R1 - Security Awareness Program

The NERC CIP-004 R1 requirement mandates that owners and operators of bulk-power facilities develop and maintain a security awareness program for all personnel who have access to critical cyber assets. The program must include initial training, periodic refresher courses, documentation of attendance, and verification that participants understand how to recognize and respond to security threats.