NERC CIP Cyber Security Awareness Program | Huntress

### Executive Summary This guidance explains how entities should implement a NERC CIP Cyber Security Awareness Program to satisfy CIP-004 R1 and CIP-003 R2 Attachment 1 requirements, describing required content areas (e.g., tailgating, passwords, removable media), acceptable delivery methods, and evidence/recordkeeping expectations (quarterly for High/Medium; every CIP year/15 months for Low). It recommends combining Low Impact awareness with High/Medium programs where practical, delivering content at least quarterly, and maintaining dated records or summaries to demonstrate compliance to auditors.