CIP-004 — Personnel & Training

Description

CIP-004 establishes personnel and training controls for individuals with authorized electronic or unescorted physical access to applicable BES Cyber Systems. It includes personnel risk assessment, security awareness, role-based training, authorization, access-status management, and records.

Implications

• Access authorization must be tied to job responsibilities and reviewed when duties change or employment ends.
• Background checks or equivalent personnel-risk processes may be required for covered personnel, subject to applicable law.
• Training must address cybersecurity responsibilities relevant to the person’s role, including incident reporting and secure handling of systems and information.
• Contractors and vendors with access create significant lifecycle and offboarding risk.

Common Compensating Controls

• Central identity governance integrated with HR and contractor-management systems.
• Role-based access matrices, manager approval, periodic recertification, and automated termination workflows.
• Privileged-access management, phishing-resistant MFA where technically feasible, session recording, and time-limited vendor access.
• Training completion tracking, knowledge checks, targeted OT training, and documented exception handling.
• Quarterly reconciliation of personnel access against current authorization and training status.

Controls must account for emergency access and operational continuity without creating unmanaged standing privileges.