Open source LMS for energy and utilities: why the training record is the audit question
If your organization operates BES Cyber Systems in the United States, every person with authorized access to those systems must be trained, and you must be able to prove it. For a compliance officer, the question at audit is rarely whether the training happened. It is whether you can show who completed which course, on what date, under which role assignment, and where that record is kept. The learning management system becomes the system of record for those answers, so it has to be designed around completion dates, role-to-course mapping and retention from day one. CIP Reliability Standards become mandatory in the United States once FERC approves them under section 215 of the Federal Power Act, and NERC and the Regional Entities monitor and enforce compliance under the NERC Rules of Procedure.
The short answer for most utilities is that Moodle is the most common fit for this kind of role-based record. It offers mature course completion tracking, role and cohort assignment, and an open source license under GPL-3.0 that lets you host the platform inside your own network. Open edX and Canvas are credible alternatives, and the choice depends on your existing identity stack, the content you already own and the in-house skills you can staff. Before you commit, confirm which Moodle release you will run. Moodle 5.3 is the designated next long-term support release, with security fixes until October 1, 2029, and its database and PHP requirements are stricter than earlier versions, so plan the host build around them.
DeployOpen prepares the systems, controls and evidence that an assessment will look at, including configured role assignments, retention settings and completion reports. DeployOpen does not issue audit reports, attestations or certifications, and independent auditors and the Regional Entities decide compliance. There is also no CIP certificate to obtain. Entities registered as a Balancing Authority, Reliability Coordinator or Transmission Operator are audited at least once every three years, and the maximum civil penalty is $1,584,648 per violation per day, so the value of a well-built training record is in being able to produce it quickly and consistently. Ask any implementation partner to show you a sample completion report that ties a named person, a role and a dated course together.
Which CIP and related duties turn into LMS requirements
This table maps each CIP duty that touches personnel access and records to what the LMS must assign, record and retain. Read each row as a build requirement, then confirm the exact training and evidence obligations against the standard's current text and your registered entity's compliance program. The main takeaway is that the LMS is a records system tied to access lists, so role mapping and retention matter as much as course content.
| Duty | What it asks for | What the LMS must do |
|---|---|---|
| CIP-002 impact classification | BES Cyber Systems are sorted into high, medium or low impact using bright-line criteria, and personnel scope follows that classification. | Tag courses and roles by impact level so that only personnel tied to high or medium impact systems are enrolled in the required cyber security courses. |
| CIP-005 Electronic Security Perimeter and Interactive Remote Access | Routable-connected assets of high and medium impact systems sit inside an Electronic Security Perimeter, and remote access passes through an Intermediate System with encryption and multi-factor authentication. | Assign remote access training only to users on the remote access list, and keep dated completion records that show who was trained before access was granted. |
| CIP-013 vendor access and software integrity | Supply chain risk management plans cover vendor incident notification, vulnerability disclosure, software integrity verification and coordination of vendor-initiated remote access, reviewed at least every 15 calendar months. | Create a vendor-facing course and attestation step for contractors and vendor staff, and record the plan review date so the 15-month cycle can be shown. |
| CIP-011 information protection | Protection of BES Cyber System Information, including how it is stored, accessed and disposed of. | Train personnel with BCSI access on handling rules, and restrict course content, reports and attachments that describe system configurations to authorized roles. |
| CIP-015 internal network security monitoring | Approved by FERC on 26 June 2025 and enforceable from 1 October 2028, covering monitoring of internal network activity. | Plan a course update path for analysts and operators, and reserve capacity in the LMS release cycle to publish revised content before the enforcement date. |
| Virtualization changes (FERC Order No. 919) | Eleven revised CIP standards accommodate virtualization, effective 1 July 2028. | Add courses on virtualized environments for staff who administer hypervisors or containers, and keep version history so training matches the standard in force on each date. |
| Retention of completion evidence | Entities must show who had access, what training was completed and when, and audits occur at least once every three years for certain registered functions. | Keep completion timestamps, course versions and roster snapshots for the retention period your compliance program sets, and export them without relying on live data. |
Which personnel and entities the training scope follows
NERC compliance attaches to the function an entity is registered for, not to its size or its industry label. Balancing Authorities, Reliability Coordinators and Transmission Operators are the registered functions most often named in training discussions, but generator owners, generator operators, transmission owners and other registered entities also carry CIP obligations where they own or operate qualifying assets. A utility can therefore hold several registrations, and each one can bring its own personnel into scope. Ask your compliance lead to confirm the exact registrations on your entity's record in the NERC Compliance Registry before you define any course audience.
- Balancing Authority: Staff who operate or support systems that balance generation and load in the Balancing Authority area.
- Reliability Coordinator: Staff in the reliability coordination functions, including those with access to shared wide-area tools.
- Transmission Operator: Control room and field personnel who operate transmission facilities and the associated cyber assets.
- Generator owners and operators: Plant control system staff, including contractors and vendor technicians with remote access to plant systems.
- Other registered entities: Functions registered for your organization that may not appear in the common lists, so the registry entry should be checked line by line.
Confirm each registration and its function with your compliance team before building role lists, because the training audience follows the registry and not the org chart.
Under CIP-002-5.1a, BES Cyber Systems are sorted into high, medium and low impact using bright-line criteria. The impact level determines which requirements apply to the people and systems around them. High impact mainly covers qualifying control centers, while medium impact includes, for example, generation of 1500 MW or more at one plant or transmission facilities at 500 kV or higher. Low impact systems carry lighter obligations, but the classification must still be documented and maintained. Training scope should be mapped to the classification output, not to a general assumption that control room staff are always in scope.
- High impact: Personnel with authorized access to high impact BES Cyber Systems and their associated Electronic Access Control or Monitoring Systems.
- Medium impact: Personnel with authorized electronic or physical access to medium impact systems, which often includes a larger group than the control room alone.
- Low impact: Personnel covered by the lighter requirements for low impact assets, where the program still needs documented scope.
- Reclassification events: Changes to a system's category after an asset change, which should trigger a review of the affected course audience.
- Mixed-classification sites: Facilities where one team touches systems at different levels, so the course assignments must follow the most restrictive access held.
Ask for the current CIP-002 classification list and check it against the access roster before setting any course assignment rule.
Job titles are a poor scope rule because the people who need cyber security training under the CIP standards are defined by what they can do on a system. A maintenance technician with logical access to a protected asset can be in scope while a senior manager with no system rights may not be. The access record, meaning who holds authorized electronic access, authorized unescorted physical access and remote access rights, is the most reliable source for scope. The same logic applies to contractors, vendor support staff and temporary personnel who hold credentials. Your access management records and your training assignments should be reconciled on a fixed cycle so that new access grants create training obligations, and removed access ends them.
- Electronic access: Accounts that can log in to, configure or query in-scope systems, including shared and service accounts with named owners.
- Physical access: Badge and key holders with unescorted access to Physical Security Perimeters for in-scope assets.
- Remote access: Vendors and employees who reach systems through Interactive Remote Access paths, which the program should treat as in scope.
- Contractors and vendors: Third parties with credentials, whose training obligations need to be written into contracts or vendor onboarding.
- Access change triggers: Grants and revocations that create or remove a course assignment, with dates kept for the evidence file.
Check whether your access management system can export a current roster that the LMS can consume, because manual reconciliation is where most scope gaps appear.
FERC Order No. 919 states that, as of June 2025, the NERC Compliance Registry identified about 1,673 unique US entities subject to mandatory compliance with the CIP Reliability Standards. That figure shows the breadth of the population: the obligations are not limited to a few large grid operators, and many smaller registered entities must run the same kind of documented training program. The number of registered entities says little about how many people your own program will train, which depends on your systems, access grants and contractor use. Your scope estimate should come from your own inventory, not from the registry total.
- Registry breadth: About 1,673 unique US entities were identified in the registry as of June 2025, according to FERC Order No. 919.
- Program scale: The number of trained people depends on the in-scope access population at your entity, which must be counted directly.
- Contractor multiplier: Vendor and contractor populations can exceed employee populations in some operations, so they need explicit counting.
- Standard updates: New or revised CIP standards can add audiences, so the roster rules should be reviewed when the standard set changes.
- Evidence scale: Each in-scope person needs retained completion evidence, so the LMS sizing should follow the roster.
Ask your implementation partner how roster counts feed the LMS sizing, and confirm the current in-scope count with your compliance team before any licensing or hosting discussion.
Which open source LMS fits a utility training program and why
Utility training programs need a platform that keeps completion records stable for years, assigns courses by role, and survives regular upgrades. Moodle, Open edX and Canvas LMS each cover parts of that need, but their support windows, plugin depth and reporting differ, so the choice should follow the evidence you must produce.
Moodle as the default choice
Moodle fits most utility programs because it is licensed under GPL-3.0, has a long-term support release line, and ships core authentication for LDAP, LTI, OAuth 2 and Shibboleth, which covers the directory and single sign-on setups utilities commonly run. Moodle 5.3 is the current long-term support release, with security fixes until October 1, 2029, which gives a multi-year window for a stable training record. Confirm that your role assignments and completion reports can be built with core features or with a named plugin you will maintain.
Moodle upgrade prerequisites
Moodle 5.3 requires 64-bit PHP 8.3 or later, PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and sites must already run Moodle 4.4 or later to upgrade. Plan the database and PHP versions into your change calendar before you commit to an upgrade date. Ask your partner to confirm which database engine your records archive will use, since it affects backup and restore testing.
Open edX and upgrade cadence
Open edX is licensed under AGPL-3.0 and is strong for course authoring and modular content, but only the latest named release receives support. Verawood is the current release, with Willow planned for December 2026 and Xylon for June 2027. A utility that must keep records under a fixed control schedule needs an upgrade path every release cycle, so confirm your partner's upgrade capacity and the budget for it before choosing this platform for compliance-bound records.
Canvas LMS fit checks
Canvas LMS by Instructure is licensed under AGPL-3.0 and is widely used in education, so its course model is familiar to many learners. For a utility, the open question is whether role-based assignment, completion dates and audit-style reports can be produced without custom development. Ask a partner to demonstrate those reports against your sample roles before selecting Canvas, and confirm how its self-hosted upgrade and plugin model would be maintained.
Authentication and access control
Access to training should follow the same identity source used for system access, so a person removed from a role also loses assignments. Compare how each platform maps directory groups to course enrollment, including LDAP group sync and SAML or OAuth 2 login. Confirm whether group changes take effect at login or on a scheduled sync, because a delayed sync can leave a former employee with an open assignment.
Evidence and record retention
Retention rules for training evidence are set by your compliance program, not by the LMS vendor. Confirm that completion dates, course versions and assignment history can be exported and archived outside the live database, and that the platform does not overwrite a completion when a course is revised. Ask your partner to show a retrieval test for a completion record from several years earlier.
Deployment pattern for an LMS that sits near critical networks
An LMS that delivers CIP training and holds completion evidence is an IT system outside the Electronic Security Perimeter, but it still touches the utility's identity and records estate. The cards below cover where the platform sits, where it runs, which database and web server layout to use, and how evidence is stored and kept.
Placement outside the ESP
Keep the LMS in a corporate or dedicated training zone, not inside the Electronic Security Perimeter that protects high and medium impact BES Cyber Systems. Training traffic should not cross into control networks, and no operator console should depend on the LMS to run. Confirm with your CIP compliance lead how the LMS is classified and document the boundary between the training zone and any identity or access systems it reads from.
Hosting in approved environments
Decide whether the LMS runs in the utility's own data center or in a cloud account the utility already governs under its supply chain and access controls. Each option carries a different set of administrators, logging and vendor access paths. Ask who holds root access, where backups live, and how vendor remote sessions are recorded and approved under the utility's supply chain risk management plan.
Supported database choice
Moodle 5.3 supports PostgreSQL 17, MySQL 8.4, MariaDB 11.4 and SQL Server 2019 or later, while Moodle 5.1 supports PostgreSQL 15, MySQL 8.4, MariaDB 10.11 and SQL Server 2017 or later. Pick the engine your utility already patches, backs up and monitors, and confirm it matches the Moodle version you plan to run for the full support window. Avoid unsupported engine versions even when the install appears to work.
Document root set to /public
From Moodle 5.1, the web server document root must point to the new /public directory, not the main Moodle folder. If it does not, the site can expose directory listings or fail with errors. Make this a checked step in the build runbook and in every upgrade, and confirm the web server configuration is reviewed during change control. Exposed code directories are an avoidable finding in an assessment.
Identity from the utility directory
Learners authenticate against the utility's directory rather than local accounts, which keeps account removal tied to access revocation. Moodle core includes LDAP, LTI, OAuth 2 and Shibboleth authentication, and SAML2 is available as a plugin. Confirm which method your identity provider supports, how multi-factor authentication is enforced for administrators, and how deprovisioned contractors lose course access on the same day their system access ends.
Backups and evidence retention
Completion records are evidence, so back up the database and the moodledata file store on a schedule, and keep copies outside the LMS host. Set retention periods with your CIP compliance team, since CIP-011 covers how BES Cyber System Information is protected. Test restores, record who can read or delete backups, and write down how completion reports are exported for auditors if the platform is unavailable.
How a utility rolls out CIP training records on Moodle
This sequence turns a utility's access lists into role-based CIP training on a self-hosted Moodle, with completion records that can be shown to an auditor and kept on a defined retention schedule. Each phase closes with a written output that the next phase depends on.
Inventory roles and tie them to access lists
Start by listing every role that holds authorized electronic or unescorted physical access to BES Cyber Systems, with the systems and access levels each role carries. Compliance, operations and the registered entity's CIP owner review the list together, and the output is a role matrix that maps each role to the CIP-004 training content it must complete. The step is done when the access list and the role matrix agree line by line, and the owner signs off on the exceptions. Ask your partner to show how the matrix will be kept current when access is granted or removed.
Connect identity and HR data
Connect Moodle to the directory or identity provider that the utility already trusts, and to the HR or access management source that records joiners, movers and leavers. Moodle core includes LDAP, OAuth 2 and Shibboleth authentication plugins, and the SAML2 single sign-on plugin is available for SAML identity providers, so confirm which of these matches the utility's environment. The output is an integration test record showing that a new hire, a role change and a termination each produce the expected enrollment and removal in Moodle. Do not treat the step as complete until a leaver's access removal has been tested end to end.
Build CIP course content and assessments
Build or adapt courses for each role in the matrix, covering the topics the utility's CIP program requires, such as security awareness, physical and electronic access controls, incident reporting and recovery. Content owners write the material, compliance reviews it against the utility's documented program, and the course settings record the version and the date each course was approved. The output is an approved course catalog with version control and a completion rule for each course. Confirm with the compliance team which content must be kept as evidence of the program itself, since this affects how courses are versioned.
Pilot with one registered entity group
Run the courses with one group of personnel, usually one registered entity or one operating area, before the wider rollout. The pilot tests role-based assignment, completion tracking, reminders and the reports the auditor will ask for, and it surfaces gaps in the role matrix. Collect feedback from learners and administrators and log every defect against the course or integration that caused it. The output is a pilot report with the defects resolved or accepted in writing, and a go or no-go decision recorded by the CIP owner.
Cut over and migrate existing records
Move from any prior tracking method, such as spreadsheets or a legacy LMS, into Moodle. Import existing completion records with their original dates and course versions so that the history stays traceable, and keep the source files under the retention rules. Reconcile record counts and sample completions against the source before the old method is switched off. The output is a migration reconciliation record signed by compliance, and a dated cutover note stating which system is the record of truth from that date.
Document the retention schedule and evidence reports
Define how long completion records, course versions, access lists and audit reports are kept, and who can export them. Build standard reports for each role that show who completed which course, when, and under which version, and test that a report can be produced for a sample period without manual editing. The output is a written retention schedule and a tested report set stored with the CIP evidence. Ask your partner whether the schedule covers backups as well as live data, because backup retention often differs from the retention the compliance team sets.
Set the upgrade and patch routine
Document how Moodle is upgraded, patched and tested, using the supported release schedule and the system requirements for each version. Moodle 5.3 is the current long-term support release with security support to 1 October 2029, and the 5.1 release notes require the web server document root to point to the /public directory, so the runbook should cover that change. The routine also covers plugin review, a staging test and a rollback plan. The output is a runbook and a calendar of planned maintenance, approved by the utility's change board before the platform goes into production use.
Which evidence the LMS produces for an auditor
This table maps each piece of training evidence an assessor may ask for under CIP-004 and CIP-013 to the Moodle component or procedure that produces it. Use it to plan which exports to schedule and which records your own audit scope must cover. The main takeaway is that completion data alone is rarely enough; the assignment history, removal logs and retention exports are what show access was controlled over time.
| Evidence item | Produced by | What to confirm in your audit scope |
|---|---|---|
| Completion records with dates | Course completion and activity completion reports, exported with completion timestamps per person and per course | Which courses count as required CIP training, the period the assessor samples, and whether completion is recorded at the course or the activity level |
| Role-to-course assignment history | Cohort or group enrollment rules and the enrollment and log data for the role-based assignments, kept with the date each assignment was made | Which roles map to which CIP-004 access categories, and who approved each mapping and when the mapping last changed |
| Enrollment and removal logs | Standard log reports for user enrollment and unenrollment events, plus authentication logs for account creation and suspension | How quickly access revocation is tied to training status, and whether removal events from HR or identity sync are logged on the same timeline |
| Policy acknowledgments | Course-based acknowledgment activities or a site policy acceptance step, with a timestamp and the policy version the learner accepted | The policy version in force on each date, and whether acknowledgments are re-collected after a policy revision |
| Supplier and vendor training where CIP-013 applies | Separate course or external-learner accounts for vendor staff, with completion and access records kept apart from employees | Which vendors need training under your supply chain plan, how remote access coordination is evidenced, and how the 15-month review cycle is documented |
| Retention exports | Scheduled database and log exports to controlled storage, kept under your own retention schedule outside the live site | The retention period your program sets, the storage location and access controls on exports, and how exports are verified and restored for an audit |
| Audit trail of administrator changes | Site and course logs covering changes to roles, enrollments, grades and settings, retained with the acting user's identity | Whether shared administrator accounts are prohibited, and whether logs are forwarded to the central monitoring platform used for CIP evidence |
What to ask an implementation partner before signing
Start with the written scope and deliverables, agreed before any work begins. Ask the partner to list each deliverable as a document or configured control, including the role-to-access-list mapping, the completion export format and the hardening baseline. Ask how role mapping stays current when people change jobs or lose system access, and who approves each change. Under CIP-004 style access reviews, a training record that no longer matches an active access list is a finding, so ask how the partner ties course assignment to the authorization source (for example, an HR or access management feed) and what reconciliation report shows the mismatches.
Ask how completion records are exported, stored and retained. Confirm the export fields the partner will produce (learner identifier, course version, completion date, assessor or method), where the exports are kept, who can read them, and how the retention period set by your own compliance team is enforced. Ask whether the Moodle database backups are tested by restore, since completion evidence that cannot be restored is not evidence. For upgrades, ask how the schedule maps to the Moodle 5.3 support window, which runs bug fixes to October 4, 2027 and security fixes to October 1, 2029 (Moodle releases page), and who signs off the change before each upgrade, including the PHP and database version requirements listed in the release notes.
Ask how the site is hardened and who holds the administrator credentials. Request the configuration baseline, the list of third-party plugins with their sources and update process, and confirmation that the web server document root points to the /public directory on Moodle 5.1 and later. Ask which accounts hold site administrator, database and server access, how those credentials are stored and rotated, and whether your staff or the partner hold the keys. For audit requests, ask how the partner pulls evidence on demand and who answers questions from your auditor. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or attestations, and the regulator's audit is run by NERC, the Regional Entity or an independent auditor.
Questions utilities ask before hiring an LMS partner
Does Moodle cost money to license, and what do I actually pay for?
Moodle is licensed under GPL-3.0, so there is no license fee for the software itself. The costs sit elsewhere: hosting sized for your user count, setup and configuration, identity and HR integration, content migration, plugin review, upgrades and support. Hosting and support recur every year, while setup, integration and content migration are mostly one-time work. Ask any partner for a written quote that separates these lines, names who pays for each (your cloud account, your staff time, the partner's fixed-scope work) and states what is included after go-live. DeployOpen scopes engagements in writing before work starts, so the quote follows from the agreed scope.
How long before we have audit-ready training records?
The timeline depends on how many systems and roles are in scope, how clean the access lists are, and how much of the course content already exists. The first milestone is usually a working record store with completion dates, role assignments and a retention approach agreed with your compliance lead, not the full course library. Ask the partner to break the schedule into discovery, build, content review, a pilot with a small group and cutover, and to state which of those steps depend on your team. Treat any single number offered before scoping as a guess.
What does our team need to provide to the LMS partner?
Expect to supply four things: current lists of personnel with authorized electronic or physical access to BES Cyber Systems, HR data that ties each person to a role and a termination or transfer date, subject matter experts who approve the security awareness and role-based content, and a named owner who signs off on completion evidence. Without the access list, role-based assignment cannot be trusted. Without HR data, revocation dates are guesses. Ask the partner to write these dependencies into the scope so that delays on your side are visible and do not quietly move the delivery date.
Can our internal staff run the LMS after handover?
Often yes, for routine tasks such as enrolling users, assigning courses, running completion reports and managing course content, provided someone is trained and has time allocated. Platform administration is a different workload: patching, PHP and database version management, backups, restore tests and the upgrade path all need a named owner. Moodle's major releases follow a published schedule, and the partner should explain which upgrade and security support you would be buying and what your team would perform itself. Ask for a written handover plan and a runbook before accepting the scope as complete.
Which CIP standards can the LMS support, and which need procedures?
The LMS can host the training content, enforce role-based assignment, record completion dates and produce reports that show who completed what and when. It cannot decide which personnel are in scope, define the program content or make your procedures compliant. Those belong to your compliance program and the applicable CIP standards, including the training requirements in CIP-004 and the information protection and supply chain obligations in CIP-011 and CIP-013. Ask the partner to map each requirement to a platform feature, a configuration, a documented procedure or a responsibility that stays with your staff, and to confirm this against your own compliance counsel and the current NERC standard text.
How are fixed-scope quotes written for an LMS project?
A fixed-scope quote lists the systems, integrations, content items, environments and deliverables in the agreement, along with the acceptance criteria for each. It should also state the assumptions, such as the number of identity sources and the content formats in use, and the client responsibilities described above. Changes that fall outside these items are priced as change requests. DeployOpen agrees scope, deliverables and timelines in writing before work starts, so ask for the written scope document, the exclusions list and the process for change requests before comparing any two quotes.
Does the LMS need to sit inside our Electronic Security Perimeter?
It depends on the system classification and how the LMS connects to your environment, so the answer must come from your CIP-002 impact assessment and your CIP-005 architecture review. A training platform that holds personnel records and receives identity data may still create dependencies that your compliance team needs to document. Ask the partner where the hosting will run, how remote administrative access will work, whether multi-factor authentication is applied, and how logs leave the environment. Confirm the classification and boundary decisions with your compliance team before design begins.
How DeployOpen scopes and supports CIP training LMS work
DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted open source platforms inside the utility's own infrastructure, whether that is its cloud accounts, data center or an isolated network segment. For a CIP training LMS, that work covers the Moodle installation, the identity connection to the access management system, the role-to-course mapping that decides who must complete which module, the reporting used for audit requests, and the backup and restore process for completion records. Security testing of the LMS itself is part of the same scope, because the platform holds records of who has system access and must be protected accordingly. Engagements are fixed-scope, and the scope, deliverables and timeline are agreed in writing before work starts. DeployOpen does not publish a price list, so the quote follows from that written scope.
Ask each partner, DeployOpen included, to name the deliverables in the statement of work: the role matrix, the integration design with the source of truth for access provisioning, the backup and restore test, the Moodle upgrade procedure, and the evidence pack format. Confirm who holds administrator credentials, where backups are stored, and whether the hosting location meets your own data handling rules. Decide early whether you want a fixed-scope build followed by a retainer for ongoing support, upgrades and continuous testing, or an in-house team with a partner on call. Retainers cover the recurring work after go-live, such as applying point releases and re-running security tests after plugin changes, so ask for their scope and response expectations in writing.
DeployOpen is a Chainscore Labs company. It prepares systems, controls and evidence for compliance assessments, so the reader should expect a documented set of configurations, completion reports and process records that the utility's compliance team can present. It does not issue audit reports, attestations or certifications, and it does not decide whether your program satisfies NERC CIP. That determination rests with your compliance function, the Regional Entity and the auditors who examine your records. Agree in writing which artifacts the engagement will produce and which compliance decisions remain with your team, so that no one assumes the partner has signed off on the program.
