Where Video Fits in a CIP-014 Physical Security Plan (and Where It Doesn't)

A substation can be physically secure and still fail a CIP-014 audit. 

That surprises a lot of utility security leaders. The problem usually isn’t the cameras, fences, or access controls. It’s the evidence behind them. 

CIP-014 isn’t just about protecting critical infrastructure. It’s about proving your physical security program works. Missing testing records, outdated plans, or footage that’s difficult to retrieve can create audit findings even when the right security measures are in place. 

The good news is that most of these issues aren’t solved by buying more hardware. They’re solved by making better use of the systems you already have. 

What CIP-014 asks for:

CIP-014 was created after the 2013 attack on PG&E’s Metcalf substation exposed the vulnerability of critical grid infrastructure. Today, utilities continue to face growing physical threats, making strong physical security and clear documentation equally important. 

Requirement R5 requires applicable transmission substations to maintain a documented physical security plan built around six functions: 

• Deter  
• Detect  
• Delay  
• Assess  
• Communicate  
• Respond  

Video supports nearly all of them. 

Where video adds value:

Deter 

Visible surveillance discourages the incidents utilities see most often: trespassing, vandalism, and theft. Cameras won’t stop every attacker, but they make facilities far less attractive to opportunistic criminals. 

Detect 

Modern video systems use AI-powered analytics to identify activity at unmanned substations and notify operators immediately, reducing the time between intrusion and response. 

Assess 

When an alert comes in, operators need to know what’s actually happening. Live video quickly separates a real intrusion from wildlife or another false alarm, helping teams respond appropriately. 

Communicate 

Recorded video gives responders and law enforcement immediate context. Instead of describing an incident over the phone, security teams can securely share exactly what happened. 

Respond 

Video doesn’t replace your response plan—it makes it more effective. Real-time alerts, live video, and two-way audio help responders understand the situation before they arrive. 

Delay 

This is the one function video can’t provide. 

Fences, gates, locks, and hardened infrastructure slow an intruder down. Video makes those barriers more valuable by detecting the intrusion while there’s still time to respond. 

Where many utilities struggle:

Most organizations don’t have a camera problem. 

They have an evidence problem. 

Auditors rarely start by asking what hardware you’ve installed. They ask whether you can prove it’s working. 

Can you retrieve footage from three months ago? 

Can you show when detection systems were last tested? 

Can you demonstrate that your cameras cover the assets your physical security plan says they protect? 

Those questions are often harder to answer than installing the cameras in the first place. 

That’s why the way video is stored matters just as much as the cameras themselves. Searchable, timestamped, retained footage turns everyday security operations into documentation that supports investigations and audits alike. 

A quick self-check:

For each applicable substation, ask yourself: 

• Can you retrieve footage from a specific date in under a minute?  
• Is footage retained long enough to support investigations and audits?  
• Do you maintain records showing when detection systems were tested?  
• Can you verify that cameras cover the critical assets identified in your security plan?  
• Could you reconstruct an incident tomorrow using today’s footage?  

If any answer is “no,” you’ve identified an opportunity to strengthen both your physical security program and your audit readiness. 

Not just for CIP-014 sites 

Although CIP-014 applies primarily to the largest transmission substations, many utilities now use the same framework across distribution substations and other critical facilities. 

The requirements may differ, but the operational principles remain the same: deter threats, detect incidents quickly, respond effectively, and maintain the evidence needed to demonstrate that your security program is working. 

Where to start:

If you’re reviewing your physical security plan, don’t begin with a hardware catalog. 

Start by looking for evidence gaps. 

Can your video platform retain footage long enough? Is every recording accurately timestamped? Can operators quickly search and share footage when an auditor—or an incident—demands it? 

Those capabilities matter just as much as image quality or camera count. 

Rhombus helps utilities centralize video, simplify investigations, and maintain the searchable records modern physical security programs depend on—making it easier to strengthen both day-to-day operations and audit readiness. 

See how it works!