passwords, per Cyber Asset capability. For Cyber Assets of Applicable Systems with the capability to change default passwords, verify the Responsible Entity has changed the known default passwords. For Assets of Applicable Systems that do not have the capability to change default passwords, verify the incapability to do so. CIP-007-6 Table R5 System Access Control – Part Applicable Systems Requirements Measures 5.5 High Impact BES Cyber For password-only Examples of evidence may include, Systems and their associated: authentication for interactive but are not limited to: user access, either technically EACMS; System-generated reports or or procedurally enforce the PACS; and screen-shots of the following password enforced password PCA parameters: parameters, including length Medium Impact BES Password length that and complexity; or Systems and their associated: is, at least, the lesser Attestations that include a EACMS; of eight characters or reference to the documented PACS; and the maximum length procedures that were PCA supported by the Cyber followed. Asset; and Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, or the maximum complexity supported by the Cyber Asset. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s)
passwords, per Cyber Asset capability. For Cyber Assets of Applicable Systems with the capability to change default passwords, verify the Responsible Entity has changed the known default passwords. For Assets of Applicable Systems that do not have the capability to change default passwords, verify the incapability to do so. CIP-007-6 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.5 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA For password-only authentication for interactive user access, either technically or procedurally enforce the following password parameters: Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, or the maximum complexity supported by the Cyber Asset. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the password parameters, including length and complexity; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document enforced