The CIP-014 compliance clock
CIP-014 does not set one deadline. It sets a chain of them, and each link starts when the previous step actually finishes — not when it was due. Enter the dates you have; this returns the rest, using the calendar-day intervals written into the standard.
| Req | Obligation | Interval | Date | Status |
|---|
Two of these six requirements we are structurally disqualified from performing for you — and you should treat any supplier who offers otherwise as a warning sign.
R2 and R6 both require an unaffiliated third party. A firm that supplies materials or construction into your R5 plan is not unaffiliated with respect to that plan. That is not modesty; it is the entire point of the requirement. The reviewer exists to catch what the people with a stake in the answer would not.
Where hardening genuinely is part of the answer, it belongs in R5 — and it should be specified against a documented threat from R4, not chosen first and justified afterwards. Preservation 2 is affiliated with Amidon (360 Ballistics, LLC), which manufactures protective construction materials. Read everything here with that in mind.
Which clock starts when. The intervals run from the completion of the preceding step, not from its due date. Finishing R2 verification early pulls the R3, R4 and R5 dates forward with it. Finishing it late pushes them out but creates no slack, because the R2 date itself was already fixed by R1. That is why this instrument asks for actual completion dates where you have them, and marks every row it had to infer.
What it deliberately does not do. It does not score you, and it does not tell you whether a given station or substation is in scope. Scope is an engineering determination under R1 that only you and your compliance function can make, and a web page that pretended otherwise would be worse than useless to you in an audit.
R1 — Risk assessment
Recurs every 30 or 60 months
Identify the stations and substations that, if rendered inoperable or damaged, could result in instability, uncontrolled separation or cascading within an Interconnection — and identify the primary control centre that operationally controls each one.
R2 — Verification
Within 90 days of R1
An unaffiliated third party verifies the R1 risk assessment. Where the verifier recommends a change, you have 60 calendar days from completion of the verification either to modify your identification or to document the technical basis for not doing so.
Unaffiliated party requiredR3 — Notification
Within 7 days of R2
Where a primary control centre identified under R1 is not under your operational control, notify the Transmission Operator that operates it. The same seven-day clock applies to notifying a removal.
R4 — Threat and vulnerability evaluation
No separate clock — feeds R5
Evaluate potential physical security threats and vulnerabilities of a physical attack, accounting for the characteristics of the facility, prior attack history, and intelligence or threat warnings from law enforcement, the ERO, the E-ISAC and government agencies.
R5 — Physical security plan
Within 120 days of R2
A documented physical security plan covering resiliency or security measures, law enforcement coordination, a timeline for implementation, and provisions for evolving threats. This is the requirement that hardened construction actually answers to.
R6 — Review
Within 90 days of the plan
An unaffiliated third party reviews the R4 evaluation and the R5 plan. The reviewer is expected to hold physical security experience in the electric industry together with CPP or PSP certification, or an equivalent qualification.
Unaffiliated party requiredwatch
CIP-014-3 is the enforceable version, effective 16 June 2022. CIP-014-4 was developed under NERC project 2023-06 and posted as Draft 4 in May 2026, with Board adoption anticipated June 2026. The draft consolidates and clarifies rather than rewrites — but it does move the forward-looking window for subsequent assessments from 24 to 36 calendar months for Facilities planned to be in service. Confirm the current version and its implementation plan against NERC before relying on any interval here in a filing. This page states its own last review date below; if that date is stale, treat the page as stale.
Intervals on this page are reproduced from NERC Reliability Standard CIP-014-3 (Physical Security), which remains in force until CIP-014-4 takes effect on October 1, 2028. FERC approved CIP-014-4 on September 10, 2026 (Docket No. RD26-9-000); it restructures the risk assessment, and this page will be revised to its intervals before that date. See what CIP-014-4 changes. Preservation 2 is not affiliated with NERC, FERC or any Regional Entity, and nothing here is compliance advice, a legal opinion, or a substitute for the standard itself; the standard and your Regional Entity govern. The dates this page returns are calendar-day arithmetic on the intervals the standard states. Whether a given interval applies to a given Facility is a determination only you and your compliance function can make.
Draft v0.01. Last reviewed against the standard 13 September 2026. Found something wrong? Tell us — corrections to this page are more useful to us than leads.