CIP-014-3: identifying critical Transmission stations and substations, third-party verification, threat and vulnerability evaluations, physical security plans, and third-party review of those plans.
The transmission analysis that identifies stations and substations whose loss could cause instability, uncontrolled separation or Cascading, repeated every 30 or 60 months, plus identification of each one's primary control center.
Independent verification of the R1 risk assessment by a registered planner or coordinator or an experienced transmission analyst, completed within 90 days, with a 60-day window to act on recommendations.
Evaluating physical attack threats and vulnerabilities at each identified station, substation and primary control center, using site characteristics, attack history and threat intelligence.
The physical security plan for identified facilities, developed within 120 days of verification, with deter, detect, delay, assess, communicate and respond measures, law enforcement coordination and an execution timeline.
Independent review of the R4 evaluation and R5 security plan by a qualified physical security reviewer within 90 days, with 60 days to act on or document disagreement with recommendations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.