Since 2014, security risks to the power grid have become an even greater concern in the electric utility industry. Reflecting ongoing security concerns, legislative proposals in the 115 th Congress include provisions directed at power grid physical security. Congress also continues its oversight of FERC's grid security activities and the implementation of NERC's physical security standards. Federal Oversight and Support

Three entities play key roles in standards oversight and implementation support for bulk power physical security. NERC and FERC directly oversee implementation of the CIP-014 standards, while the Department of Energy (DOE) plays a supporting role in helping bulk power asset owners to protect their critical assets. The detailed findings of NERC's compliance activities are not publically disclosed due to the confidential nature of security information. However, NERC stated that, based on observations in 2016, the utility industry was "making progress towards effective implementation of and compliance with CIP-014-2." According to NERC, the audits completed to date have not uncovered any major compliance failures, and NERC has been "encouraged" by security measures that utilities have put in place so far. Since that time, there have been a number of apparent changes within the electricity sector related to increasing bulk power physical security. Nonetheless, anecdotal information in the public domain suggests that such changes may be significant and widespread. American Electric Power (AEP) also has incorporated asset criticality as a design criterion in its transmission planning. Policy Issues for Congress

Although NERC's CIP-014 standards have been promulgated, and bulk power asset owners have begun enhancing physical security, Congress continues to be concerned about the current state of electric grid physical security. Among many issues of potential interest, Congress may focus on several with overarching policy significance: security implementation oversight, cost recovery, hardening vs. resilience, and the quality of threat information. Conclusion

The 2013 attack on the Metcalf transformer substation marked a turning point for the U.S. electric power sector. The attack prompted utilities across the country to reevaluate and restructure their physical security programs. It also set in motion proceedings in Congress and at FERC which resulted in the promulgation of NERC's CIP-014 mandatory physical security standards in 2015. Although the electric power sector seems to be moving in the direction of more extensive physical security, many measures have yet to be implemented and the process of corporate realignment around physical security is still underway. Therefore, although it is probably accurate to conclude that, based on the objectives of the CIP-014 standards, the U.S. electric grid is more physically secure than it was five years ago, it has not necessarily reached the level of physical security needed based on the sector's own assessments of risk. Bulk power physical security remains a work in progress. As CIP-014 implementation and other physical security initiatives proceed, Congress may seek to maintain its focus on the power sector's overall progress, not only on short term compliance with NERC's security standards, but also on structural changes supporting physical security as a priority far into the future.
A 2013 rifle attack on a critical electric power substation in Metcalf, CA, marked a turning point for the U.S. electric power sector. The attack prompted utilities across the country to reevaluate and restructure their physical security programs. It also set in motion proceedings in Congress and at the Federal Energy Regulatory Commission (FERC) which resulted in a new mandatory Physical Security Reliability Standard (CIP-014) for bulk power asset owners promulgated by the North American Electric Reliability Corporation (NERC) in 2015. In the three years since FERC approved this new standard, security risks to the power grid have become an even greater concern in the electric utility industry. Reflecting these ongoing security concerns, legislative proposals in the 115th Congress include provisions directed at power grid physical security. Congress also continues its oversight of grid security and implementation of NERC's security standards.
Three entities play key roles in standards oversight and support of implementation for bulk power physical security. NERC and FERC oversee implementation of the CIP-014 standards, while the Department of Energy plays a supporting role in helping bulk power asset owners to protect their critical infrastructure. The detailed findings of NERC's compliance activities are not publicly disclosed due to their confidential nature. However, NERC has stated that the utility industry is making progress towards effective implementation of the CIP-014 standard and NERC has been "encouraged" by grid security measures put in place so far. NERC compliance audits as of February 2018 have uncovered no major failures to date.
In addition to compliance with NERC's standards, there have been other observable changes within the electricity sector reflecting greater emphasis on bulk power physical security. These changes include realignment in corporate structure to support physical security, incorporating physical security in transmission planning, new security products and services, utility capital investment in physical security, and utility participation in voluntary security programs. While public information about such changes is limited, it suggests they may be significant and widespread.
Although the electric power sector seems to be moving in the overall direction of greater physical security for critical assets, many measures have yet to be implemented and the process of corporate realignment around physical security is still underway. NERC's CIP-014 standards have been promulgated recently, and bulk power asset owners have largely begun enhancing physical security under the standard over the last two years. Therefore, although it is probably accurate to conclude that, based on the objectives of the CIP-014 standards, the U.S. electric grid is more physically secure than it was five years ago, it has not necessarily reached the level of physical security needed based on the sector's own assessments of risk. Bulk power security remains a work in progress.
Congress continues to be concerned about the current state of electric grid physical security. Among many specific issues of potential interest, Congress may focus on several with policy significance: security implementation oversight, cost recovery, hardening vs. resilience, and the quality of threat information. As CIP-014 implementation and other physical security initiatives proceed, Congress also may seek to maintain its focus on the power sector's overall progress, not only on short term compliance with NERC's security standards, but also on structural changes supporting physical security as a priority far into the future.