What CIP-006-6 R1 asks for and why auditors test it closely
Once a BES Cyber System has been categorized, the compliance lead needs a documented physical security plan that shows how people and devices are kept away from it. CIP-006-6 R1 is that plan requirement. Its parts cover who may enter each Physical Security Perimeter (PSP), how entry is controlled, how unauthorized access is detected and alerted, how entries are logged and kept, and how cabling outside the perimeter is protected. The scope of each part depends on the impact rating from CIP-002 and on whether a medium impact system has External Routable Connectivity. A high impact system needs two or more different physical access controls where technically feasible, so a single badge reader is not enough. Medium impact systems without External Routable Connectivity can rely on operational or procedural controls instead of a physical access control at each PSP entry. Confirm the rating and the connectivity status in writing before you draft the plan, because they decide which parts apply.
Monitoring and alerting create most of the operational work. The plan must detect unauthorized access through physical access points and alert the personnel named in the incident response plan within 15 minutes of detection. The same 15-minute alerting applies to unauthorized access to Physical Access Control Systems. Entries of each authorized individual into each PSP must be logged, and those logs must be kept for at least 90 calendar days. Auditors usually test these parts by picking an alarm or door event and tracing it: who was notified, when, what the timestamp source was, and whether the log still exists. Check that your PACS clocks are synchronized and that alert routing works outside business hours before an assessor asks.
Cabling is the part most often missed. Nonprogrammable communication components that connect Cyber Assets in the same Electronic Security Perimeter and run outside a PSP must either be physically restricted or protected through encryption, monitoring and alerting, or an equally effective logical control. This applies to high impact systems and to medium impact systems at Control Centers. Walk the routes from the PSP to the building entry points and to any other facilities, and document what protects each run. For self-hosted log and alert pipelines, tools such as Wazuh and OpenSearch Security Analytics can collect access events and route alerts, but they do not replace the physical controls, and the plan should say which system produces each piece of evidence. Read the CIP-006-6 standard with your registered entity's impact categories in hand.
Which systems and locations fall under the physical security plan
The CIP-006-6 R1 plan applies to different locations depending on how each BES Cyber System was categorized under CIP-002. Impact rating, External Routable Connectivity, control center status and where PACS sit each change which parts of the plan apply, so the categorization record should be settled before anyone designs physical controls.
High impact systems
High impact BES Cyber Systems carry the strictest physical requirements in R1. Each Physical Security Perimeter needs at least one access control that limits unescorted entry to authorized individuals, and where technically feasible, two or more different controls must work together for that entry. Confirm with your CIP-002 record which Control Centers and substations are rated high impact, since that rating sets the baseline for every other card.
Medium impact with External Routable Connectivity
Medium impact BES Cyber Systems that have External Routable Connectivity need at least one physical access control at each Physical Security Perimeter, but they do not need the layered controls required for high impact systems. Teams often miss that the External Routable Connectivity test is applied per system, so a site with mixed connectivity may need two sets of documented procedures. Check the connectivity inventory before scoping the perimeter.
Medium impact without External Routable Connectivity
For medium impact systems without External Routable Connectivity, Part 1.1 requires operational or procedural controls to restrict physical access rather than a specific access control device. This is the lightest path in R1, but the plan still has to show how access is restricted and who is authorized. Document the procedure clearly, since an assessor will ask for the same proof of restriction that a card reader would produce.
Control Centers and Part 1.10 cabling
Part 1.10 applies to cabling and nonprogrammable communication components that run outside a Physical Security Perimeter, but only for high impact systems and for medium impact systems located at Control Centers. Cable runs between buildings, conduit in shared ducts and rooms outside the perimeter all need review. Where physical restriction is not practical, the plan must rely on encryption, monitoring and alerting, or an equally effective logical protection, so map each run before choosing the method.
PACS as a separate target
Physical Access Control Systems are scoped as their own category, and Parts 1.6 and 1.7 require monitoring for unauthorized access to them with alerting within 15 minutes. The badge server, door controllers and networked readers can sit in a different room or network segment from the protected asset, so they often need their own inventory and log review. Confirm which PACS components are in scope for each impact rating and where their logs are kept.
Colocation and hosted facilities
When BES Cyber Systems sit in a third-party colocation or hosted facility, the entity still owns the compliance obligation for its Physical Security Perimeter. The plan must explain which controls the provider operates, which the entity controls, and what contract terms or evidence the provider supplies. Ask the provider for its access logs, visitor records and maintenance documentation before you commit to a shared-control design.
How an assessor tests the physical security plan
This table maps each part of CIP-006-6 R1 to how an auditor typically tests it, the evidence usually requested, and the findings that appear most often. Read it as a pre-audit checklist: confirm that every part has a named owner, a documented procedure and records that show the control operating, not just a written plan.
| Requirement part | How the assessor tests it | Evidence requested and common findings |
|---|---|---|
| R1 plan and scope (Parts 1.1 and 1.2) | Confirms a documented physical security plan exists, that it covers each in-scope Physical Security Perimeter, and that access controls match the impact rating and External Routable Connectivity status. | Evidence: the plan, the PSP inventory, and the impact rating from CIP-002. Common finding: plan not updated after a new PSP was added or a Control Center changed. |
| Two or more controls for high impact (Part 1.3) | Checks that high impact PSPs have two or more different physical access controls that together permit unescorted entry, and that any technical infeasibility is documented. | Evidence: door and access system diagrams, device types, and the feasibility record. Common finding: two controls that are the same type (for example, two card readers on one credential) or no written feasibility justification. |
| Monitoring and 15-minute alerting for PSP access points (Parts 1.4 and 1.5) | Samples alarm events and traces each one from detection to notification, measuring whether personnel named in the incident response plan were alerted within 15 minutes. | Evidence: alarm logs with timestamps, notification records, and the named recipients. Common findings: alarm recipients not documented, timing not shown in the logs, or alerts sent to a mailbox nobody monitors. |
| Monitoring and alerting for PACS (Parts 1.6 and 1.7) | Checks that unauthorized access attempts or tampering with Physical Access Control Systems are detected and alerted within the same 15-minute window. | Evidence: PACS event logs, alert configuration, and test results. Common finding: PACS controllers and door panels not in the monitored set, so their events never reach an alert. |
| Access logging (Part 1.8) | Selects entries by authorized individuals and confirms each entry into the PSP is recorded with enough detail to identify the person and time. | Evidence: entry logs for sampled dates and the authorized access list for the same period. Common finding: log entries that cannot be tied to a named, authorized individual. |
| Log retention of 90 days (Part 1.9) | Requests logs from the start of the audit period and checks that anything older than 90 calendar days is still retained for the required period. | Evidence: retention settings and a sample of logs at the beginning, middle and end of the period. Common finding: automatic deletion or rotation shorter than 90 days, or logs stored only on a device that overwrites them. |
| Cabling and communication components outside the PSP (Part 1.10) | Walks the route of cabling between in-scope Cyber Assets that leaves a PSP and checks whether it is protected physically, encrypted, or monitored and alerted. | Evidence: cable routing diagrams, conduit and enclosure inspection records, or encryption and monitoring configuration. Common finding: cable runs in unlocked ceilings or shared spaces with no documented protection. |
| Procedural controls for medium impact without External Routable Connectivity (Part 1.1) | Confirms the operational or procedural controls exist, are described in the plan, and that staff can explain how they work in practice. | Evidence: written procedures, escort or badge rules, and interviews with the staff who apply them. Common finding: procedures described in general terms with no evidence they are followed. |
How to build a compliant physical security plan step by step
This sequence takes a registered entity from confirming which BES Cyber Systems need physical protection to a tested plan that shows access control, alarm routing, logging and cabling protection working as written. Each step produces a record an auditor can examine.
Confirm impact categories and PSP boundaries
Start from the CIP-002 categorization of each BES Cyber System and confirm whether it is high impact, medium impact with or without External Routable Connectivity, or low impact. That rating decides which Part of CIP-006-6 R1 applies to each location. Then walk each site and mark where the Physical Security Perimeter will sit around the BES Cyber Systems, their associated PACS and any cabling. The output is a dated PSP boundary drawing for each site, signed off by the people who own the categorization record.
Select access controls for each perimeter
For each PSP, choose the physical access controls that allow unescorted entry, such as badge readers, locks, or staffed points. Where the rating is high impact and it is technically feasible, document two or more different controls that work together, so a single failure does not open the perimeter. For medium impact systems with External Routable Connectivity and for high impact systems, confirm that at least one control restricts unescorted access to authorized individuals. The output is an access control matrix listing each entry point, the controls on it and the authorization method for each.
Design monitoring and alarm points
Identify every physical access point that needs monitoring for unauthorized access, including the points that lead to the PACS themselves. Define what counts as unauthorized access at each point and which personnel in the incident response plan receive the alert. The design must show how detection leads to an alarm or alert within 15 minutes. The output is a monitoring point inventory that maps each door, sensor or camera to its alert recipient and its detection logic.
Write the physical security plan document
Draft the plan as a single controlled document that names each PSP, its access controls, its monitoring points, its logging method and its cabling protections. Assign an owner for each control and state how the plan links to the incident response plan and to the access authorization process under CIP-004. Route the draft through the entity's approval process and record the approval date and the approver. The output is an approved physical security plan with a version history, reviewed against the sites and BES Cyber Systems it covers.
Configure alarm routing and access logging
Set up the PACS and the monitoring tools so that alarms reach the named personnel and each entry by an authorized individual is recorded. Log entry events with enough detail to identify the person, the PSP and the time. Set log retention to at least the 90 calendar days required by Part 1.9. Logs can be forwarded to a central platform, but the evidence must still show retention for the required period. Self-hosted tools such as Wazuh or OpenSearch Security Analytics can ingest and correlate these logs, though the entity must verify that each event source is covered. The output is a documented logging configuration and a sample export showing retained entries.
Test alarm routing and detection
Run controlled tests in which an unauthorized access attempt is simulated at each monitored point, and record the time of detection and the time the alert reached the designated personnel. Confirm that the alert arrived within 15 minutes and that the test is repeatable. Test the monitoring of the PACS as well. Keep the test plan, the test date, the witnesses and the results. The output is an alarm test record for each PSP that an auditor can follow from the simulated event to the alert.
Validate cabling protection outside the perimeter
Identify all cabling and nonprogrammable communication components between Cyber Assets in the same Electronic Security Perimeter that run outside a PSP. For high impact systems and medium impact systems at Control Centers, document whether each run is protected by restricting physical access, by encryption with monitoring and alerting, or by an equally effective logical protection. Inspect the runs in the field and compare them with the drawings. The output is a cabling inventory with the protection method for each segment and an inspection record signed by the person who walked the route.
Close the loop with evidence and review
Assemble one evidence package per PSP that links the boundary drawing, access control matrix, approved plan, logging sample, alarm test record and cabling inventory. Check that each document matches the current site layout and the current CIP-002 categorization. Schedule a review after any change to the perimeter, the access controls or the BES Cyber Systems. The output is a version-controlled evidence index that lets the entity answer a Regional Entity request without rebuilding the record from memory.
How access logs and 15-minute alarms fit together
The 15-minute alarm and the access log are two halves of one monitoring chain, and an auditor will expect to trace a single unauthorized-access event through both. The chain starts at the physical access point, where a door controller or badge reader records each attempt and each door position change. Those records feed the monitoring system that decides whether an access is unauthorized, and when it is, the system issues an alarm or alert to the personnel named in the entity's incident response plan. Parts 1.4 through 1.7 of CIP-006-6 R1 cover both the access points into the Physical Security Perimeter and the Physical Access Control Systems themselves, so the chain needs to be documented for each of them, not only for the main entrance. Confirm with your own design who receives the alert, through which channel, and what happens when that person is unavailable.
The 15-minute clock is measured from detection, so the evidence has to show when detection happened and when the alert left the system. In practice that means the controller, monitoring platform and alerting tool write timestamps you can compare, and those timestamps come from clocks that agree with each other. Time synchronization is therefore a control in its own right: confirm that every device in the chain syncs to a common, documented time source and that drift is monitored. Log retention matters for the same reason. CIP-006-6 requires retaining entry logs for at least ninety calendar days, and the retained records should be exportable in a form that keeps their original timestamps and identifiers intact, so the reviewer can reconstruct the sequence without relying on screenshots.
A reviewer typically samples a few alarms and asks for the detection record, the alert record, the recipient list in the incident response plan and proof that the response was carried out. They look for gaps between those records, alerts that were generated but never acknowledged, and timestamps that do not line up. Open-source log pipelines can produce this evidence when they are configured deliberately. For example, a Wazuh deployment can write matching alerts to alerts.json with the event time retained, and an OpenSearch Security Analytics detector can record findings with their rule and severity. Neither tool decides on its own what counts as unauthorized access at your facility, so the detection rules and alert routing are decisions your team must make and document before the first audit sample is pulled.
Evidence that passes a CIP-006-6 R1 review
An auditor testing CIP-006-6 R1 wants to see a physical security plan that matches how the facility actually works, backed by dated records from the access, alarm and logging systems. The cards below cover each artifact, along with the routine that keeps it accurate between Compliance Audits.
Written physical security plan and version history
The plan is the document the auditor reads first. It should name each Physical Security Perimeter, the access controls at each one, the monitoring method and the personnel alerted under the incident response plan. Keep a change log with dates, approvers and the reason for each revision, so the auditor can see the plan was in force when each event occurred. Check that the plan's references to access lists, drawings and alarm procedures still point to current documents.
Physical Security Perimeter drawings
Drawings show where each PSP boundary sits, where every physical access point is and where cabling runs outside the perimeter. An auditor compares them against the plan and against a walkthrough of the facility. Update the drawings after any construction, door change or cable reroute, and record the revision date on each sheet.
Access control configuration exports
Exports from the badge, biometric and door controller systems show which credentials open which doors and whether two different controls apply at high impact PSPs. Keep dated exports taken before and after each configuration change, and confirm that the access control system is itself covered by the monitoring and logging described in the plan.
Authorized unescorted access lists
The list of individuals with authorized unescorted physical access should match the approved personnel records and the access control system. Reconcile the two at a regular interval and record each addition and removal with its date. Mismatches between the list and the controller are a common finding, so the reconciliation record itself is useful evidence.
Alarm test and alert samples
Auditors look for proof that unauthorized access is detected and that the designated personnel are alerted within 15 minutes of detection. Keep test records showing the date, the door tested, the alert received and the time to alert. Pair them with sample alerts from production, including the monitoring system's timestamps, so the test results can be compared with real events.
Access logs and cabling protection records
Entry logs for each PSP must be retained for at least 90 calendar days, so set your log retention to exceed that period and confirm that exports are complete for the sampled dates. Cabling records should show how non-programmable communication components outside the perimeter are protected, through restricted access, encryption or monitoring, with inspection dates. Confirm retention settings and cable inspections on a fixed schedule, not only before an audit.
What meeting R1 costs in money and effort
High impact BES Cyber Systems carry the heaviest R1 load because Part 1.3 requires two or more different physical access controls to work together for unescorted access into each Physical Security Perimeter where technically feasible, and Parts 1.4 and 1.5 require monitoring and a 15-minute alert. Most of the spend goes to hardware, integration and testing across layered controls, and the effort rises with the number of PSPs and access points at each Control Center.
- Layered access hardware: Each additional control, such as a badge reader paired with a biometric or mantrap, adds purchase, mounting, wiring and licensing cost.
- Alarm integration: Connecting door sensors and the PACS to the alerting path that meets the 15-minute requirement is usually a one-time engineering task with ongoing monitoring cost.
- Logging and retention: Logs for 90 calendar days need storage sizing, backup and review procedures that recur every cycle.
- Evidence preparation: Assembling sampled entry records and alarm tickets for an auditor is recurring labor, and it grows with the number of PSPs.
Ask any quote to separate layered-control hardware, integration labor and recurring monitoring so you can see which items scale with site count.
For medium impact BES Cyber Systems, Part 1.1 allows operational or procedural controls where the systems have no External Routable Connectivity, while Part 1.2 requires at least one physical access control for medium impact systems with External Routable Connectivity. Entities with only procedural controls at some sites often spend far less on hardware, but they still must document, monitor and evidence those procedures.
- Procedural scope: Escort rules, locked cabinets and key control cost mainly staff time to write and enforce.
- Single control points: One badge or keypad controlled door costs less to install than a layered design, but it still needs alarm and logging coverage where the requirement applies.
- Classification sensitivity: Whether a site has External Routable Connectivity decides which path applies, so reviewing connectivity before buying equipment avoids rework.
- Mixed portfolios: Entities with many small sites may find that the per-site effort of documentation dominates the hardware cost.
Confirm with your Regional Entity and internal CIP-002 categorization which controls each site must meet before pricing any hardware.
Delivering R1 in-house keeps direct control over the plan and avoids external fees, but it moves cost into internal staff time, specialist skills and the risk of gaps found at audit. The largest hidden cost is often the time security, facilities and operations staff spend reconciling access lists, alarm tests and log reviews across sites.
- One-time work: Plan drafting, PSP boundary design, alarm wiring review and cabling assessment consume engineering and facilities hours.
- Recurring work: Log review, alarm testing, plan updates after changes and sampling for audits repeat on a schedule set by your own procedures.
- Skills gaps: Staff may need training on the PACS and on how assessors read evidence, which adds course fees and time away from operations.
- Tooling: Log storage and alert routing may run on existing systems, but capacity and retention settings must be confirmed.
Ask internal teams to estimate hours by task, so the cost of staying in-house can be compared directly with a fixed-scope quote.
An implementation partner can prepare the plan, design evidence collection, configure logging and alert routing, and build the review workflow, while the entity keeps ownership of the controls and of every decision. Partner cost is typically front-loaded in fixed-scope work, followed by a smaller recurring element if the entity buys ongoing support. The partner does not issue audit reports or certifications, and the Compliance Enforcement Authority judges the outcome.
- Fixed scope: Agree in writing the sites, PSPs, PACS components and deliverables before work starts, so the quote maps to a defined outcome.
- Knowledge transfer: Ask whether the partner will hand over procedures and runbooks that your staff can operate.
- Retainers: Recurring log review, alarm testing support and plan maintenance can be bought as ongoing services, priced to the agreed frequency.
- Responsibility boundaries: Confirm who signs off on the plan and who handles auditor questions.
Request a quote that lists one-time and recurring items separately and names every site and system in scope.
Open-source tools that support R1 evidence
This table compares four open-source tools that can generate logs and alerts around physical access documentation and Physical Access Control Systems. None of them performs a physical control, so they support the evidence for R1 rather than satisfy the requirement itself. Read each row for the tool's role, the evidence it produces, and its license.
| Tool | Role for R1 evidence | Evidence it produces | License |
|---|---|---|---|
| Nextcloud admin_audit | Records who accessed or changed the physical security plan and related documentation | Audit entries written to audit.log in the data directory, or to a path set with logfile_audit | AGPL-3.0-only |
| OpenBao audit devices | Logs API requests and responses to systems that hold access credentials or PACS-related secrets | Detailed JSON log of each request and response, with most sensitive values hashed using HMAC-SHA256 | MPL-2.0 |
| OpenSearch Security Analytics | Detects unauthorized-access patterns in ingested logs and routes alerts to responders | Findings recorded with rule, log type and severity; alerts sent to channels such as Slack or email | Apache-2.0 |
| Wazuh ruleset | Decodes collected logs and matches events against built-in and custom rules | Alerts written to alerts.log and alerts.json, mapped to MITRE ATT&CK, and forwarded to the Wazuh indexer | GPL-2.0-only |
| Physical controls (doors, card readers, cameras) | Not provided by any of these tools; these remain the organization's own PACS and perimeter hardware | Confirm with the PACS vendor which logs and alerts it exports for ingestion | Varies by product |
| Timing of 15-minute alerts | Each tool can only help meet the alert window if its pipeline is tested end to end | Test records showing detection time and delivery to the personnel named in the incident response plan | Not applicable |
Who owns the plan, who helps build it, and who audits it
The registered entity owns the physical security plan under CIP-006-6 R1 and remains accountable for every access point, alarm, log and cabling decision it describes. The plan must reflect how the entity's facilities actually operate, and the people who sign it, approve it and maintain it work for the entity. No outside party can accept that accountability on its behalf.
- Plan ownership: Named individuals approve the plan, keep it current and answer for its contents during monitoring.
- Impact scoping: The entity confirms with its CIP-002 categorization which Physical Security Perimeters apply and whether high impact, medium impact or cabling provisions are triggered.
- Operational controls: Locks, badges, guards, escort rules and alarm routing are run by the entity's own facilities and security staff.
- Personnel and alert recipients: The entity names the people who receive unauthorized access alerts within 15 minutes through its incident response plan.
- Evidence custody: The entity retains access logs for at least ninety calendar days and produces them on request.
Confirm that a named owner can explain each access control, alarm path and log source in the plan without relying on a vendor.
An implementation partner helps the entity build the technical and documentary parts that make the plan testable. Under a fixed scope agreed in writing, a partner can prepare configuration of logging and alerting, assemble evidence packs and document test records. The partner does not decide whether the entity is compliant and does not write the attestation of the plan's effectiveness.
- Logging configuration: Setting up access log capture, retention and alert routing on self-hosted systems inside the entity's environment.
- Evidence packs: Collecting configuration exports, log samples, alert records and change history into an organized set for each requirement part.
- Test records: Documenting alarm and alert tests, including the time from detection to notification, performed by or with the entity's staff.
- Plan drafting support: Helping draft procedure text that the entity reviews, edits and adopts as its own.
- Gap identification: Reporting where systems, documents or logs do not yet match the plan, so the entity can decide on remediation.
Ask the partner to state in writing which deliverables it prepares and confirm that the entity, not the partner, signs off on the plan and its evidence.
Compliance is monitored by the Compliance Enforcement Authority, which is a Regional Entity or NERC, through mechanisms such as Compliance Audits, Spot Checks and Self-Certifications. There is no CIP certificate. The auditor samples the entity's evidence, tests whether the plan is implemented, and reports findings. Those findings and any resulting enforcement belong to the Compliance Enforcement Authority, not to the entity's consultants.
- Audit cadence: Balancing Authorities, Reliability Coordinators and Transmission Operators receive a Compliance Audit at least once every three years under Section 403.10.1 of the NERC Rules of Procedure; other registered entities are audited on a risk-based schedule.
- Testing method: Auditors request records, walk through physical access points where applicable and check alarm and log behavior against the plan's text.
- Independence: The partner that built the evidence should not be the party that evaluates it for the Compliance Enforcement Authority.
- Findings and enforcement: Violations, mitigation and penalties follow the Compliance Monitoring and Enforcement Program, not the partner's assessment.
- Self-reporting: Entities that discover a gap may self-report, which is an entity decision that should be discussed with counsel and compliance staff.
Confirm the audit schedule and notification process with the entity's Regional Entity before assuming the plan will be reviewed.
Where R1 programs usually fall short
Most CIP-006-6 R1 findings come from a plan that was accurate when written but has drifted from the actual building, staffing and systems. The gaps below cluster around documentation, alerting, PACS coverage, log retention, cabling and proof of testing, and each one has a closing step an assessor can verify.
Out-of-date PSP drawings
The physical security plan usually includes drawings or descriptions of each Physical Security Perimeter and its access points. When a wall is moved, a door is added or a cage is re-leased, the drawing lags behind the building. Assessors compare the drawing with the site, so a stale plan can fail R1 even when the controls work. Check that every perimeter change triggers a plan update and that the revision date matches the last walkdown.
Alerts routed to departed staff
Parts 1.5 and 1.7 require alerts to reach the personnel named in the incident response plan within 15 minutes of detection. Alert distribution lists often keep the names of people who have left or changed roles, so the alert goes nowhere. Confirm that the alert recipients are tied to roles in the incident response plan, that the list is reviewed when that plan changes, and that a test alert reaches a live person.
PACS left out of monitoring
Teams often monitor the doors but not the systems that control them. Parts 1.6 and 1.7 extend unauthorized access monitoring and alerting to Physical Access Control Systems, including the badge server, controllers and locally mounted readers where they sit inside the scope of the standard. Walk the PACS inventory against the monitoring configuration and confirm that each component that can grant access produces an alert.
Access logs kept under 90 days
Part 1.9 requires retaining entry logs for at least ninety calendar days. Log rotation settings, storage quotas and SIEM forwarding rules sometimes truncate logs earlier, often without anyone noticing until an assessor asks for a sample. Verify retention on the source system and on every copy, and pull a sample from the oldest date the platform still holds to confirm it is complete.
Undocumented cabling outside perimeters
Part 1.10 covers cabling and nonprogrammable communication components between Cyber Assets in the same ESP that run outside a Physical Security Perimeter. Facilities teams often reroute conduit or add fiber runs without updating the plan, so the documented path no longer matches reality. Maintain a cable path record for in-scope runs, then choose protection by method (physical protection, encryption, or monitoring with alerting) and record which method applies to each segment.
No evidence of testing
A plan that has never been exercised leaves little to show an assessor. Teams often hold alarm configurations and access logs but no record of a simulated unauthorized access event, a test alert delivered to the named recipients, or a review of the plan after an incident or drill. Schedule periodic tests, keep the dated results with the names of responders, and record the corrective action when a test fails.
Questions buyers ask about CIP-006-6 R1
What drives the cost of meeting CIP-006-6 R1?
The biggest cost drivers are how many Physical Security Perimeters the entity has, which impact level each one serves, and how much of the physical access system is already in place. A high impact site needs at least two different physical access controls where technically feasible, so it costs more than a medium impact site with only operational or procedural controls. Costs fall into one-time work (plan writing, gap analysis, configuring access logging and alarm routing) and recurring work (reviewing the plan, reviewing logs, testing alerts). Ask any partner or contractor for a quote that separates these items and states which ones depend on the impact rating from CIP-002. No public figure for these costs is supplied with this page, so confirm the numbers against your own site list.
How long does it take to get ready for a CIP-006-6 R1 audit?
The timeline depends on how many sites are in scope, whether the physical access control system already exists, and whether the entity has a documented plan that matches what its staff actually do. A gap review and plan rewrite usually come first, followed by configuration changes and a test of alarm routing and log retention. No fixed duration is supplied for this page, so ask any provider to tie its schedule to a written scope and to the Regional Entity's notification timing. The 90-day log retention period in Part 1.9 means that logs must already exist for at least that long when an auditor asks to see them, which affects how early the logging controls must be live.
What does the entity's own staff need to provide?
Staff need to supply the facts a plan cannot be written without: a current list of Physical Security Perimeters and the BES Cyber Systems inside each one, the physical access points and the controls at each (badge readers, locks, mantraps, guard posts), the people authorized for unescorted access, and the names of the personnel in the incident response plan who receive alarms. Operations and facilities staff also need to confirm how alarms are actually handled after hours. Without these inputs, any written plan will describe an environment that does not exist, and an auditor will find the gap quickly.
Can an internal team meet CIP-006-6 R1 without an outside partner?
Yes, an internal team can meet the requirement if it has people who understand both the physical security systems and the CIP standard, and the time to maintain the evidence. Many teams choose outside help for a gap review, for assistance wiring access logs into a central system, or for an independent check before an audit. The work that cannot be outsourced is ownership: the registered entity owns its plan, its controls and its compliance record. Confirm that any internal or external team can produce the evidence the Regional Entity will request, not only the documents.
What does an implementation partner do, and what does the auditor do?
An implementation partner prepares systems, controls and evidence. For CIP-006-6 R1 that can include configuring access logging, routing unauthorized-access alerts to the right people, retaining logs for the required period, and documenting the plan. DeployOpen works this way for self-hosted platforms inside the client's own infrastructure, under a fixed scope agreed in writing. The Regional Entity or NERC, acting as the Compliance Enforcement Authority, monitors compliance through audits, spot checks and self-certifications. DeployOpen does not issue audit reports, attestations or certifications, and the entity remains responsible for its own compliance status.
How are alarms and access logs shown as evidence?
Evidence for Parts 1.4 to 1.9 is a record that shows monitoring was active, alarms were raised within 15 minutes of detection, the right people were alerted, and entry logs were kept for at least 90 calendar days. Typical evidence includes access control system exports, alarm and alert records with timestamps, a log retention setting with proof it was applied, and a record showing that alerts reached the personnel named in the incident response plan. Test the chain end to end, from door event to alert received, and keep the test results. Ask your auditor which formats they accept before you build the export process.
Can a self-hosted open-source tool produce the log and alert evidence?
Open-source platforms can help collect and retain the events that support CIP-006-6 R1, but they do not replace the physical access control system. Wazuh, for example, decodes collected logs, compares events to a ruleset of over 3,000 built-in rules and decoders plus custom rules, and writes matching alerts to alerts.log and alerts.json, which can support an alert trail. OpenSearch Security Analytics can run detectors against ingested logs and send alerts to channels such as email. Confirm that the physical access system exports events to the tool, that retention meets the 90-day period, and that alert timing is tested against the 15-minute limit. Verify the license and edition limits before relying on any feature.
Which parts of the plan does the auditor check first?
Auditors usually start by comparing the written physical security plan with what they observe at the site and in the logs. They check whether access controls match the impact rating, whether unescorted access is limited to authorized individuals, whether alarms were raised within 15 minutes of detection, and whether logs show entries for at least 90 calendar days. Because the plan must describe what actually happens, the most common findings come from gaps between documents and practice. Walk the plan through each part of CIP-006-6 R1 with the site team before the audit to identify mismatches.
How DeployOpen prepares R1 systems and evidence
DeployOpen works on the R1 physical security plan as a set of systems and records the registered entity can show a Compliance Enforcement Authority. We prepare the controls, logging and alerting that the plan describes, while the entity keeps ownership of its controls, its plan and its compliance decisions.
How we scope
- Engagements are fixed-scope, with the BES Cyber Systems, PSPs and PACS in scope agreed in writing before work starts.
- We confirm each asset's impact rating with the entity's CIP-002 categorization, which determines which R1 parts apply.
- The written scope names the physical access points, alarm paths and log sources that the R1 plan will cover.
How we build
- We configure access control, door monitoring and alarm routing so unauthorized access reaches the incident response personnel within 15 minutes.
- We set up access logging for each authorized individual's entry into each Physical Security Perimeter, with 90-day retention.
- We document the plan's procedural controls, such as the restrictions on cabling outside the perimeter, and test alerting paths before handover.
How we hand over
- Deliverables include the written physical security plan, configuration records, alert test results and log retention settings.
- We map each R1 part to the evidence that shows it, so the entity can answer an assessor's request without rebuilding records.
- Independent auditors, not DeployOpen, assess the plan and issue any findings, so the entity should confirm the assessor's expectations early.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer for the physical access and monitoring stack.
- We can review changes to PSP doors, badge systems or alarm routing against the plan before they go live.
- Ask the team to confirm which retainer covers R1 evidence reviews and how changes to the written scope are handled.
