CIP-004-6 — Cyber Security – Personnel & Training
A. Introduction

1. Title:

Cyber Security — Personnel & Training

2. Number:

CIP-004-6

3. Purpose:
To minimize the risk against compromise that could lead to misoperation or
instability in the Bulk Electric System (BES) from individuals accessing BES Cyber Systems byrequiring an appropriate level of personnel risk assessment, training, and security awareness insupport of protecting BES Cyber Systems.
4. Applicability:
4.1.

Functional Entities: For the purpose of the requirements contained herein, the following
list of functional entities will be collectively referred to as “Responsible Entities.” Forrequirements in this standard where a specific functional entity or subset of functional
entities are the applicable entity or entities, the functional entity or entities are specified
explicitly.

4.1.1. Balancing Authority
4.1.2. Distribution Provider that owns one or more of the following Facilities, systems, andequipment for the protection or restoration of the BES:
4.1.2.1. Each underfrequency Load shedding (UFLS) or undervoltage Load shedding(UVLS) system that:
4.1.2.1.1. is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.1.2.1.2. performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation, of
300 MW or more.
4.1.2.2. Each Special Protection System (SPS) or Remedial Action Scheme (RAS) where
the SPS or RAS is subject to one or more requirements in a NERC or Regional
Reliability Standard.
4.1.2.3. Each Protection System (excluding UFLS and UVLS) that applies to Transmission
where the Protection System is subject to one or more requirements in a NERC
or Regional Reliability Standard.
4.1.2.4. Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.1.3. Generator Operator
4.1.4. Generator Owner
4.1.5. Interchange Coordinator or Interchange Authority

Page 1 of 46

CIP-004-6 — Cyber Security – Personnel & Training
4.1.6. Reliability Coordinator
4.1.7. Transmission Operator
4.1.8. Transmission Owner
4.2.

Facilities: For the purpose of the requirements contained herein, the following
Facilities, systems, and equipment owned by each Responsible Entity in 4.1 above arethose to which these requirements are applicable. For requirements in this standard
where a specific type of Facilities, system, or equipment or subset of Facilities, systems,
and equipment are applicable, these are specified explicitly.

4.2.1. Distribution Provider: One or more of the following Facilities, systems andequipment owned by the Distribution Provider for the protection or restoration of
the BES:4.2.1.1. Each UFLS or UVLS System that:
4.2.1.1.1. is part of a Load shedding program that is subject to one or more
requirements in a NERC or Regional Reliability Standard; and4.2.1.1.2. performs automatic Load shedding under a common control systemowned by the Responsible Entity, without human operator initiation, of
300 MW or more.
4.2.1.2. Each SPS or RAS where the SPS or RAS is subject to one or more requirements in
a NERC or Regional Reliability Standard.
4.2.1.3. Each Protection System (excluding UFLS and UVLS) that applies to Transmission
where the Protection System is subject to one or more requirements in a NERC
or Regional Reliability Standard.
4.2.1.4. Each Cranking Path and group of Elements meeting the initial switchingrequirements from a Blackstart Resource up to and including the firstinterconnection point of the starting station service of the next generation
unit(s) to be started.
4.2.2. Responsible Entities listed in 4.1 other than Distribution Providers:
All BES Facilities.
4.2.3. Exemptions: The following are exempt from Standard CIP-004-6:
4.2.3.1. Cyber Assets at Facilities regulated by the Canadian Nuclear Safety Commission.
4.2.3.2. Cyber Assets associated with communication networks and data
communication links between discrete Electronic Security Perimeters.
4.2.3.3. The systems, structures, and components that are regulated by the Nuclear
Regulatory Commission under a cyber security plan pursuant to 10 C.F.R.
Section 73.54.
4.2.3.4. For Distribution Providers, the systems and equipment that are not included in
section 4.2.1 above.

Page 2 of 46

CIP-004-6 — Cyber Security – Personnel & Training
4.2.3.5. Responsible Entities that identify that they have no BES Cyber Systems
categorized as high impact or medium impact according to the CIP-002-5.1
identification and categorization processes.
5. Effective Dates:
See Implementation Plan for CIP-004-6.
6. Background:Standard CIP-004 exists as part of a suite of CIP Standards related to cyber security, which
require the initial identification and categorization of BES Cyber Systems and require aminimum level of organizational, operational, and procedural controls to mitigate risk to BES
Cyber Systems.
Most requirements open with, “Each Responsible Entity shall implement one or more
documented [processes, plan, etc.] that include the applicable items in [Table Reference].” Thereferenced table requires the applicable items in the procedures for the common subject
matter of the requirements.
The term documented processes refers to a set of required instructions specific to the
Responsible Entity and to achieve a specific outcome. This term does not imply any particularnaming or approval structure beyond what is stated in the requirements. An entity should
include as much as it believes necessary in its documented processes, but it must address theapplicable requirements in the table.
The terms program and plan are sometimes used in place of documented processes where it
makes sense and is commonly understood. For example, documented processes describing a
response are typically referred to as plans (i.e., incident response plans and recovery plans).
Likewise, a security plan can describe an approach involving multiple procedures to address abroad subject matter.
Similarly, the term program may refer to the organization’s overall implementation of its
policies, plans and procedures involving a subject matter. Examples in the standards include
the personnel risk assessment program and the personnel training program. The full
implementation of the CIP Cyber Security Standards could also be referred to as a program.
However, the terms program and plan do not imply any additional requirements beyond whatis stated in the standards.
Responsible Entities can implement common controls that meet requirements for multiple highand medium impact BES Cyber Systems. For example, a single training program could meet therequirements for training personnel across multiple BES Cyber Systems.
Measures for the initial requirement are simply the documented processes themselves.
Measures in the table rows provide examples of evidence to show documentation andimplementation of applicable items in the documented processes. These measures serve toprovide guidance to entities in acceptable records of compliance and should not be viewed as
an all-inclusive list.

Page 3 of 46

CIP-004-6 — Cyber Security – Personnel & Training
Throughout the standards, unless otherwise stated, bulleted items in the requirements andmeasures are items that are linked with an “or,” and numbered items are items that are linked
with an “and.”Many references in the Applicability section use a threshold of 300 MW for UFLS and UVLS.
This particular threshold of 300 MW for UVLS and UFLS was provided in Version 1 of the CIP
Cyber Security Standards. The threshold remains at 300 MW since it is specifically addressing
UVLS and UFLS, which are last ditch efforts to save the BES. A review of UFLS tolerances definedwithin regional reliability standards for UFLS program requirements to date indicates that thehistorical value of 300 MW represents an adequate and reasonable threshold value forallowable UFLS operational tolerances.
“Applicable Systems” Columns in Tables:
Each table has an “Applicable Systems” column to further define the scope of systems to whicha specific requirement row applies. The CSO706 SDT adapted this concept from the National
Institute of Standards and Technology (“NIST”) Risk Management Framework as a way of
applying requirements more appropriately based on impact and connectivity characteristics.
The following conventions are used in the “Applicable Systems” column as described.
 High Impact BES Cyber Systems – Applies to BES Cyber Systems categorized as high impact
according to the CIP-002-5.1 identification and categorization processes.
 Medium Impact BES Cyber Systems – Applies to BES Cyber Systems categorized as medium
impact according to the CIP-002-5.1 identification and categorization processes.
 Medium Impact BES Cyber Systems with External Routable Connectivity – Only applies tomedium impact BES Cyber Systems with External Routable Connectivity. This also excludes
Cyber Assets in the BES Cyber System that cannot be directly accessed through External
Routable Connectivity.
 Electronic Access Control or Monitoring Systems (EACMS) – Applies to each Electronic
Access Control or Monitoring System associated with a referenced high impact BES Cyber
System or medium impact BES Cyber System. Examples may include, but are not limited to,
firewalls, authentication servers, and log monitoring and alerting systems.
 Physical Access Control Systems (PACS) – Applies to each Physical Access Control Systemassociated with a referenced high impact BES Cyber System or medium impact BES Cyber
System with External Routable Connectivity.

Page 4 of 46

CIP-004-6 — Cyber Security – Personnel & Training
B. Requirements and Measures

R1.

Each Responsible Entity shall implement one or more documented processes that collectively include each of theapplicable requirement parts in CIP-004-6 Table R1 – Security Awareness Program. [Violation Risk Factor: Lower] [TimeHorizon: Operations Planning]

M1. Evidence must include each of the applicable documented processes that collectively include each of the applicablerequirement parts in CIP-004-6 Table R1 – Security Awareness Program and additional evidence to demonstrate
implementation as described in the Measures column of the table.

CIP-004-6 Table R1 – Security Awareness Program
Part

Applicable Systems

1.1

High Impact BES Cyber Systems
Medium Impact BES Cyber Systems

Requirements

Measures

Security awareness that, at least once
each calendar quarter, reinforces cybersecurity practices (which may include
associated physical security practices)
for the Responsible Entity’s personnel
who have authorized electronic or
authorized unescorted physical accessto BES Cyber Systems.

An example of evidence may include,
but is not limited to, documentationthat the quarterly reinforcement has
been provided. Examples of evidenceof reinforcement may include, but are
not limited to, dated copies of
information used to reinforce security
awareness, as well as evidence ofdistribution, such as:Page 5 of 46

direct communications (forexample, e-mails, memos,
computer-based training); or
indirect communications (forexample, posters, intranet, or
brochures); or
management support andreinforcement (for example,
presentations or meetings).

CIP-004-6 — Cyber Security – Personnel & Training

R2. Each Responsible Entity shall implement one or more cyber security training program(s) appropriate to individual roles,
functions, or responsibilities that collectively includes each of the applicable requirement parts in CIP-004-6 Table R2 –Cyber Security Training Program. [Violation Risk Factor: Lower] [Time Horizon: Operations Planning]
M2. Evidence must include the training program that includes each of the applicable requirement parts in CIP-004-6 Table R2 –Cyber Security Training Program and additional evidence to demonstrate implementation of the program(s).

Page 6 of 46

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R2 – Cyber Security Training Program
Part
2.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Requirements

Measures

Training content on:
2.1.1. Cyber security policies;
2.1.2. Physical access controls;
2.1.3. Electronic access controls;
2.1.4. The visitor control program;
2.1.5. Handling of BES Cyber System
Information and its storage;
2.1.6. Identification of a Cyber
Security Incident and initial
notifications in accordancewith the entity’s incident
response plan;
2.1.7. Recovery plans for BES Cyber
Systems;
2.1.8. Response to Cyber Security
Incidents; and2.1.9. Cyber security risks associatedwith a BES Cyber System’s
electronic interconnectivity
and interoperability withother Cyber Assets, including
Transient Cyber Assets, andwith Removable Media.

Page 7 of 46

Examples of evidence may include,
but are not limited to, training
material such as power point
presentations, instructor notes,
student notes, handouts, or othertraining materials.

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R2 – Cyber Security Training Program
Part
2.2

Applicable Systems

Requirements

Measures

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Require completion of the training
specified in Part 2.1 prior to granting
authorized electronic access andauthorized unescorted physical accessto applicable Cyber Assets, except
during CIP Exceptional Circumstances.

Examples of evidence may include,
but are not limited to, training
records and documentation of when
CIP Exceptional Circumstances wereinvoked.

Require completion of the training
specified in Part 2.1 at least once
every 15 calendar months.

Examples of evidence may include,
but are not limited to, dated
individual training records.

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS
2.3

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS
Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Page 8 of 46

CIP-004-6 — Cyber Security – Personnel & Training
R3.

Each Responsible Entity shall implement one or more documented personnel risk assessment program(s) to attain andretain authorized electronic or authorized unescorted physical access to BES Cyber Systems that collectively include each of
the applicable requirement parts in CIP-004-6 Table R3 – Personnel Risk Assessment Program. [Violation Risk Factor:
Medium] [Time Horizon: Operations Planning].

M3. Evidence must include the documented personnel risk assessment programs that collectively include each of the applicablerequirement parts in CIP-004-6 Table R3 – Personnel Risk Assessment Program and additional evidence to demonstrate
implementation of the program(s).

CIP-004-6 Table R3 – Personnel Risk Assessment Program
Part

Applicable Systems

3.1

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Requirements

Measures

Process to confirm identity.

An example of evidence may
include, but is not limited to,
documentation of the Responsible
Entity’s process to confirm identity.

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 9 of 46

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R3 – Personnel Risk Assessment Program
Part
3.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Requirements

Measures

Process to perform a seven year
criminal history records check as part ofeach personnel risk assessment that
includes:An example of evidence may include,
but is not limited to, documentation of
the Responsible Entity’s process toperform a seven year criminal history
records check.

3.2.1. current residence, regardless ofduration; and3.2.2. other locations where, during
the seven years immediately prior to
the date of the criminal history
records check, the subject has resided
for six consecutive months or more.
If it is not possible to perform a fullseven year criminal history records
check, conduct as much of the sevenyear criminal history records check as
possible and document the reason thefull seven year criminal history records
check could not be performed.

Page 10 of 46

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R3 – Personnel Risk Assessment Program
Part

Applicable Systems

3.3High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Requirements

MeasuresCriteria or process to evaluate criminal
history records checks for authorizing
access.

An example of evidence may
include, but is not limited to,
documentation of the
Responsible Entity’s process toevaluate criminal history records
checks.

Criteria or process for verifying that
personnel risk assessments performed forcontractors or service vendors are
conducted according to Parts 3.1 through3.3.

An example of evidence may
include, but is not limited to,
documentation of the
Responsible Entity’s criteria orprocess for verifying contractors
or service vendors personnel risk
assessments.

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS
3.4

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 11 of 46

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R3 – Personnel Risk Assessment Program
Part

Applicable Systems

Requirements

Measures3.5

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Process to ensure that individuals withauthorized electronic or authorized
unescorted physical access have had apersonnel risk assessment completed
according to Parts 3.1 to 3.4 within the last
seven years.

An example of evidence may
include, but is not limited to,
documentation of the
Responsible Entity’s process for
ensuring that individuals withauthorized electronic or
authorized unescorted physicalaccess have had a personnel risk
assessment completed within thelast seven years.

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 12 of 46

CIP-004-6 — Cyber Security – Personnel & Training

R4. Each Responsible Entity shall implement one or more documented access management program(s) that collectively include
each of the applicable requirement parts in CIP-004-6 Table R4 – Access Management Program. [Violation Risk Factor:
Medium] [Time Horizon: Operations Planning and Same Day Operations].
M4. Evidence must include the documented processes that collectively include each of the applicable requirement parts in CIP004-6 Table R4 – Access Management Program and additional evidence to demonstrate that the access management
program was implemented as described in the Measures column of the table.

CIP-004-6 Table R4 – Access Management Program
Part

Applicable Systems

Requirements

Measures

4.1

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Process to authorize based on need, as
determined by the Responsible Entity,
except for CIP Exceptional
Circumstances:

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

4.1.1. Electronic access;4.1.2. Unescorted physical access into a
Physical Security Perimeter; and4.1.3. Access to designated storage
locations, whether physical orelectronic, for BES Cyber System
Information.

An example of evidence may
include, but is not limited to, dated
documentation of the process toauthorize electronic access,unescorted physical access in a
Physical Security Perimeter, andaccess to designated storage
locations, whether physical orelectronic, for BES Cyber System
Information.

Page 13 of 46

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R4 – Access Management Program
Part

Applicable Systems

Requirements

Measures

4.2

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Verify at least once each calendar
quarter that individuals with active
electronic access or unescorted physicalaccess have authorization records.

Examples of evidence may include,
but are not limited to:

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 14 of 46



Dated documentation of theverification between the systemgenerated list of individuals who
have been authorized for access(i.e., workflow database) and asystem generated list of
personnel who have access (i.e.,user account listing), or Dated documentation of theverification between a list of
individuals who have beenauthorized for access (i.e.,
authorization forms) and a listof individuals provisioned foraccess (i.e., provisioning forms
or shared account listing).

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R4 – Access Management Program
Part

Applicable Systems

Requirements

Measures

4.3

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACSFor electronic access, verify at least once
every 15 calendar months that all user
accounts, user account groups, or userrole categories, and their specific,
associated privileges are correct and arethose that the Responsible Entity
determines are necessary.

An example of evidence may
include, but is not limited to,
documentation of the review that
includes all of the following:

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 15 of 46

1. A dated listing of all
accounts/account groups orroles within the system;
2. A summary description ofprivileges associated witheach group or role;
3. Accounts assigned to thegroup or role; and4. Dated evidence showing
verification of the privileges
for the group are authorized
and appropriate to the work
function performed bypeople assigned to eachaccount.

CIP-004-6 — Cyber Security – Personnel & Training

CIP-004-6 Table R4 – Access Management Program
Part

Applicable Systems

Requirements

Measures

4.4

High Impact BES Cyber Systems and theirassociated:
1. EACMS; and2. PACS

Verify at least once every 15 calendar
months that access to the designatedstorage locations for BES Cyber System
Information, whether physical orelectronic, are correct and are those that
the Responsible Entity determines arenecessary for performing assigned work
functions.

An example of evidence may
include, but is not limited to, thedocumentation of the review that
includes all of the following:

Medium Impact BES Cyber Systems with
External Routable Connectivity and theirassociated:
1. EACMS; and2. PACS

Page 16 of 46

1. A dated listing ofauthorizations for BES Cyber
System information;
2. Any privileges associatedwith the authorizations; and3. Dated evidence showing averification of theauthorizations and any
privileges were confirmed
correct and the minimum
necessary for performing
assigned work functions.

CIP-004-6 — Cyber Security – Personnel & Training
R5. Each Responsible Entity shall implement one or more documented access revocation program(s) that collectively include
each of the applicable requirement parts in CIP-004-6 Table R5 – Access Revocation. [Violation Risk Factor: Medium] [TimeHorizon: Same Day Operations and Operations Planning].
M5. Evidence must include each of the applicable documented programs that collectively include each of the applicablerequirement parts in CIP-004-6 Table R5 – Access Revocation and additional evidence to demonstrate implementation as
described in the Measures column of the table.

CIP-004-6 Table R5 – Access Revocation
Part
5.1

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Requirements

Measures

A process to initiate removal of anindividual’s ability for unescorted
physical access and Interactive Remote
Access upon a termination action, andcomplete the removals within 24 hoursof the termination action (Removal of
the ability for access may be different
than deletion, disabling, revocation, or
removal of all access rights).

An example of evidence may include,
but is not limited to, documentation of
all of the following:

Page 17 of 46

1. Dated workflow or sign-off form
verifying access removal
associated with the termination
action; and2. Logs or other demonstration
showing such persons no longer
have access.

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R5 – Access Revocation
Part
5.2

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Requirements

Measures

For reassignments or transfers, revoke
the individual’s authorized electronic
access to individual accounts andauthorized unescorted physical accessthat the Responsible Entity determines
are not necessary by the end of thenext calendar day following the datethat the Responsible Entity determinesthat the individual no longer requires
retention of that access.

An example of evidence may include,
but is not limited to, documentation of
all of the following:

Page 18 of 46

1. Dated workflow or sign-off formshowing a review of logical andphysical access; and2. Logs or other demonstration
showing such persons no longer
have access that the
Responsible Entity determines
is not necessary.

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R5 – Access Revocation
Part

Applicable Systems

Requirements

Measures5.3

High Impact BES Cyber Systems andtheir associated:
1. EACMS; and2. PACS

For termination actions, revoke theindividual’s access to the designatedstorage locations for BES Cyber System
Information, whether physical orelectronic (unless already revokedaccording to Requirement R5.1), by theend of the next calendar day following
the effective date of the termination
action.

An example of evidence may include,
but is not limited to, workflow or signoff form verifying access removal todesignated physical areas or cybersystems containing BES Cyber System
Information associated with theterminations and dated within the next
calendar day of the termination action.

Medium Impact BES Cyber Systems
with External Routable Connectivity
and their associated:
1. EACMS; and2. PACS

Page 19 of 46

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R5 – Access Revocation
Part

Applicable Systems

Requirements

Measures

5.4

High Impact BES Cyber Systems andtheir associated:
 EACMSFor termination actions, revoke theindividual’s non-shared user accounts(unless already revoked according toParts 5.1 or 5.3) within 30 calendar
days of the effective date of thetermination action.

An example of evidence may include,
but is not limited to, workflow or signoff form showing access removal for
any individual BES Cyber Assets andsoftware applications as determined
necessary to completing the revocationof access and dated within thirty
calendar days of the termination
actions.

Page 20 of 46

CIP-004-6 — Cyber Security – Personnel & Training
CIP-004-6 Table R5 – Access Revocation
Part
5.5

Applicable Systems
High Impact BES Cyber Systems andtheir associated:
 EACMS

Requirements

Measures

For termination actions, change
Examples of evidence may include, butpasswords for shared account(s) known are not limited to:to the user within 30 calendar days of Workflow or sign-off form
the termination action. For
showing password reset withinreassignments or transfers, change
30 calendar days of thepasswords for shared account(s) known
termination;
to the user within 30 calendar days
 Workflow or sign-off form
following the date that the Responsible
showing password reset within
Entity determines that the individual no
30 calendar days of thelonger requires retention of thatreassignments or transfers; oraccess.
 Documentation of theextenuating operating
If the Responsible Entity determines
circumstance and workflow or
and documents that extenuating
sign-off form showing password
operating circumstances require a
reset within 10 calendar days
longer time period, change thefollowing the end of thepassword(s) within 10 calendar days
operating circumstance.
following the end of the operating
circumstances.

Page 21 of 46

CIP-004-6 — Cyber Security – Personnel & Training
C. Compliance1. Compliance Monitoring Process:1.1. Compliance Enforcement Authority:
As defined in the NERC Rules of Procedure, “Compliance Enforcement Authority” (CEA)
means NERC or the Regional Entity in their respective roles of monitoring and enforcing
compliance with the NERC Reliability Standards.
1.2. Evidence Retention:
The following evidence retention periods identify the period of time an entity isrequired to retain specific evidence to demonstrate compliance. For instances where
the evidence retention period specified below is shorter than the time since the lastaudit, the CEA may ask an entity to provide other evidence to show that it wascompliant for the full time period since the last audit.
The Responsible Entity shall keep data or evidence to show compliance as identified
below unless directed by its CEA to retain specific evidence for a longer period of time
as part of an investigation:
Each Responsible Entity shall retain evidence of each requirement in this standard forthree calendar years.



If a Responsible Entity is found non-compliant, it shall keep information related to thenon-compliance until mitigation is complete and approved or for the time specified
above, whichever is longer.



The CEA shall keep the last audit records and all requested and submitted subsequent
audit records.

1.3. Compliance Monitoring and Assessment Processes:
Compliance Audits
Self-Certifications
Spot Checking
Compliance Violation Investigations
Self-Reporting
Complaints
1.4. Additional Compliance Information:
None

Page 22 of 46

CIP-004-6 — Cyber Security – Personnel & Training
2. Table of Compliance Elements
R#

R1

R2

Time
Horizon

VRF

Operations
Planning

Lower

Operations
Planning

Violation Severity Levels (CIP-004-6)
Lower VSL

Lower

Moderate VSLHigh VSL

Severe VSL

TheResponsible
Entity did not
reinforce cybersecuritypracticesduring acalendarquarter but did
so less than 10
calendar days
after the startof asubsequentcalendarquarter. (1.1)

The Responsible Entity
did not reinforce cybersecurity practices during
a calendar quarter but
did so between 10 and
30 calendar days after
the start of asubsequent calendar
quarter. (1.1)

The Responsible Entity
did not reinforce cybersecurity practices during
a calendar quarter but
did so within thesubsequent quarter but
beyond 30 calendar
days after the start ofthat calendar quarter.
(1.1)

The Responsible Entity
did not document or
implement any security
awareness process(es)to reinforce cybersecurity practices. (R1)

The
Responsible
Entityimplemented acyber security
training
program but
failed toinclude one of
the training

The Responsible Entity
implemented a cybersecurity training
program but failed toinclude two of the
training content topics
in Requirement Parts
2.1.1 through 2.1.9.
(2.1)

The Responsible Entity
implemented a cybersecurity training
program but failed toinclude three of the
training content topics
in Requirement Parts
2.1.1 through 2.1.9.
(2.1)

The Responsible Entity
did not implement acyber security training
program appropriate toindividual roles,
functions, or
responsibilities. (R2)OR

OR

Page 23 of 46

OR
The Responsible Entity
did not reinforce cybersecurity practices andassociated physicalsecurity practices for atleast two consecutive
calendar quarters. (1.1)

OR

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
content topics
in Requirement
Parts 2.1.1
through 2.1.9.
(2.1)
OR
The
Responsible
Entityimplemented acyber security
training
program but
failed to train
one individual(with theexception of
CIP Exceptional
Circumstances)prior to their
being granted
authorized
electronic andauthorized
unescorted
physical access.
(2.2)

Moderate VSLHigh VSLThe Responsible Entity
implemented a cybersecurity training
program but failed totrain two individuals(with the exception of
CIP Exceptional
Circumstances) prior totheir being granted
authorized electronic
and authorized
unescorted physicalaccess. (2.2)

The Responsible Entity
implemented a cybersecurity training
program but failed totrain three individuals(with the exception of
CIP Exceptional
Circumstances) prior totheir being granted
authorized electronic
and authorized
unescorted physicalaccess. (2.2)

OR

OR

The Responsible Entity
implemented a cybersecurity training
program but failed totrain two individuals
with authorized
electronic or authorized
unescorted physicalaccess within 15
calendar months of theprevious training
completion date. (2.3)

The Responsible Entity
implemented a cybersecurity training
program but failed totrain three individuals
with authorized
electronic or authorized
unescorted physicalaccess within 15
calendar months of theprevious training
completion date. (2.3)

Page 24 of 46

Severe VSL
The Responsible Entity
implemented a cybersecurity training
program but failed toinclude four or more of
the training content
topics in Requirement
Parts 2.1.1 through2.1.9. (2.1)
OR
The Responsible Entity
implemented a cybersecurity training
program but failed totrain four or moreindividuals (with the
exception of CIP
Exceptional
Circumstances) prior totheir being granted
authorized electronic
and authorized
unescorted physicalaccess. (2.2)
OR

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL

Moderate VSLHigh VSLORThe Responsible Entity
implemented a cybersecurity training
program but failed totrain four or moreindividuals withauthorized electronic or
authorized unescorted
physical access within
15 calendar months ofthe previous training
completion date. (2.3)

The
Responsible
Entityimplemented acyber security
training
program but
failed to train
one individualwith authorized
electronic or
authorized
unescorted
physical accesswithin 15
calendarmonths of theprevious
training
completion
date. (2.3)
R3

Operations
Planning

MediumThe
Responsible
Entity has a
program for
conducting

Severe VSL

The Responsible Entity
has a program for
conducting Personnel
Risk Assessments (PRAs)
for individuals, including

The Responsible Entity
has a program for
conducting Personnel
Risk Assessments (PRAs)
for individuals, including

Page 25 of 46

The Responsible Entity
did not have all of therequired elements as
described by 3.1
through 3.4 includedCIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
Personnel Risk
Assessments(PRAs) for
individuals,
includingcontractors andservicevendors, but
did not conduct
the PRA as acondition of
granting
authorized
electronic or
authorized
unescorted
physical accessfor oneindividual. (R3)OR
The
Responsible
Entity did
conduct
Personnel Risk
Assessments(PRAs) for
individuals,

Moderate VSL
contractors and service
vendors, but did notconduct the PRA as acondition of granting
authorized electronic or
authorized unescorted
physical access for two
individuals. (R3)High VSL
contractors and service
vendors, but did notconduct the PRA as acondition of granting
authorized electronic or
authorized unescorted
physical access for three
individuals. (R3)OR

OR

The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not confirm identity for
two individuals. (3.1 &3.4)

The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not confirm identity forthree individuals. (3.1 &
3.4)

OR

OR

The Responsible Entity
has a process toperform seven-year
criminal history record
checks for individuals,

The Responsible Entity
has a process toperform seven-year
criminal history record
checks for individuals,

Page 26 of 46

Severe VSL
within documented
program(s) for
implementing Personnel
Risk Assessments(PRAs), for individuals,
including contractors
and service vendors, forobtaining and retaining
authorized cyber orauthorized unescorted
physical access. (R3)ORThe Responsible Entity
has a program for
conducting Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, but did notconduct the PRA as acondition of granting
authorized electronic or
authorized unescorted
physical access for fouror more individuals. (R3)OR

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
includingcontractors andservicevendors, withauthorized
electronic or
authorized
unescorted
physical accessbut did notconfirm
identity for one
individual. (3.1
& 3.4)OR

Moderate VSL
including contractors
and service vendors,with authorized
electronic or authorized
unescorted physicalaccess but did notinclude the required
checks described in
3.2.1 and 3.2.2 for two
individuals. (3.2 & 3.4)

High VSL
including contractors
and service vendors,with authorized
electronic or authorized
unescorted physicalaccess but did notinclude the required
checks described in
3.2.1 and 3.2.2 for three
individuals. (3.2 & 3.4)

OR

OR

The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not evaluate criminal
history records checkfor access authorization
for two individuals. (3.3
& 3.4)The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not evaluate criminal
history records checkfor access authorization
for three individuals.
(3.3 & 3.4)

The
Responsible
Entity has aprocess toperform sevenyear criminal
history record
checks forindividuals,
includingcontractors and OR
servicevendors, withOR

Page 27 of 46

Severe VSL
The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not confirm identity for
four or moreindividuals. (3.1 & 3.4)
OR
The Responsible Entity
has a process toperform seven-year
criminal history record
checks for individuals,
including contractors
and service vendors,with authorized
electronic or authorized
unescorted physicalaccess but did notinclude the required
checks described in
3.2.1 and 3.2.2 for fourCIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
authorized
electronic or
authorized
unescorted
physical accessbut did notinclude therequiredchecksdescribed in
3.2.1 and 3.2.2
for oneindividual. (3.2
& 3.4)

Moderate VSL
The Responsible Entity
did not conduct
Personnel Risk
Assessments (PRAs) for
two individuals withauthorized electronic or
authorized unescorted
physical access within 7
calendar years of theprevious PRA
completion date. (3.5)

High VSLThe Responsible Entity
did not conduct
Personnel Risk
Assessments (PRAs) for
three individuals withauthorized electronic or
authorized unescorted
physical access within 7
calendar years of theprevious PRA
completion date. (3.5)

OR
The
Responsible
Entity did
conduct
Personnel Risk
Assessments(PRAs) for
individuals,
includingcontractors andservicevendors, withauthorized

Severe VSL
or more individuals. (3.2
& 3.4)OR
The Responsible Entity
did conduct Personnel
Risk Assessments (PRAs)
for individuals, including
contractors and service
vendors, withauthorized electronic or
authorized unescorted
physical access but did
not evaluate criminal
history records checkfor access authorization
for four or moreindividuals. (3.3 & 3.4)
OR
The Responsible Entity
did not conduct
Personnel Risk
Assessments (PRAs) for
four or more individuals
with authorized
electronic or authorized
unescorted physicalaccess within 7 calendar

Page 28 of 46

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
electronic or
authorized
unescorted
physical accessbut did notevaluate
criminal history
records checkfor accessauthorizationfor oneindividual. (3.3
& 3.4)

Moderate VSL

OR
The
Responsible
Entity did notconduct
Personnel Risk
Assessments(PRAs) for one
individual withauthorized
electronic or
authorized
unescorted
physical accesswithin 7

Page 29 of 46

High VSL

Severe VSL
years of the previous
PRA completion date.
(3.5)

CIP-004-6 — Cyber Security – Personnel & Training

R#

R4

Time
Horizon

VRF

Operations
Planning
and SameDay
Operations

MediumViolation Severity Levels (CIP-004-6)
Lower VSL
calendar yearsof the previous
PRA
completion
date. (3.5)

Moderate VSLHigh VSL

The
Responsible
Entity did notverify that
individuals withactiveelectronic or
activeunescorted
physical accesshave
authorization
records during
a calendar
quarter but did
so less than 10
calendar days
after the startof asubsequentcalendarquarter. (4.2)

The Responsible Entity
did not verify that
individuals with active
electronic or active
unescorted physicalaccess haveauthorization records
during a calendar
quarter but did so
between 10 and 20
calendar days after thestart of a subsequentcalendar quarter. (4.2)

The Responsible Entity
did not verify that
individuals with active
electronic or active
unescorted physicalaccess haveauthorization records
during a calendar
quarter but did so
between 20 and 30
calendar days after thestart of a subsequentcalendar quarter. (4.2)

OR

OR

The Responsible Entity
has implemented
processes to verify thatuser accounts, user
account groups, or userrole categories, andtheir specific, associatedprivileges are correct

The Responsible Entity
has implemented
processes to verify thatuser accounts, user
account groups, or userrole categories, andtheir specific, associatedprivileges are correct

Page 30 of 46

Severe VSL

The Responsible Entity
did not implement any
documented program(s)for access management.
(R4)
OR
The Responsible Entity
has implemented one ormore documented
program(s) for accessmanagement that
includes a process toauthorize electronic
access, unescorted
physical access, oraccess to the designatedstorage locations where
BES Cyber System
Information is located.
(4.1)

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
OR
The
Responsible
Entity has
implemented
processes toverify that user
accounts, user
account
groups, or userrole categories,
and their
specific,
associatedprivileges arecorrect andnecessary
within 15
calendarmonths of theprevious
verification but
for 5% or lessof its BES Cyber
Systems,
privileges wereincorrect orModerate VSL
and necessary within 15
calendar months of theprevious verification but
for more than 5% but
less than (or equal to)
10% of its BES Cyber
Systems, privileges wereincorrect or
unnecessary. (4.3)

High VSL
and necessary within 15
calendar months of theprevious verification but
for more than 10% but
less than (or equal to)
15% of its BES Cyber
Systems, privileges wereincorrect or
unnecessary. (4.3)

OR

OR

The Responsible Entity
has implemented
processes to verify thataccess to the designatedstorage locations for
BES Cyber System
Information is correct
and necessary within 15
calendar months of theprevious verification but
for more than 5% but
less than (or equal to)
10% of its BES Cyber
System Information
storage locations,privileges were

The Responsible Entity
has implemented
processes to verify thataccess to the designatedstorage locations for
BES Cyber System
Information is correct
and necessary within 15
calendar months of theprevious verification but
for more than 10% but
less than (or equal to)
15% of its BES Cyber
System Information
storage locations,privileges were

Page 31 of 46

Severe VSL
OR
The Responsible Entity
did not verify that
individuals with active
electronic or active
unescorted physicalaccess haveauthorization records
for at least twoconsecutive calendar
quarters. (4.2)
OR
The Responsible Entity
has implemented
processes to verify thatuser accounts, user
account groups, or userrole categories, andtheir specific, associatedprivileges are correct
and necessary within 15
calendar months of theprevious verification but
for more than 15% of its
BES Cyber Systems,
privileges were

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
unnecessary.
(4.3)
OR

Moderate VSL
incorrect or
unnecessary. (4.4)

High VSL
incorrect or
unnecessary. (4.4)

Severe VSL
incorrect or
unnecessary. (4.3)
OR

The
Responsible
Entity has
implemented
processes toverify thataccess to thedesignatedstoragelocations for
BES Cyber
SystemInformation iscorrect andnecessary
within 15
calendarmonths of theprevious
verification but
for 5% or lessof its BES Cyber
SystemInformation
storage

The Responsible Entity
has implemented
processes to verify thataccess to the designatedstorage locations for
BES Cyber System
Information is correct
and necessary within 15
calendar months of theprevious verification but
for more than 15% of its
BES Cyber System
Information storage
locations, privileges
were incorrect or
unnecessary. (4.4)

Page 32 of 46

CIP-004-6 — Cyber Security – Personnel & Training

R#

R5

Time
HorizonVRF

Same Day
Operations

MediumandOperations
Planning

Violation Severity Levels (CIP-004-6)
Lower VSL
locations,privileges wereincorrect or
unnecessary.
(4.4)
The
Responsible
Entity has
implemented
one or more
process(es) to
revoke theindividual’s
access to thedesignatedstoragelocations for
BES Cyber
SystemInformation
but, for one
individual, did
not do so by
the end of thenext calendar
day following
the effective
date and time

Moderate VSL

The Responsible Entity
has implemented one ormore process(es) toremove the ability forunescorted physicalaccess and Interactive
Remote Access upon atermination action orcomplete the removal
within 24 hours of thetermination action but
did not initiate thoseremovals for one
individual. (5.1)

High VSLThe Responsible Entity
has implemented one ormore process(es) toremove the ability forunescorted physicalaccess and Interactive
Remote Access upon atermination action orcomplete the removal
within 24 hours of thetermination action but
did not initiate thoseremovals for two
individuals. (5.1)

Severe VSL

The Responsible Entity
has not implemented
any documented
program(s) for accessrevocation for electronic
access, unescorted
physical access, or BES
Cyber System
Information storage
locations. (R5)ORThe Responsible Entity
has implemented one ormore process(es) toremove the ability forOROR
unescorted physicalaccess and Interactive
The Responsible Entity
The Responsible Entity
has implemented one or has implemented one or Remote Access upon atermination action ormore process(es) tomore process(es) tocomplete the removal
determine that an
determine that anwithin 24 hours of theindividual no longer
individual no longer
termination action but
requires retention ofrequires retention of
did not initiate thosePage 33 of 46

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSLof thetermination
action. (5.3)
OR
The
Responsible
Entity has
implemented
one or more
process(es) to
revoke theindividual’suser accounts
upontermination
action but did
not do so forwithin 30
calendar daysof the date of
termination
action for one
or moreindividuals.
(5.4)
OR

Moderate VSL
access following
reassignments ortransfers but, for one
individual, did not
revoke the authorized
electronic access toindividual accounts andauthorized unescorted
physical access by theend of the next calendar
day following thepredetermined date.
(5.2)

High VSL
access following
reassignments ortransfers but, for two
individuals, did not
revoke the authorized
electronic access toindividual accounts andauthorized unescorted
physical access by theend of the next calendar
day following thepredetermined date.
(5.2)

Severe VSL
removals for three ormore individuals. (5.1)
OR

The Responsible Entity
has implemented one ormore process(es) todetermine that anindividual no longer
requires retention ofaccess following
reassignments ortransfers but, for threeor more individuals, didOROR
not revoke the
The Responsible Entity
The Responsible Entity
authorized electronic
has implemented one or has implemented one or access to individual
more process(es) tomore process(es) toaccounts and authorized
revoke the individual’s
revoke the individual’s
unescorted physicalaccess to the designated access to the designated access by the end of thestorage locations forstorage locations fornext calendar day
BES Cyber System
BES Cyber Systemfollowing theInformation but, for two Information but, forpredetermined date.
individuals, did not do
three or more
(5.2)
so by the end of theindividuals, did not donext calendar day
so by the end of thefollowing the effective
next calendar day
date and time of thefollowing the effective

Page 34 of 46

CIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
The
Responsible
Entity has
implemented
one or more
process(es) tochangepasswords forsharedaccounts
known to theuser upon
termination
action,reassignment,
or transfer, but
did not do sofor within 30
calendar daysof the date of
termination
action,reassignment,
or transfer for
one or moreindividuals.
(5.5)

Moderate VSL
termination action.
(5.3)

High VSL
date and time of thetermination action. (5.3)

ORPage 35 of 46

Severe VSLCIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL

Moderate VSL

TheResponsible
Entity has
implemented
one or more
process(es) todetermine anddocument
extenuating
operatingcircumstances
following atermination
action,reassignment,
or transfer, but
did not change
one or morepasswords forsharedaccounts
known to theuser within 10
calendar days
following theend of theextenuating
operating

Page 36 of 46

High VSL

Severe VSLCIP-004-6 — Cyber Security – Personnel & Training

R#

Time
Horizon

VRF

Violation Severity Levels (CIP-004-6)
Lower VSL
circumstances.
(5.5)

Moderate VSL

Page 37 of 46

High VSL

Severe VSL

Guidelines and Technical Basis
D. Regional Variances

None.
E. Interpretations

None.
F. Associated Documents

None.

Version History
VersionDate

Action1

1/16/06

R3.2 — Change “Control Center” to“control center.”2

9/30/09

Modifications to clarify therequirements and to bring thecompliance elements into conformancewith the latest guidelines for developing
compliance elements of standards.

Change Tracking
3/24/06

Removal of reasonable businessjudgment.
Replaced the RRO with the RE as a
responsible entity.
Rewording of Effective Date.
Changed compliance monitor toCompliance Enforcement Authority.
3

12/16/09

Updated Version Number from -2 to -3
In Requirement 1.6, deleted thesentence pertaining to removing
component or system from service inorder to perform testing, in response to
FERC order issued September 30, 2009.

3

12/16/09

3

3/31/104

1/24/11

Approved by the NERC Board ofTrustees.
Approved by FERC.
Approved by the NERC Board ofTrustees.

Page 38 of 46

Guidelines and Technical Basis

VersionDate

ActionChange Tracking

5

11/26/12

Adopted by the NERC Board ofTrustees.

5

11/22/13

FERC Order issued approving CIP-004-5.

5.1

9/30/13

Modified two VSLs in R4

Errata6

11/13/14

Adopted by the NERC Board ofTrustees.

Addressed two
FERC directives
from Order No.
791 related to
identify, assess,and correct
language andcommunication
networks.

6

2/12/15

Adopted by the NERC Board ofTrustees.

Replaces theversion adopted
by the Board on
11/13/2014.
Revised version
addresses
remaining
directives from
Order No. 791
related totransient devices
and low impact
BES Cyber
Systems.

6

1/21/16

FERC order issued approving CIP-004-6.
Docket No. RM15-14-000

Modified tocoordinate withother CIP
standards and torevise format touse RBS
Template.

Page 39 of 46

Guidelines and Technical Basis
Guidelines and Technical Basis
Section 4 – Scope of Applicability of the CIP Cyber Security Standards
Section “4. Applicability” of the standards provides important information for Responsible
Entities to determine the scope of the applicability of the CIP Cyber Security Requirements.
Section “4.1. Functional Entities” is a list of NERC functional entities to which the standard
applies. If the entity is registered as one or more of the functional entities listed in Section 4.1,
then the NERC CIP Cyber Security Standards apply. Note that there is a qualification in Section
4.1 that restricts the applicability in the case of Distribution Providers to only those that own
certain types of systems and equipment listed in 4.2.
Section “4.2. Facilities” defines the scope of the Facilities, systems, and equipment owned by
the Responsible Entity, as qualified in Section 4.1, that is subject to the requirements of thestandard. As specified in the exemption section 4.2.3.5, this standard does not apply to
Responsible Entities that do not have High Impact or Medium Impact BES Cyber Systems under
CIP-002-5.1’s categorization. In addition to the set of BES Facilities, Control Centers, and othersystems and equipment, the list includes the set of systems and equipment owned byDistribution Providers. While the NERC Glossary term “Facilities” already includes the BES
characteristic, the additional use of the term BES here is meant to reinforce the scope of
applicability of these Facilities where it is used, especially in this applicability scoping section.
This in effect sets the scope of Facilities, systems, and equipment that is subject to thestandards.
Requirement R1:
The security awareness program is intended to be an informational program, not a formal
training program. It should reinforce security practices to ensure that personnel maintainawareness of best practices for both physical and electronic security to protect its BES Cyber
Systems. The Responsible Entity is not required to provide records that show that eachindividual received or understood the information, but they must maintain documentation of
the program materials utilized in the form of posters, memos, and/or presentations.
Examples of possible mechanisms and evidence, when dated, which can be used are:•Direct communications (e.g., emails, memos, computer based training, etc.);•

Indirect communications (e.g., posters, intranet, brochures, etc.);•

Management support and reinforcement (e.g., presentations, meetings, etc.).

Requirement R2:
Training shall cover the policies, access controls, and procedures as developed for the BES
Cyber Systems and include, at a minimum, the required items appropriate to personnel roles
and responsibilities from Table R2. The Responsible Entity has the flexibility to define thetraining program and it may consist of multiple modules and multiple delivery mechanisms, but

Page 40 of 46

Guidelines and Technical Basisa single training program for all individuals needing to be trained is acceptable. The training
can focus on functions, roles or responsibilities at the discretion of the Responsible Entity.
One new element in the training content is intended to encompass networking hardware andsoftware and other issues of electronic interconnectivity supporting the operation and controlof BES Cyber Systems as per FERC Order No. 706, Paragraph 434. Additionally, training should
address the risk posed when connecting and using Transient Cyber Assets and Removable
Media with BES Cyber Systems or within an Electronic Security Perimeter. As noted in FERC
Order No. 791, Paragraph 135, Transient Cyber Assets and Removable Media have been thesource of incidents where malware was introduced into electric generation industrial control
systems in real-world situations. Training on their use is a key element in protecting BES Cyber
Systems. This is not intended to provide technical training to individuals supporting networking
hardware and software, but educating system users of the cyber security risks associated with
the interconnectedness of these systems. The users, based on their function, role, or
responsibility, should have a basic understanding of which systems can be accessed from othersystems and how the actions they take can affect cyber security.
Each Responsible Entity shall ensure all personnel who are granted authorized electronic accessand/or authorized unescorted physical access to its BES Cyber Systems, including contractors
and service vendors, complete cyber security training prior to their being granted authorizedaccess, except for CIP Exceptional Circumstances. To retain the authorized accesses, individuals
must complete the training at least one every 15 months.
Requirement R3:
Each Responsible Entity shall ensure a personnel risk assessment is performed for all personnel
who are granted authorized electronic access and/or authorized unescorted physical access to
its BES Cyber Systems, including contractors and service vendors, prior to their being granted
authorized access, except for program specified exceptional circumstances that are approvedby the single senior management official or their delegate and impact the reliability of the BES
or emergency response. Identity should be confirmed in accordance with federal, state,provincial, and local laws, and subject to existing collective bargaining unit agreements.
Identity only needs to be confirmed prior to initially granting access and only requires periodic
confirmation according to the entity’s process during the tenure of employment, which may or
may not be the same as the initial verification action.
A seven year criminal history check should be performed for those locations where theindividual has resided for at least six consecutive months. This check should also be performedin accordance with federal, state, provincial, and local laws, and subject to existing collective
bargaining unit agreements. When it is not possible to perform a full seven year criminal
history check, documentation must be made of what criminal history check was performed, andthe reasons a full seven-year check could not be performed. Examples of this could include
individuals under the age of 25 where a juvenile criminal history may be protected by law,individuals who may have resided in locations from where it is not possible to obtain a criminal
history records check, violates the law or is not allowed under the existing collective bargaining
agreement. The Responsible Entity should consider the absence of information for the fullseven years when assessing the risk of granting access during the process to evaluate thePage 41 of 46

Guidelines and Technical Basis
criminal history check. There needs to be a personnel risk assessment that has been completed
within the last seven years for each individual with access. A new criminal history records checkmust be performed as part of the new PRA. Individuals who have been granted access under aprevious version of these standards need a new PRA within seven years of the date of their last
PRA. The clarifications around the seven year criminal history check in this version do not
require a new PRA be performed by the implementation date.
Requirement R4:
Authorization for electronic and unescorted physical access and access to BES Cyber System
Information must be on the basis of necessity in the individual performing a work function.
Documentation showing the authorization should have some justification of the business needincluded. To ensure proper segregation of duties, access authorization and provisioning should
not be performed by the same person where possible.
This requirement specifies both quarterly reviews and reviews at least once every 15 calendar
months. Quarterly reviews are to perform a validation that only authorized users have been
granted access to BES Cyber Systems. This is achieved by comparing individuals actuallyprovisioned to a BES Cyber System against records of individuals authorized to the BES Cyber
System. The focus of this requirement is on the integrity of provisioning access rather than
individual accounts on all BES Cyber Assets. The list of provisioned individuals can be an
automatically generated account listing. However, in a BES Cyber System with several accountdatabases, the list of provisioned individuals may come from other records such as provisioning
workflow or a user account database where provisioning typically initiates.
The privilege review at least once every 15 calendar months is more detailed to ensure an
individual’s associated privileges are the minimum necessary to perform their work function(i.e., least privilege). Entities can more efficiently perform this review by implementing rolebased access. This involves determining the specific roles on the system (e.g., system operator,
technician, report viewer, administrator, etc.) then grouping access privileges to the role andassigning users to the role. Role-based access does not assume any specific software and canbe implemented by defining specific provisioning processes for each role where access group
1/1
1) Quarterly access review2) privilege review (at least once every
15 calendar months)
3) BES Cyber
System Information
review (at least once every
4/1
15 calendar months)
Quarterly access review

2/1
1/1

3/1

4/1

7/1
Quarterly access review

5/1

6/1

7/1

1/1
1) Quarterly access review2) privilege review(at least once every
15 calendar months)
3) BES Cyber System
Information review(at least once every
15 calendar months)

10/1
Quarterly access review

8/1

9/1

10/1

11/1

12/1
1/1

Page 42 of 46

Guidelines and Technical Basisassignments cannot be performed. Role-based access permissions eliminate the need toperform the privilege review on individual accounts. An example timeline of all the reviews in
Requirement R4 is included below.
Separation of duties should be considered when performing the reviews in Requirement R4.
The person reviewing should be different than the person provisioning access.
If the results of quarterly or at least once every 15 calendar months account reviews indicate anadministrative or clerical error in which access was not actually provisioned, then the SDT
intends that this error should not be considered a violation of this requirement.
For BES Cyber Systems that do not have user accounts defined, the controls listed in
Requirement R4 are not applicable. However, the Responsible Entity should document suchconfigurations.
Requirement R5:
The requirement to revoke access at the time of the termination action includes procedures
showing revocation of access concurrent with the termination action. This requirement
recognizes that the timing of the termination action may vary depending on the circumstance.
Some common scenarios and possible processes on when the termination action occurs areprovided in the following table. These scenarios are not an exhaustive list of all scenarios, but
are representative of several routine business practices.

Scenario

Possible Process

Immediate involuntarytermination

Human resources or corporate security escorts the individual
off site and the supervisor or human resources personnel
notify the appropriate personnel to begin the revocation
process.

Scheduled involuntarytermination

Human resources personnel are notified of the termination
and work with appropriate personnel to schedule therevocation of access at the time of termination.

Voluntary termination

Human resources personnel are notified of the termination
and work with appropriate personnel to schedule therevocation of access at the time of termination.

Retirement where the lastworking day is several weeks
prior to the termination date

Human resources personnel coordinate with manager todetermine the final date access is no longer needed andschedule the revocation of access on the determined day.

Death

Human resources personnel are notified of the death andwork with appropriate personnel to begin the revocation
process.

Page 43 of 46

Guidelines and Technical Basis
Revocation of electronic access should be understood to mean a process with the end resultthat electronic access to BES Cyber Systems is no longer possible using credentials assigned toor known by the individual(s) whose access privileges are being revoked. Steps taken toaccomplish this outcome may include deletion or deactivation of accounts used by theindividual(s), but no specific actions are prescribed. Entities should consider the ramificationsof deleting an account may include incomplete event log entries due to an unrecognizedaccount or system services using the account to log on.
The initial revocation required in Requirement R5.1 includes unescorted physical access andInteractive Remote Access. These two actions should prevent any further access by theindividual after termination. If an individual still has local access accounts (i.e., accounts on the
Cyber Asset itself) on BES Cyber Assets, then the Responsible Entity has 30 days to complete therevocation process for those accounts. However, nothing prevents a Responsible Entity fromperforming all of the access revocation at the time of termination.
For transferred or reassigned individuals, a review of access privileges should be performed.
This review could entail a simple listing of all authorizations for an individual and working withthe respective managers to determine which access will still be needed in the new position. For
instances in which the individual still needs to retain access as part of a transitory period, theentity should schedule a time to review these access privileges or include the privileges in thequarterly account review or annual privilege review.
Revocation of access to shared accounts is called out separately to prevent the situation where
passwords on substation and generation devices are constantly changed due to staff turnover.
Requirement 5.5 specified that passwords for shared account are to the changed within 30
calendar days of the termination action or when the Responsible Entity determines anindividual no longer requires access to the account as a result of a reassignment or transfer.
The 30 days applies under normal operating conditions. However, circumstances may occur
where this is not possible. Some systems may require an outage or reboot of the system inorder to complete the password change. In periods of extreme heat or cold, many Responsible
Entities may prohibit system outages and reboots in order to maintain reliability of the BES.
When these circumstances occur, the Responsible Entity must document these circumstancesand prepare to change the password within 10 calendar days following the end of the operating
circumstances. Records of activities must be retained to show that the Responsible Entity
followed the plan they created.
Rationale:

During development of this standard, text boxes were embedded within the standard to explain
the rationale for various parts of the standard. Upon BOT approval, the text from the rationale
text boxes was moved to this section.
Rationale for Requirement R1:
Ensures that Responsible Entities with personnel who have authorized electronic or authorized
unescorted physical access to BES Cyber Assets take action so that those personnel with such

Page 44 of 46

Guidelines and Technical Basisauthorized electronic or authorized unescorted physical access maintain awareness of the
Responsible Entity’s security practices.
Rationale for Requirement R2:
To ensure that the Responsible Entity’s training program for personnel who need authorized
electronic access and/or authorized unescorted physical access to BES Cyber Systems covers
the proper policies, access controls, and procedures to protect BES Cyber Systems and aretrained before access is authorized.
Rationale for Requirement R3:
To ensure that individuals who need authorized electronic or authorized unescorted physicalaccess to BES Cyber Systems have been assessed for risk. Whether initial access or maintaining
access, those with access must have had a personnel risk assessment completed within the last
7 years.
Rationale for Requirement R4:
To ensure that individuals with access to BES Cyber Systems and the physical and electronic
locations where BES Cyber System Information is stored by the Responsible Entity have been
properly authorized for such access. “Authorization” should be considered to be a grant ofpermission by a person or persons empowered by the Responsible Entity to perform suchgrants and included in the delegations referenced in CIP-003-6. “Provisioning” should beconsidered the actions to provide access to an individual.
Access is physical, logical, and remote permissions granted to Cyber Assets composing the BES
Cyber System or allowing access to the BES Cyber System. When granting, reviewing, or
revoking access, the Responsible Entity must address the Cyber Asset specifically as well as thesystems used to enable such access (i.e., physical access control system, remote access system,
directory services).
CIP Exceptional Circumstances are defined in a Responsible Entity’s policy from CIP-003-6 andallow an exception to the requirement for authorization to BES Cyber Systems and BES Cyber
System Information.
Quarterly reviews in Part 4.5 are to perform a validation that only authorized users have been
granted access to BES Cyber Systems. This is achieved by comparing individuals actuallyprovisioned to a BES Cyber System against records of individuals authorized to access the BES
Cyber System. The focus of this requirement is on the integrity of provisioning access rather
than individual accounts on all BES Cyber Assets. The list of provisioned individuals can be an
automatically generated account listing. However, in a BES Cyber System with several accountdatabases, the list of provisioned individuals may come from other records such as provisioning
workflow or a user account database where provisioning typically initiates.

Page 45 of 46

Guidelines and Technical BasisIf the results of quarterly or annual account reviews indicate an administrative or clerical error
in which access was not actually provisioned, then the SDT intends that the error should not be
considered a violation of this requirement.
For BES Cyber Systems that do not have user accounts defined, the controls listed in
Requirement R4 are not applicable. However, the Responsible Entity should document suchconfigurations.
Rationale for Requirement R5:
The timely revocation of electronic access to BES Cyber Systems is an essential element of anaccess management regime. When an individual no longer requires access to a BES Cyber
System to perform his or her assigned functions, that access should be revoked. This is ofparticular importance in situations where a change of assignment or employment isinvoluntary, as there is a risk the individual(s) involved will react in a hostile or destructive
manner.
In considering how to address directives in FERC Order No. 706 directing “immediate”
revocation of access for involuntary separation, the SDT chose not to specify hourly timeparameters in the requirement (e.g., revoking access within 1 hour). The point in time at which
an organization terminates a person cannot generally be determined down to the hour.
However, most organizations have formal termination processes, and the timeliest revocationof access occurs in concurrence with the initial processes of termination.
Access is physical, logical, and remote permissions granted to Cyber Assets composing the BES
Cyber System or allowing access to the BES Cyber System. When granting, reviewing, or
revoking access, the Responsible Entity must address the Cyber Asset specifically as well as thesystems used to enable such access (e.g., physical access control system, remote access system,
directory services).

Page 46 of 46