What CIP-014-3 R6 asks for and why the review matters
Once a station or control center has been identified under CIP-014, the compliance lead's task is to make sure the R4 threat and vulnerability evaluation and the R5 physical security plan get an independent review. CIP-014-3 R6 requires an unaffiliated third party to review both documents, and it sets the rules for who may do that review and how the results must be handled. The requirement does not ask the entity to pass a test or obtain a certificate. It asks for an outside reviewer to challenge the work, and for the entity to show what it did with that challenge.
Part 6.2 sets the review window: the review must be completed within 90 calendar days of finishing the R5 plans. Part 6.3 then gives the entity 60 calendar days after the review to act on each recommendation, either by modifying the evaluation or plan or by documenting why it did not. Those two windows run back to back, so a late plan leaves little room for a review and a response. Confirm the completion date of each R5 plan now, because that date starts the clock, and confirm whether your internal records treat the review report date or the date of your written response as the close of each step.
The most common weakness is a plan written entirely by the people who run the site, with no outside challenge. Such a plan can be internally consistent and still miss a threat the site staff have stopped seeing, or a detection gap that only a fresh reviewer would question. The review is the only point in the cycle where someone outside the team must test the assumptions behind the evaluation. Documenting the reviewer's recommendations and your reasoned responses also gives an auditor a clear trail to follow.
Which facilities, documents and reviewers fall under R6
R6 reviews only what R4 and R5 produced, so the scope of the review follows the facilities identified earlier in the chain. The decisions below determine which stations, documents and reviewer categories the entity must put in front of an independent reviewer, and who holds responsibility for each choice.
Facilities in the R4 evaluation
R6 covers the R4 evaluation, which addresses each Transmission station, substation and primary control center identified through the earlier R1 and R2 process. Confirm the facility list against the current R2 verified output, not an older working list, because a station added or dropped after verification changes what the reviewer must see. Record the primary control center for each facility, since the evaluation is tied to those sites. The entity owns this list and should be able to show how each facility entered or left it.
Physical security plans under review
The R5 physical security plans for the identified facilities are the second object of review, and each facility's plan is reviewed alongside its evaluation. Check that every identified facility has a plan in the set sent to the reviewer, and that the plan version matches the one in effect when the review starts. A plan revised mid-review invites questions about which version the recommendations address.
Supporting documents for the reviewer
Reviewers need enough context to judge the evaluation and plan, so the package usually includes the threat and vulnerability basis, site characteristics, law enforcement coordination records and the execution timeline referenced in the plan. Decide which supporting material is shared under a confidentiality agreement, since physical security details are sensitive. Ask the reviewer to state in writing what it received and what it did not.
Reviewer category under Part 6.1
Part 6.1 limits the reviewer to one of four categories: an organization with electric industry physical security experience whose review staff includes at least one Certified Protection Professional or Physical Security Professional, an entity approved by the ERO, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. Ask each candidate which category it claims and for evidence, such as credential holders named on the review team. Keep that evidence in the R6 file.
Reviewer independence and ownership
The entity chooses the reviewer, but the reviewer must be unaffiliated with the entity, and that independence is a condition of the requirement rather than a preference. Ask candidates to disclose any ownership, employment or consulting ties to the entity, its parent or the consultants who prepared the evaluation or plan. Document the conflict check before engagement starts, so the independence question does not surface later in an audit.
Implementation partner boundaries
An implementation partner can prepare the evaluation, plan and evidence package, but it cannot serve as the unaffiliated reviewer for the same work. The entity should confirm that the reviewer and the party that helped write the documents are separate, and that the review does not reuse the drafting team's sign-off as independent assurance. Ask any partner to state its role in writing so the scope of its work is clear to the entity and to the Compliance Enforcement Authority.
How the 90-day review and 60-day response windows work together
The two windows in CIP-014-3 R6 run in sequence, and both start from dates the registered entity controls. Part 6.2 requires the unaffiliated third-party review of the R5 physical security plans to be completed within 90 calendar days of completing those plans. Part 6.3 then gives the entity 60 calendar days from the review to act on each recommendation, either by modifying the R4 evaluation or the R5 plan or by documenting why it will not. In practice, the review clock cannot start until the plans are finished, and the response clock cannot start until the review is finished. The earliest possible response deadline therefore depends on two dates the entity must record itself.
The compliance lead should record, at minimum, the date the R5 plans were completed, the date the reviewer's report was delivered, and the date each recommendation was received. Those dates are the anchors for every calculation, and an auditor will ask how each deadline was derived. Keep the reviewer's report in the same record set as the R4 evaluation and the R5 plan version it covered, so that the recommendations can be traced to the exact document they addressed. If the plan is revised after the review, the record should show which version each decision applied to. Confirm with your Regional Entity how it expects these dates to be evidenced, since the standard sets the windows but does not prescribe the format of the records.
A practical check is to build a single tracking entry per recommendation, showing its source, the date it was received, the 60-day response date, the decision (modify or document why not), and the approver. Review the open entries against the calendar at regular intervals so that no response window closes unnoticed. Because Part 6.3 applies to each recommendation separately, one report can produce several decisions with different outcomes, and each decision needs its own written rationale where the entity declines a change. Versioned document storage that records who changed a plan and when can make these trails easier to produce, but the entity still needs to define the decision process and the sign-off roles.
How an auditor tests R6 and what they ask to see
The first test is whether the reviewer fits one of the categories in Part 6.1. The auditor checks that the organization has electric industry physical security experience and that review staff include at least one Certified Protection Professional or Physical Security Professional, or that the reviewer is an ERO-approved entity, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. The auditor is looking for proof of the reviewer's standing at the time of the review, not a general claim of expertise.
- Credential records: Copies of certificates or verifiable registry entries for each named CPP or PSP, with dates showing they were valid when the review was performed.
- Engagement letter: A signed statement naming the reviewer, the review scope (the R4 evaluation and R5 plans) and the qualifying basis under Part 6.1.
- Staff roster: Names of the review team members and their roles, so the auditor can match each credential to a person who worked on the review.
- Conflict of interest statement: Confirmation that the reviewer is unaffiliated with the entity and did not prepare the R4 evaluation or R5 plan.
- Common findings: Missing or expired credentials, a reviewer whose only qualification is general consulting experience, and a reviewer that is an affiliate or contractor who also wrote the plan.
Check that each credential is dated, tied to a named person and linked to the review engagement before the audit starts.
Part 6.2 requires the review within 90 calendar days of completing the R5 plans. The auditor reconstructs the timeline from dated records and compares the review completion date with the plan completion date. The test depends on dates the organization can prove, so undated documents weaken the case even when the work was done on time.
- Plan completion record: A dated approval or sign-off showing when the R5 plans were completed, which starts the 90-day clock.
- Review start and finish dates: Dated correspondence, a signed review report and transmittal records showing when the review was completed.
- Calendar tracking: The internal tracker or ticket that set the deadline and shows who owned it.
- Common findings: Review reports with no date, plan completion dates that differ between documents, and reviews that started on time but were not finished within the window.
- Action item: Confirm with your Regional Entity how it expects completion to be dated, whether by signature, delivery or acceptance.
Confirm that the plan completion date and the review completion date can each be proven from a dated record that a third party could read.
Part 6.3 requires that, within 60 calendar days of the review, the entity either modifies the R4 evaluation or R5 plan for each recommendation or documents why it did not. The auditor checks every recommendation in the review report and traces it to a recorded decision. A review with recommendations and no disposition for each one is a common basis for a finding, even when the plan was otherwise sound.
- Recommendation register: A list of every recommendation with a unique reference, the section of the evaluation or plan it affects and the date received.
- Disposition record: For each recommendation, either the revised section with its change date, or a written rationale for not adopting it, approved by an accountable manager.
- Revised documents: The updated R4 evaluation or R5 plan showing the changes that match the accepted recommendations.
- Common findings: Recommendations with no recorded disposition, rationales that do not address the recommendation, and dispositions issued after the 60-day window.
- Key point: The auditor tests whether the entity responded to each recommendation, not whether the entity accepted it. A documented decision not to change the plan can pass if the reasoning is recorded.
Before the audit, match every recommendation to exactly one disposition and confirm each is dated inside the 60-day window.
The auditor needs to know which version of the R4 evaluation and R5 plan the reviewer saw, and which version the entity uses today. Version history ties the review to a specific document and shows whether changes made after the review were traceable. Without it, the auditor cannot confirm that the disposition applies to the reviewed text.
- Version identifiers: A version number, date and author for each revision of the evaluation and plan, including the version delivered to the reviewer.
- Change log: A record of what changed between versions, when, and by whom, linked to the recommendation that prompted the change.
- Comparison and rollback records: Evidence that the team can compare two versions and restore an earlier one, so the reviewed text can be recovered.
- Access records: Who could edit the controlled documents and whether the reviewer received a read-only copy.
- Common findings: Documents shared as unversioned files, plan edits made after the review with no log, and no clear link between the reviewed version and the final version.
Confirm that you can produce the exact reviewed version and every later version from a controlled repository, with dates and authors visible.
Implementing an R6 review process, step by step
This sequence turns the R6 review requirement into a documented workflow, so the reviewer's findings, your decisions and the resulting plan version can be shown to the Compliance Enforcement Authority in order.
Confirm the R5 plan completion date
Compliance staff record the date the R5 physical security plans were completed, because the 90 calendar day review window in Part 6.2 is counted from that point. The owner of the physical security program signs off the date and stores it with the plan version it applies to. Done means a dated record links the R5 plan version to the review clock, so anyone auditing the timeline can see when the window opened.
Select and qualify the unaffiliated reviewer
The entity shortlists candidates and checks each one against the Part 6.1 qualification categories: electric industry physical security experience with review staff holding a CPP or PSP, an ERO-approved entity, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. Confirm the qualification basis with the candidate in writing and confirm the reviewer is unaffiliated with the entity. Done means a signed record names the reviewer, states which Part 6.1 basis applies, and identifies the credentials relied on.
Agree confidentiality terms before sharing
Before the reviewer receives the R4 evaluation and R5 plans, the entity signs a non-disclosure agreement and sets handling rules for the documents, which contain sensitive information about facility vulnerabilities. Access is limited to named reviewers, delivered through a controlled channel, and logged. Done means the agreement is executed and an access list records who received which document version and when.
Provide the R4 evaluation and R5 plan
The entity transmits the exact R4 evaluation and R5 plan versions in scope, with the list of facilities they cover. Version identifiers are recorded so the reviewer's findings can be tied to a specific document. Done means the reviewer confirms receipt of the listed versions, and the transmittal record is kept with the audit evidence.
Obtain and file the written review
The reviewer completes the review within the Part 6.2 window and provides a written report containing each recommendation. The entity checks that the report covers both the R4 evaluation and the R5 plans and is signed by the reviewer. Done means a dated, signed report is stored as the controlled record, and the date of the review is compared against the 90 calendar day limit.
Log each recommendation and assign an owner
Each recommendation is entered as its own line in a tracking register with a reference number, the document it affects, a named owner and the start date of the 60 calendar day clock under Part 6.3. Recommendations are not grouped, so each can be closed or explained separately. Done means every recommendation in the report has a register entry with an owner and a status of open.
Decide and document each modify or not-modify outcome
For each recommendation, the owner and the physical security approver decide whether to modify the R4 evaluation or R5 plan, or to keep it unchanged. Any decision not to modify is documented with the technical or operational reasons, and any modification is described with the section changed. Done means every entry is closed within 60 calendar days of the review, and the reasoning is signed and filed with the register.
Update and version the plan
Where recommendations led to changes, the entity issues a new version of the affected R4 evaluation or R5 plan, records what changed and why, and retires the superseded version under document control. The register is linked to the new version identifiers. Done means the current plan version reflects every accepted recommendation, and the audit file shows the link from each finding to each change or documented decision.
Documenting disagreement with a reviewer's recommendation
Part 6.3 lets the entity keep its evaluation or plan unchanged, but only if it documents why. Within 60 calendar days of receiving the third-party review, the entity must either modify the R4 evaluation or R5 plan for each recommendation or document the reason it did not. The reason is the part an auditor reads closely, so it has to stand on its own. A defensible record has three features: a specific written response to each individual recommendation, a link from that response to the security rationale in the evaluation or plan, and a sign-off by the accountable owner, such as the CIP Senior Manager or the physical security leader who approved the plan.
A blanket rejection fails this test even when the entity's position is correct. A single note saying the reviewer's recommendations were considered and not adopted does not show which recommendation was weighed, what the entity concluded, or why. Each reviewer comment should have its own entry that quotes or references the recommendation, states whether the entity adopted it, partly adopted it or declined it, and points to the threat, site characteristic or control that supports the decision. Where the reason depends on a physical characteristic of the station, the record should cite the evaluation section that describes it. Confirm with your Regional Entity how it expects these entries to be organized before the review arrives.
The opposite error is changing the plan without keeping the comment it answers. When a recommendation is adopted, the revised R5 plan should carry a version history entry that names the reviewer comment, the change made and the approver. Without that link, an auditor sees a changed plan with no visible reason for the change and cannot confirm that Part 6.3 was followed. Keep the reviewer's report, the response log, the revised documents and the sign-offs together under retention controls, and confirm with your compliance team how long the Compliance Enforcement Authority can request them.
Evidence that passes an R6 audit
An auditor testing CIP-014-3 R6 looks for a dated trail that connects the reviewer's qualifications, the review itself and every recommendation's disposition. Each artifact below is kept by the registered entity, not issued by DeployOpen or any other party, and each one has to stay current between audits, not be assembled the week before one.
Reviewer qualification record
This file shows that the reviewer meets one of the Part 6.1 categories: electric industry physical security experience with review staff holding a CPP or PSP, an ERO-approved entity, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. Store the credential numbers, the expiration dates of each certification and the staff names that the review relies on. Recheck it whenever reviewers change, because the qualification applies to the people doing the work. Confirm the exact categories against the standard text before you rely on them.
Engagement letter and unaffiliation statement
The engagement letter sets out the scope of the review of the R4 evaluation and R5 plans and states that the reviewer is unaffiliated with the entity. Keep a signed unaffiliation statement from the reviewer that names any past or present business, ownership or employment relationship checked. A reviewer who helped write the plan cannot serve as the independent check, so record the conflict screen as well as the signature. Update the letter when the scope or the reviewer changes.
Transmittal of R4 and R5 materials
The transmittal record shows the date the entity delivered the R4 evaluation and R5 physical security plans to the reviewer, the version delivered and the recipients on each side. The 90 calendar day clock in Part 6.2 runs from completing the R5 plans, so this record and the plan's approval date together establish when the review window opened. Use controlled transfer with a hash or version label so the reviewed version is provable later. Confirm with the auditor how they expect the completion date to be documented.
Signed review report with its date
The reviewer's written report should identify the evaluation and plan versions reviewed, state the review date, list each recommendation and give the reviewer's signature. An auditor checks whether the review was completed within 90 calendar days of completing the R5 plans, so the signed date is central. Keep the report in the entity's own repository, with the signed copy, not only in the reviewer's email. If the reviewer produces a draft first, retain the draft and final versions separately.
Recommendation disposition log
This log lists every recommendation from the review and, for each one, records whether the entity modified the R4 evaluation or R5 plan or documented why it did not. Each row carries a 60 calendar day date running from the review, the responsible owner and the closing evidence. Auditors commonly test the log by picking several recommendations and tracing them to the revised text, so a log that cannot be traced to specific document changes creates a finding. Review the log before the 60-day window closes, not after.
Revised evaluation or plan with version history
The revised R4 evaluation or R5 plan should carry version numbers, change descriptions, approval dates and the names of the people who approved each change. Where a recommendation was declined, the rationale belongs in the document or in the disposition log with a link to it. Keep the full history, not just the current version, so an auditor can compare what was reviewed with what was changed. Document version control in a wiki or document system is the usual place to hold this, and the retention period should match your CIP audit period.
What meeting R6 costs in money and effort
This table breaks down the cost components of an R6 review, who is paid for each one, whether it is one-time or recurring, and what moves it up or down. Use it to scope a quote request and to see where internal effort goes before the reviewer is engaged. No dollar figures or durations are given beyond the 90 and 60 day windows in the standard, so request a written quote from each reviewer.
| Cost component | Who is paid or who spends effort | One-time or recurring | What drives it up or down |
|---|---|---|---|
| External reviewer fee | The unaffiliated third-party reviewer, paid under a written engagement | One-time per review cycle | Number of R4 evaluations and R5 plans in scope, plan complexity, and reviewer availability within the 90 day window |
| Internal preparation of review materials | Your physical security, engineering and compliance staff, or an implementation partner if engaged | One-time per review cycle | Completeness of current R4 evaluations and R5 plans, and how well evidence of execution is already organized |
| Responding to reviewer questions | Internal security staff who answer clarifications and walk the reviewer through sites | One-time per review cycle | Clarity of plan documentation and the number of follow-up sessions the reviewer needs |
| Acting on recommendations under Part 6.3 | Facility owners and engineers who modify the evaluation or plan, or document why a recommendation is not adopted | One-time per review cycle, with possible follow-on work | Number and scope of recommendations, and whether changes require capital work, procedure changes or new law enforcement coordination |
| Legal and contract review | Legal, procurement and sometimes risk teams who review the reviewer agreement, confidentiality terms and handling of sensitive facility information | One-time per engagement | Whether you use a standard template, how many parties handle the plans, and how sensitive the site detail is |
| Document version control tooling | Internal IT or security teams who maintain the system holding the evaluation and plan, including any open-source wiki or document platform | Recurring, with a one-time setup | Number of documents, required retention, access control design, and whether tooling already exists in your environment |
| Periodic re-review after plan changes | Reviewer and internal staff, when the evaluation or plan changes materially and a new review is needed | Recurring, tied to change events | Frequency of site changes, threat landscape updates, and how often the R5 plan is revised |
| Quote and scope definition | Your team, with each candidate reviewer, before any work starts | One-time | Written scope, number of facilities, and whether the reviewer must visit sites or review remotely |
Open-source tools that keep R6 evidence organized
The R6 review depends on a clear trail of what the R4 evaluation and R5 plan said, when they changed, and who could access them. The tools below can hold that trail, but none of them performs the independent review or replaces the reviewer's judgment.
Plan version history
XWiki keeps every change to a page under version control, recording what changed, when and by whom. Users can compare any two versions and roll back to an earlier one. For R6, this lets the entity show a reviewer which version of the R5 plan was complete when the 90 calendar day review window started, and how the plan changed afterward. Confirm that the version history covers attachments and linked documents you rely on, since page history alone may not capture them.
Role-based access to sensitive plans
BookStack assigns user abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. This supports restricting R4 evaluations and R5 plans to staff with a need to know, while letting the reviewer's access be granted and removed in a documented way. Check that the restricted material is not copied into unrestricted books, search results or exports, because a permission on one page does not follow a copy.
Framework assessments and R6 evidence list
CISO Assistant ships more than 200 frameworks and runs audits and compliance assessments against them, with automatic mapping between frameworks. It can hold the R6 evidence list as tracked items, with owners, due dates and status, so the entity can show that the review was requested, received and acted on. Mapping output is a working aid. Treat any cross-framework link as something your compliance lead validates before relying on it in an assessment.
Tracking the 60-day response record
Part 6.3 requires the entity, within 60 calendar days of the review, to modify the evaluation or plan for each recommendation or document why it did not. A tracked register, whether in CISO Assistant or a controlled wiki page, can record each recommendation, the decision, the approver and the revised plan version it produced. Keep the recommendation text, the decision and the document reference together so the disagreement rationale can be shown without reconstructing it later.
Limits of these tools
None of these products issues the review, verifies the reviewer's qualifications, or determines whether a recommendation was sound. The reviewer must meet the Part 6.1 criteria, such as holding a CPP or PSP credential on staff, and that qualification evidence is kept separately. Confirm each tool's current license terms with its maintainer before deploying, and confirm whether your deployment is a community or commercial edition.
Who owns R6: your team, a partner and the independent reviewer
Your compliance team owns the R6 obligation from start to finish. It decides when the R5 plans are complete, starts the 90 calendar day clock for the review under Part 6.2, selects the reviewer, and signs off on the decision to modify the evaluation or plan, or to document why a recommendation was not adopted under Part 6.3. Those decisions carry the accountability in a Regional Entity audit, so they cannot be delegated to a vendor. Your team also keeps the record that shows the review happened in time and that each recommendation was handled.
- Calendar ownership: Track the 90 day review window from plan completion and the 60 day action window from the review report, with named owners and escalation dates.
- Reviewer selection: Confirm the candidate meets the Part 6.1 qualifications and document the basis for that conclusion.
- Disposition decisions: Approve each recommendation as adopted or declined, with a written rationale for every declined item.
- Records: Retain the review report, the disposition log and the revised documents with dates and approvals.
Before the review starts, confirm with your Regional Entity or internal audit how they expect the documented dispositions to look.
Your physical security team supplies the substance that the reviewer examines. It knows the site conditions, guard and response arrangements, camera and access control coverage, and the law enforcement relationships that the R4 evaluation and R5 plan describe. Because the reviewer tests whether those documents match how the facility actually operates, the security team must be ready to walk the reviewer through the site, answer questions about assumptions, and explain gaps it has already identified.
- Site knowledge: Provide access to the facilities and staff who can explain how deter, detect, delay and respond measures work in practice.
- Assumption tracking: List the threat and vulnerability assumptions behind the R4 evaluation so the reviewer can test them.
- Plan currency: Confirm that the R5 plan reflects current equipment, contracts and response partners before the review starts.
- Remediation input: Estimate the work needed for accepted recommendations, so your compliance team can set realistic action dates.
Check that the team has time set aside during the review window, since site walkthroughs and interviews tend to be the step that slips.
An implementation partner such as DeployOpen can help the entity prepare for R6 by organizing the material the review depends on. Under a written, fixed scope, a partner can structure the evidence folder, set up version control for the R4 evaluation and R5 plan, and build a review-tracking workflow that records each recommendation and its disposition. A partner does not perform the review, does not act as the Part 6.1 reviewer, and does not issue any report or certification. Those roles stay with the entity and the independent reviewer.
- Evidence folder: Arrange the R4 and R5 documents, revision history, approvals and supporting records in a consistent structure.
- Version control: Keep every change to the evaluation and plan traceable, so the reviewer can see what changed after recommendations were received.
- Review tracking: Log each recommendation with its owner, due date, decision and supporting change.
- Document preparation support: Help draft and format materials, while the entity reviews and approves the content.
Ask any partner to state in writing that it will not perform or influence the independent review.
The independent reviewer is the party that carries out the R6 review. Part 6.1 limits who may do this: an organization with electric industry physical security experience whose review staff includes at least one Certified Protection Professional (CPP) or Physical Security Professional (PSP), an entity approved by the ERO, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. The reviewer must be unaffiliated, which means it should not be a party whose work or interests would compromise the review. Confirm each qualification with the candidate in writing before engagement.
- Qualification evidence: Ask for the basis of each credential, such as named CPP or PSP holders on the review staff.
- Unaffiliated status: Obtain a written statement covering ownership, employment and business ties to the entity or its vendors.
- Scope of review: Agree on the documents reviewed, the method and the form of the recommendations before work begins.
- Deliverable timing: Confirm the review will be complete within the 90 calendar day window, leaving time for your 60 day action period.
Check that the reviewer's engagement letter names the R4 evaluation and R5 plan as the subject of the review.
Common R6 gaps and how to close them
Most R6 findings are not about the reviewer's skill. They come from missing records: an unchecked reviewer, an undated review, or recommendations with no written outcome. Each gap below has a specific fix that a compliance lead can assign and verify before the next audit.
Reviewer chosen without a Part 6.1 check
The entity engages a reviewer without confirming the Part 6.1 qualifications on file. Part 6.1 requires an organization with electric industry physical security experience whose review staff includes at least one CPP or PSP, or another qualifying type of entity. Fix: before signing, record which qualification the reviewer relies on, obtain the named staff's credentials, and keep that memo with the engagement letter.
Review completion date not recorded
The review finishes, but nobody records the completion date, so the 90-day window under Part 6.2 cannot be demonstrated. Auditors look for a dated, signed review report tied to the completed R5 plans. Fix: log the date the R5 plans were completed, calculate the 90-day deadline in the tracker, and store the signed report with its issue date.
Recommendations without written disposition
Reviewer recommendations are accepted in meetings but never recorded as a decision. Part 6.3 requires, within 60 calendar days of the review, either a modification to the evaluation or plan or a documented reason for not modifying it. Fix: give each recommendation its own row with a decision, a responsible owner, a due date and the date the decision was signed.
Plan changes not linked to reviewer comments
The plan is revised, but the revision history does not show which reviewer comment drove each change. An assessor cannot tell whether a change answers a recommendation or is unrelated maintenance. Fix: require every revision to cite the recommendation ID in its change note, and keep the before and after versions of the R4 evaluation and R5 plan.
Reviewer conflicted by a prior engagement
The same firm assessed or designed the physical security of the facility earlier, which can weaken the independence the requirement assumes. Teams often discover this only when the report is already drafted. Fix: ask each candidate reviewer to disclose prior work on the same stations, substations or primary control centers, and document the conflict check before engagement.
Review evidence scattered across email
Engagement letters, drafts, comments, sign-off emails and the final report sit in individual inboxes. When an auditor asks for the chain from review to plan change, the team reconstructs it from memory. Fix: keep one controlled folder or wiki space per review, with an index that lists each document, its version and its owner, and retain it under the entity's CIP evidence retention rules.
Questions buyers ask about CIP-014-3 R6
How much effort does CIP-014-3 R6 take to run in-house?
R6 is a single review event, but the work around it is not small. Your team must assemble the R4 evaluation and the R5 physical security plans in a form a reviewer can read, answer follow-up questions, and then track each recommendation through modification or written justification. The main drivers are how many stations and substations are in scope, how mature your existing documentation is, and whether the people who wrote the evaluation and plan are available during the review window. Ask any partner for a written scope that lists the facilities, the documents and the named roles on both sides before work starts.
Can our organization choose its own third-party reviewer under R6?
Yes, but the reviewer must meet the qualifications in Part 6.1 of the standard. The organization must be unaffiliated, have electric industry physical security experience, and have review staff that includes at least one Certified Protection Professional or Physical Security Professional, or an entity approved by the ERO, a government agency with physical security expertise, or an entity with law enforcement, government or military physical security expertise. Confirm the qualifications in writing, check independence from the team that produced the R4 evaluation and R5 plans, and keep the selection record as evidence.
What starts the 90 and 60 day clocks in R6?
The 90 calendar day clock in Part 6.2 runs from completion of the R5 physical security plans, so the review must be finished within that window. The 60 calendar day clock in Part 6.3 runs from the date of the review, and within it you must either modify the evaluation or plan for each recommendation or document why you did not. Record the completion date of the R5 plans and the date the review report is received, because an auditor will ask for both dates to test whether each clock was met.
What would a partner do for R6, and what would it not do?
A partner can prepare the R4 evaluation and R5 plan packages, organize the documentation for the reviewer, coordinate the response log for each recommendation, and help document decisions where you do not adopt a recommendation. A partner cannot act as the unaffiliated reviewer, because that role is limited by Part 6.1 and must be independent of the preparers. A partner also does not decide whether your plans are sufficient, and it does not issue any report or attestation. Those decisions remain with your CIP Senior Manager and the reviewer you select.
How long must R6 review evidence be kept?
Evidence retention for CIP compliance is governed by the Regional Entity's audit period and the retention rules in NERC's compliance program rather than by R6 alone. For the exact retention periods and how they interact with your audit schedule, see the NERC CIP audit preparation guide and confirm the current period with your Regional Entity. Keep the reviewer qualification records, the signed review report, the dated response log, and the modified or justified versions of the R4 and R5 documents together.
What does the R6 review need from our team?
The review needs named owners on your side, a CIP Senior Manager or delegate who can accept or reject recommendations, subject matter experts who can explain the site characteristics and threat assessment, and someone who controls the document set and version history. Expect the reviewer to ask questions during the review, so availability inside the 90 day window matters. Confirm the staffing plan in the written scope, including who signs the response log and how security-sensitive material will be shared with the reviewer.
Does R6 carry a penalty risk, and what is its violation risk factor?
R6 carries a Medium Violation Risk Factor under CIP-014-3. Penalty amounts depend on the Sanction Guidelines, the duration and severity of the violation, and the entity's compliance history, so a missed clock is treated as a finding that must be mitigated and reported. The maximum civil penalty referenced by NERC's Sanction Guidelines is $1,584,648 per violation, per day, as adjusted by FERC Order No. 906, which sets a ceiling rather than an expected outcome. Ask your compliance lead to confirm how your Regional Entity applies these factors.
How DeployOpen prepares R6 evidence with your team
DeployOpen's part in R6 is preparation. Before work starts, we agree a written scope with your team that names the R4 evaluation and R5 physical security plan versions to be reviewed, the facilities in scope, the people who own each record, and the evidence package the entity will hand to its independent reviewer. The organization keeps ownership of the evaluation, the plan and the decision on each recommendation. DeployOpen does not act as the R6 reviewer under Part 6.1, does not issue review reports or attestations, and does not certify compliance. Those outputs come from an independent reviewer that meets the Part 6.1 qualifications, and the entity must confirm that reviewer's qualifications against the standard itself.
We set up the working records in self-hosted tools inside your own environment. XWiki keeps a version history of each document, recording what changed, when and by whom, and lets reviewers compare any two versions, which matters when the reviewer asks what the R5 plan said on the date the review began. BookStack holds the review workspace, with role-based permissions set per shelf, book or page so that the physical security team, the reviewer and executives see only what their role needs. Each reviewer recommendation is logged with a Part 6.3 decision field, the modified section or documented reason, and an owner. The 90-day and 60-day windows in Parts 6.2 and 6.3 are tracked against dates your team confirms, so the calendar is visible to everyone who needs it.
The evidence package is assembled so an independent reviewer can trace each claim in the R4 evaluation and R5 plan to its source, with the version of each document and the date it was approved. We do not decide whether the evaluation is sufficient. Before handoff, your compliance lead should confirm that the scope matches the facilities identified under R1 and R2, that the R5 completion date is recorded correctly, and that the reviewer's qualifications are documented. DeployOpen's engagements are fixed-scope: deliverables, timelines and responsibilities are agreed in writing first, and a quote follows from that written scope rather than from a published price list.
