privileges to protected information. Change Control and CIP-003-3 R6. N/A N/A N/A The Responsible Entity Configuration Management — has not established or The Responsible Entity shall documented a change establish and document a process control process for the of change control and activities required in configuration management for R6, adding, modifying, replacing, or OR removing Critical Cyber Asset The Responsible Entity hardware or software, and has not established or implement supporting documented a configuration management configuration activities to identify, control and management process document all entity or vendor for the activities related changes to hardware and required in R6. software components of Critical Cyber Assets pursuant to the change control process. R1. Each Responsible Entity, for its CIP-003-5 The Responsible Entity The Responsible Entity The Responsible Entity The Responsible Entity high impact and medium impact documented and documented and implemented documented and documented and BES Cyber Systems, shall review implemented one or one or more cyber security implemented one or more implemented one or and obtain CIP Senior Manager more cyber security policies for its high impact and cyber security policies for more cyber security approval at least once every 15 policies for its high medium impact BES Cyber its high impact and policies for its high calendar months for one or more impact and medium Systems, but did not address medium impact BES impact and medium documented cyber security impact BES Cyber two of the nine topics required Cyber Systems, but did impact BES Cyber policies that collectively address Systems, but did not by R1. (R1) not address three of the Systems, but did not the following topics: [please see address one of the nine nine topics required by address four or more of standard for more information] OR topics required by R1. R1. (R1) the nine topics required (R1) by R1. (R1) The Responsible Entity did not OR complete its review of the one OR OR or more documented cyber The Responsible Entity The Responsible Entity security policies for its high did not complete its The Responsible Entity did not complete its impact and medium impact review of the one or more did not have any review of the one or BES Cyber Systems as required documented cyber documented cyber more documented cyber by R1 within 16 calendar security policies for its security policies for its security policies for its months but did complete this high impact and medium high impact and high impact and review in less than or equal to impact BES Cyber medium impact BES
privileges to protected information. CIP-003-3 R6. Change Control and Configuration Management — The Responsible Entity shall establish and document a process of change control and configuration management for adding, modifying, replacing, or removing Critical Cyber Asset hardware or software, and implement supporting configuration management activities to identify, control and document all entity or vendor related changes to hardware and software components of Critical Cyber Assets pursuant to the change control process. N/A N/A N/A The Responsible Entity has not established or documented a change control process for the activities required in R6, OR The Responsible Entity has not established or documented a configuration management process for the activities required in R6. CIP-003-5 R1. Each Responsible Entity, for its high impact and medium impact BES Cyber Systems, shall review and obtain CIP Senior Manager approval at least once every 15 calendar months for one or more documented cyber security policies that collectively address the following topics: [please see standard for more information] The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address one of the nine topics required by R1. (R1) OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for its high impact and The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address two of the nine topics required by R1. (R1) OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for its high impact and medium impact BES Cyber Systems as required by R1 within 16 calendar months but did complete this review in less than or equal to The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address three of the nine topics required by R1. (R1) OR The Responsible Entity did not complete its review of the one or more documented cyber security policies for its high impact and medium impact BES Cyber The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address four or more of the nine topics required by R1. (R1) OR The Responsible Entity did not have any documented cyber security policies for its high impact and medium impact BES