and annually review recovery not annually reviewed plan(s) for Critical Cyber Assets. their recovery plan(s) The recovery plan(s) shall for Critical Cyber address at a minimum the Assets following: OR has created a plan but did not address one or more of the requirements R1.1 and R1.2. Specify the required actions in CIP-009-3 R1.1. N/A N/A N/A N/A response to events or conditions of varying duration and severity that would activate the recovery plan(s). CIP-009-3 R1.2. Define the roles and N/A N/A N/A N/A responsibilities of responders. Exercises The recovery — CIP-009-3 R2 N/A N/A N/A The Responsible plan(s) shall be exercised at least Entity's recovery annually. An exercise of the plan(s) have not been recovery plan(s) can range from a exercised at least paper drill, to a full operational annually. exercise, to recovery from an actual incident. Change Control Recovery — CIP-009-3 R3 N/A N/A N/A The Responsible plan(s) shall be updated to reflect Entity's recovery any changes or lessons learned as plan(s) have not been a result of an exercise or the updated to reflect any recovery from an actual incident. changes or lessons Updates shall be communicated learned as a result of an to personnel responsible for the exercise or the activation and implementation of recovery from an actual the recovery plan(s) within thirty incident. calendar days of the change being completed. OR
and annually review recovery plan(s) for Critical Cyber Assets. The recovery plan(s) shall address at a minimum the following: not annually reviewed their recovery plan(s) for Critical Cyber Assets OR has created a plan but did not address one or more of the requirements R1.1 and R1.2. CIP-009-3 R1.1. Specify the required actions in response to events or conditions of varying duration and severity that would activate the recovery plan(s). N/A N/A N/A N/A CIP-009-3 R1.2. Define the roles and responsibilities of responders. N/A N/A N/A N/A CIP-009-3 R2 Exercises — The recovery plan(s) shall be exercised at least annually. An exercise of the recovery plan(s) can range from a paper drill, to a full operational exercise, to recovery from an actual incident. N/A N/A N/A The Responsible Entity's recovery plan(s) have not been exercised at least annually. CIP-009-3 R3 Change Control — Recovery plan(s) shall be updated to reflect any changes or lessons learned as a result of an exercise or the recovery from an actual incident. Updates shall be communicated to personnel responsible for the activation and implementation of the recovery plan(s) within thirty calendar days of the change being completed. N/A N/A N/A The Responsible Entity's recovery plan(s) have not been updated to reflect any changes or lessons learned as a result of an exercise or the recovery from an actual incident. OR