “risk assessment” in Requirement R1 of 

Reliability Standard CIP-014-1 be changed to “impact assessment” because the 

requirement contemplates an assessment on the impact of the loss of facilities on the 

stability of the bulk electric system rather than a “risk assessment.” Reclamation further 

states that, based on the generally accepted meaning of the term “risk assessment,” that 

term better correlates to Requirement R4. We see no practical reason to require NERC to 

modify the nomenclature used in Requirement R1. Similarly, we see no reason to require 

NERC to change “risk assessment” to “threat risk assessment,” as suggested by Paschall, 
Docket No. RM14-15-000 - 57 -

or to require NERC to define “risk assessment” because the term is largely defined in 

Requirement R1.

111. Foundation recommends that the Commission direct NERC to begin development 

of a second phase physical security Reliability Standard. Foundation maintains that such 

a Reliability Standard would address deficiencies in Reliability Standard CIP-014-1, 

including the exclusion of generation facilities and certain control centers. For example, 

Foundation maintains that the loss of a single generation facility could cause cascading 

outages on the Bulk-Power System. However, for the reasons discussed in Sections C 

and F above, we are not persuaded that there is a sufficient factual basis at this time to 

direct NERC to develop a second phase physical security Reliability Standard. While we 

decline to direct NERC to develop a second phase physical security Reliability Standard 

at this time, the informational filing on “High Impact” control centers required in this 

final rule, the post-implementation reports that NERC has committed to provide to the 

Commission, the Commission’s compliance and enforcement efforts, and other outreach 

with NERC, industry and the public, will inform the Commission’s views going forward 

as to what additional steps, if any, might be required to help ensure the reliable operation 

of the Bulk-Power System in the face of physical security threats.

I. Violation Risk Factors and Violation Severity Levels

112. Each requirement of Reliability Standard CIP-014-1 includes one 

violation risk factor and has an associated set of at least one violation severity level. The 

ranges of penalties for violations will be based on the sanctions table and supporting 

penalty determination process described in the Commission-approved NERC Sanction 
Docket No. RM14-15-000 - 58 -

Guidelines, according to the NERC petition. The NOPR proposed to approve the 

violation risk factors and violation severity levels for the requirements in Reliability 

Standard CIP-014-1 consistent with the Commission’s established guidelines.87 The 

Commission did not receive any comments regarding this aspect of the NOPR. 

Accordingly, the Commission approves the violation risk factors and violation severity 

levels for the requirements in Reliability Standard CIP-014-1.

J. Implementation Plan and Effective Date

NERC Petition

113. The NERC petition proposes that Reliability Standard CIP-014-1 become effective 

the “first day of the first calendar quarter that is six months beyond the date that this 

standard is approved by applicable regulatory authorities” (i.e., the effective date of a 

final rule in this proceeding approving the proposed Reliability Standard).88 NERC states 

that the initial risk assessment required under Requirement R1 must be completed by or 

 87 North American Electric Reliability Corp., 135 FERC ¶ 61,166 (2011). 

88 NERC Petition, Exhibit B (Implementation Plan) at 1. Exhibit B also delineates 

the completion timelines for Requirements R2 through R6. Parts 2.1, 2.2, and 2.4 of 

Requirement R2 shall be completed within 90 calendar days of the effective date of the 

Reliability Standard. Part 2.3 of Requirement R2 shall be completed within 60 calendar 

days of the completion of performance under Requirement R2 part 2.2. Requirement R3 

shall be completed within 7 calendar days of completion of performance under 

Requirement R2. Requirements R4 and R5 shall be completed within 120 calendar days 

of completion of performance under Requirement R2. Parts 6.1, 6.2, and 6.4 of 

Requirement R6 shall be completed within 90 calendar days of completion of 

performance under Requirement R5. Part 6.3 of Requirement R6 shall be completed 

within 60 calendar days of Requirement R6 part 6.2.
Docket No. RM14-15-000 - 59 -

before the effective date of the proposed Reliability Standard.89 As described in the 

requirements of the Reliability Standard, NERC also identifies when Requirements R2, 

R3, R4, R5, and R6 must be complied with following the effective date of Reliability 

Standard CIP-014-1. 

NOPR

114. The NOPR proposed to approve NERC’s implementation plan and effective date 

for Reliability Standard CIP-014-1.

Comments

115. KCP&L states that the Commission should make it clear if the effective date of 

Reliability Standard CIP-014-1 will be earlier than April 2016, which KCP&L states is 

the effective date of Reliability Standard CIP-002-5. KCP&L states that the “basis for 

determination of criticality in CIP-014-1 references the same applicability as found in the 

CIP-002-5 ... [and the] potential disconnect in implementation dates may impact 

registered entities adversely in preparations for Critical Infrastructure Protection 

standards or in application of physical security improvements given the work required to 

identify critical assets.”90

 89 Id.

90 KCP&L Comments at 7.
Docket No. RM14-15-000 - 60 -

Commission Determination

116. We approve the implementation plan and effective date proposed by NERC for 

Reliability Standard CIP-014-1. In response to KCP&L’s comment, we understand that, 

pursuant to the implementation plan and effective date proposed by NERC and approved 

herein, Reliability Standard CIP-014-1 will become effective before April 2016.

III. Information Collection Statement

117. The Paperwork Reduction Act (PRA)91 requires each federal agency to seek and 

obtain Office of Management and Budget (OMB) approval before undertaking a 

collection of information directed to ten or more persons or contained in a rule of general 

applicability. OMB regulations require approval of certain information collection 

requirements imposed by agency rules.92 Upon approval of a collection(s) of 

information, OMB will assign an OMB control number and an expiration date. 

Respondents subject to the filing requirements of an agency rule will not be penalized for 

failing to respond to these collections of information unless the collections of information 

display a valid OMB control number.

Comments

118. Associations state that developing a security plan will cost more than $19,000 per 

company and “should include a more realistic estimate of costs to comply with the 

 91 44 U.S.C. 3501-3520.

92 See 5 CFR 1320.10.
Docket No. RM14-15-000 - 61 -

proposed standard because of the influence that the Commission’s assessment may have 

on the judgment of state utility commission or other regulatory authorities determining 

the prudence of costs incurred to comply with the proposed standard.”93 Associations 

also state “that it understands that one medium-sized investor-owned utility anticipates 

that third-party contract support will cost approximately $270,000 for conducting 

transmission studies under R1, third-party verification under R2, analyses of threats 

under R4, and support for security plan development under R5.”94 Associations further 

state that the Commission’s estimate did not include the cost of implementing the actual 

security measures included in applicable entity security plan. KCP&L states that it 

supports Associations’ comments.

Commission Determination

119. We adopt the Information Collection Statement estimates contained in the NOPR. 

As we have previously stated, the estimates provided in an Information Collection 

Statement are meant to quantify the paperwork burden imposed by a final rule.

95 The 

 93 Associations Comments at 19.

94 Id. at 19 n.19.

95 As defined in the PRA, “the term ‘‘burden’’ means time, effort, or financial 

resources expended by persons to generate, maintain, or provide information to or for a 

Federal agency, including the resources expended for— (A) reviewing instructions; 

(B) acquiring, installing, and utilizing technology and systems; (C) adjusting the existing 

ways to comply with any previously applicable instructions and requirements; 

(D) searching data sources; (E) completing and reviewing the collection of information; 

and (F) transmitting, or otherwise disclosing the information.”
Docket No. RM14-15-000 - 62 -

Information Collection Statement is not intended to estimate the cost of compliance with 

the requirements of a Reliability Standard approved in a final rule.

96 Associations has not 

explained why it believes the Commission’s paperwork burden estimate is not “realistic” 

or what would be a “realistic” figure other than to relate, in a footnote, that it understands 

that an unidentified medium-sized utility anticipates that compliance with requirements 

of Reliability Standard CIP-014-1, rather than the paperwork burden imposed by a final 

rule approving the Reliability Standard, will cost approximately $270,000. Associations’ 

comments do not provide any creditable evidence or analysis to cause us to reevaluate the 

paperwork burden estimate contained in the NOPR. Accordingly, as set forth below, we 

adopt the NOPR’s Information Collection Statement burden and cost estimates.

120. The Commission based its estimates on the number of respondents on the NERC 

compliance registry as of May 28, 2014. According to the registry, there are 

357 transmission owners (TOs) and 197 transmission operators (TOPs). The NERC 

compliance registry also shows that there are only 19 transmission operators that are not 

also registered as a transmission owner. 

121. The burden associated with the final rule is included in FERC-725U (Mandatory 

Reliability Standards: Reliability Standard CIP-014, OMB Control Number 1902-

 96 Version 5 Critical Infrastructure Protection Reliability Standards, Order 

No. 791, 78 Fed. Reg. 72,755 (Dec. 3, 2013), 145 FERC ¶ 61,160, at P 235 (2013), order 

granting clarification in part and denying rehearing, Order No. 791-A, 146 FERC 

¶ 61,188 (2014).

.
Docket No. RM14-15-000 - 63 -

0274).97 The following table shows the Commission’s burden and cost estimates, broken 

down by requirement and year:

FERC-725U

Requirements 

in Reliability 

Standard 

CIP-014-1 

over 

Years 1-3

Number and 

Type of 

Respondents

(1)

Number of 

Responses 

per 

Respondent

(2)

Total 

Number of 

Responses 

(1)*(2)=(3)

Average 

Burden 

Hours & 

Cost Per 

Response98

(4)

Total 

Burden 

Hours & 

Total Cost

(3)*(4)

Year 1

R1 357 TOs 1 357 20

$1,220

7,140

$435,540

R2 357 TOs 1 357 34

$2,342

12,138

$836,094

R3 2 TOPs 1 2 1

$128

2

$256

 97 The requirement for NERC to make the informational filing is part of the 

responsibilities related to being the nation-wide Electric Reliability Organization. The 

burden related to that filing is part of FERC-725 (OMB Control Number 1902-0225).

98 The estimates for cost per response are derived using the following formula: 

Average Burden Hours per Response * XX per Hour = Average Cost per Response. 

The hourly cost figures are based on data for wages plus benefits from the Bureau 

of Labor Statistics (as of September 4, 2014) at http://www.bls.gov/oes/current/

naics3_221 000.htm and http://www.bls.gov/news.release/ecec.nr0.htm. The figures are 

rounded for the purposes of calculations in this table and are:

• for electrical engineers: $60.87/hr., rounded to $61/hr.

• for attorneys: $128/hr.

• for administrative staff: $31.86/hr., rounded to $32/hr. 

 
Docket No. RM14-15-000 - 64 -

R4 30 TOs

2 TOPs

1 32 80

$4,880

2,560

$156,160

R5 30 TOs

2 TOPs

1 32 320

$19,520

10,240

$624,640

R6 30 TOs

2 TOPs

1 32 304

$18,812

9,728

$601,984

Record 

Retention

357 TOs

2 TOPs

1 359 2

$64

718

$22,976

Year 2

Record 

Retention

357 TOs

2 TOPs

1 359 2

$64

718

$22,976

Year 3 

R1 30 TOs 1 30 20

$1,220

600

$36,600

R2 30 TOs 1 30 34

$2,342

1,029

$70,260

R3 2 TOPs 1 2 1

$128

2

$256

R4 30 TOs

2 TOPs

1 32 80

$4,880

2,560

$156,160

R5 30 TOs

2 TOPs

1 32 80

$4,880

2,560

$156,160

R6 30 TOs

2 TOPs

1 32 134

$8,442

4,288

$270,144

Record 

Retention

357 TOs

2 TOPs

1 359 2

$64

718

$22,976

Year 1 Total 42,526

$2,677,650

Year 2 Total 718

$22,976

Year 3 Total 11,748

$712,556

TOTAL (for 

Years 1-3)

54,992

$3,413,182

122. In arriving at the figures in the above table, the Commission made the following 

assumptions:

a. Requirement R1: We assume that responsible entities will complete the 

required risk assessment at approximately the same time as they complete 
Docket No. RM14-15-000 - 65 -

the assessments required under the existing TPL Reliability Standards. 

Accordingly, the burden for Reliability Standard CIP-014-1 only represents 

the documentation required in addition to what entities currently prepare. 

Conservatively, we assume that in the first year all transmission owners and 

transmission operators will complete the required risk assessment.

99 In the 

third year, we assume that only 30 transmission operators will be required 

to do another risk assessment and that the entities with critical facilities 

after the first risk assessment will still have critical facilities after the 

second risk assessment.

b. Requirement R5: We assume that developing physical security plans in the 

first year will be more time consuming than in later years because in later 

years the plans will likely only need to be updated.

123. Title: FERC-725U, Mandatory Reliability Standards: Reliability Standard CIP014-1.

Action: Proposed Collection of Information.

OMB Control No: 1902-0274.

Respondents: Business or other for profit, and not for profit institutions.

Frequency of Responses: Ongoing.

 99 While it is likely that only large transmission owners and transmission operators 

will have critical facilities under Requirement R1, the Commission’s estimate includes all 

transmission owners and operators because reliable data on what percentage of large 

owners and operators control critical facilities is unavailable. 
Docket No. RM14-15-000 - 66 -

Necessity of the Information: Reliability Standard CIP-014-1 implements the 

Congressional mandate of the Energy Policy Act of 2005 to develop mandatory and 

enforceable Reliability Standards to better ensure the reliability of the nation’s BulkPower System. Specifically, Reliability Standard CIP-014-1 ensures that applicable

entities with critical Bulk-Power System facilities develop and implement physical 

security plans to address physical security threats and vulnerabilities that could result in 

widespread instability, uncontrolled separation, or cascading within an Interconnection.

Internal review: The Commission has reviewed Reliability Standard CIP-014-1 and has 

determined that the Reliability Standard is necessary to ensure the reliability and integrity 

of the nation’s Bulk-Power System. 

124. Interested persons may obtain information on the reporting requirements by 

contacting: Federal Energy Regulatory Commission, 888 First Street, NE, Washington, 

DC 20426 [Attention: Ellen Brown, Office of the Executive Director, e-mail: 

DataClearance@ferc.gov, Phone: (202) 502-8663, fax: (202) 273-0873]. Comments on 

the requirements of this rule may also be sent to the Office of Information and Regulatory 

Affairs, Office of Management and Budget, Washington, DC 20503 [Attention: Desk 

Officer for the Federal Energy Regulatory Commission]. For security reasons, comments 

should be sent by e-mail to OMB at oira_submission@omb.eop.gov. Comments 

submitted to OMB should refer to FERC-725U and OMB Control No. 1902-0274.

IV. Environmental Analysis

125. The Commission is required to prepare an Environmental Assessment or an 

Environmental Impact Statement for any action that may have a significant adverse effect 
Docket No. RM14-15-000 - 67 -

on the human environment.100 The Commission has categorically excluded certain 

actions from this requirement as not having a significant effect on the human 

environment. Included in the exclusion are rules that are clarifying, corrective, or 

procedural or that do not substantially change the effect of the regulations being 

amended.101 The actions here fall within this categorical exclusion in the Commission’s 

regulations. 

V. Regulatory Flexibility Act

126. The Regulatory Flexibility Act of 1980 (RFA)102 generally requires a description 

and analysis of proposed rules that will have significant economic impact on a substantial 

number of small entities.

127. The Small Business Administration (SBA) revised its size standard (effective 

January 22, 2014) for electric utilities from a standard based on megawatt hours to a 

standard based on the number of employees, including affiliates.

103 Under SBA’s new 

size standards, transmission owners and transmission operators likely come under the 

 100 Order No. 486, Regulations Implementing the National Environmental Policy 

Act of 1969, 52 FR 47897 (Dec. 17, 1987), FERC Stats. & Regs. Regulations Preambles 

1986-1990 ¶ 30,783 (1987).

101 18 CFR 380.4(a)(2)(ii).

102 5 U.S.C. 601-612.

103 SBA Final Rule on “Small Business Size Standards: Utilities,” 78 FR 77,343 

(Dec. 23, 2013).
Docket No. RM14-15-000 - 68 -

following category and associated size threshold: Electric bulk power transmission and 

control, at 500 employees.

104

128. The NOPR stated that, based on U.S. economic census data, the approximate 

percentage of small firms in this category is 57 percent.105 The NOPR also stated that the 

Commission did not have information concerning how the economic census data 

compares with entities registered with NERC and is unable to estimate the number of 

small transmission owners and transmission operators using the new SBA definition. 

However, the NOPR stated that Reliability Standard CIP-014-1 only applies to 

transmission owners and transmission operators that own and/or operate certain critical

Bulk-Power System facilities. In the NOPR, the Commission stated that it believes that

Reliability Standard CIP-014-1 will be applicable to a relatively small group of large 

entities. No comments were received addressing the Commission’s proposed 

certification.106

 104 13 CFR 121.201, Sector 22, Utilities. 

105 NOPR, 148 FERC ¶ 61,040 at P 70. Data and further information are available 

on the SBA website. See SBA Firm Size Data, available at http://www.sba.gov/ 

advocacy/849/12162. Since issuance of the NOPR, the Commission has obtained data 

that enables us to estimate more closely the number of small entities affected by this final 

rule. We now estimate that 28 percent (or 103 out of the 359 entities) are small entities.

106 To the extent that Associations’ comments, which we addressed above in the 

Information Collection Statement section, were also directed to the Commission’s 

proposed certification regarding the Regulatory Flexibility Act, Associations’ comments 

do not dispute any of the assumptions underlying the proposed certification or contest the 

proposed certification itself. 
Docket No. RM14-15-000 - 69 -

129. Accordingly, the Commission certifies that Reliability Standard CIP-014-1 will 

not have a significant impact on a substantial number of small entities. Accordingly, no 

regulatory flexibility analysis is required.

VI. Document Availability

130. In addition to publishing the full text of this document in the Federal Register, the 

Commission provides all interested persons an opportunity to view and/or print the 

contents of this document via the Internet through the Commission's Home Page 

(http://www.ferc.gov) and in the Commission's Public Reference Room during normal 

business hours (8:30 a.m. to 5:00 p.m. Eastern time) at 888 First Street, NE, Room 2A, 

Washington DC 20426.

131. From the Commission’s Home Page on the Internet, this information is available 

on eLibrary. The full text of this document is available on eLibrary in PDF and 

Microsoft Word format for viewing, printing, and/or downloading. To access this 

document in eLibrary, type the docket number excluding the last three digits of this 

document in the docket number field.

132. User assistance is available for eLibrary and the Commission’s website during 

normal business hours from the Commission’s Online Support at 202-502-6652 (toll free 

at 1-866-208-3676) or email at ferconlinesupport@ferc.gov, or the Public Reference 

Room at (202) 502-8371, TTY (202) 502-8659. E-mail the Public Reference Room 

at public.referenceroom@ferc.gov.

VII. Effective Date and Congressional Notification

133. This final rule is effective [INSERT DATE 60 days after publication in the 
Docket No. RM14-15-000 - 70 -

FEDERAL REGISTER]. The Commission has determined, with the concurrence of the 

Administrator of the Office of Information and Regulatory Affairs of OMB, that this rule 

is not a “major rule” as defined in section 351 of the Small Business Regulatory 

Enforcement Fairness Act of 1996.107 This final rule is being submitted to the Senate,

House, and Government Accountability Office.

By the Commission.

( S E A L )

Nathaniel J. Davis, Sr.,

Deputy Secretary.

 107 5 U.S.C. 804(2).
Docket No. RM14-15-000 - 71 -

Note: The Appendix will not appear in the Code of Federal Regulations.

Appendix

Initial Commenters

Abbreviation Commenter

APS Arizona Public Service Company

Associations Edison Electric Institute, Electric Power Supply Association, 

Electricity Consumers Resource Council

BPA Bonneville Power Administration

CEA Canadian Electricity Association

Duke Duke Energy Corporation

Entergy Entergy

Foundation Foundation for Resilient Societies

GridWise GridWise Alliance

G&T Cooperatives Associated Electric Cooperative, Inc., Basin Electric Power 

Cooperative, and Tri-State Generation and Transmission 

Association, Inc.

Idaho Power Idaho Power Company

ITC International Transmission Company

KCP&L Kansas City Power & Light Company and KCP&L Greater 

Missouri Operations Company

MISO Midcontinent Independent System Operator, Inc.

NARUC National Association of Regulatory Utility Commissioners

NEMA National Electrical Manufactures Association

NERC North American Electric Reliability Corporation

NU Utilities Northeast Utilities System

NYPSC New York Public Service Commission

Ohio PUC Public Utilities Commission of Ohio

Oncor Oncor Electric Delivery Company LLC

Pa PUC Pennsylvania Public Utility Commission

Paschall Roger Paschall

Pepco Pepco Holdings, Inc.

Reclamation U.S. Department of Interior, Bureau of Reclamation

Seattle City of Seattle

SCE Southern California Edison

SDG&E San Diego Gas & Electric

SIA Security Industry Association

Southern Southern Company Services, Inc.

TAPS Transmission Access Policy Study Group

TVA Tennessee Valley Authority
Docket No. RM14-15-000 - 72 -

Trade Associations American Public Power Association, Large Public Power 

Council, National Rural Electric Cooperative Association

Xcel Xcel Energy Services Inc.

Reply Commenters

Foundation Foundation for Resilient Societies

ITC International Transmission Company

NIPSCO Northern Indiana Public Service Company

SmartSenseCom SmartSenseCom, Inc.

SWTDUG Southwest Transmission Dependent Utility Group

Tallahassee City of Tallahassee