NERC CIP: Identity Requirements for Utilities

By Robert Ivey, CTO, GCA. Practice opinion as of October 16, 2026, NERC-CIP-IDM v1. Not legal advice and not a standard-of-care statement. The cited source text controls.

NERC CIP requirements ask responsible entities to control who can reach systems that support the electric grid. Identity and access management is part of that work, not all of it. NERC CIP-007 sets system security management requirements, including system access controls, and CIP-004 and CIP-005 cover access authorization and remote access. This matrix covers the identity-relevant requirements in the CIP standards named below. Of 20 requirement rows, 6 are primary identity work, 6 are supporting and 8 sit outside identity scope (GCA classification).

Requirement identifiers and official standard titles come from the NERC Reliability Standards. All descriptions are GCA's own wording and are not NERC text.

This matrix records the versions subject to enforcement in the United States as of October 16, 2026: CIP-003-9, CIP-004-7, CIP-005-7, CIP-007-6 and CIP-011-3. FERC Order No. 919 (final rule effective May 26, 2026) approved CIP-003-10, CIP-004-8, CIP-005-8, CIP-007-7.1 and CIP-011-4.1, which NERC lists with a U.S. effective date of July 1, 2028. FERC Order No. 918 (effective May 26, 2026) approved CIP-003-11, which NERC lists with a U.S. effective date of July 1, 2029. Confirm the version that applies to your entity with your Regional Entity.

The primary rows are CIP-004 R4 to R6 (access authorization, revocation and repository access), CIP-005 R2 and R3 (interactive and vendor remote access) and CIP-007 R5 (system access controls).

For CIOs and compliance leaders

The six primary rows cover access authorization and revocation, remote access, and system authentication. Those are the places identity programs usually carry the work.
Vendor sessions under CIP-005 R3 depend on how third-party identities are issued, brokered and removed. Treat vendor identity lifecycle as part of the CIP scope discussion.
The version an entity is audited against depends on its enforceable version and implementation plan. Confirm the applicable version with your Regional Entity.

Information as of October 16, 2026 Last verified October 16, 2026 Subject to enforcement in the United States as of 2026-10-16: CIP-003-9 (effective 2026-04-01), CIP-004-7 (2024-01-01), CIP-005-7 (2022-10-01), CIP-007-6 (2016-07-01) and CIP-011-3 (2024-01-01). Approved, not yet enforceable: CIP-003-10, CIP-004-8, CIP-005-8, CIP-007-7.1 and CIP-011-4.1 (FERC Order No. 919, final rule effective May 26, 2026; U.S. effective date July 1, 2028 per NERC) and CIP-003-11 (FERC Order No. 918, effective May 26, 2026; U.S. effective date July 1, 2029 per NERC). Version 1

Reference material, not a compliance determination. This matrix reflects GCA's practice view as of October 16, 2026. It does not certify, warrant or predict the outcome of any assessment, audit or examination. The NERC Reliability Standards, available from NERC, control. Read the full notice.

The matrix

Primary
Supporting
Outside identity scope (GCA classification)

NERC CIP Reliability Standards: identity-relevant requirements identity traceability matrix. Subject to enforcement in the United States as of 2026-10-16: CIP-003-9 (effective 2026-04-01), CIP-004-7 (2024-01-01), CIP-005-7 (2022-10-01), CIP-007-6 (2016-07-01) and CIP-011-3 (2024-01-01). Approved, not yet enforceable: CIP-003-10, CIP-004-8, CIP-005-8, CIP-007-7.1 and CIP-011-4.1 (FERC Order No. 919, final rule effective May 26, 2026; U.S. effective date July 1, 2028 per NERC) and CIP-003-11 (FERC Order No. 918, effective May 26, 2026; U.S. effective date July 1, 2029 per NERC). Information as of October 16, 2026.
Requirement	Requirement description (GCA summary)	Identity area	Identity relevance (GCA classification)	GCA approach	Platform families that commonly provide relevant capabilities	Evidence commonly examined
CIP-004-R4 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R4 The program for governing who holds access. Each grant of electronic or unescorted physical access is authorized against a business need. Authorization records, accounts and privileges are then re-verified on fixed recurring cycles, so that stale or excessive access is found and corrected. In practice: Each grant of access is approved against a business need in a request workflow, and managers confirm on a recurring cycle who still holds it, with their decisions exported.	Identity area Access lifecycle	Primary Why this classification Authorizing and periodically re-verifying access is the central activity of an access governance program.	Assess Implement Manage Role Mining Engine Request and approval workflows, role-based access, and scheduled access review campaigns with exported decisions commonly contribute here.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC SailPoint IIQ Netwrix IDM	Evidence commonly examined Access request and approval records Access review campaign export with reviewer, date and decision Account and privilege verification report Exception log with business justification
CIP-004-R5 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R5 The access revocation program. When someone leaves or changes role, their access is removed within fixed deadlines that range from 24 hours to 30 days, and for high impact systems, passwords for shared accounts they knew are changed afterward. In practice: When someone leaves or changes roles, the leaver or mover process removes access within the set deadline, and shared credentials they knew are changed afterward.	Identity area Access lifecycle	Primary Why this classification Timely removal on departure or role change is a lifecycle capability implemented in identity governance and privileged access tooling.	Implement Manage Leaver and mover automation, deadline tracking, and rotation of shared credentials after departures commonly contribute here.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC SailPoint IIQ CyberArk / BeyondTrust / Delinea	Evidence commonly examined Leaver event to account disablement timing report Shared credential rotation record tied to a departure Mover access adjustment record
CIP-004-R6 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R6 Access management for repositories that hold sensitive operational information. The same authorize, re-verify and remove discipline applies to the people and accounts that can reach those repositories, whether hosted on premises or by a provider. In practice: Access to repositories holding sensitive operational information is granted through approved group membership, and the owners review those groups on a recurring schedule.	Identity area Access lifecycle	Primary Why this classification Controlling who can reach repositories is an access governance activity; the content and configuration of the protected information is outside identity scope.	Implement Manage Repository-level access groups, authorization workflow and recurring review for the groups that grant repository access commonly contribute here.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC SailPoint IIQ	Evidence commonly examined Repository access group membership report Access review record for repository access groups
CIP-005-R2 CIP-005: Electronic Security Perimeters	Cyber Security - Electronic Security Perimeter(s), Requirement R2 Control of interactive remote access into the protected zone. Sessions are routed through an intermediary system, the traffic is protected, more than one authentication factor is used, and vendor-originated sessions can be identified and cut off. In practice: Remote users connect through an intermediary system, complete a second sign-in factor, and brokered privileged sessions show which vendor sessions are open.	Identity area Remote access	Primary Why this classification Multi-factor authentication and session control for remote access are identity capabilities; the intermediary system and network path are network engineering.	Assess Implement Manage Multi-factor authentication policy for remote access, brokered privileged sessions and vendor session visibility commonly contribute here.	Platform families that commonly provide relevant capabilities Entra Okta / Ping CyberArk / BeyondTrust / Delinea	Evidence commonly examined Remote access authentication policy export Session broker or jump host access log Vendor session list and disablement procedure
CIP-005-R3 CIP-005: Electronic Security Perimeters	Cyber Security - Electronic Security Perimeter(s), Requirement R3 Handling of vendor-initiated remote sessions to the systems that control and watch electronic and physical access: knowing which vendor sessions are active, being able to end them, and controlling whether the vendor can reconnect. In practice: Vendor accounts are created on request with an end date, privileged vendor access is time-limited and recorded, and the team can see active vendor sessions and cut them off.	Identity area Remote access	Primary Why this classification Vendor session identification and termination depends on how third-party identities are issued, brokered and removed.	Implement Manage Third-party identity lifecycle, time-bound privileged access and session recording commonly contribute here.	Platform families that commonly provide relevant capabilities CyberArk / BeyondTrust / Delinea Entra SailPoint ISC	Evidence commonly examined Third-party account inventory with sponsor and expiry Vendor session record with start, end and approver
CIP-007-R5 CIP-007: System Security Management	Cyber Security - System Security Management, Requirement R5 System access controls on the in-scope systems themselves. Interactive users must authenticate where technically feasible, default and generic accounts are inventoried, the people who can use each shared account are known, vendor-default credentials are changed, password rules apply where passwords alone are used, and repeated failed attempts are limited or alerted on. In practice: Shared and default accounts are listed, shared passwords sit in a vault so each use is tied to a named person, vendor-default passwords are changed, and lockout limits repeated failed sign-ins.	Identity area Authentication	Primary Why this classification Authentication, shared account and default account controls are the principal means of implementing account hygiene on a system.	Assess Implement Manage Account inventory, shared account vaulting with named-user attribution, default credential changes, and password and lockout policy commonly contribute here.	Platform families that commonly provide relevant capabilities CyberArk / BeyondTrust / Delinea Entra SailPoint ISC	Evidence commonly examined Default and generic account inventory Shared account list with authorized users Password and lockout policy configuration export Credential change record for vendor-default accounts
CIP-003-R1 CIP-003: Security Management Controls	Cyber Security - Security Management Controls, Requirement R1 Written management direction for the security topics a responsible entity must cover, with one set of topics for its high and medium impact systems and a shorter set for assets containing low impact systems, kept current and signed off by an accountable senior manager. For identity work this is the policy layer that account ownership, access authorization and remote access rules trace back to. In practice: A senior manager signs off the written security policies; identity engineers help draft the sections on who may be authorized, how access is reviewed and how remote access is handled.	Identity area Governance	Supporting Why this classification Policy ownership usually sits with the program and its senior manager; identity teams supply the access-related policy content.	Assess Identity policy documents covering authorization, review and remote access commonly feed this requirement.	Not mapped	Evidence commonly examined Access management policy with owner, approval date and review date Policy-to-control mapping prepared by the identity team
CIP-003-R2 CIP-003: Security Management Controls	Cyber Security - Security Management Controls, Requirement R2 Security plans for assets rated low impact. The identity share is deciding which electronic access paths and vendor remote sessions can reach those assets and how that reach is controlled, in proportion to the lower rating. In practice: For lower-rated assets, the security plan owner decides what is needed; identity helps define which accounts and vendor remote sessions can reach those assets and how that is recorded.	Identity area Remote access	Supporting Why this classification The plan is usually owned by the program; electronic access and vendor remote session handling are the identity-relevant parts.	Assess Implement Scoping who and what can reach low-impact assets, and how vendor-originated remote sessions are authorized and recorded, commonly contributes here.	Platform families that commonly provide relevant capabilities Entra CyberArk / BeyondTrust / Delinea	Evidence commonly examined Low-impact asset access scoping worksheet Vendor remote session authorization procedure
CIP-004-R2 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R2 A role-based training program that people complete before they receive access and repeat on a cycle. In practice: Training records belong to the training owner; an access request rule can check a training-completion attribute before access to an in-scope system is granted.	Identity area Other	Supporting Why this classification Role-based training content and delivery are usually owned by security training teams. In GCA's classification this row is supporting because it also ties access to completed training, and gating access on completed training is a provisioning rule identity workflows can enforce.	Implement A provisioning or access request rule that checks a training-completion attribute before granting access commonly contributes here.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC SailPoint IIQ	Evidence commonly examined Provisioning policy with training-completion condition Access request record showing the gate
CIP-004-R3 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R3 A screening program that establishes background checks before access is granted and refreshes them on a cycle. In practice: HR owns the personnel risk assessment. The onboarding workflow can hold back access to in-scope systems until HR records the assessment as complete.	Identity area Other	Supporting Why this classification Screening is usually performed by human resources and security; provisioning rules can read the result.	Implement A provisioning rule that checks a personnel risk assessment status attribute before granting access commonly contributes here.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC SailPoint IIQ Netwrix IDM	Evidence commonly examined Provisioning rule or workflow that holds access until the assessment status is set Sample joiner records showing the status check
CIP-007-R4 CIP-007: System Security Management	Cyber Security - System Security Management, Requirement R4 Event logging and alerting on in-scope systems, including successful sign-ins, failed access and sign-in attempts, and malicious code detections, kept for a defined period and reviewed on a cadence. In practice: The monitoring team runs event logging; identity sends successful and failed sign-in events and account changes to the logging platform, retained for the period the policy sets.	Identity area Logging	Supporting Why this classification Logging is usually a security operations responsibility; identity systems supply the sign-in and account events.	Implement Manage Forwarding successful and failed sign-in events and account changes to the logging platform, with retention set to policy, commonly contributes here.	Platform families that commonly provide relevant capabilities Entra CyberArk / BeyondTrust / Delinea SailPoint ISC	Evidence commonly examined Identity event forwarding configuration Retention setting export Sample failed-sign-in alert record
CIP-011-R1 CIP-011: Information Protection	Cyber Security - Information Protection, Requirement R1 An information protection program covering how sensitive operational information is identified and handled in storage, transit and use. The identity share is who and what can reach the repositories that hold it. In practice: The information protection program belongs to the compliance owner; identity manages the access groups for the repositories involved and runs periodic reviews of who is in them.	Identity area Access lifecycle	Supporting Why this classification The program and the protected information are usually owned outside identity; access to repositories is the identity-relevant part, covered more directly under CIP-004 R6.	Assess Implement Access groups and review for repository access commonly contribute here; no protected information is described on this page.	Platform families that commonly provide relevant capabilities Entra SailPoint ISC	Evidence commonly examined Repository access group membership report
CIP-003-R3 CIP-003: Security Management Controls	Cyber Security - Security Management Controls, Requirement R3 Naming the single senior manager who is accountable for the program.	Identity area Governance	Outside identity scope (GCA classification) Why this classification Appointing an accountable manager is usually an organizational decision owned by company leadership.	Not applicable	Not applicable	Not applicable
CIP-003-R4 CIP-003: Security Management Controls	Cyber Security - Security Management Controls, Requirement R4 Recording, in writing, any delegation of that manager's authority.	Identity area Governance	Outside identity scope (GCA classification) Why this classification Delegation of authority is a governance record usually owned by company leadership and compliance.	Not applicable	Not applicable	Not applicable
CIP-004-R1 CIP-004: Personnel and Training	Cyber Security - Personnel & Training, Requirement R1 A recurring awareness program that keeps security practices in front of the workforce.	Identity area Other	Outside identity scope (GCA classification) Why this classification Awareness programs are usually owned by security training and human resources, and sit outside identity engineering.	Not applicable	Not applicable	Not applicable
CIP-005-R1 CIP-005: Electronic Security Perimeters	Cyber Security - Electronic Security Perimeter(s), Requirement R1 Defining and defending the network boundary around in-scope systems.	Identity area Other	Outside identity scope (GCA classification) Why this classification Perimeter design and firewall rules are network engineering controls.	Not applicable	Not applicable	Not applicable
CIP-007-R1 CIP-007: System Security Management	Cyber Security - System Security Management, Requirement R1 Limiting enabled network ports and services on in-scope systems to what is needed.	Identity area Other	Outside identity scope (GCA classification) Why this classification Port and service hardening is system administration work outside identity.	Not applicable	Not applicable	Not applicable
CIP-007-R2 CIP-007: System Security Management	Cyber Security - System Security Management, Requirement R2 Tracking and applying security patches on a defined cycle.	Identity area Other	Outside identity scope (GCA classification) Why this classification Patch management is usually owned by IT and OT operations.	Not applicable	Not applicable	Not applicable
CIP-007-R3 CIP-007: System Security Management	Cyber Security - System Security Management, Requirement R3 Deploying methods to prevent and detect malicious code.	Identity area Other	Outside identity scope (GCA classification) Why this classification Malware controls are endpoint and system security functions.	Not applicable	Not applicable	Not applicable
CIP-011-R2 CIP-011: Information Protection	Cyber Security - Information Protection, Requirement R2 Preparing devices for reuse or disposal so that sensitive information does not remain on them.	Identity area Other	Outside identity scope (GCA classification) Why this classification Media sanitization and disposal are asset management and operations controls.	Not applicable	Not applicable	Not applicable

Summary

Primary: 6; Identity platforms or processes are typically the principal means of implementing the requirement.
Supporting: 6; Another discipline owns the requirement. Identity configuration or evidence contributes.
Outside identity scope (GCA classification): 8; Listed for completeness, with a one-line note on what the requirement is.

How to read the matrix

Identity area: GCA classification of the identity topic a requirement touches. It is a navigation aid and not a NERC category.
Identity relevance: Identity relevance is a GCA classification of whether identity capabilities are typically the principal means of implementing a requirement (Primary), contribute to a requirement owned by another discipline (Supporting), or usually sit outside identity work (Outside identity scope (GCA classification)).

It describes where primary implementation ownership usually sits. It is not a statement about whether identity configuration could be relevant to a particular incident, finding or environment. Every "Outside identity scope (GCA classification)" classification carries a rationale, and other classifications show one where GCA has recorded it, under "Why this classification" beside the label.
Platform families: Product families that commonly provide capabilities relevant to a requirement. A blank cell means GCA has not mapped a platform family to the requirement. It does not mean a product lacks a capability.
Evidence: Examples of artifacts commonly examined. The list is not complete, and it is not a statement that any artifact is sufficient. Assessors determine sufficiency.

Sources

NERC Reliability Standards, CIP family North American Electric Reliability Corporation
NERC One-Stop-Shop (Reliability Standards status and U.S. effective dates) North American Electric Reliability Corporation
Order No. 919, Virtualization Reliability Standards, 91 FR 13957 (March 24, 2026) Federal Energy Regulatory Commission
Order No. 918, Critical Infrastructure Protection Reliability Standard CIP-003-11, 91 FR 13952 (March 24, 2026) Federal Energy Regulatory Commission
Standards Update, Texas Reliability Entity, August 27, 2026 (Standards with Future Effective Dates) Texas Reliability Entity
Standards, Compliance and Enforcement Bulletin, May 25, 2026 North American Electric Reliability Corporation

Important notice

Purpose. This NERC CIP identity traceability matrix is general educational reference material, written by Robert Ivey and published by GCA Technology Services ("GCA") to help organizations plan identity and access management work. It is not legal, audit, accounting or compliance advice, and it is not a substitute for advice from qualified professionals who know your environment.

No compliance determination. Whether an organization meets a requirement is decided by the applicable assessor, auditor, certifying body or regulator, applying the governing requirements to that organization's actual systems, policies and evidence. Nothing in this matrix states or implies that any organization, product, service or configuration meets or complies with any requirement, or that any assessment, audit, examination or certification will have any particular outcome.

Classifications are practice opinion. Relevance classifications, offering mappings, platform mappings and evidence examples are the author's professional judgment as of the date shown. They are not regulatory classifications and are not statements of the standard of care. Other qualified practitioners may reasonably classify requirements differently, and the right answer for a given environment depends on its facts.

Evidence examples are illustrative. Evidence listed is an example of artifacts commonly examined. It is not a complete list, and it is not a statement that any artifact is sufficient. Assessors determine sufficiency.

Source text controls. Requirement text and references come from the sources listed on this page. Where this matrix differs from a source, the source controls. Regulations, guidance and assessment methods change, so confirm current requirements with the issuing authority before relying on them.

Products and services. Platform names identify product families that commonly provide capabilities relevant to a requirement. A blank cell means GCA has not mapped that platform family to the requirement. It does not mean the product lacks a capability. GCA makes no representation about any third party's products, features, roadmaps or government authorization status, including FedRAMP, DoD Impact Levels and similar programs. Confirm capabilities with the vendor and authorization status with the authorizing program.

GCA services. Offering descriptions identify the type of GCA service that addresses an area. The scope, deliverables, terms and outcomes of any GCA engagement are defined only by a signed agreement and Statement of Work, and this page does not change those terms.

No relationship; no reliance. Reading or using this matrix does not create a client, advisory or other relationship with GCA or the author. To the fullest extent permitted by law, this material is provided "as is," without warranties of any kind, express or implied, including accuracy, completeness, merchantability and fitness for a particular purpose, and GCA is not liable for any decision made or action taken in reliance on it.

No client data. This matrix contains no client data. Any example organization is fictitious.

NERC text. Only NERC CIP requirement identifiers and official standard titles are used, for reference. All descriptions on this page are GCA's own and are not NERC text. The NERC Reliability Standards, available from NERC, control. This page contains no BES Cyber System Information.

Version 1 · Prepared October 16, 2026 · Last reviewed October 16, 2026 · Reviewed every 90 days · View changelog

© 2026 Quasius Investment Corp. d/b/a GCA Technology Services. The selection, arrangement, classifications and annotations in this matrix are GCA's original work. You may use this matrix within your organization for planning and may quote short portions with attribution to GCA and a link to this page. Republishing the matrix in whole or in substantial part requires GCA's written permission. Only requirement identifiers and official titles from the NERC CIP Reliability Standards are used, for reference. All descriptions on this page are GCA's own and are not the publisher's text. The NERC CIP Reliability Standards are available from the North American Electric Reliability Corporation, which holds the rights in them and does not endorse this page.

Microsoft and Microsoft Entra are trademarks of the Microsoft group of companies. SailPoint, IdentityIQ and Identity Security Cloud are trademarks or product names of SailPoint Technologies, Inc. or its affiliates. Netwrix is a trademark of Netwrix Corporation. Okta is a trademark of Okta, Inc. Ping Identity is a trademark of Ping Identity Corporation. CyberArk is a trademark of Palo Alto Networks, Inc. or its affiliates. BeyondTrust is a trademark of BeyondTrust Corporation. Delinea is a trademark of Delinea Inc. NERC is a trademark of the North American Electric Reliability Corporation. All other trademarks belong to their respective owners. These names identify products and programs only and do not imply endorsement by, sponsorship by or affiliation with any of these companies or programs, except where a GCA partnership is expressly stated elsewhere on gca.net.

Changelog

November 10, 2026 Version 1: First publication.

Frequently Asked Questions

Which NERC CIP requirements does identity work most often support?

The primary rows are CIP-004 R4 to R6, CIP-005 R2 and R3, and CIP-007 R5. Each row has a GCA description of the identity work involved and a rationale for its classification. NERC requirement wording is not reproduced here.

Why do some platform cells look empty?

A blank platform cell means GCA has not mapped that platform family to the requirement. It does not mean the product lacks a capability. Confirm capabilities with the vendor and treat the matrix as a planning aid.

Which CIP versions are enforceable now?

As of October 16, 2026, NERC lists CIP-003-9, CIP-004-7, CIP-005-7, CIP-007-6 and CIP-011-3 as subject to enforcement in the United States. The successor versions approved under FERC Order No. 919 have a U.S. effective date of July 1, 2028, and CIP-003-11, approved under Order No. 918, has a U.S. effective date of July 1, 2029. Confirm the version that applies to your entity with your Regional Entity.

Does GCA claim any affiliation with NERC?

No. GCA is not affiliated with, endorsed by or sponsored by NERC. The NERC word mark is used only to refer to the Reliability Standards, and no NERC logo appears on this page.

Request an identity assessment conversation

How Identity and Access Management Supports NERC CIP

For CIOs and compliance leaders

The matrix

Summary

How to read the matrix

Sources

Important notice

Changelog

Frequently Asked Questions

Which NERC CIP requirements does identity work most often support?

Why do some platform cells look empty?

Which CIP versions are enforceable now?

Does GCA claim any affiliation with NERC?