NERC CIP CIP-003 R4: CIP-003-9 R4: Documented delegation of CIP Senior Manager authority

What does CIP-003 R4 require?

Unless no delegations are used, implement a documented process to delegate authority where the CIP Standards allow, recording each delegate's name or title, the specific actions delegated and the date, approved by the CIP Senior Manager and updated within 30 days of any change; a change of delegator does not require delegations to be reinstated.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in CIP-003: Security Management Controls – NERC CIP

CIP-003 R1.1 CIP-003-9 R1.1: Cyber security policies for high and medium impact systems
CIP-003 R1.2 CIP-003-9 R1.2: Cyber security policies for assets containing low impact systems
CIP-003 R2 Att1 S1 CIP-003-9 R2 Att1 S1: Low impact plan Section 1: cyber security awareness
CIP-003 R2 Att1 S2 CIP-003-9 R2 Att1 S2: Low impact plan Section 2: physical security controls
CIP-003 R2 Att1 S3 CIP-003-9 R2 Att1 S3: Low impact plan Section 3: electronic access controls
CIP-003 R2 Att1 S4 CIP-003-9 R2 Att1 S4: Low impact plan Section 4: Cyber Security Incident response
CIP-003 R2 Att1 S5 CIP-003-9 R2 Att1 S5: Low impact plan Section 5: Transient Cyber Asset and Removable Media malicious code mitigation
CIP-003 R2 Att1 S6 CIP-003-9 R2 Att1 S6: Low impact plan Section 6: vendor electronic remote access security controls

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NERC CIP controls