exists. Auditor Notes: R1 Part 1.3 CIP-005-5 Table R1 Electronic Security Perimeter – Part Applicable Systems Requirements Measures 1.3 Electronic Access Points for High Require inbound and outbound An example of evidence may include, but is Impact BES Cyber Systems access permissions, including the not limited to, a list of (firewall, access reason for granting access, and deny control lists, etc.) that demonstrate that Electronic Access Points for Medium all other access by default. only permitted access is allowed and that Impact BES Cyber Systems each access rule has a documented reason. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-005-5, R1, Part 1.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes which require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default.
exists. Auditor Notes: R1 Part 1.3 CIP-005-5 Table R1 – Electronic Security Perimeter Part Applicable Systems Requirements Measures 1.3 Electronic Access Points for High Impact BES Cyber Systems Electronic Access Points for Medium Impact BES Cyber Systems Require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default. An example of evidence may include, but is not limited to, a list of (firewall, access control lists, etc.) that demonstrate that only permitted access is allowed and that each access rule has a documented reason. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-005-5, R1, Part 1.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes which require inbound and outbound access permissions, including the reason for granting access, and deny all other access by default.