CIP-014-3 R5 Physical security plan: requirements and evidence

What the CIP-014-3 R5 physical security plan asks for

If you are a registered Transmission owner or operator that has already identified critical Transmission stations, substations and primary control centers, R5 is the step where that work becomes a documented, executable plan. The standard asks you to develop a physical security plan for each identified facility within 120 calendar days after completing the third-party verification under R2, and then to carry it out on the timeline the plan sets. The plan must combine resiliency or security measures designed together to deter, detect, delay, assess, communicate and respond to the threats and vulnerabilities identified under R4. It must also name law enforcement contact and coordination information, set a timeline for the security enhancements, and include provisions for evaluating evolving physical threats (Parts 5.1 to 5.4). The plan is only as good as the R4 evaluation behind it, because the measures you choose must answer the specific attack scenarios and weaknesses that evaluation documented at each site.

The hard part is usually not writing the document but making the measures fit the site. Deter, detect, delay, assess, communicate and respond are six different jobs, and a fence upgrade or camera refresh often covers only one or two of them. Delay and response depend on how long a responding force would take to reach the site, which requires coordination with local law enforcement, documented contact details and, in many cases, an agreed response arrangement. Teams also struggle with the timeline. Each enhancement needs a realistic schedule, budget approval and a named owner, and the plan must show how the organization will track progress against it. Confirm with your Regional Entity and internal counsel how they expect the timeline to be documented and whether changes to it need to be recorded.

Before you start drafting, decide who owns each site plan, which R4 findings each measure addresses, and how you will show that the plan still fits after a threat changes. Ask your team to produce a traceability table linking every R4 finding to a measure, an owner and a completion date. Keep the plan, its revision history and the law enforcement contact records together so an auditor can follow the chain from R1 through R5 without reconstruction. Whether you need outside help with threat evaluation or document preparation is a scoping question: an implementation partner can prepare the documentation and evidence, but the plan and its decisions remain your responsibility, and independent third-party review is handled under R6.

Which facilities and teams the R5 plan covers

R5 applies only to facilities that R1 and R2 have identified, so the plan's workload is set before any security work begins. The cards below cover which sites fall in scope, who owns each part of the plan, and which outside parties need to be drawn in.

Identified Transmission stations and substations

R5 applies to the Transmission stations and substations identified through R1 and verified under R2, not to every site an entity operates. Each identified facility needs its own documented plan, so the count of identified sites is the first driver of effort. Confirm the current identified list against the latest R1 and R2 outputs, and check that the list has been updated after any change in the transmission system that affects station criticality.

Primary control centers

R5 also covers the primary control center for each identified station or substation, as recorded during R1. Control centers often hold more sensitive equipment and access paths than the substation itself, so their plans usually carry more controls. Confirm that each primary control center is linked to the correct identified facility, since a mismatch leaves a control center without a plan.

Shared security infrastructure between sites

Sites that share fences, alarm panels, camera networks, access badging systems or monitoring centers can often be covered by one set of measures, but the plan must still describe how each site is protected. Shared infrastructure also means one failure can affect several sites at once. Document which components are shared, who maintains them, and what happens to each site if the shared element fails.

Internal owners across security, operations and engineering

Physical security leads usually own the plan, but operations staff know how sites run and engineering staff know the equipment that must be protected. Each group needs a defined role in threat evaluation, measure selection and the execution timeline. Assign a named owner for each section of the plan and confirm who approves changes, since a plan without clear ownership often stalls at the first review.

Legal and law enforcement contacts

Legal reviews the plan's wording, the handling of sensitive site information and any contract terms that affect how security work is carried out. The plan must also record law enforcement contact and coordination information, so the people who maintain those records need to be identified. Confirm who may release site details to outside agencies and who keeps the contact list current.

Guard, alarm and integrator contractors

Guard companies, alarm monitoring providers and security integrators often run daily controls that the plan depends on, such as patrols, alarm response and camera monitoring. Their responsibilities must match what the plan promises, and contracts should state response expectations and notification duties. Ask each provider for its own procedures, staff vetting practices and how it reports failures to the entity.

How an assessor tests the R5 physical security plan

This table sets out each test step an auditor is likely to take for CIP-014-3 R5, the evidence requested for it, and the findings that appear most often. Read it as a pre-audit checklist: each row describes what the assessor will try to confirm and what you should have ready before the Compliance Enforcement Authority asks.

Test step	What the assessor confirms	Evidence requested	Common finding
Plan existence	A documented physical security plan exists for each identified Transmission station, substation and primary control center	Plan documents with version history, facility list traced to the R2 verified list	A facility identified under R1 or R2 has no plan, or the plan covers a different site
Timing against R2	The plan was developed within 120 calendar days after R2 was completed	R2 completion record, plan approval date, revision history showing original development date	Plan dated after the 120-day window, or no evidence of when the original was written
Traceability to R4	Each deter, detect, delay, assess, communicate and respond measure responds to a threat or vulnerability recorded in the R4 evaluation	R4 evaluation report mapped to plan measures, with the rationale for measures added or omitted	Plan measures are generic, with no link to the site-specific R4 findings
Law enforcement contacts	Contact and coordination information for local law enforcement is included and current	Contact register with names, roles, numbers and last verification date, plus coordination records	Contacts were accurate when the plan was written but were never reviewed afterward
Timeline and execution	Security enhancements are being carried out on the dates the plan sets	Project schedule, work orders, completion records, change approvals for any slipped dates	Planned dates passed without completion and without documented reason or revised plan
Evaluation of evolving threats	The plan includes provisions to re-evaluate physical threats over time	Documented review cycle, triggers for reassessment, minutes of reviews	No evidence of review since the first version, or reviews that do not change the plan
Assessor interviews	Staff responsible for the plan can explain how measures were chosen and who maintains them	Named owners, responsibility matrix, staff walkthrough of a sample facility	Plan owner cannot explain the link to R4 or where the contact list is kept
Compliance status	The Compliance Enforcement Authority, a Regional Entity or NERC, monitors compliance through audits, spot checks, self-certifications and self-reports. No certificate is issued	Audit-ready evidence package and a record of the review performed by the independent auditor	Organizations expect a certificate to close the question, which is not how CIP compliance is verified

How to build an R5 plan that survives an audit

This sequence turns the R2 verification and R4 evaluation results into a physical security plan that an auditor can trace from each identified threat to a measure, an owner and a dated action. Each step produces a record that the next step depends on.

Confirm the R2 completion date and the 120-day clock
Start by fixing the date on which the R2 unaffiliated third-party verification was completed, since R5 requires the plan to be developed within 120 calendar days after that completion. Compliance owns this step and records the date, the verifier's name and the resulting list of identified Transmission stations, substations and primary control centers in the compliance evidence repository. The step is done when a single dated record shows the clock start and every facility in scope, so the team can plan backward from the deadline.
Map R4 threats and vulnerabilities to candidate measures
Take each threat and vulnerability identified in the R4 evaluation for each facility and list the candidate measures that could address it, such as perimeter barriers, intrusion detection, lighting, cameras, access control, response procedures or spare equipment. Physical security staff and the operations team draft the matrix, and the R4 evaluation is the only source for the threats it lists. The output is a traceability table with one row per threat, showing the candidate measures and any threat that has no measure yet.
Select a layered measure set for each facility
Choose measures so that, taken together for each facility, they address all six functions the standard names: deter, detect, delay, assess, communicate and respond. Record which measure serves which function, because an auditor will check for coverage of each function, not just a list of equipment. Where a function has no measure, document the reason and the compensating control. The output is a per-facility matrix that shows each function covered and the selection rationale for every measure.
Document law enforcement contact and coordination
Identify the local, state and federal law enforcement agencies that would respond to each facility, and record contact details, the escalation path and how coordination would work during an incident. Confirm each contact's current details with the agency or through the facility's existing emergency arrangements, because stale phone numbers are a common finding. The output is a contact and coordination section in the plan with the date each entry was last verified and the name of the person who verified it.
Set a dated execution timeline with named owners
Convert each selected measure into a security enhancement with a target completion date, an accountable owner and a dependency list, such as procurement, construction or outage scheduling. R5 requires a timeline for the enhancements and execution on that timeline, so every item needs a date the team can later show it met or explain why it changed. The output is a timeline in the plan and a tracking record that shows status, approvals for any date changes and the evidence for each completed item.
Define the review trigger for evolving threats
R5 requires provisions to evaluate evolving physical threats, so write down what prompts a review of the plan. Typical triggers include a change in the R4 threat picture, a physical security incident at or near a facility, new threat intelligence from the operator's sources, or a change in the facility's configuration. Assign an owner to monitor each trigger and state how the review feeds back into the R4 evaluation and the plan. The output is a documented review procedure with a named owner and a record of how each trigger was assessed.
Approve and version the plan before the audit
Route the completed plan for approval by the people the entity's governance assigns to it, then store it under version control so that each change shows what changed, when and by whom. Keep the approved version, the drafts and the change rationale together so the audit team can see the plan as it stood at each point in time. The step is done when the approved version is in the evidence repository, the approval record is attached, and the team can reproduce the state of the plan on any earlier date.

Why the plan must trace back to R4 findings

The R5 physical security plan is only as sound as the R4 evaluation it answers. R4 identifies the physical attack threats and vulnerabilities at each identified Transmission station, substation and primary control center, and R5 requires measures designed collectively to deter, detect, delay, assess, communicate and respond to those specific threats and vulnerabilities. An assessor therefore tests the plan by asking whether every finding from R4 has a corresponding measure, and whether each measure can be pointed to as addressing a named finding. A plan that lists generic controls such as fencing, cameras and alarms, without showing which R4 finding each one answers, gives the assessor nothing to verify against.

A mapping table makes that link visible. Build one row per R4 threat or vulnerability at each facility, with columns for the site characteristic or attack history that produced it, the deter, detect, delay, assess, communicate and respond measures assigned to it, the owner of each measure, and the enhancement date from the plan's timeline. Read the table in both directions: every R4 finding should appear at least once, and every physical measure in the plan should trace to a finding. Measures that trace to nothing are either unjustified spending or a sign that R4 missed a risk. Confirm with your own R4 team how findings are numbered and whether one finding may be addressed by several measures, since the table must stay stable enough for an assessor to follow it between the evaluation and the plan.

Keep the mapping current as conditions change. R5 requires provisions to evaluate evolving physical threats, so a new attack, a change to site layout or a new threat intelligence source should trigger a review of the R4 findings and then the table, not just the plan text. Store the table with the plan and its version history so that an assessor can see when each row was added or changed. Tools such as XWiki keep page-level version history, which can support this record, but the mapping must still be reviewed by the people accountable for the physical security program. The third-party reviewer under R6 will also test this traceability, so the table should be ready for that review before it is requested.

Evidence that passes an R5 review

An R5 review tests whether the physical security plan for each identified facility exists, matches the R4 findings, and is being carried out on the timeline it sets. The cards below cover the records that show this, and the routine checks that keep them current between Compliance Audits.

Approved plan per facility

Keep one plan for each Transmission station, substation and primary control center identified under R1 and verified under R2. Each plan should show its approval date, owner, version number and the R2 completion date it was built from. Check that every identified facility has a plan on file, since a missing facility is the simplest finding an assessor can write.

R4 traceability mapping

Build a table that links each threat and vulnerability found under R4 to the specific deter, detect, delay, assess, communicate or respond measure in the plan that addresses it. Assessors check this link first. A measure with no finding behind it, or a finding with no measure, invites questions about how the evaluation shaped the plan.

Law enforcement contact records

Record the agencies, named contacts, phone numbers and the date each contact was last verified for every facility. Store the verification as a dated entry, not an update that overwrites the old value. Confirm the list at a set interval and after staffing changes at the agency or the utility, because stale contacts are easy to miss until an incident occurs.

Execution timeline with completion evidence

The plan must set a timeline for its security enhancements, so track each item with its planned date, current status, owner and the evidence of completion, such as a work order, purchase record, inspection report or test result. Items that slip need a documented revised date. Auditors compare actual completion against the dates the plan itself states.

Change records for plan revisions

Each revision should record what changed, why, who approved it and when it took effect. Keep prior versions available so an assessor can see the plan as it stood on any audited date. Changes triggered by a new R4 finding or a threat review should cite that trigger, which links the revision back to the evaluation that required it.

Periodic threat review records

Schedule a recurring review of evolving physical threats and document each one: the date, the reviewers, the sources consulted, the findings and any resulting plan change or documented decision not to change. A review that happens but leaves no record gives the assessor nothing to test, so treat the review record as the evidence itself.

What meeting R5 costs in money and effort

This table breaks down the cost and effort components of writing and running a CIP-014-3 R5 physical security plan, who is typically paid for each, and whether it is one-time or recurring. Use the drivers column to see which site facts move each cost up or down, and the quote column to compare written scopes.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it, and what to ask for in a quote
Physical security engineering and design	Security engineers, physical security consultants or the entity's own design staff	One-time for the initial plan, recurring when sites change	Site count and layout, perimeter length, sight lines and existing barriers. Ask the provider to list the sites in scope and the design deliverables for each.
Hardening and security equipment	Integrators and equipment vendors, plus the entity's facilities budget	Mostly one-time capital, with recurring maintenance and replacement	Existing infrastructure such as fencing, cameras, locks and alarms, and whether they can be reused. Ask for an itemized bill of materials and the warranty terms.
Guard or monitoring services	Contracted guard firms or remote monitoring centers	Recurring, usually for the life of the plan	Whether the plan relies on people or remote detection, and how many locations need coverage. Ask for staffing levels, response times written into the contract and who owns the alarm data.
Legal and contract review	Entity counsel and outside counsel	One-time for each new vendor contract, plus periodic renewals	Number of vendors, whether contracts already address confidential security information, and whether law enforcement coordination needs formal agreements. Ask counsel to review sensitive-information handling terms.
Internal staff time for plan writing and maintenance	Entity compliance, operations and physical security staff	One-time drafting, recurring updates	Number of stations and control centers, and how often the evaluation under R4 changes the plan. Plan the update cycle around the timeline set in the plan itself.
Evidence upkeep	Compliance staff, plus any consultant preparing records	Recurring	Volume of records, retention needs and how many sites are reviewed at audit. Ask the provider how the plan, drawings, approvals and execution records will be stored and version controlled.
Separate R6 external review	A qualified physical security reviewer independent of the entity	Its own engagement, outside this R5 cost	R6 requires an independent review of the R4 evaluation and R5 plan within 90 days. Budget for it as a separate scope with its own written terms.
Auditor sampling	The Regional Entity or independent audit team	Set by the audit, not by the entity's plan	Audit scope and sampling are decided by the Compliance Enforcement Authority. Prepare the evidence, but do not treat preparation services as an audit fee.

Who owns R5 and who can help

The registered entity owns the R5 physical security plan. It is the organization that must develop the documented plans for its identified Transmission stations, substations and primary control centers, approve them, and execute them on the timeline the plans set. Compliance responsibility stays with the entity even when outside firms help with drafting or evidence. Internal leaders decide which measures are adopted, which risks are accepted, and when the plan is considered in force.

Plan approval: Senior leadership should formally approve each plan and record who signed it and when, so the approval itself becomes audit evidence.
Execution ownership: Named operational owners should be accountable for each deter, detect, delay, assess, communicate and respond measure and for the enhancement timeline.
Law enforcement coordination: The entity should maintain and verify the law enforcement contact and coordination information the plan requires.
Evolving threat review: Someone internal should own the process for evaluating changing physical threats and updating the plan.
Decision records: Deferred or rejected measures need documented rationale signed by an accountable manager.

Confirm internally who holds each of these roles before any outside firm begins work, because the auditor will ask the entity, not the partner, to explain them.

Where R5 plans usually fall short

Most CIP-014-3 R5 plans that fail review do not lack security measures. They lack the links between the R4 findings, the R2 dates, the contacts and the owners that keep the plan current and provable. Each card below names one gap and the check that closes it.

Plans without R4 traceability

An R5 plan must address the threats and vulnerabilities found under R4 at each identified facility. A plan that lists generic measures, such as fencing and cameras, without showing which R4 finding each measure answers is hard to defend. Build a table that maps every R4 finding to one or more resiliency measures, the owner of each measure and its completion date. An auditor should be able to pick any finding and follow it to a control.

Missed 120-day deadlines

R5 requires plans within 120 calendar days after completing R2, and that start date is often not written down anywhere the compliance team can find. When the R2 completion date lives only in an email or a meeting note, the deadline is easy to miscount. Record the R2 completion date in the compliance tracker when it occurs, calculate the R5 due date from it, and set a reminder well before that date.

Outdated law enforcement contacts

Part 5.2 requires the plan to include law enforcement contact and coordination information. Contact lists go stale when personnel change, when a local agency reorganizes, or when a site acquires a new jurisdiction. Assign an owner for each site's contact list, verify numbers on a fixed schedule, and record the date of the last check. A list that has not been verified since the last staff change will not show that the plan can be executed.

Execution timelines without owners

Part 5.3 requires a timeline for the security enhancements. A timeline with milestones but no named owner for each milestone gives an assessor no one to interview and no one accountable when a date slips. Assign one accountable person and one backup to every enhancement, tie each to a budget approval or work order, and record any change to a date with the reason for it.

Plans stored in unversioned files

A plan saved as a loose file on a shared drive cannot show what changed, when, or who approved it. Store the plan in a wiki or document system that keeps version history, so each revision shows its author, date and the change it made. Restrict edit rights through roles, and keep a copy of the approved version that was in force on each date an audit period covers.

No review of evolving threats

Part 5.4 requires provisions to evaluate evolving physical threats, so a plan written once and never revisited will not meet the requirement. Schedule a recurring review that compares the plan against new threat information, incidents at other facilities, and changes at the site. Record each review, its findings and the plan revisions it triggers, so the evaluation itself is evidence.

Questions buyers ask about CIP-014-3 R5

How much effort does a CIP-014-3 R5 physical security plan take?

The effort depends on how many Transmission stations, substations and primary control centers the R2 verification confirmed, how many threats and vulnerabilities the R4 evaluation recorded, and how much of the protection already exists. R5 requires a documented plan for each identified facility that combines measures to deter, detect, delay, assess, communicate and respond, plus law enforcement contacts, a timeline for enhancements and provisions for evolving threats. Each facility adds its own site-specific measures, so the work scales with the number of sites and the number of gaps. Ask any provider to break the effort down by facility and by plan component before agreeing a scope. The R5 plan is also only one step: the entity must still execute the plan on the timeline it sets, so budget for construction, hardening and procurement work that follows the document.

Does an R5 physical security plan need a consultant?

No standard requires a consultant to write the R5 plan. The entity owns the plan, the measures in it and the compliance outcome. A consultant or implementation partner is useful when the in-house team lacks physical security design experience, the facility count is high, or the R4 findings require engineering input. Outside help can draft documentation, organize evidence and run a structured review, but it cannot approve the plan or certify compliance. Only the Compliance Enforcement Authority, through its monitoring processes, decides whether the entity met R5. Make sure any outside party's role is written into the engagement so that accountability stays with the registered entity.

How long does it take to write an R5 plan?

The hard deadline is the 120 calendar days that R5 allows after completing R2, measured against the entity's own R2 completion date. Within that window, the work runs in sequence: the R4 evaluation informs the threats the plan must address, the measures are selected and scoped, the law enforcement contacts are gathered, and the enhancement timeline is set. Duration depends on facility count, procurement lead times for physical security equipment, and internal approval cycles. Confirm your R2 completion date first, since it sets the clock. Then map the remaining steps backward from that date and check each one with your internal stakeholders and any vendors you plan to use.

What does the entity need to provide for an R5 plan?

The entity needs to supply the facts that the plan rests on. These include the R2 verified list of stations, substations and primary control centers, the R4 threat and vulnerability evaluation for each site, the existing physical security layout and controls, and contact details for local and state law enforcement. Operations staff must describe how each site runs, and facilities or engineering staff must confirm what can be changed. The entity also needs decision authority to approve the measures and the enhancement timeline, and budget owners who can commit to the work. Missing inputs are the most common cause of delay, so collect them before drafting begins.

Can our team write the R5 plan in-house?

Many entities can write the plan in-house if they have people who understand their sites, their R4 findings and physical security design. The plan must be specific to each facility, and it must address the four content areas in R5 Parts 5.1 to 5.4. Staff who have written security plans, managed access control or worked with local law enforcement are well placed to draft it. A gap usually appears in engineering judgment about which measures reduce the specific threats found at each site, or in the time available to do the work alongside other compliance duties. Document the plan in a controlled wiki or document system with version history, so reviewers can see what changed and when.

What will the auditor check in an R5 plan, and what won't they do?

The Compliance Enforcement Authority checks whether documented plans exist for each identified facility, whether they include the required measures, law enforcement contacts and a timeline, and whether the entity is executing them as written. Auditors review evidence such as the plan documents, change records, implementation records and proof of contact information. They do not write the plan, choose the physical measures for you, or tell you which products to buy. They also do not certify your facilities as secure. Your evidence should show what you decided, why, and what you did, so the auditor can trace each requirement to a result. Confirm the evidence expectations with your Regional Entity and with the current standard text before your audit window opens.

What drives the cost of an R5 plan, and what should a quote include?

Cost is driven by the number of facilities, the number of R4 findings, the scale of physical measures that must be added or upgraded, and the amount of outside help used. The plan itself is mostly documentation and engineering time, while the security enhancements can be far larger and recur through maintenance, monitoring and testing. A useful quote states the scope in writing: which facilities, which plan components, which deliverables, what the entity must supply, and what is excluded, such as construction or hardware purchases. Ask the provider to separate one-time work from recurring support. DeployOpen does not publish a price list. A quote follows from the written scope, which is agreed before work starts.

Using a wiki and roles to keep the R5 plan under control

The physical security plan under CIP-014-3 R5 is a living document, and its value depends on being able to show who changed it, what changed, and who approved the version in force. A self-hosted wiki can hold each plan as a controlled page. XWiki keeps every change under version control, recording what changed, when and by whom, and lets users compare any two versions and roll back to an earlier one. An assessor who asks why a timeline date moved or why a countermeasure was removed can be shown the diff and the author, rather than a reconstructed story. Confirm with your chosen product how it handles approval states, whether a published version can be locked, and how long revision history is retained.

Role-based permissions decide who may edit a plan at all. In BookStack, user abilities come from assigned roles, and permissions can be overridden per role at the shelf, book, chapter or page level. A practical design gives the physical security team edit rights on the R5 plan pages, gives the CIP Senior Manager or a delegate approval authority, and gives operations and law enforcement liaison staff read access to the sections they need. Keep the plan for each identified facility on its own page or within a restricted book so that a change at one station does not expose or alter another. Document this role matrix as its own evidence, because an assessor will test whether the people who changed the plan were authorized to do so.

A governance, risk and compliance (GRC) tool can hold the R5 requirement itself, with links to the plan version, the R4 evaluation it responds to, the 120-day completion record, and the evidence of execution against the timeline. CISO Assistant is open source under AGPL-3.0-only and supports custom frameworks and assessments, so the team can record R5 as a control with an owner, status and linked artifacts. The tool does not decide whether the plan is adequate. Confirm whether your chosen version supports the CIP-014-3 framework directly or requires a custom framework, and whether evidence links can point to wiki page versions rather than only to documents, so the record stays accurate after the next revision.

How DeployOpen prepares R5 plans and evidence

DeployOpen is a Chainscore Labs company that plans and implements self-hosted open-source platforms inside the client's own infrastructure. For CIP-014-3 R5, we prepare the documentation, systems and evidence that support the physical security plan, while the utility remains the owner of the plan and its measures and an independent reviewer under R6 covers the review.

How we scope

Agree in writing which identified stations, substations and primary control centers the R5 work covers.
Confirm which R4 threat and vulnerability findings feed each deter, detect, delay, assess, communicate and respond measure.
Define the deliverables, the evidence set and the timeline for the security enhancements before work starts.

How we build

Set up a version-controlled plan repository so each revision records what changed, when and by whom.
Configure role-based access so plan authors, reviewers and approvers hold only the permissions their role needs.
Draft the law enforcement contact and coordination section alongside the execution timeline and the provisions for evolving threats.

How we hand over

Deliver the plan, its supporting records and an evidence index mapped to the Part 5.1 to 5.4 requirements.
Document how each system is hosted, backed up and access-controlled so the utility can run it after handover.
Walk the compliance and operations staff through the plan so they can maintain and update it themselves.

How we support

Offer ongoing support, upgrades and documentation maintenance as a retainer after the fixed-scope work closes.
Help the utility prepare the plan packet for the R6 third-party reviewer, without acting as that reviewer.
Confirm with the utility's counsel and compliance lead which records must be retained and for how long.