NERC CIP-004 Training Requirements: A Practical Compliance Guide for 2026

What Is NERC CIP-004 Training?

NERC CIP-004 training is the role-based cybersecurity training required for personnel who have authorized electronic access or authorized unescorted physical access to applicable Bulk Electric System Cyber Systems and associated assets.

Under the currently enforceable CIP-004-7 standard, applicable personnel must complete training before receiving covered access and repeat that training at least once every 15 calendar months. Organizations must also provide cybersecurity awareness reinforcement at least once every calendar quarter.

The training must address nine required subject areas, including cybersecurity policies, physical and electronic access controls, visitor controls, handling BES Cyber System Information, incident identification, incident response, recovery plans, and risks involving system interconnectivity, transient cyber assets, and removable media.

For utilities, generation companies, transmission organizations, and other applicable entities, completing a generic annual security course is not enough. A defensible NERC CIP-004 training program must connect the right people, roles, systems, training content, access decisions, completion dates, and evidence.

Why NERC CIP-004 Training Matters

Human access creates risk even when an organization has strong firewalls, monitoring tools, physical controls, and authentication systems.

An employee may mishandle protected information. A contractor may connect unauthorized removable media. A technician may fail to recognize an incident. A system administrator may grant access without verifying whether the user has completed the required training.

CIP-004 addresses these risks by connecting personnel security, cybersecurity training, awareness, access authorization, and access revocation.

The purpose of the standard is to reduce the risk that individuals with access to BES Cyber Systems could contribute to a compromise that causes misoperation or instability in the Bulk Electric System. NERC describes personnel risk assessment, training, security awareness, and access management as supporting controls for protecting BES Cyber Systems.

Training is therefore not an isolated learning activity. It is part of the access-control process.

An effective program answers five questions at any time:

1. Who currently has covered access?
2. What training applies to each person’s role?
3. Did each person complete training before access was granted?
4. Is the person’s recurring training still current?
5. Can the organization produce dated evidence supporting every answer?

If those questions require manual searches across spreadsheets, email folders, learning systems, access databases, and contractor records, the program may be difficult to defend during an audit.

Is CIP-004-7 or CIP-004-8 Currently Applicable?

As of July 2026, NERC lists CIP-004-7 as mandatory and subject to enforcement. NERC lists CIP-004-8 as subject to future enforcement beginning July 1, 2028.

Organizations should therefore base current compliance activities on CIP-004-7 while preparing for the future scope introduced by CIP-004-8.

The core training topics and timing remain similar under CIP-004-8. However, the future version expands parts of the applicable-system scope to include:

• Medium-impact BES Cyber Systems with Interactive Remote Access
• Shared Cyber Infrastructure supporting applicable systems
• Associated changes in terminology and applicability

The future standard still requires training before covered access and at least once every 15 calendar months.

Waiting until 2028 to begin scope analysis could create unnecessary pressure. Entities can start identifying affected personnel, shared infrastructure, remote-access roles, and training-content changes now.

NERC CIP-004 Training Requirements at a Glance

The training program is primarily addressed by Requirement R2, but compliance depends on how R2 interacts with awareness, personnel risk assessments, and access management.

A person should not receive covered access merely because an access ticket was approved. The entity must verify that the required prerequisites, including applicable training, have been completed.

NERC CIP-004 R1: Quarterly Security Awareness

One of the most common CIP-004 mistakes is treating security awareness and cybersecurity training as the same activity.

They are separate requirements.

CIP-004 R1 requires a documented security awareness process that reinforces cybersecurity practices at least once each calendar quarter for personnel who have covered access.

NERC provides several examples of acceptable reinforcement methods:

• Emails, memos, or computer-based communications
• Posters, brochures, or intranet content
• Presentations or meetings
• Management communication and reinforcement

The organization must be able to show both what was communicated and that it was distributed or delivered. Dated materials alone may not prove that the intended audience received them.

Awareness is not the same as role-based training

Quarterly awareness usually provides shorter, repeated reminders. It may address phishing, credential protection, removable media, tailgating, secure information handling, incident reporting, or a current threat.

Role-based training is more structured. It must address all applicable CIP-004 R2 topics and reflect the individual’s function or responsibility.

A quarterly phishing email may support R1. It does not automatically satisfy R2.

Likewise, completing the full CIP course once every 15 months does not remove the need for quarterly awareness reinforcement.

A practical quarterly awareness schedule

A simple annual plan could include:

• Quarter 1: Phishing, suspicious messages, and incident reporting
• Quarter 2: Physical access, badge security, and visitor controls
• Quarter 3: BES Cyber System Information handling and approved storage
• Quarter 4: Removable media, transient cyber assets, and remote access

Each campaign should have a dated artifact, defined audience, delivery record, and responsible owner.

NERC CIP-004 R2: Cybersecurity Training Program

CIP-004 R2 requires one or more cybersecurity training programs appropriate to individual roles, functions, or responsibilities.

The phrase “appropriate to individual roles” is important.

A control-room operator, system administrator, physical security employee, vendor technician, engineer, and compliance analyst may not need identical training. They may share a common foundation, but the scenarios, systems, procedures, and expected actions should reflect their work.

A strong program commonly uses two layers:

Core training covers subjects that apply to everyone in scope.

Role-specific training covers procedures, risks, assets, and decisions unique to a role or access type.

This model provides consistency without forcing every learner through irrelevant material.

The Nine Required CIP-004 Training Topics

CIP-004-7 Requirement R2.1 identifies nine areas that must collectively be included in the training program.

1. Cybersecurity policies

Personnel should understand the policies that govern access to, use of, and protection of applicable systems.

Training should explain more than the policy title. Learners should know:

• Which policies apply to their role
• What actions are permitted or prohibited
• Where current policies are located
• How policy changes are communicated
• Who can answer questions or approve exceptions

Policy training should use the entity’s actual requirements rather than generic statements copied from an industry course.

2. Physical access controls

Personnel must understand how physical access to protected locations is controlled.

Topics may include:

• Badge use
• Restricted areas
• Tailgating prevention
• Lost badge reporting
• Door and gate controls
• Physical access alarms
• Responsibilities within a Physical Security Perimeter
• Actions to take when an access control fails

Training should clearly state that an authorized badge does not permit the user to bypass visitor, escort, or reporting procedures.

3. Electronic access controls

The program should explain how electronic access is requested, approved, authenticated, used, monitored, and removed.

Content may address:

• Individual and shared accounts
• Password and authentication requirements
• Privileged access
• Interactive remote access
• Approved access paths
• Prohibited connections
• Account sharing
• Session security
• Reporting unexpected access behavior

Role-specific modules are especially useful here. The risks faced by a privileged administrator differ from those faced by a person with limited application access.

4. Visitor control program

Personnel need to understand how visitors are approved, identified, escorted, monitored, and documented.

Training should address:

• Who qualifies as a visitor
• Who may authorize a visit
• Escort responsibilities
• Visitor badge procedures
• Access limitations
• Visitor log requirements
• What to do when an unknown or unescorted person is observed

Employees should also understand that vendors and familiar contractors may still be subject to visitor-control requirements when they do not hold the necessary authorized access.

5. Handling and storage of BES Cyber System Information

BES Cyber System Information, commonly called BCSI, requires controlled handling and storage.

Personnel should know:

• What the entity classifies as BCSI
• How to identify protected information
• Where BCSI may be stored
• How BCSI may be transmitted
• Which collaboration and cloud tools are approved
• How printed copies must be protected
• How BCSI must be destroyed
• How to report suspected exposure

Examples are valuable. Training can show whether network diagrams, configuration files, asset lists, vulnerability information, access-control details, and recovery documents fall within the entity’s classification process.

6. Identification and initial notification of a cybersecurity incident

Personnel must be able to recognize indicators that may represent a Cyber Security Incident and make the initial notifications required by the entity’s incident response plan.

Training should provide clear examples, such as:

• Unexpected account activity
• Unauthorized access attempts
• Malware alerts
• Suspicious removable media
• Unexplained system changes
• Loss or disclosure of protected information
• Unusual remote-access behavior
• Physical access anomalies affecting cyber systems

The learner should know whom to contact, how quickly to act, which communication method to use, and what information to provide.

7. Recovery plans for BES Cyber Systems

Personnel whose roles may affect recovery should understand the relevant recovery plans.

Training may cover:

• Recovery roles and decision authority
• Backup and restoration responsibilities
• Recovery priorities
• Required communications
• Documentation during recovery
• Alternate systems or procedures
• Validation before returning systems to service

Not every learner needs detailed technical recovery instruction. The content should match the person’s assigned responsibilities.

8. Response to cybersecurity incidents

Incident response training should explain what happens after initial notification.

Depending on the role, this may include:

• Preserving evidence
• Isolating affected assets
• Escalating the incident
• Following communication restrictions
• Supporting containment
• Recording actions and timestamps
• Coordinating with operations
• Avoiding unauthorized remediation
• Participating in post-incident review

Scenario-based exercises can help personnel practice these decisions before a real incident occurs.

9. Interconnectivity, transient cyber asset, and removable-media risks

The final required topic addresses cybersecurity risks arising from electronic interconnectivity and interoperability with other Cyber Assets, including Transient Cyber Assets and Removable Media.

Training should explain risks created by:

• Laptops used across multiple environments
• Diagnostic equipment
• Vendor maintenance devices
• USB drives and other removable media
• Temporary connections
• Network bridges
• Remote-support tools
• Connections between operational and business systems

Personnel should understand the entity’s authorization, testing, scanning, connection, and reporting procedures before using these devices.

Who Must Complete NERC CIP-004 Training?

The requirement applies to personnel receiving authorized electronic access or authorized unescorted physical access to the applicable Cyber Assets and systems identified by the standard.

Depending on the organization, the training population may include:

• Operators
• Engineers
• System and network administrators
• Cybersecurity personnel
• Physical security personnel
• Maintenance technicians
• Application support teams
• Managers with covered access
• Contractors
• Service vendors
• Temporary personnel

NERC’s technical rationale states that personnel, including contractors and service vendors, must complete the required training before covered access is granted, except when a qualifying CIP Exceptional Circumstance applies. Training must then be completed at least once every 15 months to retain that access.

The safest approach is to build the training population from access records rather than relying only on HR lists.

HR may know who works for the company, but it may not know which employees, contractors, or vendors have access to specific BES Cyber Systems, EACMS, PACS, protected locations, or remote-access methods.

How Often Is NERC CIP-004 Training Required?

CIP-004 training must be completed:

1. Before covered electronic or unescorted physical access is granted
2. At least once every 15 calendar months after that

The standard says 15 calendar months, not “once per calendar year” and not simply “annually.”

Many organizations still schedule training every 12 months. This creates a three-month compliance buffer for delays, leave, system errors, and operational demands.

For example, if an individual completes training on March 10, 2026, the outer recurring deadline would generally be June 10, 2027. Assigning the refresher in March 2027 reduces the risk of crossing the 15-month limit.

The entity should define how it calculates deadlines, assigns refresher courses, sends reminders, escalates overdue items, and restricts or removes access when training expires.

What Evidence Should Be Retained?

A strong evidence package shows both program design and program execution.

Program-level evidence

Maintain:

• Current training procedure
• Scope and applicability criteria
• Role-to-training matrix
• Training curriculum
• Presentation decks and course content
• Instructor notes and handouts
• Content approval records
• Course version history
• Change records
• Quarterly awareness plan
• Exceptional-circumstance procedure

Person-level evidence

Maintain:

• Learner name or unique identifier
• Employment or contractor status
• Role and department
• Applicable access type
• Required course or curriculum
• Assignment date
• Completion date
• Course version completed
• Training status
• Access-authorization date
• Recurring deadline
• Exception documentation, when applicable

The evidence should make it possible to compare training completion with access provisioning.

A completion report by itself may show that a person completed a course. It may not prove that the training occurred before access was granted.

How to Build an Audit-Ready CIP-004 Training Program

Step 1: Define the applicable population

Identify people with covered electronic or unescorted physical access.

Reconcile data from:

• Identity and access management systems
• Active Directory or other directories
• Physical badge systems
• Remote-access platforms
• Privileged-access tools
• Contractor systems
• HR records
• Vendor records

Assign an owner for resolving differences between these sources.

Step 2: Create a role-to-training matrix

List each covered role and determine which training components apply.

For each role, record:

• Systems or locations accessed
• Electronic or physical access type
• Job function
• Required core modules
• Required role-specific modules
• Training owner
• Approval authority
• Refresher frequency

This matrix demonstrates how the training is appropriate to roles, functions, or responsibilities.

Step 3: Build the curriculum around the nine required topics

Map each required R2.1 topic to a course section.

Do not assume that a topic is covered because the presentation contains a related word. Document the mapping clearly.

For example:

Step 4: Connect training to access approval

Training status should be a required input in the access workflow.

The workflow should prevent provisioning until:

• The person’s identity and role are confirmed
• Required personnel risk assessment steps are complete
• Required training is complete
• Access is authorized
• Evidence is retained

A manual email saying “training complete” creates more risk than a controlled, dated workflow linked to the completion record.

Step 5: Automate recurring deadlines

Calculate the next due date from the actual completion date.

Send reminders before expiration, such as:

• 90 days before
• 60 days before
• 30 days before
• 15 days before
• On the due date

Escalate approaching deadlines to the learner, manager, compliance owner, and access owner.

Step 6: Reconcile training and access regularly

Compare the training roster with active electronic and physical access lists.

Flag:

• Access without valid training
• Training records for people who no longer have access
• Expired training
• Unassigned contractors
• Duplicate identities
• Role changes without updated training
• Access that should have been removed

Step 7: Test the evidence package

Select a sample employee, contractor, and vendor.

For each person, verify that the organization can produce:

1. Applicable role
2. Required curriculum
3. Training content
4. Completion date
5. Access authorization
6. Access provisioning date
7. Current recurring status
8. Supporting evidence

If the evidence cannot be assembled quickly, the underlying process may need improvement.

Common CIP-004 Training Compliance Gaps

Treating quarterly awareness as full training

Awareness reinforcement under R1 and role-based training under R2 are separate obligations.

Using one generic course for every role

A common foundation is acceptable, but the program must remain appropriate to individual roles, functions, or responsibilities.

Granting access before training completion

Training must normally occur before covered access is granted. Access workflows should enforce the sequence.

Calling the deadline “annual”

Annual scheduling can be a useful internal control, but the regulatory interval is at least once every 15 calendar months.

Leaving contractors outside the training system

Covered contractors and service vendors should be included in the same controlled process as employees.

Keeping completion records without course versions

The organization should be able to show what content a learner completed, not merely that a course with a certain title was completed.

Failing to update training after change

Policies, systems, incident plans, approved tools, access methods, and BCSI procedures may change. The curriculum should have a defined review and approval process.

Maintaining separate, unreconciled records

Training, HR, contractor, badge, and access data often reside in different systems. Without reconciliation, gaps can remain hidden until an audit.

NERC CIP-004 Training Checklist

Use this checklist to review the program:

• The covered training population is defined.
• Employees, contractors, and applicable service vendors are included.
• Training requirements are mapped to roles and responsibilities.
• All nine R2.1 subject areas are covered.
• Training occurs before covered access is provisioned.
• Refresher training is completed within 15 calendar months.
• Quarterly awareness reinforcement is documented separately.
• Course content and versions are retained.
• Individual completion records are dated.
• Training records can be matched to access records.
• Upcoming deadlines generate reminders and escalation.
• Role changes trigger training and access review.
• Exceptions are approved and documented.
• Training content is reviewed after relevant changes.
• Evidence can be produced by person, role, asset, and period.

Frequently Asked Questions About NERC CIP-004 Training

Make CIP-004 Training Part of Access Governance

The greatest weakness in many NERC CIP-004 training programs is not the course itself. It is the disconnected process around the course.

Training may sit in one system. Electronic access may sit in another. Badge access may be managed by a separate team. Contractors may be tracked in spreadsheets. Policy changes may be communicated through email. Evidence may be collected only when an audit begins.

A stronger model treats training as a controlled compliance obligation connected to personnel, roles, access, policies, deadlines, and evidence.

When those relationships are visible, the entity can identify expiring training before it affects access, prevent unauthorized provisioning, verify contractor status, track quarterly awareness, and produce evidence without searching through scattered records.

VComply helps energy and utility organizations assign compliance requirements, automate reminders, track ownership, connect evidence, and maintain a current view of NERC compliance activities.

See how VComply can help your team manage NERC CIP obligations, training evidence, owners, and deadlines in one place.

Start your 21-day free trial and experience how VComply helps you with your compliance operations and maturity.

Questions to Ask Energy Compliance Software Vendors

Ask potential vendors:

• Can the platform manage NERC, FERC, environmental, safety, and internal requirements together?
• Can requirements be assigned by entity, facility, asset, and jurisdiction?
• Can one control map to multiple obligations?
• Does the platform support recurring control activities?
• Can we define our own evidence standards?
• How are overdue tasks escalated?
• Can failed controls automatically create issues?
• Does the system support root-cause analysis and corrective action?
• Can we compare performance across locations?
• Are complete audit trails retained?
• Can we import existing obligations and controls?
• What integrations are available?
• How long does implementation take?
• How are occasional business users trained?
• Can dashboards be tailored for executives and regulators?
• How does the system support regulatory change?
• How are permissions configured for sensitive information?
• Can the platform scale to additional frameworks and entities?

Common Implementation Mistakes

Moving bad spreadsheets into new software

Do not import every existing row without reviewing ownership, duplication, applicability, and evidence requirements.

Implementation is an opportunity to improve the compliance structure.

Starting with every requirement

A large, organization-wide implementation may delay value.

Start with a high-priority use case, prove the workflow, and expand systematically.

Failing to involve operational teams

Compliance cannot design every workflow alone.

Control owners should help define procedures, evidence, frequency, and realistic deadlines.

Overcomplicating task forms

Users should see only the information needed to complete their responsibility.

Complex forms reduce adoption.

Treating software as the compliance program

Technology cannot replace regulatory interpretation, governance, trained employees, or management oversight.

It supports the program but does not create it.

Measuring only task completion

A high completion rate does not prove that controls are effective.

Organizations should also monitor failures, recurrence, evidence quality, issue severity, and remediation time.

Best Energy and Utilities Compliance Software

The best energy and utilities compliance software is the platform that fits the organization’s regulatory scope, operating structure, and compliance maturity.

A strong system should provide a connected view of:

• Regulatory requirements
• Applicable entities and facilities
• Risks
• Policies
• Controls
• Owners
• Recurring activities
• Evidence
• Findings
• Corrective actions
• Audits
• Management reporting

Organizations should avoid selecting software solely because it includes a large regulatory library.

A library may be useful, but the platform must also help teams translate requirements into repeatable operational work.

The best platform should be able to:

• Adapt to utility-specific workflows
• Coordinate responsibilities across departments
• Support multiple facilities and legal entities
• Map controls to several requirements
• Automate recurring tasks and escalation
• Maintain reliable audit evidence
• Track issues through verified closure
• Provide clear executive reporting
• Scale as operations and regulations change
• Remain usable for non-compliance employees

VComply for Energy and Utility Compliance

VComply helps energy and utility organizations centralize regulatory requirements, assign compliance responsibilities, manage controls, collect evidence, monitor risks, and track corrective actions from one platform.

Energy teams can use VComply to:

• Organize requirements across NERC, FERC, environmental, safety, and internal compliance programs
• Assign recurring compliance tasks to operational owners
• Automate reminders and escalations
• Map requirements to policies and controls
• Maintain a central evidence repository
• Track incidents, findings, and corrective actions
• Monitor performance across entities and locations
• Maintain audit trails
• Report compliance status to leadership

VComply’s energy and utilities solution is positioned around centralized compliance management, risk and incident workflows, evidence management, and support for requirements such as NERC, FERC, EPA, OSHA, and the Clean Air Act.

Manage energy compliance without chasing spreadsheets, evidence, and overdue updates.

CTA: See VComply for Energy and Utilities

Energy Compliance Software Implementation Roadmap

A phased implementation can reduce complexity.

Phase 1: Establish the foundation

• Define program scope
• Identify priority regulations
• Create the entity and facility structure
• Clean the obligation inventory
• Assign owners
• Confirm policies and controls

Phase 2: Configure workflows

• Create recurring tasks
• Define evidence requirements
• Set review and approval steps
• Establish escalation rules
• Configure dashboards
• Import active issues

Phase 3: Pilot the platform

• Select one regulatory area or facility
• Train users
• Run recurring workflows
• Review evidence quality
• Test escalation
• Collect feedback
• Improve configuration

Phase 4: Expand coverage

• Add additional standards
• Onboard more facilities
• Connect policies and risks
• Introduce control testing
• Migrate corrective actions
• Configure executive reporting

Phase 5: Improve continuously

• Review completion and failure trends
• Remove duplicate controls
• Adjust monitoring frequency
• Improve owner instructions
• Integrate source systems
• Update reports
• Respond to regulatory changes

Metrics to Track

Useful energy compliance metrics include:

• Percentage of obligations with assigned owners
• Percentage of requirements mapped to controls
• On-time compliance task completion
• Overdue high-risk activities
• Control pass and failure rates
• Repeat control failures
• Evidence rejection rates
• Open issues by severity
• Corrective actions completed on time
• Average remediation time
• Regulatory changes awaiting assessment
• Upcoming filing deadlines
• Audit findings by facility
• Repeat audit findings
• Training and certification completion
• Expired permits or qualifications
• Compliance performance by location
• Number of potential violations
• Aging of unresolved issues

Metrics should show whether the compliance system reduces risk, not just whether employees complete tasks.

Build Compliance Into Daily Utility Operations

Energy compliance cannot be managed effectively as an annual audit exercise.Requirements must be converted into daily, monthly, quarterly, and event-based responsibilities across the organization.

An effective energy and utilities compliance platform connects each important requirement with:

• An accountable owner
• A relevant policy
• An operational control
• A recurring monitoring activity
• Clear evidence requirements
• A review and approval process
• An escalation path
• Corrective action
• Management reporting

When these elements operate in one connected system, energy organizations gain a clearer view of compliance performance, identify gaps earlier, reduce manual follow-up, and maintain stronger evidence for audits and regulatory reviews.

The goal is not simply to digitize a spreadsheet.

The goal is to create a compliance operating system that makes regulatory responsibilities visible, repeatable, and defensible across every team, facility, and entity.

Ready to strengthen policy management and compliance across your organization, Book a personalized demo with VComply and take the first step toward smarter compliance management.

Frequently Asked Questions (FAQs)

What is the purpose of NERC CIP-004?

NERC CIP-004 reduces risks created by people who access BES Cyber Systems. It establishes requirements for cybersecurity awareness, role-based training, personnel risk assessments, access management, access revocation, and related controls.

Is NERC CIP-004 training required annually?

The standard requires training at least once every 15 calendar months. Many entities use a 12-month internal schedule to provide additional time before the regulatory deadline.

Is quarterly cybersecurity awareness considered training?

Not automatically. Quarterly security awareness is addressed under R1. Role-based cybersecurity training is addressed separately under R2. An activity should only be counted toward both when its content, audience, execution, and evidence independently satisfy both requirements.

Must training be completed before access is granted?

Yes. Applicable training must normally be completed before authorized electronic access or authorized unescorted physical access is granted, except during properly invoked CIP Exceptional Circumstances.

Does CIP-004 apply to contractors and vendors?

It can. Contractors and service-vendor personnel who receive covered access should be included in the applicable personnel, training, and access-management processes.

Does NERC CIP-004 require an examination?

CIP-004-7 requires completion of role-appropriate training but does not expressly require a test score in R2. Knowledge checks, scenario questions, and acknowledgments can still provide useful evidence that the training was meaningful and understood.

What records should be retained?

Entities should retain the training program, course content, role mapping, course versions, dated completion records, awareness materials, distribution evidence, access dates, exception records, and other documents showing implementation.

What changes under CIP-004-8?

CIP-004-8 retains the core awareness and training structure while extending relevant applicability to additional areas, including medium-impact BCS with Interactive Remote Access and Shared Cyber Infrastructure supporting applicable systems. NERC currently identifies July 1, 2028, as its future enforcement date.