What CIP-004-7 R1 security awareness requires each quarter
CIP-004-7 R1 requires you to reinforce cyber security practices for every person with authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems, and to do it at least once each calendar quarter. The reinforcement may also cover associated physical security practices, so a reminder about tailgating or badge handling counts alongside a reminder about phishing or credential handling. Low impact assets sit under a separate awareness requirement in CIP-003-9, so do not assume a low impact site falls under this quarterly cadence. Confirm the impact categorization from CIP-002 before you build the population list.
The requirement is mostly about proof of delivery. An auditor will not grade the prose of your reminder, but will ask for dated copies of each quarter's material and evidence that it reached the right people. Direct communications such as emails, memos or computer-based training, indirect communications such as posters, intranet pages or brochures, and documented management reinforcement all appear as acceptable forms of evidence in the standard's measures. Ask your team to name, for each quarter, the material, the date, the channel and the audience list, and to keep those four items together in one place.
The hard part is usually assembly, not content. Access holders often sit across several sites, and contractors may be provisioned through a different sponsor than employees, so the population list drifts from the access records. Evidence then lives in mailboxes, a learning management system, a physical noticeboard photo and a manager's notes, and nobody can show a complete quarter at audit time. Before the next quarter closes, confirm who owns the population list, which system is the record of delivery, and how a missed quarter will be detected and escalated. If you use an open-source learning platform such as Moodle, check how its activity completion settings define a completed view, grade or manual tick before you treat completion data as proof.
Which people, systems and locations R1 covers
R1 scope is set by two earlier decisions: how the entity categorized its BES Cyber Systems under CIP-002, and who holds authorized electronic or unescorted physical access to them. The cards below separate the decisions that change the work from the people who must be included in the quarterly reinforcement.
CIP-002 sets the boundary
R1 only reaches personnel tied to high and medium impact BES Cyber Systems, so the CIP-002 categorization is the first scoping input. Confirm the current impact rating of every system and location, including those reclassified after a change. A system rated low impact is outside R1 even if it sits on the same network as a medium impact system, so document the rating and the reasoning behind it.
High and medium impact only
R1 applies to personnel with access to high and medium impact BES Cyber Systems. Low impact assets follow a separate awareness requirement in CIP-003-9 Attachment 1, Section 1, which uses a 15-month cycle rather than the quarterly reinforcement in R1. Entities with both types of asset should run two tracks with separate rosters, so that the quarterly cadence is not applied to people who only need the 15-month activity.
Authorized electronic access
People with authorized electronic access include staff who can log in to, configure or administer a high or medium impact BES Cyber System, along with those who hold credentials to its EACMS, PACS or PCA. Pull these names from the access management records that the entity already keeps for R4, not from a directory of employees. Confirm that the roster is refreshed each quarter so that new grants and revocations are reflected in the next reinforcement cycle.
Authorized unescorted physical access
Unescorted physical access covers people who can enter a Physical Security Perimeter around a high or medium impact BES Cyber System without a escort. Badge holders, key holders and anyone with combination access belong on the roster, including facilities staff who can reach server rooms. Compare the badge system export against the physical access list, because a person can hold physical access without any electronic credentials and still fall within R1.
Contractors and vendor staff
Contractors, integrators and vendor personnel with authorized access are in scope in the same way as employees. The entity still owns the awareness obligation, so it must either deliver the reinforcement to these people directly or confirm in writing that the vendor delivers equivalent content and retains dated proof. Confirm this in the contract, and keep the vendor roster current because turnover on vendor teams is often faster than on internal teams.
Remote and shared access paths
Remote users reaching a high or medium impact system through Intermediate Systems, shared service accounts and jump hosts all create access that can be missed when a roster is built from HR records alone. Map each access path to the named individuals who use it, and treat any shared account as a case that needs a clear list of who may use it. Document how these paths were reviewed so an assessor can see that the roster covers them.
How an auditor tests quarterly security awareness
This table walks through the steps an assessor follows when testing CIP-004-7 R1 Part 1.1, from confirming who has access to checking dated material and distribution proof for each calendar quarter. Read it as a checklist: the evidence column shows what to have ready, and the findings column shows where programs most often fail the test.
| Test step | What the assessor checks | Common finding |
|---|---|---|
| Confirm the population | Lists of personnel with authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems, pulled from access management records | Access holders are missing from the awareness distribution list, or contractors with access are not identified |
| Select quarters to sample | Each calendar quarter in the audit period, since the requirement applies at least once every calendar quarter | A quarter has no reinforcement record at all, so the gap is visible on the timeline |
| Check the material | Dated copies of each reinforcement item (emails, memos, computer-based training, posters, intranet posts) that cover cyber security practices and, where relevant, physical security practices | Material is undated, undated versions cannot be tied to a quarter, or content does not address security practices |
| Verify distribution proof | Send logs, learning platform completion records, intranet publication dates or signed management communications showing the material reached personnel | Only a copy of the content is kept, with no record that anyone received or viewed it |
| Test reach to contractors and vendors | Evidence that third-party staff with authorized access received the same reinforcement, through the contract, the vendor portal or a direct send | Contractor personnel are left out of the distribution because they sit outside the employee directory |
| Confirm reinforcement content matches the program | That the topics in each quarter reflect the entity's cyber security policies and the risks addressed in its program | Reinforcement repeats generic material with no link to the entity's own practices |
| Match records to access changes | That people granted access after a quarter's communication were brought into the next reinforcement cycle | New access holders have no awareness record in their first full quarter |
Building a quarterly awareness program that produces evidence
This sequence turns the quarterly awareness obligation into a repeatable program: the right people receive reinforcement on a fixed calendar, and each delivery leaves dated proof that an auditor can trace back to a named population. The output is a program file that an assessor can follow from the access list to the distributed material.
Define the in-scope access population
Start from the access records for your high and medium impact BES Cyber Systems, not from the HR org chart. List every person with authorized electronic access or authorized unescorted physical access, including contractors and vendor staff who hold those rights. Compare the list with your access management records so that anyone who has been granted access, and anyone whose access was revoked during the period, is accounted for. The output is a dated roster of in-scope personnel, tied to the systems and access types that place them in scope, and signed off by the program owner.
Select reinforcement topics for cyber and physical practices
Choose the topics each quarter from the practices your organization actually relies on, such as phishing and credential handling, removable media rules, remote access procedures, incident reporting paths, and visitor and badge controls for Physical Security Perimeters. The standard expects cyber security practices, and it allows associated physical security practices to be included. Tie each topic to a policy or procedure that already exists in your CIP program so the content is consistent with what staff are held to. The output is a topic plan with one line per quarter explaining why each topic was chosen.
Choose direct, indirect and management channels
Decide how each quarter's material reaches people. Direct communications include email, memos and computer-based training. Indirect communications include posters, intranet pages and brochures. Management support and reinforcement covers supervisors raising the topic in team meetings or briefings. Using more than one channel makes the program easier to evidence, because each channel leaves a different record. Confirm with your Compliance and Learning teams which tools can log distribution and retain copies. The output is a channel matrix showing which channels carry each topic and which system holds the proof of delivery.
Set the quarterly calendar and assign owners
Build a calendar that places one reinforcement cycle in each calendar quarter, with a named owner for content, distribution, and evidence collection. Record the planned send or publication date for each channel so that a missed quarter is visible before an auditor finds it. Agree who approves the content and who can correct a late delivery. Confirm the internal deadlines you set with your CIP Senior Manager or compliance lead, because the standard requires the calendar quarter, not a specific day. The output is a published calendar with owners and approval steps.
Deliver each reinforcement and retain the material
Publish or send the approved material to the roster on the planned date. Keep a dated copy of every item as it was delivered, including the email text, slide deck, poster image, intranet page version or training module version. Where distribution is by system, export the send log, the publication history or the completion report. For management reinforcement, keep the meeting agenda or a signed note confirming the topic was covered. The output for each quarter is a folder containing the dated material and proof of distribution for each channel used.
Record completion and follow up on gaps
Compare the delivery records against the in-scope roster for the quarter and identify anyone who did not receive or open the reinforcement through the channels assigned to them. Where a learning platform is used, rely on the completion status it records, and confirm in your configuration what each completion setting means, since completion may be triggered by viewing, grading or a manual tick. Follow up on gaps through the owner, and record the follow-up actions. The output is a quarterly reconciliation that shows the roster, the delivered items, the exceptions and how each exception was closed.
Review the program each year
Once a year, review the whole program: whether the roster matches current access records, whether the topics reflect recent incidents, policy changes and threats, whether the channels still reach the people in scope, and whether the evidence folders can be retrieved quickly. Record the review, its findings and the changes made, and have the CIP Senior Manager or delegate sign it. Ask any consultant you engage to test the program against the evidence an auditor would request, and remember that an independent auditor, not the consultant, judges whether the program meets the standard. The output is a signed annual review record with a change log.
Choosing how to deliver and record awareness
A learning management system gives the strongest individual record. Each quarter, the reinforcement module is published to the people with authorized electronic or unescorted physical access, and the platform stores who opened or finished it and when. Moodle, for example, can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on how the activity is configured. That setting matters: a view-based completion proves less than a quiz-based one, so the completion condition should be chosen to match what you claim the person learned.
- Completion conditions: Decide in advance whether completion means viewing, passing a short check or a manual attestation, and document that choice.
- Per-person records: Export completion data with user identifiers and timestamps for each quarter, so each individual's reinforcement can be traced.
- Dated course versions: Keep a copy of the exact module content for each quarter, since the content itself is part of the evidence.
- Access list reconciliation: The enrollment list must match the current authorized population, or people with access will be missing from the record.
- Gap: A completion record does not prove the person was present, paying attention or able to apply the content.
Before relying on the platform, confirm how your version records completion and whether reports can be produced for a past quarter without manual reconstruction.
Direct messages such as emails, memos or short bulletins are the simplest channel to run and document. The evidence is the message itself, dated and archived, plus proof that it was sent to the right distribution. The weakness is that sending a message is not the same as the recipient reading or acting on it, and mail systems rarely prove who opened it. Distribution lists also drift over time as people join, transfer and leave, so the list used in one quarter may not match the authorized population.
- Archived copies: Store each quarter's message, attachments and subject line in a records system that cannot be silently edited.
- Distribution proof: Keep the sent-items or mail server log showing the recipients and send date for that quarter.
- Recipient reconciliation: Compare the list against the current access records and document any exclusions or late additions.
- Read receipts: Treat these as unreliable indicators, since many clients disable them, and do not depend on them as proof of reach.
- Gap: A mass email does not show individual reach. Pair it with a reply, acknowledgment or a second channel where individual proof matters.
Confirm with your compliance team how the message archive is retained and whether the list used for each quarter can be reproduced.
Posters, desk cards, screen savers and intranet banners reach people who never open an email or course. They reinforce practices passively, including associated physical security practices, which the requirement allows. Their evidence is weaker because the organization can show the material existed and was placed, but not that any particular person saw it. Auditors typically expect this channel to supplement a more traceable one rather than stand alone for the whole population.
- Dated content records: Keep an image or export of each poster, banner or page, with the date it went live and the location or URL.
- Placement evidence: Record where physical materials were posted, such as floor or building, and photograph them if the program requires proof of placement.
- Intranet analytics: Page view statistics can show that a posting was visible and accessed, although they do not identify each reader.
- Rotation log: Document the quarterly change so the record shows reinforcement occurred in each calendar quarter.
- Gap: Passive channels cannot show that a specific individual with access was reached. Use them as a supporting measure.
Before relying on posters or intranet pages, ask your auditor how they expect passive reach to be documented for your facilities and staff.
Briefings led by a manager, supervisor or security lead allow direct discussion and let the presenter answer questions about the current threat or a recent incident. The evidence is an attendance record, the agenda or slide deck, and notes on what was covered. Briefings give the best quality of reinforcement but are the hardest to scale, and attendance sheets often miss people on shift, on leave or working at remote sites. Management support is also a recognized form of reinforcement, so a leader's communication can count when it is documented.
- Attendance records: Capture name, role, date and session for each attendee, and sign or confirm the list where your process requires it.
- Materials: Keep the slides or talking points used in each session, dated and version-controlled.
- Make-up sessions: Schedule and record follow-up sessions for people who were absent, so the quarter's coverage is complete.
- Coverage check: Reconcile attendees against the authorized population at the end of each quarter.
- Gap: Attendance sheets are easy to fill in after the fact. Require sign-in at the session and keep the original form.
Confirm with your compliance team whether attendance records alone satisfy your evidence expectations, or whether they must be paired with a message or training record for each person.
Evidence that passes an R1 review
An R1 review asks whether the reinforcement actually happened in every calendar quarter and whether the records prove it reached the right people. The cards below cover the artifacts that answer those questions, and the habits that keep them retrievable without a scramble before an audit.
Dated copies of each quarter's material
Keep a dated copy of every piece of reinforcement content you issued, including slide decks, posters, intranet posts, newsletters and computer-based modules, exactly as they were delivered. Store each version with the quarter it covers, so an assessor can see the content for Q2 without asking which file was current. Check that the date on the material matches the distribution record, since a mismatch is one of the easiest findings to raise.
Distribution records for the in-scope population
Proof of distribution must reach the personnel who hold authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems. Tie each send, posting or notice to a roster drawn from your access management records, not from a general mailing list. Record who was reached, when, and by which channel, so direct, indirect and management reinforcement can each be traced to a named population.
LMS completion exports
When reinforcement runs through a learning management system, export completion data for each quarter and keep it with the content it refers to. Confirm what the platform counts as complete, since some systems mark an activity done when it is viewed, graded or ticked manually. Your written procedure should state which condition you rely on, so the export matches what you claim in the evidence.
Management reinforcement records
Management support and reinforcement is one of the accepted ways to show awareness, and it leaves its own trail. Keep records of managers' briefings, team meeting notes, or emails in which leaders restated security expectations, each tied to a date and an audience. Verify that these records are not only verbal assurances, because an assessor will ask for something written and dated.
A quarterly evidence index
Maintain one index with a row for each calendar quarter that links to the content copy, distribution record, completion export and any management record. Name the owner of each row and the date it was last checked. The index turns a sample request into a single lookup, and a gap in any quarter shows up as an empty cell rather than a discovery during fieldwork.
Retention and retrieval between audits
Confirm with your Compliance Enforcement Authority which audit period applies to you and how far back samples may be drawn, then set retention to cover it. Store evidence in a location with access controls that match the sensitivity of the records, and check each quarter that files open and the index links resolve. Review the retention rule at least once a year, so an old quarter does not disappear because a storage policy changed.
How a self-hosted Moodle course records awareness completion
A self-hosted Moodle course can produce the quarterly record that CIP-004-7 R1 Part 1.1 expects, but only if the activity completion rule is set to match what the reinforcement actually is. Moodle's activity completion marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions the course author sets. For a short awareness notice, viewing may be the right trigger. For a quiz or acknowledgement, a grade or a manual tick with a signed attestation may fit better. The organization owns the decision, and the completion condition should be written down in the security awareness procedure before the first quarter starts.
The risk is a completion record that looks complete but does not show reinforcement. If a learner opens a page while doing something else, a view-based rule will mark it done with no proof they read the content. A manual tick can be done by anyone with access, so it needs a documented owner. Before relying on the platform, confirm three things with your compliance lead and your CIP Senior Manager's delegate: which activity type and completion rule each quarterly item uses, whether the content matches the cyber security and associated physical security practices the program covers, and whether the record satisfies the evidence described in the standard, including dated copies of the material and proof of distribution.
Plan the export as part of the process, not as an afterthought. Each calendar quarter, export completion data for the awareness course, store it with the dated copy of the material it refers to, and keep it under your retention practice. Confirm with the vendor or your platform engineer which Moodle report or export format your version provides, and test it with a dry run before the first audit period. An implementation partner can configure the course and export routine, but the entity still owns the content, the completion rule and the evidence file. Only the auditor or the Compliance Enforcement Authority decides whether the records are sufficient.
What meeting R1 costs in money and effort
Meeting R1 is mostly a recurring operating cost, not a one-time project. The cards below separate what is paid once from what repeats every calendar quarter, and what drives each cost up or down for a given population of personnel.
Content development (one-time)
Building the first set of reinforcement material is the main up-front cost: policies translated into short lessons, posters, and intranet articles covering the cyber security practices and any associated physical security practices your program names. Ask whether the quote includes a review of the material by your CIP Senior Manager or compliance lead before first use, and who owns updates when your procedures change. Content that is generic and not tied to your own access processes is hard to defend in an audit.
Delivery and LMS tooling (recurring)
Each quarter, the material must reach every person with authorized electronic or unescorted physical access. That needs a delivery channel, such as email, a learning management system, or intranet postings, plus the hosting and licensing that channel requires. Confirm whether your platform or the partner's platform is licensed per user, per course, or per environment, and who pays for hosting if the system runs in your own cloud account or data center.
Staff time to run and record each quarter
Someone internal must schedule each reinforcement, send it, follow up with people who have not engaged, and file the result. This recurring effort grows with the number of in-scope people and sites, and it is often underestimated because it is spread across security, HR and operations. Ask the vendor or partner to describe the quarterly steps they will hand over and the steps they will run for you.
Evidence upkeep (recurring)
R1 is tested through documentation: dated copies of each reinforcement plus proof of distribution. Keeping that record complete every quarter, with completion data exported and stored where the auditor can retrieve it, is a recurring task. Check whether the quote includes a quarterly evidence pack, retention of earlier quarters, and a way to show who received each item, including contractors and staff who joined mid-quarter.
Drivers of cost and scope
The main cost drivers are the number of people with authorized access, the number of sites and Control Centers in scope, and the share of those people who are contractors or vendors whose access is managed by another organization. Each added site or contractor group adds distribution and evidence work every quarter. Ask the quote to state its assumed headcount, site count and how onboarding of new people is handled.
External review and auditor sampling
An independent review of the awareness program or preparation for a Regional Entity audit is an optional, periodic cost. Auditors do not issue certificates for CIP, and the compliance monitoring program samples records rather than reviewing every quarter in detail. Ask whether the quote includes a pre-audit sample check of recent quarters, and whether any external assessor fees sit outside the implementation scope.
Who owns R1 and what a partner can take on
Who is responsible for CIP-004-7 R1 security awareness?
The registered entity is responsible for the security awareness program and for proving that the quarterly reinforcement happened. The obligation sits with the entity under its own compliance program, not with any vendor or partner. The entity decides what reinforces cyber security practices for its personnel with authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems, runs the program, and keeps the records that a Compliance Enforcement Authority may ask to see. A partner can support that work, but it cannot take over the obligation or the accountability that comes with it.
What can an implementation partner set up for R1?
An implementation partner can configure the learning management system that delivers the reinforcement material, build the course structure and completion settings, and set up recording so that completions are captured in a form that can be exported. It can also build an evidence index that maps each quarter to the dated material, distribution records and completion data. DeployOpen implements, integrates and documents self-hosted open-source platforms inside the client's own infrastructure, so this work is delivered in that environment. Scope, deliverables and timelines are agreed in writing before work starts, and the entity should confirm that its chosen platform records the completion behavior it relies on.
What should stay in-house for CIP-004-7 R1?
Content approval and accountability should stay with the entity. Someone inside the organization must decide what the quarterly reinforcement covers, confirm that it reflects the entity's cyber security practices and physical security practices, and sign off on each release. The entity should also name an owner who answers for missed quarters and who can speak to the program during a Compliance Audit or Spot Check. A partner can draft or format material, but the content an auditor reads should reflect decisions the entity made and can explain.
Which parts of R1 do organizations usually outsource?
Organizations most often outsource the mechanical parts of the program: course configuration, scheduled distribution, completion tracking setup and evidence packaging. These tasks are repetitive, depend on tool knowledge, and are easy to get wrong when staff run them only once a quarter. A typical split is that the partner configures and documents the platform and evidence process, while internal staff approve content and review the quarterly package before it is filed. The entity should write this split into its own procedures so that it can show who did what in each quarter.
How much does outside help for R1 typically cost?
Cost depends on the scope agreed in writing, the number of platforms and personnel groups in scope, and whether the work is a one-time setup, an ongoing retainer, or both. The one-time costs usually cover platform configuration, the evidence index and a walkthrough for staff. Recurring costs come from keeping the platform updated and running the quarterly process. No standard figure is supplied here. Ask any provider for a quote that separates setup from recurring support, lists the systems and personnel groups covered, and states what evidence will be delivered each quarter.
What does the auditor test for R1, and what is their role?
The auditor tests whether the entity's program meets the requirement. In practice that means sampling quarters, checking that dated reinforcement material exists, and verifying proof of distribution or management reinforcement for each sampled period. Only an independent auditor or Regional Entity assessment team issues findings. Neither the implementation partner nor DeployOpen issues audit reports, attestations or certificates. Because there is no CIP certificate, the entity should expect findings through the compliance monitoring process, and the partner's role ends at preparing systems and evidence for that review.
Can a partner's involvement affect audit independence?
A partner's involvement does not make the auditor less independent, provided the roles stay clear. The partner prepares systems, configures the platform and assembles evidence. The auditor selects samples, tests them and reaches its own conclusions. Problems arise when a partner also writes the findings, signs compliance statements or presents itself as the party that verified compliance. The entity should keep separate records of who configured what, document that the partner did not evaluate the program, and ask the auditor how it prefers evidence to be delivered.
Can our own staff run R1 without an outside partner?
Yes, an entity can run R1 with its own staff, provided it has the skills to configure the learning platform, the discipline to deliver material every calendar quarter, and a way to retain dated evidence. Many entities find the risk lies in continuity: one person often holds the knowledge of how completions are recorded. Before deciding, the entity should confirm which platform it will use, who can export records, and how the evidence index will be maintained. An outside partner is one option among several, and the decision should follow from the entity's own capacity and written scope.
Common reasons quarterly awareness fails an audit
Most CIP-004-7 R1 findings are not about missing training content. They come from gaps in the quarterly cycle: a quarter with no record, a distribution list that no longer matches who holds access, or evidence that cannot be tied to a specific version of the material. Each card below names one gap, why an assessor will notice it, and the check that closes it.
A quarter with no record
R1 Part 1.1 expects reinforcement at least once in every calendar quarter, so a single empty quarter is a visible violation even when the team was active the rest of the year. Staff turnover, a skipped campaign during an outage or a holiday period are the usual causes. Build a quarterly calendar with a named owner and a due date for each quarter, and file the dated evidence before the quarter closes rather than reconstructing it later.
Reinforcement sent to a stale list
Reinforcement must reach personnel with authorized electronic or unescorted physical access. If the distribution list was built from a directory group or an old access spreadsheet, people who were granted access after it was created are missed, and people who left may still receive it. Generate the recipient list from the current access authorization records each quarter, keep the query or export as evidence, and reconcile it against the access list before sending.
Contractors left out
Contractors and vendor staff with authorized access are personnel under this requirement, yet they often sit outside the employee directory and the LMS. A quarter can look complete for employees while contractors with active access never received anything. Ask each contract manager for a current roster of people with access, include them in the recipient source, and record how the material reached them, such as a signed acknowledgment or a training account.
Completion marked without reinforcement
An LMS can mark an activity complete when a learner opens it, when a grade is posted or when someone ticks a box, depending on how the activity is configured. A completion flag alone does not show that a reinforcement message was delivered or read. Configure the completion condition deliberately, such as requiring the learner to view the full content, and keep the content, the completion log and the delivery record together. Confirm the exact completion conditions with your platform administrator before relying on them.
Undated or unversioned content
Assessors expect dated copies of the material that was actually distributed. If a slide deck or poster is overwritten each quarter, or the file name carries no date, the team cannot prove what a given reviewer saw in a given quarter. Store each quarter's content as an immutable, dated version in a document repository, record the version identifier in the campaign log, and keep the exact file that was sent, not a later revision.
Records split across tools
Quarterly evidence often lives in an email archive, an LMS, an intranet and a spreadsheet, so an auditor must assemble the story by hand. Gaps appear when one tool shows delivery, another shows completion and no one can show which version went out. Pick one system of record per quarter, or an index that links each delivery method to its artifact, and retain the recipient list, the content version and the proof of distribution together for the audit period.
CIP-004-7 R1 questions buyers ask before hiring help
Can we run CIP-004-7 R1 security awareness in-house?
Yes, most registered entities run R1 themselves, because the requirement is a quarterly reinforcement of cyber security practices with evidence that it was delivered. The work is small in form but unforgiving in detail: someone must own the calendar, produce the material, distribute it through channels you can prove, and keep dated copies. Teams that struggle usually lack a named owner or a repeatable evidence routine, not the ability to write a good email or poster. Ask whether your current staff can commit to the quarterly cycle and keep records for the audit period before deciding whether outside help is needed.
What skills and staff time does R1 actually need?
R1 needs a compliance owner who understands which people hold authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems, a content author who can tie reinforcement to your own cyber security practices, and a records keeper who files evidence. The effort recurs every calendar quarter, so the real cost is the standing routine rather than any single session. Staff time scales with the number of people in scope, the number of channels you use and how many sites or business units share the program. Ask your team to estimate those drivers internally before requesting a quote.
How long does it take to build a first R1 evidence set?
The duration depends on drivers rather than a fixed figure: how mature your existing awareness material is, how many distribution channels you already log, whether learning platforms record completions, and how quickly the people who approve content can respond. A team with a documented practice and an existing intranet may need far less time than one starting with no records. The first set also carries setup work, such as defining the in-scope population and agreeing on what counts as proof of distribution. Any partner should give you a duration in a written, fixed-scope plan based on your environment.
How does R1 security awareness differ from R2 cyber security training?
R1 is a recurring reinforcement: at least once each calendar quarter, you remind in-scope personnel of cyber security practices, and you keep evidence that it happened. R2 is a structured training program with defined content areas, which must be completed before access is granted and repeated at least every 15 calendar months. Auditors look for different artifacts for each: dated reinforcement material and distribution proof for R1, and training records tied to access grants and completion dates for R2. Keep the two programs separate in your evidence index so an assessor can trace each requirement without guessing.
Does a low impact asset need CIP-004-7 R1?
No. CIP-004-7 R1 applies to high impact and medium impact BES Cyber Systems. Low impact assets have a separate awareness requirement in CIP-003-9 Attachment 1 Section 1, which calls for a 15-month cycle rather than a quarterly one. Confirm your categorization under CIP-002 before you design the program, because the wrong impact rating sends you to the wrong requirement. If your assets are all low impact, a lean program built around the CIP-003 plan is usually the more proportionate starting point. You can review the NERC CIP standards page to confirm current effective dates.
What is the partner's role compared with the auditor's?
The organization owns its controls and its compliance obligations. An implementation partner such as DeployOpen can help prepare systems, set up training and reinforcement workflows, organize evidence and document the process, under a fixed scope agreed in writing. Only an independent auditor or the Compliance Enforcement Authority, typically a Regional Entity or NERC, assesses compliance and issues findings. There is no CIP certificate, so a partner cannot certify your program. Ask any partner to state in writing which deliverables are preparation and which, if any, involve an assessment by an outside party.
What does outside help cost, and what drives the price?
DeployOpen does not publish a price list, and a quote follows from the written scope. The main cost components are the setup work to define scope and evidence, the content and workflow build, any learning platform configuration, and the recurring quarterly routine if you ask a partner to run it. Costs rise with the number of in-scope people, sites and channels, and with how much of the evidence you want automated. Ask for a quote that separates one-time setup from recurring quarterly work, and that lists which evidence artifacts are included.
What penalty risk comes with missing R1 reinforcement?
A missed quarter is a potential violation, and enforcement can carry substantial penalties. NERC's Sanction Guidelines reference a maximum civil penalty of $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 and shown in the eCFR. Actual outcomes depend on the facts, the history, the self-reporting and the mitigation, so treat the maximum as a ceiling, not an expected result. Good evidence and a self-report of gaps usually shape the outcome more than the maximum itself.
How DeployOpen prepares R1 awareness evidence
DeployOpen's role in R1 is to prepare the systems and records that show the quarterly reinforcement happened, not to decide whether the program is compliant. The first step is agreeing the in-scope population with the client in writing before any work starts. That means identifying which people hold authorized electronic or unescorted physical access to high and medium impact BES Cyber Systems, which of those assets are in scope under the CIP-002 categorization, and which contractors and vendor staff sit inside the same population. Because the requirement is tied to access, the scope list should come from the access management records the client already keeps, and the client should confirm it matches what its access systems show on the day the list is produced.
Next, DeployOpen configures a self-hosted learning platform inside the client's own infrastructure, such as Moodle under the GPL-3.0-or-later license, to deliver the quarterly material and record completions. Activity completion in Moodle marks an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions set for that activity. Those conditions must be chosen deliberately, because a view-based completion proves that a page loaded, not that the person received the reinforcement. The client should confirm, with its compliance lead, which completion rule it will accept as evidence of distribution for each communication type. DeployOpen can also set up the non-learning channels the standard recognizes, such as intranet posts and posters, and document how each one is distributed.
DeployOpen then prepares the evidence index and recording process: a dated record of each quarter's material, the distribution method, the audience, and the completion or acknowledgment data for each person. The index should show every calendar quarter in the audit period, so an assessor can see that no quarter was skipped. DeployOpen documents the procedure so the client's staff can run it after handover. DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and the Compliance Enforcement Authority assess the program, and the client remains responsible for its own controls and the accuracy of its records.
