R3 Requirement & Measure Evidence Submission Evidence Description Evidence Assessment Approach Auditor Notes R3. Each Responsible Entity shall maintain each of its recovery plans in accordance with each of the applicable requirement parts in CIP‐009-AB‐5 Table R3 Recovery – Plan Review, Update and Communication. M3. Acceptable evidence includes, but is not limited to, each of the applicable requirement parts in CIP‐009-AB‐5 Table R3 Recovery Plan Review, Update and Communication. – in Please Part 3.1 Table R3 Recovery Plan Review, Update and AR3 Part 3.1 – Verify that no later than 90 days after completion Communication provide: of a recovery plan test or actual recovery, the Responsible Entity has: Applicable Systems Evidence that the documented any lessons learned High Impact BES systems and their associated: recovery plans associated with a recovery plan test or 1. electronic access control or monitoring systems; and pertaining to actual recovery or document the 2. physical access control systems requirement R3 Part absence of any lessons learned; 3.1 have been updated the recovery plan based on any Medium Impact BES cyber systems at control centres maintained. documented lessons learned associated and their associated: with the plan; and 1. electronic access control or monitoring systems; and notified each person or group with a 2. physical access control systems defined role in the recovery plan of the updates to the recovery plan based on Requirements any documented lessons learned. No later than 90 days after completion of a recovery plan test or actual recovery: 3.1.1. document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any lessons learned; 3.1.2. update the recovery plan based on any documented lessons learned associated with the plan; and 3.1.3. notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any documented lessons learned. Measures An example of evidence may include, but is not limited to, all of the following: 1. dated documentation of identified deficiencies or lessons learned for each recovery plan test or actual incident recovery or dated documentation stating there were no lessons learned; 2. dated and revised recovery plan showing any changes based on the lessons learned; and 3. evidence of plan update distribution including, but not limited to: emails; USPS or other mail service; electronic distribution system; or training sign-in sheets.
R3 Requirement & Measure Evidence Submission Evidence Description Evidence Assessment Approach Auditor Notes R3. Each Responsible Entity shall maintain each of its recovery plans in accordance with each of the applicable requirement parts in CIP‐009-AB‐5 Table R3 – Recovery Plan Review, Update and Communication. M3. Acceptable evidence includes, but is not limited to, each of the applicable requirement parts in CIP‐009-AB‐5 Table R3 – Recovery Plan Review, Update and Communication. Part 3.1 in Table R3 – Recovery Plan Review, Update and Communication Applicable Systems High Impact BES systems and their associated: 1. electronic access control or monitoring systems; and 2. physical access control systems Medium Impact BES cyber systems at control centres and their associated: 1. electronic access control or monitoring systems; and 2. physical access control systems Requirements No later than 90 days after completion of a recovery plan test or actual recovery: 3.1.1. document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any lessons learned; 3.1.2. update the recovery plan based on any documented lessons learned associated with the plan; and 3.1.3. notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any documented lessons learned. Measures An example of evidence may include, but is not limited to, all of the following: 1. dated documentation of identified deficiencies or lessons learned for each recovery plan test or actual incident recovery or dated documentation stating there were no lessons learned; 2. dated and revised recovery plan showing any changes based on the lessons learned; and 3. evidence of plan update distribution including, but not limited to: emails; USPS or other mail service; electronic distribution system; or training sign-in sheets. AR3 Part 3.1 Please provide: Evidence that the recovery plans pertaining to requirement R3 Part 3.1 have been maintained. Verify that no later than 90 days after completion of a recovery plan test or actual recovery, the Responsible Entity has: documented any lessons learned associated with a recovery plan test or actual recovery or document the absence of any lessons learned; updated the recovery plan based on any documented lessons learned associated with the plan; and notified each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any documented lessons learned.