CIP-003-9 R3 CIP Senior Manager and R4 delegation evidence

What the CIP Senior Manager and delegation requirements ask for

CIP-003-9 R3 requires a registered entity to name one CIP Senior Manager by name, and R4 requires a documented process for delegating that manager's approval authority if any delegations are used. For a compliance lead, the practical goal is a single accountable person on record, plus a clean trail showing who may approve on that person's behalf and for which actions. R3 carries a Medium Violation Risk Factor, and the evidence an auditor usually asks for is a dated, approved document from a high level official naming the CIP Senior Manager. For R4, the evidence is a dated document approved by the CIP Senior Manager that lists each delegate by name or title, the actions delegated and the effective date. Both R3 and R4 allow 30 calendar days to update the record after a change, so the timing of a reassignment or a new delegate is part of the requirement, not an afterthought.

Delegations under R4 do not need to be reinstated when the delegator changes, so a new CIP Senior Manager does not automatically wipe out earlier delegations. That is useful, but it also means a delegation can quietly outlive the context in which it was approved. Confirm against the current standard text whether each existing delegation still matches the actions the delegate is performing, and decide who reviews the list when the CIP Senior Manager changes. If no delegations are used, the entity should be able to show that position, since the absence of a delegation process is only defensible when it is true.

Unclear ownership is the usual source of trouble here. Organizations often hand approvals to whoever is most available, record them in email or chat, or keep the delegation list in a spreadsheet that nobody updates. A useful first step is to inventory every approval the CIP program depends on, check which ones are actually approved by the CIP Senior Manager, and compare that list with the signed document on file. Version-controlled documentation helps here because each change to the delegation record shows what changed, when and by whom. Confirm with your Regional Entity how it expects dated approvals to be presented before you standardize the format.

Which entities and roles fall under the CIP Senior Manager requirement

R3 and R4 apply to every registered entity with CIP-scoped assets, including entities whose only assets are low impact. The CIP-002 categorization decides how much the CIP Senior Manager must oversee, and the delegation records show who else carries approval authority day to day.

Low impact only entities

An entity whose assets contain only low impact BES Cyber Systems still needs a named CIP Senior Manager under R3 and a delegation process under R4 if it delegates approvals. The manager's oversight covers the low impact cyber security plan and policies, so a small program still needs a documented, named owner. Confirm with your Regional Entity how your assets were categorized before assuming the scope is light.

High and medium impact scope

Where CIP-002 places BES Cyber Systems at high or medium impact, the CIP Senior Manager approves or oversees the work in many more CIP standards, from CIP-004 through CIP-013. Ask who in the organization must be named to stand behind each of those obligations, because the delegation record should reflect that breadth. Review the categorization list whenever assets change.

Compliance and security leadership

The CIP Senior Manager is often the CISO, a compliance director or an operations executive. The person chosen must have authority over the CIP program and the budget to fund it. Check that the named manager can actually approve policies and exceptions, since an assessor will test whether the approvals match the stated authority.

Operations and control room delegates

Operations managers, control room supervisors and system owners commonly receive delegated approval for specific actions, such as approving access changes or maintenance windows. Each delegate should appear by name or title, with the actions listed and the date recorded. Keep the list short, because every entry must be kept current within 30 days of a change.

Vendors and contractors

Contractors and integrators may perform CIP work but should not hold approval authority unless the entity deliberately delegates it under R4. Their staff may be recorded as performing actions while approvals stay with employees. Confirm that any delegation to an outside party is written, approved by the CIP Senior Manager and reviewed when the contract or personnel changes.

Multi-entity and shared functions

Entities within a holding structure or those sharing a control center may need to decide whether one CIP Senior Manager covers several registered entities or whether each registered entity names its own. Document the boundary clearly, including which delegates act for which entity. Ask your Regional Entity to confirm the approach before the first audit.

How an auditor tests the CIP Senior Manager and delegations

This table compares what an auditor checks for the CIP Senior Manager (R3) and for delegations of that manager's approval authority (R4), along with the evidence requested and the findings that most often appear. Read each row as a test step, then check your own records against the same question before an engagement begins.

Test step	What the auditor confirms	Evidence requested	Common finding
Identify the named individual	One CIP Senior Manager is named by name, and the named person matches the current organization chart and access records	Dated, approved document from a high level official naming the CIP Senior Manager	Name left unchanged after a departure or reorganization
Check the date against change events	Each change to the CIP Senior Manager has a documented update dated within 30 calendar days of the change	Change log of the senior manager designation, with dates and approval records	Update recorded more than 30 days after the personnel change
Confirm delegation process exists	A documented delegation process is in place, or a statement that no delegations are used	Written delegation process or signed statement that no delegations exist	Delegations used in practice with no written process behind them
Sample delegation records	Each sampled delegation lists the delegate's name or title, the specific actions delegated and the date	Delegation register with entries selected by the auditor across the audit period	Entries that name a role but not an individual, or omit the specific actions
Verify approval by the CIP Senior Manager	Each delegation is approved by the CIP Senior Manager, not by the delegate or another delegate	Signed or approved delegation record showing the approver and approval date	Approval missing, or approved by a person who was not the CIP Senior Manager
Match authority to actions performed	Actions the delegate took in the period fall within the scope recorded in the delegation	Sample of approvals or change tickets tied to delegates, compared with the delegation scope	Delegate signs off on actions outside the delegated scope
Check the 30-day update window	Each change to a delegation is recorded within 30 calendar days, including removal of departed delegates	Revision history of the delegation document with dated entries	Departed delegate still listed, or updates recorded late
Confirm delegations carry across personnel changes	Delegations remain valid when the delegator changes, and the record reflects the current delegator	Records showing how the delegation was handled at the time of the delegator change	Team assumes delegations lapse and makes approvals without a current record

Steps to name the CIP Senior Manager and document delegations

This sequence moves from an executive decision about who owns the CIP program to a dated, approved record of every delegation, with a routine that keeps both records inside the 30-day update window. Each step leaves a document or check that an auditor can sample.

Confirm executive sponsorship for the program
Start with the executive who can sign for the entity, usually a senior officer with authority over operations and budget. Confirm in writing that this person is the high level official who will approve the naming of the CIP Senior Manager. Ask legal or governance counsel to confirm that the signatory's authority covers CIP obligations under the entity's bylaws or board delegations. The output is a short sponsorship record that names the official and states the scope of the authority they hold.
Name the CIP Senior Manager by name
The sponsoring official selects one individual to act as CIP Senior Manager and records that person's full name, title and the registered entity they cover. Confirm that the nominee has the seniority and independence to approve CIP policies and delegations, and that their contact details are current for audit requests. The output is the naming decision, which feeds the approved document in the next step.
Produce the dated, approved naming document
Write a short document that names the CIP Senior Manager, states the effective date and identifies the entity and its CIP scope. Have the high level official sign and date it, then store the signed version in the controlled document repository with a unique identifier. The evidence for this requirement is a dated, approved document from that official, so an unsigned draft or an email alone does not meet it. The output is a signed, dated naming record in the repository.
Define the delegation process and approval workflow
Decide whether the entity will use delegations at all. If it will, write a short procedure that states who may request a delegation, what the request must contain, and that the CIP Senior Manager must approve each one before it takes effect. Confirm the process also covers removing a delegation. If no delegations are used, document that decision and the reason so the record shows the choice was deliberate. The output is an approved delegation procedure or a documented decision not to delegate.
Record each delegation with name or title, actions and date
For each delegation, create an entry that lists the delegate's name or title, the specific actions delegated, the effective date and the CIP Senior Manager's approval. Keep each entry in a single list so an auditor can sample it quickly. The delegation list needs to be dated and approved by the CIP Senior Manager. Confirm that delegations remain valid when the delegator changes, so a change of delegator does not require re-entering them, but the list itself must still be updated. The output is a current, approved delegation register.
Set a change-triggered update routine for the 30-day window
Define the events that trigger an update, including a change in the CIP Senior Manager, a new or removed delegation and a change in delegate name or title. Assign an owner for each trigger and set a review in the change workflow so the update is made within the 30-day window that applies to both the Senior Manager record and the delegation list. Confirm that the team can produce the change date and the approver for each update. The output is a written routine and a trigger log that shows when each change was recorded.
Keep the records in version-controlled storage
Place the naming document, the delegation procedure and the delegation register in a system that keeps version history, records who changed each item and when, and lets staff compare or restore earlier versions. Wiki platforms such as XWiki and BookStack can meet this need, but the entity should confirm that the chosen tool meets its own retention and access rules before relying on it. Restrict edit rights to the owners named in the routine, so the approval chain stays visible. The output is a controlled repository that holds the evidence for both requirements.

How a change of CIP Senior Manager or delegate is handled

The 30-day clock in CIP-003-9 R3 and R4 starts from the change itself, not from the date someone notices it. A change of CIP Senior Manager or a change to a delegation is the event that triggers the update, so the entity should treat the personnel decision, the reassignment or the departure as the start date. Build the trigger into HR offboarding, role changes and contractor end dates, so that a departing manager or delegate creates a ticket on the day the change takes effect. Ask who in your organization owns that trigger and whether it reaches the people who maintain the CIP documentation. The standard fixes the 30-day window, but the internal process decides whether the entity meets it.

Delegations carry over when the delegator changes. Under R4, a delegation made by the CIP Senior Manager does not lapse because the person who made it has been replaced, so the entity cannot assume that a new manager starts with a clean slate. The new CIP Senior Manager should review every existing delegation, confirm that each delegate and the delegated actions are still accurate, and then either re-approve the record or update it within the window. Because the delegation was approved by the previous manager, the new manager's review is what gives the record its current approval. Confirm with your Regional Entity or auditor how they expect that review to be evidenced. A clean transition record is a dated, approved document that shows the before and after state. It should name the outgoing and incoming CIP Senior Manager (for R3 evidence, a dated approval from a high level official), list each delegation still in force with the delegate's name or title, the specific actions delegated and the date, and show the approval by the current CIP Senior Manager. In a wiki or document system such as XWiki, the version history can show what changed, when and by whom, which helps an assessor follow the sequence. Keep the approval records and version history together so the transition can be reconstructed without interviews.

Evidence that passes for R3 and R4

CIP-003-9 R3 and R4 are judged on paperwork: a named CIP Senior Manager and, where used, a delegation record, each dated and approved in the way the measures describe. The cards below cover the two evidence types the auditor expects, the approval chain behind them, and the version history that lets dates and approvals be proven between audits.

Dated approval naming the Senior Manager

For R3, the evidence is a dated, approved document from a high level official that names the CIP Senior Manager by name. Check that the approval comes from someone with authority over the program, not the Senior Manager approving their own appointment, and that the document states the effective date. Keep the signed copy and the approval record together so the auditor can trace who signed and when.

Delegation register with named delegates

For R4, the evidence is a dated document approved by the CIP Senior Manager that lists each delegate by name or title and the specific actions delegated. A vague entry such as "operations staff" will not show which approvals were transferred. Record the date each delegation took effect and any date it ended, so the register matches what people actually approved.

Delegations that survive staff changes

Delegations under R4 do not need to be reinstated when the delegator changes. Note this in the procedure so a new manager does not treat existing delegations as lapsed. The register should still show who the original delegator was and when the delegation was approved, so the chain of authority stays readable after a personnel change.

Version history for dates and approvals

Auditors test whether a record existed on the date it claims. Store the R3 designation and R4 register in a wiki or document system that keeps every revision with the time and author, and that lets you compare two versions. Run a test to confirm that a previous approval can be retrieved and that the approval date is not overwritten when the register is edited.

Access limits on the records

Only the CIP Senior Manager and designated approvers should be able to edit the R3 and R4 records, while the wider team can read them. Role-based permissions at the shelf, book or page level keep edits limited to those roles. Review the permission settings at each periodic review, because a change in role assignment can quietly widen who can alter an approved register.

Confirm evidence with your auditor

Before the audit, ask your Regional Entity or auditor which form of approval they accept, whether an electronic signature is sufficient, and how they want the register presented. Practices differ between audit teams, so confirm them in writing. Keep the confirmation with the evidence set so you can show the expectation you planned against.

What meeting R3 and R4 costs in money and effort

This table breaks down the people time, tooling, review and external checks behind R3 and R4, and marks which costs are one-time and which recur. Read it to see where spend comes from and which drivers you can control. No prices are stated because none are supplied for this requirement; use the questions in the final row when requesting quotes.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it
Executive time to name the CIP Senior Manager	Senior executive or high level official signing the dated approval	One-time at first designation, then recurring on each change	Frequency of leadership changes and how quickly the approval is signed
Compliance lead time to draft and maintain the R3 and R4 documents	Internal compliance lead, sometimes supported by an external consultant	Largely recurring as records are kept current	Number of CIP-scoped entities and the number of named delegates
Delegation register and approval workflow	Internal IT or compliance staff configuring the documentation platform	One-time setup, then recurring upkeep	Number of delegations, approval steps and how many approvers must sign each change
Documentation platform licensing	Internal budget for commercial document or workflow software	Recurring license fees where commercial tools are used	Seat count and feature tier. Self-hosted open-source wikis such as XWiki or BookStack carry no license fee, though hosting and administration still apply
Hosting and administration of a self-hosted platform	Internal platform team or an implementation partner such as DeployOpen	One-time build, then recurring operations and patching	Hosting location, access control design, backup and upgrade cadence
Turnover and re-designation effort	Compliance lead and executive approver	Recurring, triggered by personnel change	Staff turnover rate and whether delegations must be re-documented after a delegator changes
Periodic review of R3 and R4 records	Compliance lead and approving executive	Recurring, aligned with the 30-day update windows and the wider policy review cycle	Number of changes in the period and whether review is combined with CIP-003-9 R1 policy reviews
External review or auditor sampling	Independent auditor or Regional Entity during a monitoring engagement	Occasional, tied to audit or spot check timing	Audit scope, sample size and how well-organized the evidence is at the time of request
Questions to ask in a quote	Vendor or implementation partner	Before work starts	Ask what is included in fixed scope, who maintains the register after handover, how upgrades are priced, and which deliverables recur

Who owns the CIP Senior Manager record and who prepares the evidence

Your organization owns the CIP program, so it also owns the decision about who is the CIP Senior Manager. Under CIP-003-9 R3, that person must be identified by name, and any change must be documented within 30 calendar days. Under R4, if your organization uses delegations, the CIP Senior Manager approves the delegation record. Those approvals must come from the people with authority to make them, and the auditor will look for that authority in the evidence itself.

Appointment decision: A named individual is chosen by an authorized official, and that approval is dated and kept on file.
Delegation decisions: Each delegate's name or title, the specific actions delegated and the date are decided by the CIP Senior Manager, not by the implementer.
Change control: Your staff decide when a 30-day update is triggered after a departure, reorganization or new delegate.
Signed records: Approval signatures and official sign-off stay with your personnel.
Interview readiness: Staff named in the record should be able to explain their role to an auditor.

Before engaging any partner, confirm internally who holds the CIP Senior Manager title, who can sign the appointment, and where the signed originals will be stored.

Where organizations usually fall short on CIP-003 R3 and R4

Most CIP-003 R3 and R4 findings come from records that exist but cannot prove who holds authority, when it was granted and what it covers. The cards below group the gaps we see most often in these two requirements, with a practical fix for each. Each fix ties back to the dated, approved documentation that the standard's evidence measures expect.

Senior Manager named by title only

A policy that says the CIP Senior Manager is the operations director names a role, not a person. R3 asks for the individual by name, so a title alone leaves the approval chain open when people change roles. Check that the document names one person, carries a date, and was approved by a high level official. Record the name, not just the role.

Delegations held in email

Delegation decisions often live in inbox threads where the approval is implied rather than documented. R4 expects a documented process listing the delegate's name or title, the specific actions delegated and the date, approved by the CIP Senior Manager. Move each delegation into a controlled register with the approval attached, and retire email as the system of record.

Approvals without dates

An approval signature with no date cannot show that the delegation was in force when a specific action was taken. Auditors test whether the approval predates the delegated action and whether updates land within the 30-day window. Require a date on every approval and every revision, and keep the prior versions so the timeline can be reconstructed.

Delegations lapsing with staff changes

When a delegate leaves or changes role, teams sometimes assume the delegation ended, or assume it carried over without review. R4 states that delegations do not need to be reinstated when the delegator changes, but the register still has to match who is acting. Review the register at each staffing change and record the outcome, whether the delegation continues, ends or is reassigned.

Records that cannot show what changed

A shared document overwritten in place cannot show what the delegation said last quarter or who edited it. Auditors ask for the version in force on a given date. Use a wiki or document system that keeps version history with the author and timestamp for each change, and confirm that the platform can compare and restore prior versions before you rely on it for evidence.

Questions about CIP Senior Manager and delegation compliance

How much effort do CIP-003-9 R3 and R4 take to meet?

R3 and R4 are documentation requirements, so the effort is small compared with technical controls, but it is not zero. R3 needs one named CIP Senior Manager and a dated, approved record of that appointment. R4 applies only if you delegate approval authority, and then requires a documented delegation process, a dated record of each delegation and a 30-day update when anything changes. Most of the work is keeping those records current and tied to the people who actually hold the roles. The effort rises with the number of delegates, the number of changes and how many people change roles each year.

Can a small entity meet R3 and R4 without outside help?

Usually yes. A small entity with one named senior manager and no delegations needs only a dated, approved document naming that person, plus a statement that no delegations are used. The main risk is not the writing but the timing: a change in the senior manager or a delegate must be documented within 30 calendar days. Small teams often miss this because the person who changed roles is also the person who would update the record. Assign an owner for the record, set a calendar reminder tied to every personnel change, and confirm the approach against your Regional Entity's expectations before your next audit.

What can an implementation partner add to R3 and R4, and what can it not do?

A partner can help design the delegation process, set up a controlled record of the senior manager and delegates, configure approval workflows and version history, and prepare the evidence an auditor will request. DeployOpen works this way: it prepares systems, records and evidence in your environment under a written, fixed scope. It cannot appoint your CIP Senior Manager, approve a delegation, or decide what authority to hand down. Those decisions remain with your organization. Only the Regional Entity or NERC monitors compliance, and no third party issues a CIP certificate.

How long does it take to document a change in the CIP Senior Manager or a delegation?

CIP-003-9 gives you 30 calendar days from the change to update the record for both R3 and R4. The clock starts with the change itself, not with the date someone notices it. Documenting the change within that window is mostly a process question: who is told about the change, who signs the updated record, and where the approved version is stored. Confirm with your compliance lead how changes flow from HR or operations into the CIP record, and test that path before you need it.

Do delegations have to be reissued when the delegator leaves?

No. CIP-003-9 R4 states that delegations do not need to be reinstated when the delegator changes. The delegation remains in place, but the record still has to reflect any change within 30 days. Because the delegator's identity is part of the approval chain, a new senior manager should review the existing delegations and confirm that each one still fits the organization's current structure. Treat that review as a documented step, so the evidence shows the handover was controlled rather than assumed.

What evidence will an auditor ask for to show R3 and R4 are met?

For R3, the evidence is a dated document approved by a high level official that names the CIP Senior Manager. For R4, it is a dated document approved by the CIP Senior Manager that lists delegates by name or title and the specific actions each one may approve. Auditors also look at version history to see when each change was made and who approved it. Keep the approved versions, not only the working drafts, and make sure the approval trail can be reproduced on request. Confirm the exact evidence format with your Regional Entity before audit preparation begins.

Can a wiki or document system hold the R3 and R4 records?

Yes, provided it keeps approved versions and an audit trail. XWiki, for example, keeps every change under version control, records what changed, when and by whom, and allows comparison and rollback between versions. BookStack assigns permissions by role and can override them at shelf, book, chapter or page level, which helps restrict who can edit the record. Confirm that the platform meets your own retention, access and approval requirements before you rely on it, and make sure the approval step is recorded, not just the edit.

How DeployOpen prepares CIP-003 R3 and R4 evidence

DeployOpen works on CIP-003-9 R3 and R4 as a fixed-scope implementation engagement inside your own environment. We prepare the named CIP Senior Manager record and the delegation register so your organization can approve them and produce dated evidence for a Regional Entity; the approval and accountability remain with your organization.

How we scope

Confirm which BES Cyber Systems and asset types fall under your CIP-003-9 program before drafting any records.
Agree in writing which named roles, documents and approval workflows the engagement covers, with deliverables and timelines.
Identify who at your organization must approve the CIP Senior Manager designation and any delegation, and record that in scope.

How we build

Set up a controlled register for the CIP Senior Manager designation with the name, the approval date and the change history.
Build a delegation register that records each delegate's name or title, the specific actions delegated and the effective date.
Configure approval and review steps so each change is tied to the CIP Senior Manager and a 30-day update window is tracked.

How we hand over

Deliver the documented records, approval templates and version history in a format your compliance team can present to auditors.
Walk your team through how to record a change, approve it and export the dated document that serves as evidence.
Document the procedure so that the register can be maintained by your staff after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer if your program needs regular updates.
Review the register against your 30-day change windows when a Senior Manager or delegate changes.
Confirm with your independent auditor or Regional Entity which evidence formats they accept before you finalize the records.