The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.6 This section to be completed by the Compliance Monitor Administrator For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months, where technically feasible. For Assets of Applicable Systems, if a password for password-only authentication for interactive user access cannot be changed. For Cyber Assets of Applicable Systems, if a password for password-only authentication for interactive user access can be changed, verify a password change, at least every 15 calendar months, is enforced by either technical or procedural methods. Note to Auditor: This Part does not apply to multi-factor authentication. CIP-007-6 R5 System Access Control – Part Applicable Systems Requirements Measures 5.7 High Impact BES Cyber Where technically feasible, Examples of evidence may include, Systems and their associated: either: but are not limited to: EACMS; the number of Documentation of the unsuccessful account-lockout parameters; PACS; and authentication or PCA attempts; or Rules in the alerting Medium Impact BES Generate alerts after a configuration showing how Systems at Control Centers threshold of the system notified and their associated: unsuccessful individuals after a determined EACMS; authentication number of unsuccessful login PACS; and attempts. attempts. PCA Registered Entity Response (Required):
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.6 This section to be completed by the Compliance Monitor Administrator For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months, where technically feasible. For Assets of Applicable Systems, if a password for password-only authentication for interactive user access cannot be changed. For Cyber Assets of Applicable Systems, if a password for password-only authentication for interactive user access can be changed, verify a password change, at least every 15 calendar months, is enforced by either technical or procedural methods. Note to Auditor: This Part does not apply to multi-factor authentication. CIP-007-6 R5 – System Access Control Part Applicable Systems Requirements Measures 5.7 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems at Control Centers and their associated: EACMS; PACS; and PCA Where technically feasible, either: the number of unsuccessful authentication attempts; or Generate alerts after a threshold of unsuccessful authentication attempts. Examples of evidence may include, but are not limited to: Documentation of the account-lockout parameters; or Rules in the alerting configuration showing how the system notified individuals after a determined number of unsuccessful login attempts. Registered Entity Response (Required):