How an open source LMS supports CIP-004 training for utilities
A compliance lead at a utility or registered entity has to show, for every person with authorized electronic or unescorted physical access to in-scope systems, that quarterly security awareness and role-based cyber security training happened on time. CIP-004-7 sets those training duties, and a self-hosted LMS can hold the course assignments, completion dates and content records that prove them. No LMS makes an entity compliant, though. The program, the content and the decisions about who needs what remain the entity's responsibility. Under Requirement R1, Part 1.1, security awareness must reinforce cyber security practices at least once each calendar quarter for personnel with authorized access. Requirement R2 requires a training program matched to individual roles, functions and responsibilities, and Part 2.2 requires training to be completed before authorized electronic or unescorted physical access is granted, except during CIP Exceptional Circumstances. Part 2.3 sets the refresh cycle at least once every 15 calendar months.
Scope comes first. R1 applies to high and medium impact BES Cyber Systems, so the entity must confirm impact categorization under CIP-002-5.1a before building the assignment rules. Low impact assets follow a separate awareness requirement in CIP-003-9 Attachment 1, Section 1, which has its own cadence and should not be folded into the CIP-004 quarterly schedule without checking the text. Confirm with your Compliance Enforcement Authority and your CIP program owner which personnel and which systems fall under each requirement before you configure anything in the LMS.
There is no CIP certificate. The Compliance Enforcement Authority, a Regional Entity or NERC, reviews evidence during Compliance Audits, Spot Checks and self-certifications, so the LMS has to answer questions such as who was assigned a course, when access was granted, when training was completed and what content was delivered. Keep dated copies of quarterly awareness material and records of how it was distributed, and export completion reports on a schedule you can defend. Ask any implementation partner to demonstrate those exports and to show how course versions, enrollments and completion timestamps are retained.
Mapping CIP-004-7 requirements to LMS configuration
This table compares each CIP-004-7 requirement the training program must meet with what the function needs to do and how to configure it on Moodle or Open edX. Read each row as a control to configure and an evidence record to keep. The main takeaway is that completion dates, assignment logic and reminders must be produced by the LMS itself, not reconstructed later from spreadsheets.
| Requirement | What the function must do | How to configure it on Moodle or Open edX |
|---|---|---|
| R1 Part 1.1: quarterly security awareness | Reinforce cyber security practices, including associated physical security practices, at least once each calendar quarter for personnel with authorized access. | Create a quarterly awareness course or activity set per quarter, enroll the access group, and set completion tracking. Keep dated copies of each item and export completion reports as distribution proof. |
| R2: role-based training program | Maintain a training program appropriate to individual roles, functions or responsibilities, rather than one generic course for everyone. | Map each role (for example, control room operator or field technician) to its own course set using cohorts or groups in Moodle, or course enrollment rules in Open edX. Review role mappings whenever access changes. |
| R2 Part 2.1: required content topics | Cover the listed topics, including policies, access controls, visitor control, BCSI handling, incident reporting, recovery plans and risks from Transient Cyber Assets and Removable Media. | Build one module per required topic and tag each module with its topic in the course description or a naming convention. Use quiz or completion activities so each topic has a recorded completion, and confirm the final content list with your compliance lead. |
| R2 Part 2.2: training before access is granted | Complete training before authorized electronic or unescorted physical access is granted, unless a CIP Exceptional Circumstance applies. | Gate the provisioning workflow: the identity or access system should check LMS completion before granting access. In Moodle, use course completion conditions and web services or an LTI or API check. Confirm the integration design with the access management owner. |
| R2 Part 2.3: 15-month training cycle | Complete training at least once every 15 calendar months for each person with access. | Set course completion expiry or recurring enrollment so the training is due before the 15-month limit. Configure automatic reminders to supervisors and learners well ahead of expiry, and record the date each completion was reached. |
| Evidence retention | Keep dated completion records, course versions and distribution proof available for compliance monitoring. | Archive course versions when content changes, export completion logs on a schedule, and confirm with your compliance team how long records must be kept under your own program. |
Which personnel and systems the LMS must cover
The first decision is scope, and it is set by the impact category of each BES Cyber System, not by the size of the workforce. Under CIP-002-5.1a, the entity sorts its BES Cyber Systems into high, medium and low impact using the bright-line criteria in Attachment 1. CIP-004-7 R1 and R2 then apply to personnel with authorized electronic or authorized unescorted physical access to high and medium impact BES Cyber Systems, and to the associated Electronic Access Control or Monitoring Systems (EACMS), Physical Access Control Systems (PACS) and Protected Cyber Assets (PCA) that the Applicable Systems column of each table names. Vendors, contractors and internal staff who hold either kind of access fall inside that population, so the LMS roster must include them as well as employees. Confirm the categorization and the list of Applicable Systems with the entity's CIP program owner before any course is assigned.
The LMS should not hold its own list of who needs training. Build the roster from access provisioning records: the access request, the approval, and the grant or revocation of electronic and physical access in the systems that enforce it. Each grant should trigger enrollment in the required courses, and each revocation should remove the person from active training obligations while keeping their completion history. Training must be completed before authorized access is granted under Part 2.2, so the provisioning workflow and the LMS should share a status check. Where an enrollment or course assignment is made by hand, record who made it and when, because an auditor will ask how the roster stayed in step with access.
Personnel with access only to low impact assets fall under a different rule. Their security awareness obligation sits in CIP-003-9 Attachment 1 Section 1, which carries a 15-month awareness requirement rather than the quarterly reinforcement in CIP-004-7 R1 Part 1.1. Keep these individuals in a separate course group, so the LMS does not apply the wrong cadence or present the wrong evidence set. Regional entity guidance and the entity's own compliance interpretation decide borderline cases, such as shared vendor accounts or contractors with remote access, so ask the compliance enforcement contact to confirm how they are treated before the roster is built.
Which open source LMS fits CIP-004 programs
Each option below can host the quarterly reinforcement content and role-based courses that CIP-004-7 expects, and each carries different upgrade, reporting and identity trade-offs. Your choice should follow from how your team will assign courses by role, export completion dates and maintain the platform through its support window.
Moodle 5.3 as the next LTS
Moodle 5.3 was released on October 5, 2026 and is the next long-term support release, with bug fixes until October 4, 2027 and security fixes until October 1, 2029. Moodle is licensed under GPL-3.0, so the code can be reviewed and modified in-house without a license fee. Confirm that the security window covers your planned hosting life, and that your team can apply LTS updates on schedule so completion records stay on a supported build.
Moodle 5.1 upgrade path
Sites on Moodle 5.1 must point the web server document root to the new /public directory instead of the main Moodle folder, or the site may show directory listings or errors. Upgrades to 5.1 also require sites to be on Moodle 4.2.3 or later, and PHP 8.2 or later. Before you cut over, check the web server configuration, database versions and any custom plugins, since a misconfigured root can expose code and break access to training records.
Open edX with Tutor
Open edX is licensed under AGPL-3.0, and its maintainers recommend production deployments through a service provider or with Tutor, the official Docker-based distribution that also supports Kubernetes. Open edX supports only the latest named release, currently Verawood, so plan for regular upgrades to Willow and Xylon. Confirm that your team can run Docker or Kubernetes operations and maintain custom plugins across each named release.
Canvas LMS where already in use
Canvas LMS by Instructure is licensed under AGPL-3.0, so a team that already operates Canvas can extend the open source code under the same terms. Choose this route only if the operations, plugin and upgrade skills already exist in-house, because a self-hosted Canvas instance carries the same patching and evidence duties as other options. Confirm which reporting exports and LTI tools your evidence process depends on before committing.
Reporting with xAPI and Aspects
Open edX Aspects captures tracking logs through the event-routing-backends plugin as xAPI statements, stores them in ClickHouse via Ralph or Vector, and presents them in Superset dashboards. This suits teams that want quarterly reinforcement activity and completion events in one analytics store. Confirm that the stored events include the dated completion fields and role assignments that an auditor will ask to see, and test an export before relying on it.
Identity integration options
Moodle core ships LDAP, LTI, OAuth 2 and Shibboleth authentication, which can tie training accounts to the directory that already governs authorized electronic and unescorted physical access. Open edX offers OAuth2, SAML 2.0, Shibboleth and LTI providers. Confirm that account creation and removal follow your access provisioning process, because a training record for a person who no longer holds access creates confusion during an audit.
Evidence the Compliance Enforcement Authority asks for
This table maps each piece of CIP-004-7 evidence to the LMS component that produces it and what to keep beside it. Read it as a checklist for the quarterly reinforcement record, the training completion record and the access timeline. Each record should be retrievable by person and date, because the Compliance Enforcement Authority reviews individual records, not just program documents.
| Evidence item | LMS component that produces it | What to retain alongside it |
|---|---|---|
| Dated copies of quarterly reinforcement material | Course versions and content repository with publish dates | Final approved copy of each reinforcement item, the author, approval record and the quarter it covered |
| Proof of direct distribution (emails, computer-based training) | Notification records and course launch or completion logs | Sent-mail records or LMS notification logs showing recipients, dates and delivery status |
| Proof of indirect distribution (posters, intranet, brochures) | Announcement or news items with posting dates in the LMS or intranet | Screenshots or photos with dates, distribution lists and location or site records |
| Management support and reinforcement records | Manager-assigned activities, acknowledgments or messages logged in the LMS | Signed or dated management communications and the reinforcement content they referenced |
| Per-person completion dates against the 15-month cycle | Completion reports by user, course and role, with completion timestamps | Role assignment history, due dates, reminders sent and the report export used for the audit |
| Access-to-training timeline for Part 2.2 | Enrollment date, completion date and access provisioning records from the identity system | Access grant tickets or logs, the training completion date and any CIP Exceptional Circumstances documentation |
| Audit trail of changes to records and course content | Audit logs for enrollments, completion edits and course version changes | Log retention settings, administrator access records and the process for correcting entries |
What the LMS alone does not satisfy
Does the LMS write our CIP-004 training program and decide the R2 content?
No. The LMS delivers and records training, but the content, roles and topics must come from your own cyber security program. CIP-004-7 Requirement R2 expects a program appropriate to individual roles, functions or responsibilities, and Part 2.1 lists the required subjects, including policies, access controls, visitor control, BCSI handling, incident reporting, recovery plans and risks from Transient Cyber Assets and Removable Media. Your compliance and security owners must map each role to those subjects and approve the courses. DeployOpen can configure role-based course assignments and completion reports, but the program design stays with your team and, where you choose, your advisors.
Does the LMS prove that access was granted only after training?
Not by itself. CIP-004-7 Part 2.2 requires training to be completed before authorized electronic or unescorted physical access is granted, so the training record must be checked against the access provisioning system. The LMS can show a completion date, but it does not know when a badge, account or key was issued. You need a documented gate, such as a manual check or an integration with your access management workflow, that compares the two dates. Confirm how your access systems expose grant dates before you design that link.
Do posters and intranet postings still need their own evidence records?
Yes. Under CIP-004-7 R1 Part 1.1, quarterly security awareness can use direct communications, indirect communications such as posters, intranet notices and brochures, or management reinforcement. Each of these needs its own evidence, such as dated copies of the material and proof of distribution. An LMS only holds what was delivered inside it. Keep a separate log for physical and intranet reinforcement, with dates, content versions and locations, and link that log to the quarterly review.
Is CIP Exceptional Circumstances handling something the LMS can automate?
No. CIP Exceptional Circumstances is a procedure your organization must define, approve and follow. CIP-004-7 allows training to be deferred under those circumstances, but the decision, who makes it, how it is documented and when it is closed out are governance matters. The LMS can record exceptions as notes or tags on a learner record, and reports can flag overdue completions, but it should not decide eligibility. Write the procedure first, then configure the platform to support it.
What patching and backup duties does a self-hosted LMS add to our team?
Self-hosting moves operational responsibility to your side. You own the operating system, web server, database, PHP or Python runtime, plugins, backups and restore tests. Moodle 5.3 requires specific PHP and database versions, and Open edX runs several services that each need maintenance. Security patches, backup retention and restore testing must be scheduled and evidenced, because a training record that cannot be restored is a compliance gap. Ask any partner who will patch, who monitors, and how restores are tested, and confirm which of those tasks your own staff will keep.
How do upgrade windows fit with the CIP-004-8 and CIP-002-8 changes?
Plan them as a single change calendar item. FERC Order No. 919 approved revised standards for virtualization, including CIP-004-8, with NERC listing them as effective July 1, 2028, and CIP-002-8 carries the same effective date for its revised Control Center definition. If your training platform runs on virtualized infrastructure, its hosting changes may fall within the scope of those standards. Confirm with your compliance team whether the LMS and its hosts are in scope, and schedule Moodle or Open edX upgrades around the platform's support windows so you do not fall behind on security fixes.
Which CIP-004 gaps should we raise with an implementation partner first?
Start with the three that a partner cannot close for you: the program content for each role, the access-to-training gate, and the exceptions procedure. Ask the partner to show how completion data leaves the LMS for your evidence store, how long records are retained, and how the platform is patched and restored. Ask which items are in the fixed scope and which remain with your team. A written scope should state these boundaries clearly before work starts.
Which CIP changes will affect training records
The revisions that will change training records are mostly not yet in force, so plan for them now and confirm each date before you commit to a content build. FERC Order No. 919, issued March 19, 2026 and effective May 26, 2026, approved revised CIP standards for virtualization, including CIP-004-8, which NERC lists as effective July 1, 2028. Ask your compliance lead to read the revised CIP-004-8 text against your current role-based courses. Any change to required content has to appear in the course modules, the assessments and the completion records, so map each changed part to a module before the change date arrives.
CIP-003-9 is already enforceable. It became effective April 1, 2026 and adds vendor electronic remote access controls for low impact BES Cyber Systems. Confirm whether any vendor or contractor staff who connect remotely to low impact assets belong in your training population. If they do, your LMS needs an account path for external users, a clear record of who completed which module, and a way to show their access was granted only after training. CIP-003-11, which FERC approved in Order No. 918 with an effective date of July 1, 2029, adds remote user authentication requirements for low impact assets, so expect a second round of content changes.
CIP-015-1 on internal network security monitoring is subject to enforcement from October 1, 2028. Staff who operate or review monitoring output will need role-based courses, so plan those modules alongside the CIP-004-8 changes. Version history is the control that makes all of these changes auditable. Keep every published course version with its effective date, approver, reason for change and assigned learners, so a reviewer can see which version a person completed and when. Confirm all of these dates on the NERC CIP standards page before you set your project timeline.
How much work and cost does CIP-004 LMS setup involve?
What drives the cost of a self-hosted LMS for CIP-004 training?
The main cost drivers are hosting, identity integration, content build, reporting and the upgrade and support model, and each one scales with the scope agreed in writing. Moodle, Canvas and Open edX have no license fee for the core platform, so the spend is in the work and infrastructure around it. Hosting depends on the number of personnel with authorized access, the environments you need (production, test and disaster recovery) and where the platform must run. Identity integration with access provisioning, content build for role-based courses, and reporting that produces dated completion evidence usually account for most of the setup effort. Ask each vendor or partner to price these components separately.
Which CIP-004 LMS costs are one-time and which recur each year?
One-time costs cover planning, installation, configuration, identity and HR integration, course and assessment build, report design and the initial validation of evidence exports. Recurring costs cover hosting, storage for completion records, security patching, platform upgrades, plugin maintenance, content updates when standards or internal procedures change, and support. Because the CIP-004-7 training cycle repeats at least once every 15 calendar months and awareness is reinforced each calendar quarter, the content and reporting work recurs as well. Ask the partner to separate the one-time project fee from the annual run cost so you can compare options over several years.
Can our own team run a self-hosted CIP-004 training LMS internally?
Many utilities can run the platform internally if they already operate Linux servers, databases, web services and identity integrations, and if they have staff for patching and upgrades. The Moodle 5.3 release requires 64-bit PHP 8.3 or later, PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and sites must run Moodle 4.4 or later to upgrade. Open edX is more complex: its maintainers recommend production installs through a service provider or with Tutor, and only the latest named release receives support. Confirm whether your team can hold a supported version, apply security fixes within your internal window, and keep audit evidence intact through each upgrade.
How long does CIP-004 LMS setup take?
Setup duration depends on the written scope, including how many roles and courses you need, how many identity and access systems must be connected, whether content is migrated from an existing tool, and how much report validation your compliance team requires. No general duration applies to every utility, so ask for a schedule tied to named deliverables and dependencies. A realistic plan separates the platform build from the content approval cycle, because subject matter reviews and policy sign-off often set the pace. Confirm which activities depend on your internal approvals and access to HR and provisioning data.
What does the utility need to provide for the LMS project?
The project needs a named CIP program owner who signs off on scope, role-to-course mapping and evidence requirements. Your HR or personnel system team must provide an authoritative list of personnel, roles and dates of authorized electronic or unescorted physical access, because the training must be completed before access is granted under Part 2.2. Your security team must supply the current cyber security policies, access control procedures, visitor control rules, BCSI handling rules, incident reporting steps and recovery plan content that the training covers. Content approvals, test accounts and a staging environment should be agreed before build starts.
What should a quote for CIP-004 LMS work include?
A useful quote lists each deliverable separately, with the scope, assumptions and exclusions written out. Ask for:
- Hosting design, the environments included and the infrastructure responsibilities of each party
- Identity integration and access provisioning steps, including which directory and HR sources are in scope
- Course build, the number of roles and modules, and the content approval process
- Reporting design, including dated completion exports for quarterly awareness and the 15-month cycle
- Upgrade, patching and support terms, with the named Moodle or Open edX release covered
- Documented assumptions about client-side inputs, approval turnaround and change requests
DeployOpen plans, implements, integrates, hardens, documents and supports open-source platforms in your own infrastructure, and most engagements are fixed-scope with agreed written deliverables before work starts.
Which cost factors could make a CIP-004 LMS project grow over time?
Costs usually grow when scope expands after the initial agreement, such as adding roles, connecting more access systems, or adding training for new CIP standards. Standards change over time: CIP-003-9 became enforceable on 1 April 2026, CIP-012-2 on 1 July 2026, and FERC Order No. 919 approved revised standards effective 1 July 2028, which may require content and evidence updates. Ask how the partner handles change requests, how new standard versions are assessed, and whether upgrade support is included in the retainer or priced separately.
How a CIP-004 LMS rollout is phased
The sequence moves from confirming which systems and people are in scope to a running quarterly program whose completion dates and reinforcement records can be produced on request. Each phase closes with a check that the output matches the written scope, so the timeline follows the agreed plan rather than a fixed calendar.
Confirm Applicable Systems and personnel scope
Start by listing which BES Cyber Systems, associated EACMS, PACS and Protected Cyber Assets fall under CIP-004-7, and which personnel hold authorized electronic or unescorted physical access to them. Your compliance lead, asset owners and the CIP program owner confirm the impact category and the access population. The step closes when the scope is signed off in writing and the access population can be exported from the access management system as a baseline roster.
Map roles to Part 2.1 training content
Group the access population into roles, functions or responsibilities, then map each role to the content topics required by CIP-004-7 Part 2.1, such as cyber security policies, access controls, visitor control, BCSI handling and incident reporting. Compliance and security teams review the matrix with HR and operations leads. The step closes with an approved role-to-course matrix that shows which topics each role must complete before access is granted.
Build quarterly awareness and role courses
Author or adapt the security awareness content that reinforces practices each calendar quarter, along with the role-based courses from the matrix. Content owners and instructional designers build the modules in Moodle, Canvas or Open edX, and the compliance lead reviews them against the standard's requirements. The step closes when every course is published, assigned to its role and tagged so that dated copies of each quarterly item can be retrieved.
Integrate identity and provisioning
Connect the LMS to the corporate directory so that learners sign in with their managed accounts and are enrolled automatically when their role or access group changes. Identity engineers configure the chosen method, such as SAML 2.0, OAuth 2 or LDAP, and test that removing access also removes course assignments. The step closes when a test set of joiners, movers and leavers produces the expected enrollments and removals in the LMS.
Pilot with one access group
Run the full cycle with a single access group, such as one control room or one set of field technicians. Participants complete the role courses and quarterly content, and the team checks that the completion dates, reminders and assignments behave as designed. The step closes with a pilot report listing issues found, fixes made and the sign-off from the program owner before wider rollout.
Run evidence walkthroughs
Before the full rollout, walk through the evidence the program must produce: dated copies of quarterly material, proof of distribution through direct, indirect or management channels, and completion dates per person against the 15-month training cycle. Compliance staff perform the walkthrough as if they were preparing for an audit request. The step closes when each evidence type can be exported in a form the compliance team accepts, with a written retention and access procedure.
Operate with a periodic review cycle
Move the program into production with a standing calendar for quarterly reinforcement, course refresh, roster reconciliation and LMS upgrades aligned to the supported Moodle or Open edX release. The CIP program owner reviews completion reports and evidence packs on a set cadence and records any changes to scope or content. The step closes when the first full review cycle is documented and the next review date is assigned.
How DeployOpen scopes, delivers and supports CIP-004 training evidence
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For CIP-004 training, that means a written scope that maps quarterly reinforcement and role-based courses to the requirement, and evidence records that your compliance team can present to a Compliance Enforcement Authority.
How we scope
- Confirm which BES Cyber Systems, EACMS, PACS and PCA populations need training, using your CIP-002 impact categorization
- Map each role to its training content, covering the R2.1 topics and the access rules that apply before authorization
- Agree in writing the deliverables, timelines and responsibilities, since most engagements are fixed-scope
How we build
- Configure role-based course assignments, quarterly awareness content and completion tracking on a self-hosted Moodle or Open edX instance
- Integrate identity and access sources so the people who receive training match your current authorized access list
- Test completion reports and dated evidence exports against the R1 measures before the program goes live
How we hand over
- Document the program design, course-to-role mapping, evidence retention steps and the procedure for reviewing completion dates
- Provide runbooks for administrators covering enrollment changes, 15-month recurrence checks and exception handling
- Train your compliance and operations staff to produce evidence packages on their own, without relying on the partner
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover
- Plan platform upgrades around the Moodle or Open edX release schedule so the LMS stays on a supported version
- Confirm with your auditors which records they expect, since DeployOpen prepares evidence but does not issue audit reports
