Part Applicable Systems Requirements Measures 1.5 Electronic Access Points for High Have one or more methods for An example of evidence may include, Impact BES Cyber Systems detecting known or suspected but is not limited to, documentation that malicious communications for malicious communications detection Electronic Access Points for both inbound and outbound methods (e.g. intrusion detection Medium Impact BES Cyber communications. system, application layer firewall, etc.) Systems at Control Centers are implemented. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.5 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes include one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications. For each Applicable System, verify the Responsible Entity has implemented one or more methods for detecting or suspected malicious communications for both inbound and outbound communications. Compliance Summary: Finding Summary: Primary Documents Supporting Findings:
Part Applicable Systems Requirements Measures 1.5 Electronic Access Points for High Impact BES Cyber Systems Electronic Access Points for Medium Impact BES Cyber Systems at Control Centers Have one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications. An example of evidence may include, but is not limited to, documentation that malicious communications detection methods (e.g. intrusion detection system, application layer firewall, etc.) are implemented. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.5 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes include one or more methods for detecting known or suspected malicious communications for both inbound and outbound communications. For each Applicable System, verify the Responsible Entity has implemented one or more methods for detecting or suspected malicious communications for both inbound and outbound communications. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: