Physical security for solar farms, battery storage sites and substations in Arizona comes down to time and distance. These sites are large, remote and usually unstaffed, so the plan has to detect trouble at the fence, confirm it quickly, get a person or a police unit moving, and leave a record that supports prosecution and insurance. Copper and equipment theft is the most common loss. Vandalism and gunfire attacks are rarer but can cause far bigger outages.
This guide is for asset owners, utilities, developers and EPC contractors. It covers the threats, when the federal substation security standard applies, the laws that protect energy sites, camera and patrol design for desert arrays, the construction phase, battery storage safety and how utility security teams and contracted officers divide the work. For guard posts, patrol and alarm response at energy sites, see our energy and utilities security service.
Key takeaways
- Copper theft from solar arrays can go unnoticed for weeks. Patrols must check inside the array, not just the gate.
- NERC CIP-014 applies to certain transmission stations and substations. Most solar farms, battery sites and distribution substations fall outside it, but its deter, detect, delay and respond logic still fits.
- Federal law (18 U.S.C. 1366) covers damage to energy facilities, including those still under construction.
- In Arizona, posted signage can make trespass at a fenced utility site a class 5 felony.
- Construction is the highest-risk phase: cable on spools, many contractors and little lighting.
- Officers should never open or approach battery storage enclosures during an alarm.
The threats that actually hit energy sites
Copper and equipment theft. Solar arrays hold thousands of feet of copper cable spread across acres. In Johnston County, North Carolina, the sheriff’s office reported in September 2025 that thieves removed about $200,000 in copper wiring from panels at a solar facility, and that the theft happened sometime between July 16 and September 10. Nobody noticed for weeks. In June 2026, Delaware State Police charged a worker employed by a solar construction company with stealing nearly 2,000 feet of copper wire, valued at over $26,000, from the site; troopers identified the wire at a salvage yard. The charges are allegations, but the lessons are clear: inspect inside the array, and treat insiders as a real risk.
Gunfire and sabotage. A joint CISA and Department of Energy product, the Sector Spotlight on Electricity Substation Physical Security, describes attacks on several Pacific Northwest substations in November 2022 and a December 3, 2022 attack on two substations in Moore County, North Carolina, that an energy provider said caused about 45,000 outages. It lists ballistic attacks, vehicle ramming, explosive devices and drones among the methods owners should plan for.
Vandalism and trespass. Remote fence lines draw off-road traffic, target shooters, dumpers and people looking for anything to sell. Broken panels and cut fences are often the first sign that a site is being scouted.
Does NERC CIP-014 apply to your site?
NERC’s physical security standard, CIP-014, applies to Transmission Owners and Transmission Operators, not to every energy site. Under CIP-014-3, a station or substation is in scope if it has transmission facilities operated at 500 kV or higher, or facilities between 200 kV and 499 kV that connect to three or more other stations at 200 kV or higher and exceed an “aggregate weighted value” of 3000. Stations identified as critical to certain operating limits or to nuclear plant interface requirements are also covered.
The standard says the collector bus for a generation plant is not a transmission facility for these criteria. In practice, most solar farms, battery storage sites and distribution substations are outside CIP-014. Owners in scope must perform a risk assessment, have it verified by an unaffiliated third party, evaluate threats and vulnerabilities, and implement a documented physical security plan. In September 2026, FERC issued an order approving a revised version, CIP-014-4, so check which version and implementation dates your compliance team is working to.
Sites outside the standard can still borrow its logic. The CISA and DOE Sector Spotlight recommends a layered approach: deter, detect, delay, assess, communicate and respond. It also calls for a threat and vulnerability assessment for each site rather than one template for all, and for outreach to local first responders so they know which sites matter most.
Federal and Arizona law that protects energy sites
This is general information, not legal advice. Your counsel should confirm how these rules apply to a given site.
- 18 U.S.C. 1366. Knowingly and willfully damaging an energy facility by more than $5,000 carries up to five years in federal prison. Damage over $100,000, or damage that causes a significant interruption of the facility’s function, carries up to 20 years. The statute defines an energy facility to include production, storage, transmission and distribution of electricity, “regardless of whether such facility is still under construction.”
- Critical public service facility. A.R.S. 13-1501 covers a structure or fenced yard posted with signs stating it is a felony to trespass, or warning of high voltage, that is used by a utility or used to transport, distribute or store electricity (retail-only facilities excluded). Unlawful entry is a class 5 felony under A.R.S. 13-1504. Whether a particular site qualifies depends on its use, so post it and confirm with counsel.
- Utility criminal damage. A.R.S. 13-1602 makes reckless damage to utility property of $5,000 or more a class 4 felony.
- Metal theft value. A.R.S. 13-1802 counts the damage caused by stealing metal in the value of the theft, so repair and outage costs belong in the report.
- Scrap dealer holds. Arizona scrap metal dealers record seller identification and report most purchases to the Department of Public Safety within 24 hours, and must hold copper for seven days after reporting under A.R.S. 44-1644. Report fast and send photos of your cable markings.
Remote sites, response time and patrol
A solar farm off a dirt road in Pinal or Maricopa County may be a long drive from the nearest deputy. Response time cannot be fixed with a single post at the gate, so the plan has to buy time and shorten the gap between the first cut and the first call.
- Detect at the fence line with sensors or camera analytics, not at the inverter after the cable is gone.
- Verify with live video so the call to police says how many people, what vehicle and which direction.
- Delay with locked combiner boxes, buried or armored runs where practical, and secured laydown areas.
- Patrol inside the array. The Johnston County case shows a gate-only check can miss weeks of theft. Randomized patrols should drive or walk rows, open no equipment, and photograph cable runs, combiner boxes and fence sections.
- Tell local responders where the gates are, who holds keys and which areas are hazardous.
Mobile patrol covers many dispersed sites with one unit on a varied schedule. Our critical infrastructure security page describes how we run patrol and alarm response across remote assets.
Cameras and analytics that work in a desert array
Arrays are long and flat, with heat shimmer, blowing dust, wildlife and dust devils that set off simple motion detection all night. Plan for those conditions:
- Thermal cameras along long fence lines, with analytics that classify people and vehicles
- Pan-tilt-zoom cameras that an operator can steer to confirm an alert
- Talk-down speakers at gates and laydown yards
- Housings rated for summer heat, mounts that survive monsoon winds, and a lens cleaning schedule after dust storms
- Reliable power and backhaul for cameras far from the substation
- Video retention long enough to cover the gap before a theft is discovered
Remote operators can watch those cameras overnight and escalate to patrol or police. Our article on remote video monitoring and virtual guarding explains how monitored video works.
Installation work is performed and contracted by our licensed Arizona ROC contractor partner. Honeybadger Solutions LLC is not a licensed contractor.
Construction phase: the highest exposure
A solar or battery project under construction has cable on spools, panels on pallets, tools in conex boxes and dozens of subcontractor crews coming and going. Permanent cameras and lighting are not yet in place. The Delaware case shows the risk can come from inside the gate. Our construction site security service covers gate control and night patrol for projects like these. Use this construction checklist:
- Fenced, lit laydown yard with one controlled entry
- Gate log of every vehicle, company and driver, checked against the day’s work plan
- Daily count of cable reels and footage installed versus received
- Serial numbers and photos of inverters, transformers, tools and equipment on delivery
- Marked cable and conductor so recovered material can be matched
- Locked containers with key control and a sign-out log
- Night patrol or monitored temporary camera towers until permanent systems go live
- A posted “felony to trespass” or high voltage sign at every gate once energized equipment is on site
Battery storage sites: officer safety comes first
Battery energy storage adds a hazard that ordinary guard posts do not have. In April 2019, an explosion at the McMicken battery storage facility in Surprise, Arizona, severely injured four firefighters, according to a report by UL’s Fire Safety Research Institute. Security officers at a BESS site should never open an enclosure, approach a smoking or venting container, or try to reset equipment. Their job is to report alarms, smoke or odors to the control center, keep people back, and meet fire crews at the entrance with keys and site maps.
Utility security teams and contracted officers
Large utilities run their own security departments. Contracted officers do not replace that team. They extend it where the utility needs more people, more hours or more locations.
| Task | Utility or owner security team | Contracted security officers |
|---|---|---|
| Risk assessments and CIP-014 compliance | Owns | Supports with patrol data and incident records |
| Access approvals and badges | Owns | Checks crews against approved lists at the gate |
| Posts, patrol and alarm response | Sets requirements | Staffs and documents |
| Outages, storms and construction surges | Directs | Adds officers fast for the duration |
| Incident command and law enforcement liaison | Leads | Preserves the scene and hands over records |
How Honeybadger Solutions helps
Honeybadger Solutions is a veteran-led security firm based in Casa Grande. Our energy site security program provides unarmed and licensed armed officers, randomized marked patrol of dispersed sites, alarm response and gate control for solar farms, battery storage sites and substations in Arizona. For sites in other states, we coordinate vetted, locally licensed partner agencies.
We write post orders around your site safety rules, including where officers may and may not go, and we coordinate with your compliance and engineering teams. We do not certify NERC compliance. We also design camera and alarm layouts that our licensed contractor partner installs, and we staff construction projects from mobilization through energization.
Quotes are written and given before any work starts. Request energy site security online, or book a confidential consultation. If an attack or theft is in progress, call 911.
Frequently asked questions
Does NERC CIP-014 apply to a solar farm?
Usually not. CIP-014 applies to qualifying transmission stations and substations, and it states that a generation plant’s collector bus is not a transmission facility for its criteria. The transmission substation a solar farm connects to may be in scope, so check with the transmission owner.
Is stealing copper from a solar farm a federal crime?
It can be. 18 U.S.C. 1366 covers knowing and willful damage over $5,000 to energy facilities, including facilities under construction. State charges under Arizona theft and criminal damage laws may also apply. This is general information, not legal advice.
What should an officer do if they hear gunfire near a substation?
Get to cover, call 911, and notify the control center with what they heard and from which direction. Officers do not investigate shots or approach the equipment.
How often should a remote solar site be patrolled?
It depends on theft history, value on site and response distance. Sites with recent losses or active construction need more frequent, randomized checks that go inside the array. We set frequency in the written plan and adjust it as incidents change.
Can you add officers for a storm outage or a construction surge?
Yes. Short-term surge coverage for outages, restoration work and construction phases is a common request. We plan it in advance where possible so posts are staffed before equipment arrives.
Sources: NERC, CIP-014-3 Physical Security, Federal Register, Order Approving Reliability Standard CIP-014-4 (September 15, 2026), CISA and DOE, Sector Spotlight: Electricity Substation Physical Security, 18 U.S.C. 1366, A.R.S. 13-1501, A.R.S. 13-1504, A.R.S. 13-1602, A.R.S. 13-1802, A.R.S. 44-1644, JoCo Report, Johnston County solar farm copper theft (September 2025), Eastern Shore Undercover, Delaware solar construction copper theft (June 2026), UL Fire Safety Research Institute, McMicken battery storage explosion report
Browse by topic
Security guard services · Private investigations · Cybersecurity · Digital forensics · Financial fraud investigation · Executive protection · All articles