344 Utilities Have Until Oct. 1, 2028 to Meet a New Substation Security Rule

The Federal Energy Regulatory Commission approved a revised grid physical security standard on Sept. 10, and the order was published in the Federal Register on Sept. 15 at 91 FR 58430 under docket RD26-9-000. The standard is CIP-014-4, written by the North American Electric Reliability Corporation and adopted by its board of trustees on June 17, 2026. It takes effect Oct. 1, 2028, twenty-four calendar months after the approval order itself becomes effective.

CIP-014 governs which high-voltage substations get treated as critical and what protection they have to carry. Version 4 folds the old 30-month and 60-month reassessment timelines into a single 36-month cycle, which shortens the clock for stations not previously flagged. It also adds a proximity test: a transmission owner that identifies a critical substation must now identify any bulk electric system station or substation within 1,500 feet of it, regardless of who owns it. FERC's order notes that NERC drew that distance from the Department of Homeland Security and Department of Justice Bomb Threat Stand-Off Card.

The applicability thresholds stay where they were. They cover stations at 500 kV and above, 200 kV to 499 kV stations with three or more connections and an aggregate weighted value above 3,000, stations critical to an interconnection reliability operating limit, and stations tied to a nuclear plant interface requirement. FERC put the recurring paperwork at 3,440 hours a year across the 344 transmission owners on NERC's compliance registry, roughly ten hours and $834 each. That estimate covers documentation and recordkeeping only. It does not price the field labor the standard's later requirements set in motion.

Those later requirements are where the work sits. Once a substation is identified, an unaffiliated third party has to verify the risk assessment within 90 calendar days, and the owner has 60 days to respond to the reviewer's recommendations. The owner then evaluates the physical attack threats and vulnerabilities at the site and has 120 calendar days after that verification closes to develop and implement a documented security plan. The plan has to deter, detect, delay, assess, communicate, and respond, which on site generally means lighting, camera and sensor circuits, communications runs, and barrier work inside an energized high-voltage yard.

For a commercial electrician, that is substation work rather than building work. It falls under OSHA's 29 CFR 1910.269 rules on minimum approach distances and personal protective grounds, it runs on utility clearance and escort procedures, and it leans on medium- and high-voltage experience, grounding discipline, and control and instrumentation wiring rather than branch circuits. The 36-month cycle also makes the demand recurring instead of one-time, and the 1,500-foot test and the new joint-ownership coordination requirement can pull a neighboring owner's substation into the same assessment.

The compliance date is two years out, and that is when the plans have to be in place, not when the work starts. Utilities that wait until 2028 to bid it will be bidding against everyone else who waited.