management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). The Responsible Entity shall R3.1. N/A N/A N/A The Responsible Entity document the assessment of did not document the security patches and security assessment of security upgrades for applicability within patches and security thirty calendar days of upgrades for availability of the patches or applicability as upgrades. required in Requirement R3 within 30 calendar days after the availability of the patches and upgrades. The Responsible Entity shall R3.2. N/A N/A N/A The Responsible Entity document the implementation of did not document the security patches. In any case implementation of where the patch is not installed, applicable security the Responsible Entity shall patches as required in document compensating R3. measure(s) applied to mitigate OR risk exposure. Where an applicable patch was not installed, the Responsible Entity did not document the compensating measure(s) applied to mitigate risk. Malicious Software Prevention R4. N/A N/A N/A The Responsible The Responsible Entity shall — Entity, where use anti-virus software and other technically feasible, did
management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter(s). R3.1. The Responsible Entity shall document the assessment of security patches and security upgrades for applicability within thirty calendar days of availability of the patches or upgrades. N/A N/A N/A The Responsible Entity did not document the assessment of security patches and security upgrades for applicability as required in Requirement R3 within 30 calendar days after the availability of the patches and upgrades. R3.2. The Responsible Entity shall document the implementation of security patches. In any case where the patch is not installed, the Responsible Entity shall document compensating measure(s) applied to mitigate risk exposure. N/A N/A N/A The Responsible Entity did not document the implementation of applicable security patches as required in R3. OR Where an applicable patch was not installed, the Responsible Entity did not document the compensating measure(s) applied to mitigate risk. R4. Malicious Software Prevention — The Responsible Entity shall use anti-virus software and other N/A N/A N/A The Responsible Entity, where technically feasible, did