Key takeaways
- Part 3.1 — confirm the individual's identity.
- CIP-004-7 is the standard enforced today, but a successor is already locked in.
- Build R5's revocation process around triggers, not a single deadline.
NERC CIP-004-7, "Cyber Security — Personnel & Training," is the mandatory, FERC-approved Reliability Standard that governs who may access Bulk Electric System (BES) Cyber Systems and how utilities and grid operators vet, train and offboard those individuals. Per its own Purpose clause it exists "to minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric System (BES) from individuals accessing BES Cyber Systems by requiring an appropriate level of personnel risk assessment, training, security awareness, and access management in support of protecting BES Cyber Systems." CIP-004-7 originated from NERC Project 2019-02 and was approved by FERC on 7 December 2021 via a Designated Letter Order in Docket No. RD21-6-000; it became effective and enforceable on 1 January 2024, per NERC's own 2023 CMEP and ORCP Annual Report. It remains the enforceable version today, even though a virtualization-focused successor, CIP-004-8, is already FERC-approved for a 2028 compliance date (see below).
Who must comply
Section 4.1 names seven "Responsible Entity" functional types: Balancing Authority, a Distribution Provider that owns specific load-shedding, Special Protection System/Remedial Action Scheme or protection facilities, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner. The requirements apply to each entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 process. Five exemption categories (Section 4.2.3) take Cyber Assets out of scope entirely: facilities regulated by the Canadian Nuclear Safety Commission; communication networks and data links between discrete Electronic Security Perimeters (see CIP-005); systems regulated by the US Nuclear Regulatory Commission under 10 C.F.R. § 73.54; for Distribution Providers, systems and equipment outside the standard's Section 4.2.1 scope; and any Responsible Entity that identifies it has no high- or medium-impact BES Cyber Systems under CIP-002 at all.
R1 and R2: awareness every quarter, training before access
Requirement R1 (Security Awareness Program, Lower VRF) is a single-part, low-formality obligation: Part 1.1 requires reinforcing cyber security practices for personnel with authorized electronic or unescorted physical access "at least once each calendar quarter" — the standard does not mandate a specific delivery method, so email reminders, posters, or short briefings can satisfy it as long as the quarterly cadence is documented.
Requirement R2 (Cyber Security Training Program, Lower VRF) is far more prescriptive:
| Part | Core obligation |
|---|---|
| 2.1 | Training content must cover nine enumerated topics: cyber security policies; physical access controls; electronic access controls; the visitor control program; handling of BES Cyber System Information (BCSI) and its storage; identification of a Cyber Security Incident and initial notification; recovery plans; response to a Cyber Security Incident; and risks posed by electronic interconnectivity |
| 2.2 | Training must be completed before an individual is granted authorized electronic or unescorted physical access — except under documented CIP Exceptional Circumstances |
| 2.3 | Personnel with existing access must be retrained "at least once every 15 calendar months" |
Part 2.2's before-access sequencing and Part 2.3's 15-month retraining cadence are the two parts most often cited in CIP-004 audit findings — the standard measures both the order of training versus access, and the recency of training for existing personnel, as separate obligations.
R3: the seven-year personnel risk assessment
Requirement R3 (Medium VRF) requires a documented personnel risk assessment (PRA) before granting authorized electronic or unescorted physical access:
- Part 3.1 — confirm the individual's identity.
- Part 3.2 — perform a "seven year criminal history records check," covering the individual's current residence for any duration of residency, and prior residences within the last seven years where the individual resided for six consecutive months or more.
- Part 3.4 — where contractors or vendors supply personnel, either perform the PRA directly or obtain confirmation from the contracting or vendor organization that an equivalent PRA was already performed. This is the standard's explicit carve-out for third-party staffing — the same vendor-risk boundary NERC CIP-013 addresses from the supply-chain side.
- Part 3.5 — renew the PRA for personnel with existing authorized access "within the last seven years."
The "seven year" figure appears twice in R3 — once as the lookback window for the criminal history check (Part 3.2), once as the renewal cadence (Part 3.5) — and the two should not be conflated: a PRA renewed on time (within seven years of the prior PRA) still only requires a seven-year criminal-history lookback from the renewal date, not a lookback to the individual's entire history.
R4 and R5: access management, and revocation on an hours-to-days clock
Requirement R4 (Access Management Program, Medium VRF) requires authorizing electronic access, unescorted physical access, and access to designated BCSI storage locations based on need (Part 4.1); verifying that authorization records are correct "at least once each calendar quarter" (Part 4.2); and verifying that user accounts, account groups, role categories and their privileges are correct and necessary "at least once every 15 calendar months" (Part 4.3).
Requirement R5 (Access Revocation, Medium VRF) carries CIP-004's most citation-critical numeric deadlines, and each is tied to a specific trigger rather than a single blanket window:
| Part | Trigger | Deadline |
|---|---|---|
| 5.1 | Termination action | Initiate removal of electronic and unescorted physical access ability within 24 hours |
| 5.2 | Reassignment or transfer | Revoke individual authorizations no longer necessary, by the end of the next calendar day following the determination |
| 5.3 | Termination action | Revoke individual user accounts (except shared accounts) within 30 calendar days |
| 5.4 | Shared account password known to a terminated individual | Change the password within 30 calendar days, or within 10 calendar days after the end of documented extenuating operating circumstances |
The 24-hour Part 5.1 deadline applies specifically to a termination action — involuntary or for cause — and is the tightest window in the standard; Part 5.2's reassignment trigger gets a next-calendar-day window instead, reflecting that a transferred employee is a lower-urgency case than a departing one. Evidence for every R1-R5 requirement must be retained for three calendar years, per the standard's Compliance section.
CIP-004-8 is already approved — the 2028 compliance clock is running
CIP-004-7 is the standard enforced today, but a successor is already locked in. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), which names "CIP-004-8 (Cyber Security—Personnel & Training)" among 11 modified CIP Reliability Standards approved together — alongside CIP-002-7, CIP-003-10, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3 — published in the Federal Register on 24 March 2026 at 91 FR 13957, with the order stating "this final action is effective May 26, 2026." The package approves four new NERC Glossary definitions — Cyber System, Management Interface, Shared Cyber Infrastructure and Virtual Cyber Asset — plus 18 revised definitions, needed to let the CIP suite apply cleanly to virtualized infrastructure (see NERC CIP-010 and NERC CIP-002).
Per NERC's implementation plan for the package, the revised standards take effect on the later of 1 April 2026 or the first day of the first calendar quarter 24 months after the order's effective date — which, from the 26 May 2026 effective date, computes to 1 July 2028. Responsible entities may elect early adoption at six, 12 or 18 months after that date instead of waiting for the mandatory date. CIP-004-8's R5 table preserves the same 24-hour/next-day/30-day/10-day revocation timelines described above; the revision's substantive change is adding Shared Cyber Infrastructure scoping language so the standard applies cleanly to personnel with access to virtualized BES Cyber Systems. This guide has not independently reviewed every redlined Part of the final CIP-004-8 text, so treat the exact wording changes as something to confirm against NERC's and FERC's own published CIP-004-8 text before compliance planning.
A workable starting point
Build R5's revocation process around triggers, not a single deadlineA termination (24 hours for access removal, 30 days for account revocation) and a reassignment (next calendar day for unnecessary authorizations) are different events with different clocks — a single "offboarding SLA" that ignores the distinction will miss one of the two. Sequence R2 training before access, and track the 15-month retraining clock separatelyPart 2.2 (train-before-access) and Part 2.3 (15-month retraining) are two different obligations measured at two different points in an individual's access lifecycle. Don't conflate R3's two "seven year" referencesPart 3.2's seven-year criminal-history lookback and Part 3.5's seven-year PRA renewal cadence use the same number for different purposes — a PRA renewed on schedule still only needs a fresh seven-year lookback from the renewal date. Document contractor/vendor PRA equivalence explicitly (Part 3.4)rather than assuming a vendor's internal screening satisfies R3 by default — the standard requires either performing the PRA directly or obtaining documented confirmation of an equivalent one. Start tracking CIP-004-8 even though it isn't enforceable yetWith a FERC-approved 1 July 2028 compliance date already set, entities planning virtualized access-control infrastructure should evaluate Shared Cyber Infrastructure scoping now rather than retrofitting personnel and access programs later.
SoftWSP's OT asset and firmware assessments can help document the access management and personnel risk assessment evidence CIP-004 requires: see OT Snapshot.
This guide quotes NERC's own published text of CIP-004-7 and the Federal Register text of FERC Order No. 919; it is not a substitute for the full standard, NERC's Implementation Plan, or compliance/legal advice. CIP-004-7 remains the enforceable standard as of this guide's publication — CIP-004-8 is approved but not yet mandatory.
Sources
- NERC: CIP-004-7 — Cyber Security – Personnel & Training (currently effective standard, full text: Purpose, Applicability, Requirements R1-R5 with Tables, Compliance, Evidence Retention, Violation Severity Levels)
- NERC: 2023 CMEP and ORCP Annual Report — confirms "On January 1, 2024, CIP-004-7 and CIP-011-3 became effective and enforceable"
- Federal Register: Order No. 919; Virtualization Reliability Standards, 91 FR 13957-13965 (FERC, Docket No. RM24-8-000, issued 2026-03-19, published 2026-03-24, effective 2026-05-26) — lists CIP-004-8 among the 11 approved standards, with NERC's implementation plan formula
- NERC: CIP-004-8 — Project 2016-02 virtualization text (final FERC-approved revision; SCI/virtualization scoping additions to CIP-004-7)
Frequently asked questions
What is NERC CIP-004-7, and who must comply?
CIP-004, "Cyber Security — Personnel & Training," is the mandatory, FERC-approved NERC Reliability Standard governing who may access Bulk Electric System (BES) Cyber Systems and how utilities vet, train and offboard those people. Per its own Purpose clause it exists "to minimize the risk against compromise that could lead to misoperation or instability in the Bulk Electric System (BES) from individuals accessing BES Cyber Systems by requiring an appropriate level of personnel risk assessment, training, security awareness, and access management in support of protecting BES Cyber Systems." The currently enforceable version, CIP-004-7, originated from NERC Project 2019-02 (BES Cyber System Information Access Management) and was approved by FERC on 7 December 2021 via a Designated Letter Order in Docket No. RD21-6-000; per NERC's own 2023 CMEP and ORCP Annual Report, "CIP-004-7 and CIP-011-3 became effective" on 1 January 2024. Section 4.1 names seven "Responsible Entity" functional types — Balancing Authority, certain Distribution Providers, Generator Operator, Generator Owner, Reliability Coordinator, Transmission Operator and Transmission Owner — and the requirements apply to each entity's BES Cyber Systems categorized as high or medium impact under the separate CIP-002 process.
What do Requirements R1 and R2 (awareness and training) require?
R1 (Security Awareness Program, Lower VRF) has a single table part: Part 1.1 requires reinforcing cyber security practices for personnel with authorized electronic or unescorted physical access to applicable BES Cyber Systems "at least once each calendar quarter," through any means (not just formal training). R2 (Cyber Security Training Program, Lower VRF) is more prescriptive: Part 2.1 requires training content covering nine enumerated topics — including cyber security policies, physical and electronic access controls, visitor control programs, handling of BES Cyber System Information, identification of a Cyber Security Incident, recovery plans, incident response, and risks from electronic interconnectivity. Part 2.2 requires completing that training **before** granting authorized access, except under documented CIP Exceptional Circumstances. Part 2.3 requires retraining personnel with existing access "at least once every 15 calendar months."
What does Requirement R3 (personnel risk assessment) require, and how far back does the background check reach?
R3 (Medium VRF) requires a personnel risk assessment (PRA) before granting authorized electronic or unescorted physical access. Part 3.1 requires confirming identity. Part 3.2 is the headline numeric requirement: a "seven year criminal history records check" covering the individual's current residence for any duration of residency, and prior residences of seven years where the individual resided for six consecutive months or more. Part 3.4 requires that Responsible Entities using contractors or vendors for personnel either conduct the PRA themselves or obtain confirmation from the contracting/vendor organization that an equivalent PRA was already performed — the standard's own carve-out for the third-party staffing arrangements common at utilities and their vendors (see our guide to [NERC CIP-013 supply chain risk management](/guides/nerc-cip-013-supply-chain-risk-management/) for the parallel vendor-risk obligations). Part 3.5 requires renewing the PRA for personnel with existing authorized access "within the last seven years" — the same seven-year figure used for the records-check window itself, not a shorter re-screening cadence.
What do Requirements R4 and R5 (access management and revocation) require, and what are the exact revocation deadlines?
R4 (Access Management Program, Medium VRF) requires authorizing electronic access, unescorted physical access and access to designated storage locations for BES Cyber System Information based on need (Part 4.1), verifying that authorization records are correct "at least once each calendar quarter" (Part 4.2), and verifying that user accounts, user account groups and role categories, and their privileges, are correct and necessary "at least once every 15 calendar months" (Part 4.3). R5 (Access Revocation, Medium VRF) sets the standard's most citation-critical numeric deadlines, scoped to specific triggers: Part 5.1 requires initiating removal of a terminated individual's ability to use electronic and unescorted physical access **within 24 hours** of the termination action. Part 5.2 requires revoking the individual authorizations an entity determines are no longer necessary following a **reassignment or transfer**, by the end of the **next calendar day** following the determination. Part 5.3 requires revoking the individual user accounts of a terminated individual (except shared accounts) **within 30 calendar days** of the termination action. Part 5.4 requires changing passwords for shared accounts known to the terminated individual **within 30 calendar days**, or, where extenuating operating circumstances are documented, within 10 calendar days following the end of those circumstances. Evidence for all R1-R5 requirements must be retained for **three calendar years**.
Is CIP-004-7 already being replaced, and by when do entities need to comply?
Yes — a successor, CIP-004-8, is already FERC-approved, though CIP-004-7 remains the enforceable standard today. On 19 March 2026 the Federal Energy Regulatory Commission issued Order No. 919 (Docket No. RM24-8-000), which states it "seeks Commission approval of the following 11 modified CIP Reliability Standards," explicitly naming "CIP-004-8 (Cyber Security—Personnel & Training)" alongside CIP-002-7, CIP-003-10, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3 as part of NERC's Project 2016-02 virtualization package — published in the Federal Register on 24 March 2026 (91 FR 13957-13965), with the order itself stating "this final action is effective May 26, 2026." Per NERC's implementation plan for that package, the revised standards take effect on the later of 1 April 2026 or the first day of the first calendar quarter 24 months after the order's effective date — which computes to **1 July 2028**. CIP-004-8's R5 table preserves the same 24-hour/next-day/30-day/10-day timelines; the revision mainly adds Shared Cyber Infrastructure (SCI) scoping language to accommodate virtualized environments. This guide has not independently reviewed every redlined Part of the final CIP-004-8 text; confirm exact wording changes against NERC's and FERC's own published text before compliance planning.
In this cluster
