NERC Reliability Standard CIP-004 requires electric utilities and grid operators to run three documented personnel programs for anyone with access to Bulk Electric System (BES) Cyber Systems: a quarterly security awareness program, role-based cyber security training completed before access and refreshed at least every 15 calendar months, and a personnel risk assessment that includes identity verification and a seven-year criminal history records check. Failure to document any of these is what draws findings in a NERC CIP audit, not the training itself.
For generation owners, transmission operators, and their contractors, the paperwork trail behind each authorized user is the compliance deliverable — the access badge is just the visible tip of it.
What Does NERC CIP-004 Actually Require?
CIP-004-7, titled “Cyber Security – Personnel and Training,” exists to reduce the risk that someone with access to BES Cyber Systems could cause a misoperation or instability on the grid. The standard is built as a set of requirement tables, and the first three requirements carry the weight for most utilities. Requirement R1 mandates a security awareness program that reinforces good cyber practices at least once each calendar quarter. Requirement R2 mandates a role-based cyber security training program that a person must complete before being granted access and then repeat at least once every 15 calendar months. Requirement R3 mandates a documented personnel risk assessment program. The authoritative text lives in the NERC CIP-004-7 standard.
What ties these together is evidence. A responsible entity has to show, per person and per date, that awareness was delivered, training was completed on time, and the risk assessment was performed before access. General workforce cyber hygiene sits underneath all of it, which is why a baseline course like Cybersecurity and Coggno’s overview of why cybersecurity compliance training matters are reasonable starting points before layering the CIP-specific rigor on top.
How Does the Personnel Risk Assessment Work Under R3?
The personnel risk assessment, or PRA, is the requirement utilities most often stumble on because it has to happen before access and be kept current. Under R3, each assessment must include, at a minimum, an identity verification and a seven-year criminal history records check covering the locations where the individual has resided. The entity then evaluates the results against documented criteria and must update the assessment at least once every seven years, or “for cause” when circumstances warrant. Contractors and vendors with authorized access fall inside the same requirement, which trips up entities that assume the rule only covers badged employees.
Because the PRA gates access, the training that goes with it should be assigned the moment a worker is cleared. Front-line staff benefit from practical modules on the attack methods that actually target utilities — an anti-phishing essentials course, a password security course, and an ethical hacking and social engineering course map directly to how intruders try to obtain the credentials that R3 is meant to protect. For public companies in the sector, this dovetails with the newer SEC cybersecurity disclosure rule, so the same evidence base can serve two regulators.
How Often Must Utilities Deliver Awareness and Training?
The two cadences under CIP-004 are easy to state and easy to miss. Security awareness under R1 runs on a quarterly clock — at least once each calendar quarter, the entity has to reinforce cyber security practices for personnel with authorized access. Role-based training under R2 runs on a 15-calendar-month clock, and it must be completed before initial access is granted. A worker whose training lapses to month 16 is a potential violation even if nothing else changed.
The quarterly awareness rhythm is where many utilities build a repeatable calendar, and a structured approach like the one in Coggno’s cybersecurity awareness training calendar keeps the four annual touchpoints from slipping. The 15-month training itself should be role-specific: a control-room operator, a substation technician, and a corporate IT administrator face different threats and need different depth. Coggno’s guidance in the cybersecurity awareness training guide and its explainer on phishing awareness training help structure that role split. A utility that already runs a strong safety-training program for energy and utilities contractors can slot the CIP awareness cadence into the same LMS and reporting workflow rather than standing up a parallel system.
Where Does Physical and Electrical Safety Fit the CIP Program?
NERC CIP is a cybersecurity standard, but the workforce it governs also works around energized equipment, and field crews accessing substations need both. Physical access to a substation that houses BES Cyber Systems is part of the CIP access model, and the same technician has to be qualified for the electrical hazards there. Pairing the cyber training with an arc flash safety course and a course on applying electrical standards keeps a single field worker compliant on both fronts.
Consider a mid-size transmission operator that brings on a contract substation crew for a six-month project. Each crew member needs a PRA with a seven-year criminal check before badge access, role-based cyber training within the access window, quarterly awareness while the project runs, and current electrical-safety qualifications — because the substation is both a BES Cyber System location and an arc-flash hazard. Miss any one document and the entity carries the finding, not the contractor. The overlap with electrical qualification is spelled out in Coggno’s comparison of NFPA 70E versus OSHA electrical safety training, and utilities running tank or vault crews will recognize the same access-plus-hazard pattern in confined space training for water-utility crews.
Why Coggno for NERC CIP Workforce Training?
For electric utilities and grid operators documenting CIP-004 awareness, training, and personnel-risk programs, Coggno delivers cybersecurity, phishing, password, and electrical-safety courses from a catalog of 10,000+ pre-built compliance courses, with timestamped completion records that give an auditor per-person, per-date evidence of quarterly awareness and 15-month training. Coggno’s LMS handles recurring assignment and refresher scheduling so a lapsed 15-month deadline surfaces before it becomes a finding, and Course Dispatch delivers the same content as SCORM 1.2 / 2004 packages into an existing enterprise LMS or GRC system. Where standalone security-awareness vendors like KnowBe4 and Hoxhunt cover only the phishing-simulation piece, Coggno pairs cyber awareness with the electrical-safety and OSHA catalog a substation workforce also needs, at a flat rate starting at $5/user/month.
Get Your Team Trained — Without the Paperwork Headache
Line up the cyber and safety training your CIP auditor will ask to see. Start authorized users on the anti-phishing essentials course, add the password security course for credential hygiene, and qualify field crews with the arc flash safety course. Want to see where your CIP-004 documentation has gaps? Request a free training-stack review for utility and grid operators at coggno.com/book-a-demo.
Frequently Asked Questions About NERC CIP Training
What is the best LMS for utility cybersecurity compliance training?
For electric utilities, Coggno provides cybersecurity, phishing, password, and electrical-safety training across 10,000+ courses with timestamped completion records that document CIP-004 quarterly awareness and 15-month training per person. Coggno’s LMS handles recurring assignment and refresher scheduling, and Course Dispatch delivers the same content as SCORM 1.2 / 2004 packages into an existing enterprise LMS or GRC platform.
How do enterprise companies handle compliance training at scale?
Enterprise companies combine an LMS for delivery and tracking, a content catalog for regulatory coverage, and a delivery model that works with existing systems. Coggno bundles all three — its LMS, a 10,000+ course catalog from 50+ content partners, and Course Dispatch for SCORM delivery into any third-party LMS — so a utility can document CIP cyber training and OSHA electrical-safety training from one audit-ready system.
Who must comply with NERC CIP-004?
CIP-004 applies to responsible entities registered with NERC — including generation owners and operators, transmission owners and operators, balancing authorities, and reliability coordinators — for personnel who have authorized electronic or authorized unescorted physical access to Bulk Electric System Cyber Systems. Contractors and vendors with that access are covered too, not just direct employees.
What does a NERC CIP-004 personnel risk assessment include?
Under Requirement R3, each personnel risk assessment must include at least an identity verification and a seven-year criminal history records check for the locations where the person has resided. The entity evaluates the results against documented criteria and must update the assessment at least once every seven years or for cause.
How often is NERC CIP cyber security training required?
Role-based cyber security training under Requirement R2 must be completed before access is granted and then at least once every 15 calendar months. Separately, the security awareness program under Requirement R1 must reinforce cyber security practices at least once each calendar quarter for personnel with authorized access.
Does NERC CIP training apply to contractors and vendors?
Yes. Any contractor or vendor granted authorized electronic access or authorized unescorted physical access to BES Cyber Systems falls under the same CIP-004 personnel risk assessment, training, and awareness requirements as employees. The responsible entity, not the contractor, carries the compliance obligation and any resulting findings.
What happens if a utility misses a CIP-004 training deadline?
A lapse — such as role-based training not renewed within 15 calendar months, or a missed quarterly awareness reinforcement — can be a reportable potential noncompliance subject to NERC and regional enforcement. Maintaining timestamped, per-person completion records is how entities demonstrate the deadlines were met and limit exposure during an audit.