ACCESS CONTROL — ELECTRICITY SECTOR
Access control for generation, transmission and distribution
Every SEN plant and substation is at least Low Impact under the Coordinator’s Cybersecurity Standard, and every national transmission facility is Medium Impact. That means controlling physical access, logging every entry and reporting each year, with evidence. We have been doing it at Colbún since 2022.
- Colbún
- GTD
- Enel
- Caja Los Héroes
What the standard asks, door by door.
| Obligation | Control in Octoberus | Evidence produced | Frequency |
|---|---|---|---|
| CIP-003 §7.2.4 Section 2 — Low Impact: control physical access to the asset and to the electronic access control cyber assets1 | One controller per door with a local credential list and permits per zone. | Authorised-person list and access logs per site. | Continuous |
| CIP-006 R1.2 — Medium Impact: at least one physical access control per physical security perimeter; evidence is the list of authorised individuals with their logs1 | One controller per door with a local credential list and permits per zone. | Authorised-person list and access logs per site. | Continuous |
| CIP-006 R2 — escorted visits, with entry and exit records, name and escort, retained at least 90 days1 | Visitor permit with an assigned escort; entry event and exit event. | Exportable visitor log. | Per visit |
| CIP-006 R3 — maintenance and testing of the physical access control system every 24 months1 | Battery and health telemetry per node; scheduled test with a report. | Dated test report. | ≤24 months |
| CIP-004 R4 — verify access authorisations at least every 15 months1 | Report of active permits per facility, with grants, removals and expiries. | Report signed by the CIP officer. | ≤15 months |
| Annual report to the Coordinator in the first quarter, signed by the CIP officer, with evidence retained at least 3 years1 | Annual export per facility and period, with retention configured. | Evidence package per facility. | Annual, Q1 |
From permit to evidence in five steps.
Facility and zones
We model your plant, substation or data center: facilities, zones, doors and assets, with floor plan.
Identities
People, contractors and services with one or more credentials: card, QR, fingerprint, plate or phone.
Permit
Who, where, when and for which job. With safety approval if your process requires it.
The door decides
The controller enforces the list locally: it opens without network and queues events.
Evidence
Event with photo, alert if needed, export and report for the auditor.
The standard is already in force. Evidence is what is missing.
Low Impact is still an obligation
Hundreds of SEN substations and plants run without a physical access control system. Low Impact is no exemption: you must control access and be able to prove it.
Evidence, not just control
The Coordinator measured evidence-backed compliance for 2023: 86 % at High Impact facilities, 75 % at Medium and 82 % at Low. Our reading: the control usually exists; the evidence does not always (source: “Proceso de Verificación de Cumplimiento Normativo” presentation, CEN).
Copper theft
CGE reported 1,426 episodes and 420 km of cable stolen during 2025. Every intrusion into an electrical room leaves an event with a photo and an alert within minutes (source: cge.cl).
SEC fines
After the February 2025 blackout, the SEC fined transmission companies up to 80,000 UTM for maintenance failures in support systems. Maintenance records are requested dated (source: La Tercera and BioBioChile, Feb 2026).
Colbún · CT Nehuenco
Six critical rooms controlled since 2022: electrical, control and server rooms, among others. Contract in force.
Frequently asked questions
Does this apply to a 20 MW plant? +
Yes. The Low Impact category covers any SEN generation facility, with no capacity threshold. What changes is the scope of the controls, not the duty to control physical access and keep a record.
How does it fit the annual report to the Coordinator? +
You export per facility and period: authorised persons, accesses, visits and alerts. Retention is configured at 3 years so the package is still there when it is requested.
Does it work for contractors? +
Yes. Permits are issued per job type, with a time window and an end date. On expiry the credential stops opening. Revocation is immediate from the platform and is pushed to the door; the standard requires it within 24 hours.