A utility worker’s day rarely stays inside a single fence line. A meter reader walks into a customer’s backyard. A line technician climbs a pole a few feet from a school bus stop. A gas crew works a trench next to a homeowner’s foundation. A control room operator has the credentials to affect power flow across a multi-state grid. Few industries put employees this close to both private property and critical infrastructure at the same time, and that combination is why utility background check requirements are layered rather than uniform.
There is no single federal law that says “screen every utility worker this way.” Instead, the requirements come from a mix of sector-specific reliability standards, pipeline security guidance, drug and alcohol testing rules, and plain operational risk. Employers who only run a standard criminal search miss the parts of the picture that regulators and reasonable customers expect them to cover.
Why utility screening looks different from a typical hire
Most jobs create risk in one direction: a bad hire can hurt coworkers, customers, or the company. Utility roles add a second and third dimension. Field workers enter homes, garages, and yards where residents are often alone, elderly, or otherwise vulnerable, so the employer is effectively vouching for a stranger’s access to someone’s property. At the same time, workers with access to substations, control systems, generation assets, or pipeline facilities can affect service to entire communities if that access is misused or simply mishandled through negligence.
That second category is not hypothetical or left to each utility’s discretion. For electric utilities that own or operate bulk power system assets, personnel risk assessments are a mandatory reliability requirement, not a best practice.
NERC CIP-004 and the personnel risk assessment
The North American Electric Reliability Corporation’s Critical Infrastructure Protection standards, developed under Federal Energy Regulatory Commission oversight, set mandatory cybersecurity and physical security requirements for the bulk electric system. FERC’s regulations at 18 CFR Part 40 establish these Critical Infrastructure Protection reliability standards as enforceable, with real penalties for noncompliance.
CIP-004, the personnel and training standard within that framework, requires utilities to complete a personnel risk assessment before granting an individual unescorted physical access or electronic access to designated Critical Cyber Assets. The current CIP-004-7 standard spells out what that assessment has to include: identity verification and a seven year criminal history records check covering all jurisdictions where the individual has resided, been employed, or attended school, with the assessment updated at least once every seven years for anyone who retains that access. The standard applies not just to direct employees but to contractors and vendors granted the same level of access, which is a detail utilities sometimes overlook until an audit catches it.
This is narrower in scope than a full pre-employment background check. It is aimed specifically at access control for critical infrastructure, not at general hiring suitability. Most utilities layer it on top of, not instead of, a standard employment background check that covers criminal history, identity, and employment verification for the broader workforce.
Pipeline operators and TSA security guidance
Natural gas and hazardous liquid pipeline operators face a parallel but separate track. The Transportation Security Administration, which holds pipeline security authority under its transportation security mission, publishes voluntary security guidelines that many operators have adopted as baseline practice, particularly after several high-profile pipeline security incidents pushed the agency toward more formal security directives for critical pipeline systems. TSA’s pipeline security guidelines address physical security, cybersecurity, and personnel security measures for operators of the nation’s pipeline systems, including recommendations around vetting personnel who have access to critical facilities and control systems.
Unlike CIP-004, TSA’s pipeline guidance is not a criminal-history checklist. It points operators toward risk-based access control and personnel reliability practices without prescribing a specific lookback period or record type. In practice, most pipeline operators build their own personnel screening standard around it, often mirroring the identity verification and criminal history elements used for electric utility critical infrastructure access, then adding role-based checks for anyone with system control or cyber access.
Where drug testing crosses over
Pipeline personnel who perform operation, maintenance, or emergency response functions on a pipeline facility are also subject to mandatory drug and alcohol testing under the Pipeline and Hazardous Materials Safety Administration’s regulations. 49 CFR Part 199 requires pre-employment, random, post-accident, reasonable cause, and return-to-duty testing for covered employees, with specific requirements around drug testing panels and reporting. This runs alongside background screening rather than replacing it. A candidate can pass a criminal history check and still be disqualified, or a current employee removed from covered duty, based on a drug test result under this separate regulatory track. Employers running both processes need to keep the two clearly separated in their records, since they serve different legal purposes and have different retention and dispute procedures.
Fleet risk: MVR checks for utility crews
Utility work is also vehicle-heavy. Line trucks, bucket trucks, gas service vans, and meter reading fleets put employees on the road constantly, often in residential neighborhoods and school zones. For any employee who drives a commercial motor vehicle requiring a CDL, or who otherwise falls under Department of Transportation driver qualification rules, 49 CFR 391.23 requires employers to investigate the driver’s safety performance history, including motor vehicle records, before allowing them to operate a commercial vehicle. Even for non-CDL utility fleet drivers, a motor vehicle record check is a reasonable and common practice given how much time these employees spend behind the wheel in populated areas. Reveal’s guide on MVR background screening for employers covers how those checks work and how often they should be refreshed for employees who drive as part of the job. For utilities running mixed fleets with both CDL and non-CDL drivers, it is worth reviewing how DOT-covered driving roles differ from the rest of the workforce, which the piece on DOT background check requirements for drivers breaks down in more detail.
The core components of a utility screening program
Strip away the sector-specific overlays and most utility screening programs are built from the same basic components, applied with different intensity depending on the role.
| Component | What it covers | Who it typically applies to |
|---|---|---|
| Identity verification | Confirms the applicant is who they claim to be before any record search runs | All employees and contractors, mandatory under CIP-004 for critical access |
| Criminal history | County, state, and federal record checks, typically a seven year lookback for critical infrastructure access | Field crews, control room staff, anyone with facility or system access |
| Motor vehicle record | Driving history, license status, moving violations | Line crews, service technicians, meter readers, any role that drives company vehicles |
| Drug and alcohol testing | Pre-employment and ongoing testing under PHMSA or DOT rules where applicable | Pipeline covered employees, CDL drivers, other safety-sensitive roles |
| Reinvestigation | Periodic refresh of the personnel risk assessment for continued access | Anyone retaining unescorted or electronic access to critical assets |
Contractors deserve the same standard, not a lighter one
Utilities lean heavily on contractors for storm restoration, capital projects, meter installation, and specialized maintenance. It is common, and a mistake, to screen full-time employees rigorously while waving contractor crews through with a lighter check or none at all. CIP-004 does not distinguish between an employee and a contractor when it comes to access, and neither should a utility’s screening policy. If a contractor or vendor employee will have unescorted access to a substation, a control room, or a customer’s home on the utility’s behalf, that person should clear the same identity, criminal history, and where relevant, drug testing standard as a direct hire. Screening gaps most often show up at the contractor boundary, not in the direct workforce, because that is where oversight tends to loosen.
Recurring checks, not a one-time gate
A background check at hire answers one question at one point in time. Utility risk does not stay static. An employee’s driving record can change within a year of a clean MVR pull. A criminal record can accumulate after someone already has building access. That is why CIP-004 builds in a mandatory reinvestigation cycle, and why many utilities extend that same logic to roles the standard does not technically cover, running periodic rescreening for MVR and criminal history on a set schedule rather than relying on the original pre-employment result indefinitely.
Building this into an ongoing program, rather than a single pre-hire step, is usually a matter of setting the right cadence and vendor rather than reinventing the process each time. Reveal’s pricing page outlines how packages scale for organizations that need both an initial screen and a recurring rescreening cadence across a distributed field workforce.
Frequently asked questions
Do all utility employees need a NERC CIP personnel risk assessment?
No. CIP-004 applies specifically to individuals who need unescorted physical access to designated Critical Cyber Asset locations or electronic access to those systems, which usually means control room staff, certain substation personnel, and IT or OT staff who manage covered systems. Field employees without that level of access, such as a meter reader who never enters a control facility, typically fall under the utility’s general employment screening policy instead.
Is TSA pipeline security guidance mandatory?
TSA’s published pipeline security guidelines function as recommended practice for the sector, though TSA has also issued specific security directives to certain pipeline operators following past incidents, which do carry compliance obligations for the operators they name. Operators should confirm which category applies to them rather than assuming the general guidelines are the only obligation in play.
Does PHMSA drug testing replace a background check?
No. PHMSA’s drug and alcohol testing rules under 49 CFR Part 199 are a separate regulatory requirement focused on substance use for employees performing covered pipeline functions. A background check covering identity, criminal history, and employment verification is a distinct process and both are typically run for the same covered employee.
How often should a utility rerun criminal history checks?
For roles covered by CIP-004, the standard requires the personnel risk assessment to be updated at least once every seven years for anyone retaining access. Many utilities choose to rescreen on a shorter cycle, such as every one to three years, for field and driving roles even where no federal standard mandates it, simply because the underlying risk does not stay fixed between hire dates.
What about employees who only enter customer homes, like meter readers?
These roles are not usually captured by NERC CIP or TSA pipeline guidance, since those frameworks focus on infrastructure access rather than customer premises. The relevant standard here is the utility’s own duty of care. A criminal history check, identity verification, and where the role involves driving, an MVR check, are the baseline most utilities apply given how much unsupervised access these employees have to private property.
This article is general information, not legal or compliance advice. Utilities and pipeline operators should confirm current NERC, FERC, TSA, and PHMSA requirements applicable to their specific assets and consult qualified counsel or compliance staff before finalizing a screening policy.
