CIP-004-7 R2 Cyber security training program: requirements and evidence

What CIP-004-7 R2 asks for before anyone gets access

If your organization grants people authorized electronic access or unescorted physical access to high or medium impact BES Cyber Systems, CIP-004-7 R2 requires a cyber security training program that fits each role. The program has to fit the job: an operator who only views alarms does not need the same depth as an engineer who changes firewall rules or a contractor who escorts equipment into a substation. Two timing rules govern the program. Part 2.2 requires each person to complete the training before authorized electronic or unescorted physical access is granted, except during CIP Exceptional Circumstances. Part 2.3 requires the training to be repeated at least once every 15 calendar months. Treat both as hard gates in your provisioning workflow, not as annual reminders.

The reason for the timing is practical. A person who has not been trained on incident reporting, Transient Cyber Assets, Removable Media or BES Cyber System Information handling can make a change to a grid system that looks routine but creates a reliability or security problem. Before you grant access, confirm that the training record exists, that it covers the role's content, and that the record date falls within the 15-month window. Ask your compliance team which roles map to which training content, and document that mapping, because an assessor will ask how you decided what each role needed.

Keeping this current is harder than it sounds. Staff change roles, contractors rotate through projects, policies and vendor tooling are revised, and the list of people with access grows over time. Confirm with your Compliance Enforcement Authority how it will test the program, since there is no CIP certificate: compliance is monitored through audits, spot checks, self-certifications and self-reports. Your evidence therefore has to show, for each person, what training was completed, when, and before which access was granted. Confirm how your learning platform records completion and retains those records for the audit period.

Which systems, people and vendors R2 covers

R2 reaches further than the control room. It applies to high impact BES Cyber Systems, medium impact BES Cyber Systems with External Routable Connectivity, and the EACMS and PACS that support them, so the people in scope are often broader than the operations staff a team first names. Each card below is a scoping decision that changes who gets trained and how the program is built.

High and medium impact systems in scope

R2 attaches to high impact BES Cyber Systems and to medium impact BES Cyber Systems with External Routable Connectivity. Medium impact systems without that connectivity fall outside the R2 table. Confirm each system's categorization under CIP-002 before you build the training roster, because a reclassification can add or remove whole groups of people.

Associated EACMS and PACS

Electronic Access Control or Monitoring Systems and Physical Access Control Systems associated with in-scope systems bring their administrators and maintainers into the program. A person who manages a badge reader or an authentication server can reach the protected system even if they never log into it. Map these support tools explicitly, or staff who run them may be missed.

Employees, contractors and vendor staff

The training obligation follows access, not employment status. Employees, contractors and vendor staff who hold authorized electronic access or authorized unescorted physical access to in-scope systems all need training before that access is granted. Ask integrators and managed service providers to confirm which of their people hold such access, since your records will not show it for them.

Role-based tiers

R2 requires training appropriate to each person's roles, functions or responsibilities, so one course for everyone rarely fits. A control room operator, a network engineer and a facilities guard need different depth on the same nine content areas. Define tiers by access type, such as electronic only, unescorted physical only or both, and document which content each tier receives.

Low impact only entities

Entities whose assets contain only low impact BES Cyber Systems are not subject to the CIP-004 R2 table in the same way. Their obligations sit mainly in CIP-003, so they should not build a full R2 program by default. Confirm with the Regional Entity how low impact categorization applies to your facilities, and note the 1 April 2026 date for CIP-003-9 vendor remote access controls.

Access that starts before training ends

Because training must be complete before authorized access is granted, the access request workflow and the training record must agree. A vendor technician granted access the same day as onboarding is a common gap. Check that provisioning cannot complete ahead of the training record, unless the event falls under CIP Exceptional Circumstances.

How an auditor tests the R2 training program

This table walks through each step an auditor typically takes when testing CIP-004-7 R2, from confirming the program exists to checking the 15-month refresh. Read each row as a test step paired with the evidence to prepare and the findings that most often appear.

Test step	What the auditor checks	Evidence to prepare	Common findings
Program existence	A documented cyber security training program exists and is tied to the in-scope BES Cyber Systems, EACMS and PACS	Current training program document, its approval record and the list of in-scope systems it covers	Program written only as informal guidance, or not updated after scope changes
Role mapping	Training content and frequency differ by role, function or responsibility, as the requirement's wording calls for	Role matrix showing who needs which training, with the access type each role holds	Roles with electronic or unescorted physical access missing from the matrix
Content coverage against Part 2.1	Each of the nine required content areas appears in the training material delivered to personnel	Course outlines or slide decks mapped to each Part 2.1 content area, plus version history	Content areas such as Transient Cyber Assets, Removable Media, visitor control or BCSI handling absent from the course
Completion before access (Part 2.2)	Training is completed before authorized electronic access or authorized unescorted physical access is granted, except during CIP Exceptional Circumstances	Completion record date for each sampled person beside the date their access was provisioned	Access granted before the completion date, or CIP Exceptional Circumstances invoked without documentation
Refresh cycle (Part 2.3)	Each person completes training again at least once every 15 calendar months	Training history for each sampled person showing the prior completion date and the next due date	Refresh dates lapsed for contractors or staff on leave, or tracking that relies on memory rather than records
Completeness of the population	Every person with in-scope access appears in the training records, including vendors and contractors	Reconciliation of the access list against the training completion list	Individuals with active access but no training record, often vendor or shared-account users
Learning management records	Completion data is reliable, timestamped and retained for the audit period	Exports from the learning platform, with settings showing what marks an activity complete	Completion marked by a manual tick or a grade setting that does not match the requirement

How to implement the R2 training program step by step

This sequence turns CIP-004-7 R2 from a policy statement into a training program that maps every role to its content, blocks access until training is complete, and leaves records an auditor can test.

Map roles to access and BES Cyber System scope
Start by listing every person and role with authorized electronic access, authorized unescorted physical access, or both, to high impact BES Cyber Systems and medium impact BES Cyber Systems with External Routable Connectivity, including their associated EACMS and PACS. Your CIP-002 categorization decides which systems are in scope, so confirm it first. Include contractors and vendor staff who hold such access. The output is a role register that links each role to the systems it touches and to the access type it holds. The step is done when the register can be reconciled against your access management records and the CIP Senior Manager has reviewed it.
Define role-based curricula against Part 2.1
For each role in the register, decide which of the nine Part 2.1 content areas it needs and to what depth. Cover policies, physical and electronic access controls, visitor control, BCSI handling, incident identification and reporting, recovery plans, incident response, and cyber security risks of interconnected systems including Transient Cyber Assets and Removable Media. A control room operator, a field technician and a records administrator will not need the same depth on every area, but the program must still address each area for the roles it applies to. The output is a curriculum matrix, reviewed by the compliance lead, that shows which content area each role covers and where the material for it lives.
Build or source the course content
Write the course material yourself or source it from a training provider, then check that it matches your own policies, procedures and system names. Generic material that does not describe your Electronic Security Perimeters, access request steps, or incident reporting path will be hard to defend in an audit. A learning management system such as Moodle can host the modules and record completion, but confirm how your chosen configuration marks an activity complete, because that determines whether a completion record proves the person actually engaged with the content. The output is a versioned set of modules, each mapped to the curriculum matrix, with an assessment or acknowledgement step and a named owner for updates.
Set access gates that block provisioning until completion
Requirement Part 2.2 requires training to be completed before authorized electronic or unescorted physical access is granted, except during CIP Exceptional Circumstances. Build that dependency into the provisioning workflow so that an access request cannot be approved until the role's required modules show as complete. Where access is granted by hand or through a ticketing system, add a checkpoint that the approver must confirm against the training record. Document the exception path for CIP Exceptional Circumstances and who may invoke it. The output is a written gate procedure and a test showing that an access request for an untrained person is stopped or flagged.
Schedule 15-month refreshers
Part 2.3 requires training at least once every 15 calendar months. Each completion record should carry its own due date, calculated from the date of completion, and the system should flag people approaching that date. Assign a named owner who reviews the upcoming list and confirms that refresher content is current, especially after changes to policies, access methods or systems. Where a person's role changes, check whether the new role requires additional content before access is granted under the new role. The output is a tracked schedule of due dates with reminders and escalation, and a record showing each refresher was completed inside the 15-month window.
Document the program and retain the evidence
Write the training program as a controlled document that states its purpose, the roles in scope, the curriculum matrix, the access gate, the refresher schedule, the exception path and the owners for each. Keep the completion records, assessment results, curriculum versions and gate test results together so they can be produced during an audit. Confirm your retention period and evidence format with your Regional Entity or compliance advisor, since requests for evidence follow a set process. The output is an approved program document and an evidence index that maps each element of R2 to the artifact that proves it.

Making training completion a gate before access

Part 2.2 of CIP-004-7 R2 is the training requirement most often missed in practice because it is decided at the moment of provisioning, not in the training system. The rule is that training must be completed before authorized electronic access or authorized unescorted physical access is granted, and an auditor will compare the access grant timestamp with the training completion record for the same person. When the two are maintained by different teams, in different tools, with no shared identifier, the sequence is hard to prove even when it was followed. The practical fix is to make training completion a gate in the access provisioning workflow, so that a ticket cannot be fulfilled until the training record shows the required course for that role was completed within the period Part 2.3 allows.

A workable gate usually has three parts. The identity or access management system should hold the role-to-training mapping, so that a request for a given Electronic Access Control or Monitoring System, or a given physical zone, names the courses that role requires. The approver or the provisioning script should query the learning record for each named course and record the result on the request. Finally, the grant itself should be logged with the training evidence attached, so the record shows what was checked and when. Ask your learning platform vendor or integrator to confirm that completion can be exported with a person identifier and a completion date, because a gate that depends on manual screenshots is difficult to evidence. If your learning system is self-hosted, check how its activity completion is recorded before relying on it. Moodle, for example, marks an activity complete depending on the conditions set for that activity, such as viewing it or receiving a grade, so the completion rule must match what you intend to count as training.

The CIP Exceptional Circumstances carve-out is the exception to this gate, and it must be documented, not assumed. Part 2.2 excludes access granted during CIP Exceptional Circumstances, so an urgent grant made without prior training is only defensible if the entity can show that the circumstance met its own definition and that the access was handled under its process. Document who authorized the emergency grant, the reason, the access given, and the follow-up that completed the training. Confirm the current CIP Exceptional Circumstances definition in the standard text and in your compliance program, and test the emergency path periodically so that it is not first used during an audit.

Evidence that proves R2 training is current

An auditor testing CIP-004-7 R2 looks for a documented program, proof of what each role was trained on, and dated records showing training came before access and was repeated within 15 calendar months. The cards below cover each artifact and how to keep it accurate between Compliance Audits, since the Compliance Enforcement Authority can request records on short notice.

Training program document

This is the written cyber security training program that sets out the content, the roles it covers and how training is delivered and tracked. It should name the owner, the approval date and the review cycle, and it should reference the nine Part 2.1 content areas so an assessor can trace each one. Check that the version in force matches the version your team actually runs, and keep prior versions with their effective dates.

Role-to-curriculum mapping

A mapping table links each role that holds authorized electronic or unescorted physical access to the courses it must complete. Because Part 2.1 requires training appropriate to roles, functions or responsibilities, this table is what justifies why a control room operator and a network administrator take different content. Review it whenever a role is created, split or retired, and record who approved each change.

Course content covering the nine areas

Keep the course materials, slides, quizzes or recordings used for each training module, with the version and publication date. Map each module to the Part 2.1 areas, including Transient Cyber Assets and Removable Media, so the auditor sees that every required topic is covered. If a third party supplies content, retain the licensing or contract terms that allow you to produce it on request.

Individual completion records

Each person's record should show the course, the completion date and the outcome, such as a passed assessment or attendance confirmation. Learning platforms can mark an activity complete when a learner views it, receives a grade or ticks it manually, so confirm which trigger your configuration uses. A manual tick alone may not show that the content was actually covered, so set completion rules to match what you can defend.

Provisioning records showing training came first

Part 2.2 requires training to be completed before authorized electronic or unescorted physical access is granted, except during CIP Exceptional Circumstances. Pair each access ticket or provisioning event with the training completion date for that person, so the sequence is visible. Flag any grant where the training date is later than the access date, and document whether a CIP Exceptional Circumstance applied.

Fifteen-month refresh tracking

Part 2.3 requires retraining at least once every 15 calendar months, so track each person's next due date from their last completion. Set reminders well before the due date and block or review access for anyone who lapses, since an overdue record is a finding even if the person still works in the role. Keep the report that shows the due-date status for all personnel at each review point, not only the most recent one.

What meeting R2 costs in money and effort

The largest upfront effort is designing the program. The organization must map its roles to the training content, decide which roles need which modules, and write course material that covers the nine content areas in Part 2.1. Most of this is internal staff time, and external consultants are often engaged to draft role matrices and content outlines. Platform setup is a separate, smaller item that covers installing and configuring a learning management system (LMS) and linking it to access provisioning.

Program design: Role inventory, role-to-module mapping and the written training plan. Staff time from security, HR and the business owners of BES Cyber Systems is the main cost.
Content development: Writing or adapting modules for policies, access controls, BCSI handling, incident reporting and Transient Cyber Assets. Buying off-the-shelf content costs license fees but may need local customization.
LMS setup: Installation, configuration, course build-out, and integration with identity management so that access is gated on completion.
Assessment design: Knowledge checks and pass criteria that you can show an auditor.

Ask any implementation partner for a written breakdown of these items, including who performs each task and which deliverables you will own at the end.

Where R2 training programs usually fall short

Most R2 failures are not missing courses. They come from training that does not match what each person does, content that skips one of the required areas, and access that starts before anyone has finished. The cards below pair each common gap with a fix the program owner can check.

Training not matched to roles

A single generic course given to everyone treats an operator at a control console the same as a network engineer or a records clerk. R2 asks for training appropriate to each individual role, function or responsibility, so the program needs a role-to-module map. Check that each role with authorized access has a named course set, and that the map is reviewed when job duties change.

Content missing a required area

Programs often cover policies and phishing but drop items such as BCSI handling, visitor control, or recovery plans. Part 2.1 lists the required content, so each course outline should be traced line by line against that list. Keep a crosswalk showing which module covers each of the nine areas and which version of the material was delivered.

Access granted before completion

Provisioning often runs ahead of training, especially for contractors who need access on day one. Part 2.2 requires completion before authorized electronic or unescorted physical access is granted, unless CIP Exceptional Circumstances apply. Make training completion a hard gate in the access request workflow, so the access system will not issue credentials until the training record exists.

Contractors and vendor staff omitted

Vendor technicians, integrators and contract staff with authorized access are still in scope for R2, yet they often sit outside the employee learning system. Their training records may live with the vendor or not exist at all. Require written confirmation of completion for each person before access, and keep those records in a form you can produce during an audit.

Refresh dates tracked in spreadsheets

A spreadsheet of completion dates breaks easily: rows are missed, dates are typed wrong, and nobody is alerted before the window closes. Part 2.3 requires completion at least once every 15 calendar months, so a missed refresh is a violation even if the person is still working. Use a learning platform that records completion and sends reminders, and run a periodic report that flags anyone approaching the deadline.

Questions buyers ask about CIP-004-7 R2 training

What drives the cost of a CIP-004-7 R2 training program?

The main cost drivers are the number of people who need authorized electronic or unescorted physical access to high or medium impact BES Cyber Systems with External Routable Connectivity, the number of distinct roles those people hold, and how much of the course content must be written for your own environment. Costs fall into two groups. One-time costs include mapping roles to the nine Part 2.1 content areas, writing or tailoring course material, and setting up the learning platform and records. Recurring costs include repeating the training at least every 15 calendar months, updating content when policies or systems change, and maintaining role assignments as staff move. Ask any quote to separate these two groups, to state which roles it covers, and to say who maintains the content after handover. No price is set here; the quote should follow from your written scope.

How long does it take to set up a CIP-004-7 R2 training program?

Setup time depends on how many roles need distinct training, how much of your existing security awareness material can be reused, and how quickly your internal reviewers can approve content. The key timing constraint is Part 2.2: training must be completed before authorized electronic or unescorted physical access is granted, so the program must exist before the first new grant. Part 2.3 then sets the repeat cycle at least every 15 calendar months. Ask a partner to show the schedule as milestones tied to your access grant process, and confirm which steps depend on your own staff, such as policy approval and subject matter review. Any duration should come from the written scope, not from a general estimate.

What does the entity's own team need to provide?

Your team owns the CIP program, so several inputs cannot come from outside. You need to name the roles that hold authorized access, confirm which BES Cyber Systems and associated EACMS and PACS they touch, and approve the training content against your actual cyber security policies, access controls, visitor control, BCSI handling, incident reporting and recovery plans. Your team also needs to decide how access grants are linked to training completion, who signs off on exceptions, and how CIP Exceptional Circumstances are recorded. Before work starts, ask the partner to list every input it needs from your staff and the person accountable for each one.

Can an entity run CIP-004-7 R2 training in-house?

Yes, an entity can build and run its own training program, and many do. The requirement does not prescribe a provider or a delivery format; it asks for a program appropriate to each role and proof that the required content was completed in time. In-house delivery makes sense when you have staff who understand the CIP standards well enough to write role-specific content and keep it current. A partner can help where internal expertise or capacity is thin, for example by preparing the course structure, the learning platform and the evidence trail. In either case, the registered entity remains responsible for the program. Confirm with your Compliance Enforcement Authority or your own compliance lead how they expect the program to be documented.

What does an implementation partner handle for CIP-004-7 R2?

A partner such as DeployOpen can plan, implement, customize, integrate and document the training program inside your own infrastructure. In practice this can include mapping roles to the Part 2.1 content areas, building role-based courses, configuring a self-hosted learning platform such as Moodle inside your environment, setting completion tracking, and preparing the records your team needs for an audit. A partner does not own the controls, decide which people receive access, or issue any audit report or certificate. Only an independent auditor or the Compliance Enforcement Authority assesses compliance. Scope, deliverables and timelines should be agreed in writing before work starts, and any ongoing support or content updates can be arranged as a retainer.

How should CIP-004-7 R2 training records be retained?

Keep records that show who completed which course, when they completed it, which version of the content they saw, and that completion came before access was granted. Records should be retrievable for each person with authorized access, and they should link to the access grant record so an assessor can trace the sequence. Because there is no official certificate, the evidence is the set of records and your program documentation. Retention periods are set by your own compliance program and the audit period that applies to you, so confirm them with your Compliance Enforcement Authority and your internal compliance lead. Where records live on a self-hosted platform, confirm backup, access control and disposal rules, since BCSI-related records may fall under CIP-011-3.

How does a learning platform show a training course was completed?

Completion tracking depends on the conditions you set on each activity. In Moodle, for example, activity completion can mark an activity complete when a learner views it, when they receive a grade, or when they tick it manually. For CIP-004-7 R2, the condition should match the evidence you need: a grade or a verified assessment is usually stronger than a page view. Ask your partner to document which completion condition each course uses, to export completion data with dates, and to confirm that the export can be linked to the access grant. Test the setup with a sample learner before relying on it. Moodle's activity completion documentation explains the available conditions.

What should be checked before accepting a CIP-004-7 R2 training quote?

Check that the quote lists the roles and systems in scope, the content areas covered against the nine Part 2.1 items, and the deliverables, such as course materials, platform configuration, completion records and documentation. Confirm which tasks are one-time and which recur, including the 15-month repeat cycle and content updates. Ask who approves the content, who maintains the platform, and how access grants are linked to completion. Confirm that the partner will not sign off on compliance and that the timeline depends on your inputs. Finally, ask for the change process if scope grows, since a fixed-scope agreement should state how changes are priced and approved.

How DeployOpen prepares R2 training systems and evidence

DeployOpen works on CIP-004-7 R2 inside the client's own infrastructure, preparing the training system, role-based course content and completion records that an auditor can sample. The organization keeps ownership of its training program and its personnel decisions, while DeployOpen prepares the systems and evidence that show the program operates as written.

How we scope

Engagements are fixed-scope, with the roles, systems and content areas agreed in writing before work starts.
The written scope lists which BES Cyber System roles need training and which Part 2.1 content areas each role must complete.
Scope also records the training deadlines tied to access grants and the 15-calendar-month repeat cycle for each role.

How we build

We configure the learning platform so each role-based course gates access grants and tracks completion dates per person.
Course content is mapped to the nine Part 2.1 content areas, including BCSI handling, Transient Cyber Assets and Removable Media.
Completion rules are tested with sample learners so records show the correct dates before any production access is granted.

How we hand over

We document the training matrix, role definitions, course versions and the process for granting and recording access.
Handover includes exportable completion reports that show each person's training date, course version and renewal due date.
Runbooks explain how to update content, record exceptions and respond when a 15-month completion date is approaching.

How we support

Ongoing support, upgrades and content maintenance are available as a retainer, agreed separately from the initial scope.
Retainers can cover course updates when CIP obligations or internal policies change, with the change recorded in the program documentation.
Confirm with your compliance lead how your Regional Entity expects training records to be retained and presented during audits.