the specific actions delegated, OR delegate by name, title, and the date of the delegation; date of delegation, and The Responsible Entity approved by the CIP Senior specific actions has used delegated Manager; and updated within 30 delegated, but did not authority for actions days of any change to the document changes to where allowed by the CIP delegation. Delegation changes the delegate within 60 Standards, has a process do not need to be reinstated with calendar days of the to delegate actions from a change to the delegator. change. (R4) the CIP Senior Manager, but did not identify, assess, or correct the deficiencies.(R4) OR The Responsible Entity has identified a delegate by name, title, date of delegation, and specific actions delegated, but did not document changes to the delegate within 50 calendar days but did document this change in less than 60 calendar days of the change. (R4) R1. Each Responsible Entity shall CIP-003-6 The Responsible Entity The Responsible Entity The Responsible Entity The Responsible Entity review and obtain CIP Senior documented and documented and implemented documented and documented and Manager approval at least once implemented one or one or more cyber security implemented one or more implemented one or every 15 calendar months for one more cyber security policies for its high impact and cyber security policies for more cyber security or more documented cyber policies for its high medium impact BES Cyber its high impact and policies for its high security policies that collectively impact and medium Systems, but did not address medium impact BES impact and medium address the following topics: impact BES Cyber two of the nine topics required Cyber Systems, but did impact BES Cyber For its high impact and Systems, but did not by R1. (R1.1) not address three of the Systems, but did not medium impact BES address one of the nine nine topics required by address four or more of OR Cyber Systems, if any: topics required by R1. R1. (R1.1) the nine topics required (R1.1) by R1. (R1.1) The Responsible Entity did not Personnel and training OR complete its review of the one (CIP-004); OR OR or more documented cyber
the specific actions delegated, and the date of the delegation; approved by the CIP Senior Manager; and updated within 30 days of any change to the delegation. Delegation changes do not need to be reinstated with a change to the delegator. OR The Responsible Entity has used delegated authority for actions where allowed by the CIP Standards, has a process to delegate actions from the CIP Senior Manager, but did not identify, assess, or correct the deficiencies.(R4) OR The Responsible Entity has identified a delegate by name, title, date of delegation, and specific actions delegated, but did not document changes to the delegate within 50 calendar days but did document this change in less than 60 calendar days of the change. (R4) delegate by name, title, date of delegation, and specific actions delegated, but did not document changes to the delegate within 60 calendar days of the change. (R4) CIP-003-6 R1. Each Responsible Entity shall review and obtain CIP Senior Manager approval at least once every 15 calendar months for one or more documented cyber security policies that collectively address the following topics: For its high impact and medium impact BES Cyber Systems, if any: Personnel and training (CIP-004); The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address one of the nine topics required by R1. (R1.1) OR The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address two of the nine topics required by R1. (R1.1) OR The Responsible Entity did not complete its review of the one or more documented cyber The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address three of the nine topics required by R1. (R1.1) OR The Responsible Entity documented and implemented one or more cyber security policies for its high impact and medium impact BES Cyber Systems, but did not address four or more of the nine topics required by R1. (R1.1) OR