Treat this as orientation, not guidance on compliance
NERC CIP is the set of reliability standards used for protecting the bulk electric system. The physical security portion is one part of a larger set of cyber and physical requirements, and which sites fall under it depends on how the owner categorizes them. Standards are revised over time, and regional entities interpret and audit them.
So this article is a vocabulary guide. It helps operations and security staff talk with compliance staff using the same terms. The people who decide scope, wording and evidence are your compliance team and, where relevant, your regional entity.
What expectations commonly cover
Physical security requirements at regulated bulk electric facilities tend to cluster around a few ideas.
- A physical security plan. A written description of the boundary, the controls and who is responsible.
- Access control. Rules for who may enter, how they are authorized and how visitors are handled.
- Monitoring and alarming. A way to notice unauthorized access at defined points and alert someone.
- Logging. Records of entries and alarms with enough detail to reconstruct events.
- Retention and review. Keeping those records for a defined period and reviewing them.
- Maintenance and testing. Showing that the controls are working and getting fixed when they are not.
Each theme produces evidence. That is why the paperwork often matters as much as the hardware.
It is also common for these themes to be spread across several documents and several teams. Operations may own the access lists, security may own the cameras, and compliance may own the plan. When an auditor asks one question, the answer may need three people. Mapping who owns which record, before any audit, saves time and prevents gaps between teams.
Evidence and logging, in practice
An audit or an investigation starts with a question such as "what happened at this gate at 3:12 a.m. on Tuesday." Good records answer it without guesswork.
Useful evidence tends to share these traits:
- Timestamped. Clocks across cameras, controllers and logs are synchronized so events line up.
- Attributable. Entries tie to a person, credential or reviewer, not just "motion."
- Retained. Kept for the period your policy requires, stored where it cannot be quietly altered.
- Retrievable. Someone can find and export the right clip or record without a long search.
- Reviewed. There is a record that someone looked at alarms and acted on them.
Retention periods are a policy decision, and the right answer is not simply the longest one, since stored video has a cost and a privacy dimension. Our article on how long security cameras should keep footage lays out the trade-offs, and the guide to security camera footage as evidence covers handling and export.
Unmanned sites are the hard case
Many bulk electric sites have no staff on site. That means monitoring has to work without anyone nearby, and the alarm has to reach someone who can verify it. A fence alarm or door contact with no video behind it creates a different problem, which is the unverified alert. Staff drive out, find nothing, and the alarm loses credibility.
The same logic applies to testing. A control that has never been tested is an assumption. Walk-tests of alarms, checks that cameras still point where intended, and confirmation that alerts reach a real person all produce records that show the system works in practice.
Verified video narrows that gap. For background on the physical threats at these sites, see our notes on substation physical security and the related risk of copper theft.
Cyber and physical overlap
Cameras, controllers and recorders are networked devices, and in a regulated environment they become part of the attack surface. Ask how devices are patched, who has remote access, how credentials are managed and how video is transmitted and stored. Our guide to security camera cybersecurity covers the basics, and your compliance team will decide how those devices are treated under the standards.
Quick-reference table
| Theme | Evidence an auditor may ask about | Question for your compliance team |
|---|---|---|
| Security plan | Written plan, site diagrams, owners | Which sites and categories does it cover? |
| Access control | Authorization lists, visitor logs | How are entries logged and reviewed? |
| Monitoring and alarming | Alarm records, response notes | What is the expected response after an alarm? |
| Retention | Stored logs and video | What retention period applies? |
| Maintenance | Test and repair records | How often must controls be tested? |
Escalation has to be written down
When an alarm is verified, the next steps should not be improvised. Define who is called, in what order, and what is recorded at each step. A short matrix works well, and our security incident escalation matrix shows one way to build it.
Where a mobile unit can help
A VDS mobile unit can add monitored video and a documented event record at an unmanned site, including during outages, upgrades or while a fixed system is being designed. It is a solar-powered trailer with a 5MP PTZ camera with 25x optical zoom and three 8MP wide-angle cameras, on a 22 ft telescopic mast. AI detection flags people, vehicles and loitering, and a 24/7 US-based security operations center verifies events, responds with live talk-down through a loudspeaker, then dispatches police with video. The hardware is NDAA Section 889 compliant, and no site power, internet or trenching is needed.
Whether a unit or its records satisfy any particular obligation is for your compliance team to decide, not a vendor. See the mobile surveillance unit for hardware details, or talk to our team about how event records and retention could support your process.
Questions to bring to your compliance team
Before changing anything at a site, ask which standard and category apply, what evidence is expected, how long records must be kept and who signs off on changes. Then work backward to the equipment.
It also helps to ask how temporary measures are documented. A trailer placed for a few weeks during an outage is still a change to the site, and your process may expect it to be recorded, with a start date, an end date and an owner. Raising that early avoids an awkward conversation later.