CIP-004-7 R1 Security awareness program
The quarterly security awareness reinforcement for personnel with authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems.
CIP-004 Personnel and training
CIP-004-7: security awareness, role-based training, personnel risk assessments, access authorization and review, access revocation, and access to BES Cyber System Information.
CIP-004-7 R2 Cyber security training program
Role-based cyber security training that must be completed before access is granted and repeated at least every 15 calendar months, with nine required content areas.
CIP-004-7 R3 Personnel risk assessment program
Identity confirmation, seven-year criminal history checks and their evaluation criteria, contractor verification, and the requirement to repeat the personnel risk assessment at least every seven years.
CIP-004-7 R4 Access management program
Need-based authorization of electronic, unescorted physical and remote access, quarterly verification of authorization records, and a 15-month review of user accounts and privileges.
CIP-004-7 R5 Access revocation
Removing access when people leave or change roles: the 24-hour removal on termination, next-day revocation on transfer, 30-day account cleanup and shared password changes.
CIP-004-7 R6 Access management for BES Cyber System Information
The requirement added in version 7 to authorize, verify and revoke provisioned access to BES Cyber System Information wherever it is stored, including with cloud and other third-party providers.
