CIP-004 access management and training for small operators

CIP-004 is the people standard: who gets access to BES Cyber Systems, what they must know before they get it, and how fast it goes away when they no longer need it. For a small operator it often has the most moving parts per person, because contractors and vendor staff are in scope just as employees are.

It also applies to fewer sites than people assume. This post covers who CIP-004-7 applies to, what each requirement asks, what low impact sites owe instead, and how to keep it manageable with a small team.

Does CIP-004 apply to you?

CIP-004-7 applies to high and medium impact BES Cyber Systems. It covers personnel, including contractors and service vendors, with authorized electronic access or authorized unescorted physical access to those systems. For medium impact, many parts apply only to systems with External Routable Connectivity and their associated EACMS and PACS, so check the Applicable Systems column for each part.

• Most solar, wind and battery plants that are under CIP rate low impact. Under CIP-002-5.1a criterion 2.1, a single plant is medium impact only at 1,500 MW or more at one plant location in one Interconnection.
• A Control Center that performs Generator Operator functions for 1,500 MW or more in a single Interconnection is medium impact under criterion 2.11. An operator running a growing fleet from one control room can cross that line.
• Category 2 inverter-based resources, registered with NERC since May 15, 2026, are not BES facilities and are not subject to CIP. Registration alone does not bring CIP-004 with it.

What low impact sites owe instead

Low impact sites do not have a CIP-004 program. Their people requirements sit in CIP-003-9:

• Attachment 1, Section 1: reinforce cyber security practices, which may include associated physical security practices, at least once every 15 calendar months.
• R1.2.1: cyber security awareness is one of the low impact policy topics, and the CIP Senior Manager reviews and approves the policies at least once every 15 calendar months.
• Access is still controlled, physically under Section 2 and electronically under Section 3, but the R2 note is explicit: "Lists of authorized users are not required."

Personnel risk assessments, a role-based training program and quarterly access reviews are not required at low impact. You may still borrow parts of CIP-004 as good practice, particularly for vendor access, but a low impact site is not audited against it.

R1: security awareness every quarter

R1 asks for security awareness that, at least once each calendar quarter, reinforces cyber security practices (which may include associated physical security practices) for personnel with authorized electronic or authorized unescorted physical access. It does not have to be a course. An email, a poster or a short briefing can do the job, as long as you can show what was delivered, to whom and when.

R2: role-based training before access, and every 15 months

R2 requires a cyber security training program appropriate to individual roles, functions or responsibilities. The required content is listed in Part 2.1 and covers, among other topics, physical and electronic access controls, handling BES Cyber System Information, and recognizing Cyber Security Incidents and making the initial notifications. Two clocks apply:

• Training must be completed before authorized electronic access or authorized unescorted physical access is granted, except during CIP Exceptional Circumstances (Part 2.2).
• It must be completed again at least once every 15 calendar months (Part 2.3).

Vendor technicians count. If a vendor's staff need authorized access, their training record has to exist before the access does.

R3: personnel risk assessments

To get authorized access, and to keep it, a person needs a personnel risk assessment (PRA). The program includes:

• a process to confirm identity (Part 3.1);
• a seven-year criminal history records check as part of each PRA (Part 3.2);
• criteria or a process for evaluating criminal history records checks when authorizing access (Part 3.3);
• criteria or a process for verifying that PRAs performed for contractors or service vendors meet Parts 3.1 to 3.3 (Part 3.4);
• a process to make sure everyone with authorized access has had a PRA completed within the last seven years (Part 3.5).

Part 3.4 is where vendors come in. You need a way to verify the vendor's assessments, which in practice usually means a contract clause, not just an assurance.

R4: access management

• Authorize access based on need, as you determine it, except during CIP Exceptional Circumstances (Part 4.1).
• At least once each calendar quarter, verify that everyone with active electronic access or unescorted physical access has an authorization record (Part 4.2).
• At least once every 15 calendar months, verify that all user accounts, account groups or role categories, and their privileges, are correct and are the ones you have determined are necessary (Part 4.3).

The quarterly check compares two lists: who can actually get in, and who is authorized. The first list should come from the systems themselves, such as the accounts on each device and the badge system, not from a record of who ought to have access. Keep evidence that a person reviewed the comparison, not only that it was produced.

R5 and R6: revocation and BCSI

• Termination: initiate removal of the person's ability for unescorted physical access and Interactive Remote Access upon the termination action, and complete the removals within 24 hours of it (Part 5.1).
• Reassignment or transfer: revoke the electronic and unescorted physical access you determine is no longer necessary by the end of the next calendar day after you make that determination (Part 5.2).
• Termination: revoke the person's non-shared user accounts (Part 5.3), and change the passwords of shared accounts they knew within 30 calendar days (Part 5.4). The same 30 days applies to shared account passwords after a reassignment or transfer, counted from the date you determine the access is no longer needed.
• BCSI (R6): authorize provisioned access to BES Cyber System Information based on need before provisioning it (Part 6.1); verify at least once every 15 calendar months that everyone with provisioned access has an authorization record and still needs it (Part 6.2); and for a termination, remove the person's ability to use it by the end of the next calendar day (Part 6.3).

The 24-hour clock depends on HR, or a contractor's own manager, telling the people who remove access in time. Write down who tells whom, and how quickly.

Keeping it manageable with a small team

• One register of everyone with authorized access, employee or not, with the date of each training, PRA and authorization.
• Due dates counted from the last completion: each calendar quarter, every 15 calendar months, every seven years.
• A contract clause for vendors and contractors covering PRAs, training, and notice when one of their staff leaves or no longer needs access.
• A termination checklist listing every system the person could reach, including shared accounts and remote access paths.
• Records kept as the work happens: each review dated, with the reviewer's name.

Where automated evidence collection helps

Training records and PRAs are records about people, and no collector can produce them. Access is different. Collecting configuration from devices read-only on a schedule gives you a dated record of the accounts that exist on each one, and comparing each collection with the device's baseline shows a new or changed account for a person to review. That is useful input to the quarterly authorization check, the 15-month review of accounts and privileges, and confirming that a leaver's non-shared accounts are gone.

What changes next

CIP-004-7 is the version in force in the U.S. today. CIP-004-8, part of NERC's virtualization revisions, takes effect on July 1, 2028. Until then, CIP-004-7 is the version you are audited against.