Compliance Assessment R1 Requirement & Measure Evidence Submission Evidence Description Evidence Assessment Approach Auditor Notes AR1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented physical security plans that collectively include all of the applicable requirement parts in CIP‐006-AB‐5 Table R1 Physical Security Plan. – Evidence must include each of the documented M1. physical security plans that collectively include all of the applicable requirement parts in CIP‐006-AB‐5 Table R1 Physical Security Plan and additional – evidence to demonstrate implementation of the plan or plans as described in the Measures column of the table. in Please Verify the Responsible Entity has documented Part 1.1 AR1 Part 1.1 Table R1 Physical Security Plan provide: one or more physical security plans that define – operational or procedural controls to restrict (i) One or more physical access. Applicable Systems documented physical Medium Impact BES systems without external security plans pertaining routable connectivity to requirement R1 Part Physical access control systems associated with: 1.1. High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity Requirements Define operational or procedural controls to restrict physical access. Measures An example of evidence may include, but is not limited to, documentation that operational or procedural controls exist. (ii) Evidence that the Verify the Responsible Entity has implemented controls pertaining to the defined operational or procedural controls to requirement R1 Part 1.1 restrict physical access to Applicable Systems. have been implemented.
Compliance Assessment R1 Requirement & Measure Evidence Submission Evidence Description Evidence Assessment Approach Auditor Notes AR1. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented physical security plans that collectively include all of the applicable requirement parts in CIP‐006-AB‐5 Table R1 – Physical Security Plan. M1. Evidence must include each of the documented physical security plans that collectively include all of the applicable requirement parts in CIP‐006-AB‐5 Table R1 – Physical Security Plan and additional evidence to demonstrate implementation of the plan or plans as described in the Measures column of the table. Part 1.1 in Table R1 – Physical Security Plan Applicable Systems Medium Impact BES systems without external routable connectivity Physical access control systems associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity Requirements Define operational or procedural controls to restrict physical access. Measures An example of evidence may include, but is not limited to, documentation that operational or procedural controls exist. AR1 Part 1.1 Please provide: (i) One or more documented physical security plans pertaining to requirement R1 Part 1.1. Verify the Responsible Entity has documented one or more physical security plans that define operational or procedural controls to restrict physical access. (ii) Evidence that the controls pertaining to requirement R1 Part 1.1 have been implemented. Verify the Responsible Entity has implemented the defined operational or procedural controls to restrict physical access to Applicable Systems.