Personnel risk assessments for contractors under NERC CIP

What personnel risk assessments for contractors under NERC CIP require before access

CIP-004-7 R3 requires a documented personnel risk assessment program for any individual before that individual receives authorized electronic access or authorized unescorted physical access to CIP-scoped systems, except during CIP Exceptional Circumstances. For contractor staff, the registered entity must confirm the person's identity under Part 3.1, obtain a seven-year criminal history records check under Part 3.2, and, where the contractor or service vendor performed its own assessment, verify that the assessment meets Parts 3.1 to 3.3 under Part 3.4. The obligation sits with the entity. A contractor can run the identity confirmation and background check on its own, but the entity still needs criteria or a process that proves the result meets the standard before the badge or account is issued. Only the entity's records are reviewed by the Compliance Enforcement Authority, so the entity must be able to produce them on request.

Several decisions vary by organization and should be settled in writing before the first contractor starts. The entity must define its evaluation criteria under Part 3.3 for deciding what a criminal history result means for access, and it must decide whether it will accept a contractor's assessment or run its own check for each engagement. Acceptance depends on what the contractor provides: the entity should ask for the check date, the scope of the residence history, the criteria the contractor applied and a statement that identity was confirmed. Contracts should require the contractor to notify the entity when a result changes during the engagement. Confirm with your Regional Entity how it expects evidence to be organized, because the required form of the record is set by the entity's program rather than by the standard text alone. Plan the paperwork around the lifecycle, not just the first day. Under Part 3.5, every individual with authorized access must have a personnel risk assessment completed within the last seven years, so contractors with long assignments need a renewal date tracked in the same system as their access. Training under Part 2.2 must be finished before access is granted, so a contractor who has cleared the background check still cannot log in until the training record exists. When a contractor's work ends, the entity must start removal of unescorted physical and Interactive Remote Access and complete it within 24 hours of the termination action under CIP-004-7 R5, so the access list and the contract end date should be linked. Ask your own compliance team which system of record will hold these dates.

Who does what: the entity, the contractor and the assessor

The registered entity owns its personnel risk assessment program under CIP-004-7 R3. That ownership covers the documented program, the criteria or process the entity uses to evaluate criminal history records (Part 3.3), and the process it uses to verify that a contractor or service vendor's assessments meet Parts 3.1 to 3.3 (Part 3.4). The entity cannot hand these duties to a vendor, even when the vendor performs the checks.

Program documentation: A written PRA program that states who must be assessed, which checks apply, and when access is withheld.
Evaluation criteria: Defined criteria for deciding what a criminal history result means for authorization, applied the same way to employees and contractors.
Verification records: Retained evidence that each contractor assessment was checked against Parts 3.1 to 3.3, not just received.
Seven-year currency: Tracking so that each individual with access has an assessment completed within the last seven years (Part 3.5).
Access decisions: A documented link between the PRA result, the access grant and any later revocation.

Before granting access, confirm that your own records would satisfy a reviewer who has never met your contractor.

How the entity verifies a contractor before access is granted

This sequence turns a contractor's access request into a documented personnel risk assessment record that the entity can show an auditor before any authorized electronic or unescorted physical access starts. Each step produces a specific artifact, and the final record ties the person to a verified assessment and a completed training date.

Define the personnel risk assessment program
Before any contractor is onboarded, the entity's compliance owner documents the CIP-004-7 personnel risk assessment program. It sets out the identity confirmation method, the criminal history check scope, the criteria used to evaluate results, the process for verifying contractor assessments, and who approves exceptions. The output is an approved, dated program document that names the roles responsible for each step. Confirm with your contractor and internal HR how long each part of the program takes before you write dates into contracts.
Confirm the individual's identity
HR or the contractor's sponsoring manager confirms the individual's identity using the process defined in the program, which satisfies Part 3.1. The reviewer records the method used, the date, and the name of the person who performed the check. The output is an identity confirmation record linked to the individual's request for access. Ask your contractor to state in writing which identity documents it collects and how it retains them.
Obtain the seven-year criminal history records check
The entity either runs the seven-year criminal history records check itself or obtains one from the contractor under Part 3.2. The check must cover the individual's current residence and each other location where the person lived for six consecutive months or more during the seven years before the check. The output is a criminal history records check report or a contractor-supplied report with its scope statement. Confirm with the contractor which jurisdictions and locations its check covers, because gaps in address history are a common audit finding.
Apply documented evaluation criteria to results
A designated reviewer applies the criteria defined under Part 3.3 to the criminal history results and records a decision for each individual: approved, denied, or referred for further review. The record includes the criteria version, the reviewer's name, and the decision date. The output is a signed evaluation record that shows the entity judged the results against its own standard rather than leaving the decision to the contractor. Keep the reviewer's decision separate from the vendor's own screening outcome.
Verify the contractor's assessment meets Parts 3.1 to 3.3
When the contractor has already performed the personnel risk assessment, the entity verifies it under Part 3.4 against its own criteria for identity confirmation, the seven-year check, and evaluation. The reviewer checks the contractor's documents, confirms the scope covered the required address history, and confirms the evaluation was made against stated criteria. The output is a verification record that states which assessment was checked, what was compared, and the outcome. Where the contractor's process falls short, the entity completes the missing part itself before granting access.
Complete required training before access
The individual completes the entity's CIP security awareness and training before any authorized electronic access or unescorted physical access is granted, as Part 2.2 requires. The training system or learning record records the course, the completion date, and the individual's name. The output is a training completion record that the access team can check before provisioning. Confirm with your contractor how it tracks training for staff who rotate between client sites.
Grant authorized access and record the date
Once the identity, criminal history, verification, and training records are complete and approved, the access owner authorizes electronic or unescorted physical access for the named individual. The access system records the grant date and the approving person, and the entity links that entry to the personnel risk assessment record. The output is an access authorization entry that ties the person to a valid assessment date, which supports the seven-year currency requirement in Part 3.5. Do not provision access before every earlier record is on file.
Track assessment currency and prepare revocation
The entity maintains a register of every contractor with authorized access, showing the date of each personnel risk assessment and when it falls due for renewal under Part 3.5. The register also flags the termination process under CIP-004-7 R5 Part 5.1, which requires removal of access within the period set in the standard. The output is a current access register and a tested offboarding checklist. Confirm with your internal HR how contractor terminations are reported to the access team.

What to have in place before the first contractor is granted access

Under CIP-004-7 R3, a contractor's personnel risk assessment must be in place before any authorized electronic or unescorted physical access starts. The items below are the records and controls an auditor will ask to see, and each one should be checked before the first badge or account is issued.

A documented PRA program

CIP-004-7 R3 requires a documented personnel risk assessment program that covers individuals before they receive authorized access. Confirm that the program names who owns it, which roles trigger an assessment, and that it covers contractor and service vendor staff, not only employees. Ask the vendor to show the version in force and its approval date.

Written evaluation criteria

Part 3.3 requires criteria or a process for deciding what a criminal history records check result means for access. Without written criteria, two reviewers can reach different decisions on the same record. Check that the criteria state which findings lead to denial, which need manager review, and who signs off each decision.

Contract clause for PRA parity

Part 3.4 requires the entity to verify that contractor assessments meet Parts 3.1 to 3.3. The contract should require identity confirmation, a seven-year criminal history check covering the residence history described in Part 3.2, and delivery of records to the entity on request. Ask counsel to confirm the clause also covers subcontractors and staff changes during the contract term.

Verification log by person

Each contractor worker needs a line in a verification log that links the name, identity confirmation date, check date and the entity's review decision. Part 3.5 requires that the assessment fall within the last seven years, so the log should show the check date for every person with access. Auditors often sample individuals from this log first, so it should be kept current rather than rebuilt before an audit.

Training completed before access

Part 2.2 requires the training to be completed before authorized electronic or unescorted physical access is granted. Confirm that the contractor's training completion records carry dates earlier than the access start date in the access system. Access granted before training, outside a documented CIP Exceptional Circumstance, is a finding that the access record alone will not show.

Termination workflow with a 24-hour limit

CIP-004-7 R5 Part 5.1 requires a process that starts removal of unescorted physical and Interactive Remote Access when a termination action occurs and completes it within 24 hours. Ask the vendor to name the notice route for contractor departures, and test it with a sample leaver. The entity's own ticket timestamps, not the vendor's word, should show completion inside the window.

Revoking contractor access on termination within 24 hours

CIP-004-7 Requirement R5 Part 5.1 requires the entity to have a process that initiates removal of an individual's unescorted physical access and Interactive Remote Access on a termination action, and to complete those removals within 24 hours of that termination action. For a contractor, the clock is set by the contractor's departure, not by the entity's own HR system, so the entity needs a path that carries the event to it quickly. Ask each contracting firm, in the contract or onboarding terms, to notify your designated contact when a named individual leaves the engagement, is reassigned off your work, or is terminated. Name the notifying role (the contractor's HR contact or project lead), the channel, and the expected lead time. Confirm with legal and procurement that the clause is enforceable in your agreements.

The entity owns the timing and the proof, even though the contractor's employer triggers the event. Your process should record the termination action time, the time the initiation was logged, and the time each access right was removed from badge systems, physical access control, Interactive Remote Access accounts, Intermediate Systems and any vendor-specific accounts. Confirm with your compliance team which system of record will hold these timestamps and how long they are retained for audit purposes. Illustrative example: if a contractor's badge is deactivated at the gate but their remote access account remains active, the removal is incomplete and the evidence will not show it.

Reassignment and offboarding of a contractor who leaves one project but stays with the vendor should run through the same workflow. A reassignment that moves someone out of CIP scope is still a change in authorized access, so treat it as a termination action for the affected rights. Review whether the contractor's access rights are tied to a role or project, because a shared account or group membership can keep access alive after the person has left. Confirm with your Interactive Remote Access and physical access administrators which accounts and groups must be checked at each offboarding event.

What makes contractor PRA work heavier or lighter

Contractor personnel risk assessment effort grows with how many people, places and access paths are involved. The cards below cover the drivers that change the workload and the controls that keep each one manageable.

Number of contractor staff

Every person with authorized electronic or unescorted physical access needs a current assessment, so headcount sets the volume of identity checks, criminal history records checks and evaluation decisions. A vendor with a small named team is far easier to manage than one that assigns rotating staff from a large pool. Ask the contractor for a named roster before work starts, and tie each name to an access request so no one gains access without a verified assessment on file.

Residence history across states

The seven-year criminal history check must cover current residence and every other location where the person lived for six consecutive months or more during that period. Staff who have moved between states or countries take more time to research, and results from some jurisdictions take longer to obtain. Ask the contractor to disclose residence history at the identity step so the check scope is known before the vendor begins work.

Contractor's existing compliant checks

If the contractor already runs a documented program that meets the identity, criminal history and evaluation requirements, the entity may need only to verify that program rather than repeat each check. Under Part 3.4, the entity needs criteria or a process to confirm that contractor assessments meet Parts 3.1 to 3.3. Ask for the contractor's written program, the date of each assessment and the evaluation criteria it applies. Gaps found at this stage are cheaper to close than gaps found during an audit.

Staff rotation and turnover

Each new person triggers a fresh cycle of identity confirmation, checks, training and access approval. High turnover also raises the number of termination actions the entity must process, since removal of access must start on termination and finish within 24 hours. Agree in the contract how the contractor will notify the entity of rotations and departures, and set a required notice period for replacements so access is not granted before the assessment is complete.

Electronic, physical or both

Electronic access (including Interactive Remote Access) and unescorted physical access both require a personnel risk assessment before they are granted, and both are covered by the same program. A person who needs both access types needs one assessment, but the entity must track which access each individual holds so removals reach every path. Map each contractor role to its access types in the contract and in the access list, so that a termination removes all paths together.

One contract template and shared log

The main control for all of these drivers is a single contract template with fixed PRA terms, paired with a shared verification log that records each person, the date of each step, the evaluator's decision and the access granted. A template makes the contractor's obligations the same across vendors, and a log gives auditors one place to sample evidence. Keep the log under the entity's CIP-004 records, and review it at least when staff rotate or a contract renews. Confirm with counsel how the log's personal data is stored and who may see it.

Common questions about contractor personnel risk assessments under NERC CIP

Can an entity accept a contractor's own personnel risk assessment?

Yes, but only if the entity has a documented way to verify it. Under CIP-004-7, the registered entity remains responsible for its personnel risk assessment program, including for staff supplied by contractors and service vendors. The entity needs criteria or a process to confirm that the contractor's assessment covers identity confirmation, the seven-year criminal history records check and the evaluation of results. Many entities request the contractor's written process, a sample of completed records, and an attestation that the individual has been assessed, then keep their own record of what was verified. Confirm with your Compliance Enforcement Authority or your internal compliance team how much evidence they expect before they accept a vendor's assessment as sufficient.

What does the seven-year criminal history check need to cover?

The check must look back seven years and cover the individual's current residence and every other location where they lived for six consecutive months or more during that period. The entity needs a process to confirm which locations apply, obtain the records, and evaluate what they show against documented criteria. Contractors often ask whether a national or single-state check is enough. The answer depends on where the person has lived, so the process should require the contractor to list residences and document how each location was covered. Ask the contractor to show how it handles gaps, such as a person who moved abroad during the period.

What must the entity verify about a contractor's assessment?

The entity must have criteria or a process to verify that the contractor's personnel risk assessment meets the same elements the entity would apply to its own staff. In practice, that means confirming that identity was confirmed, that a seven-year criminal history records check was run with the right location coverage, and that the contractor has documented criteria for evaluating the results. The entity also tracks that each individual with authorized access has an assessment completed within the last seven years. Verification is a recurring record-keeping task, so the entity should decide in advance which records it will hold, how long it keeps them, and who reviews them.

Does contractor training have to be finished before access is granted?

Yes. CIP-004-7 requires that required cyber security training be completed before an individual receives authorized electronic access or authorized unescorted physical access, except during CIP Exceptional Circumstances. Contractors are included in that requirement. The practical control is an access workflow that checks the training record before the access ticket is approved, not after. Entities usually ask contractors to complete the entity's training or to provide evidence that equivalent training was completed and is current, then record the completion date against each individual's access authorization.

What does the 24-hour revocation requirement mean for contractors?

When a contractor's employment or assignment ends, the entity must start the removal of that person's unescorted physical access and Interactive Remote Access on the termination action and complete the removal within 24 hours. The clock starts at the termination action, so the entity needs a documented trigger that reaches it quickly, such as a notice from the contractor's project manager, a badge deactivation request, or an automated feed from the contractor management system. Entities often test this by tracing a sample termination from notice to removal. Confirm the exact start point of the clock and your evidence format with your compliance team.

How is the cost of contractor personnel risk assessments split?

The entity usually pays for its own program, and the contractor usually pays for the checks it runs on its staff, but the split varies by contract. Costs fall into four groups: the identity and criminal history checks themselves, the staff time to review and document results, the training delivered to contractor personnel, and the record-keeping that proves the program works. Checks are typically one-time for each individual, while recertification and re-verification recur over the seven-year window and whenever someone is reassigned. Costs rise with the number of contractors, the number of residence locations to cover, and the number of times people rotate. The contract should state who pays for each item and what evidence the contractor must provide. Ask any quote to separate check fees, administration and training.

Can an outside partner prepare the PRA and training evidence?

An outside partner can help prepare systems, records and evidence, but the registered entity keeps responsibility for its CIP-004 program. DeployOpen plans, implements and documents self-hosted open-source platforms in the client's own infrastructure, so it can help configure access workflows, training tracking, access records and revocation logs so they produce the evidence an assessor will request. DeployOpen does not run criminal history checks, issue personnel risk assessments, or approve contractor staff. Those decisions belong to the entity and its contractors, and an independent auditor or the Regional Entity assesses the outcome. Any engagement should be fixed in writing with a defined scope before work starts.

How to choose help for contractor PRA evidence

A partner can prepare the contractor personnel risk assessment program and its evidence, but the entity keeps ownership of its CIP-004-7 controls and access decisions. The cards below set out what to check before signing, so the evidence trail holds up when a Regional Entity asks for it.

Experience with CIP-004-7 evidence

Ask whether the partner has prepared personnel risk assessment evidence against the Part 3 requirements before, and which artifacts they produced. Look for familiarity with how identity confirmation, the seven-year criminal history records check, and the criteria for evaluating results are documented. Ask to see a redacted sample of a past deliverable, so you can judge whether it would stand up to an auditor's questions.

Entity owns, partner prepares

Confirm in writing which decisions stay with the registered entity: accepting a contractor for access, approving criteria for evaluating records, and signing off on access authorization. The partner typically drafts the program, templates and checklists, and assembles the evidence. Be wary of any proposal that has the partner deciding who gets access.

Written scope before work starts

A fixed scope should list the in-scope contractor populations, the systems and access types covered, the documents to be delivered, and the boundaries for verifying vendor-run assessments. Without this, PRA work often expands to cover every vendor, and the entity pays for effort it did not plan. Ask for a written statement of exclusions too.

Handover of templates and logs

Agree up front that the entity receives every template, criteria document, verification record and access log in editable form, along with the process owner's instructions. Evidence that lives only in a partner's tooling becomes a dependency at the next audit. Confirm where the records will be stored and who can retrieve them.

No claims to issue compliance reports

A partner can prepare evidence but cannot issue a compliance report, attestation or certificate. There is no CIP certificate. Treat any vendor that promises a CIP compliance certification or a clean audit result as a warning sign, and ask how they describe their role in writing.

Privacy handling of criminal history records

Criminal history records are sensitive personal data. Ask how the partner limits who can view them, where they are stored, how long they are kept, and how they are destroyed. Confirm that the entity, not the partner, decides retention, and that the partner will not copy records into general project files or shared tickets.

How DeployOpen prepares contractor access evidence for NERC CIP

DeployOpen works with the registered entity and its contractors to prepare the systems and records behind contractor personnel risk assessments under CIP-004-7. The entity keeps ownership of its access decisions and its PRA program, while DeployOpen helps organize the access workflow, verification records and revocation steps so the evidence is ready for review.

How we scope

Engagements are fixed-scope, with the systems, contractor populations and access types agreed in writing before work starts.
The written scope lists which contractor roles need authorized electronic or unescorted physical access to in-scope BES Cyber Systems.
Scope also defines which contractor PRA records the entity expects to verify under its CIP-004-7 Part 3.4 process.

How we build

We help configure the access request, approval and tracking workflow so each contractor's identity confirmation and PRA status are recorded before access is granted.
We set up account and access records in the entity's own environment so authorized access and training completion can be shown per individual.
We document the revocation path so removal steps tied to a termination action can be traced against the 24-hour requirement in CIP-004-7 Part 5.1.

How we hand over

Deliverables include the written procedures, workflow configuration notes and sample evidence records agreed in the scope.
Each record set is organized so the entity can show, per contractor, identity confirmation, PRA verification, training and access status.
The entity's compliance team receives documentation to review and confirm against its own CIP-004-7 program before any audit.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Retainers can cover periodic review of contractor access records as staffing and vendor relationships change.
Ask whether the auditor or Regional Entity will accept the entity's PRA verification method, since DeployOpen does not issue audit reports or certifications.