purposes of Standard CIP-007-3, The Responsible Entity a significant change shall, at a did not address one or minimum, include more of the following: implementation of security R1.1, R1.2, R1.3. patches, cumulative service packs, vendor releases, and version upgrades of operating systems, applications, database platforms, or other third-party software or firmware. The Responsible Entity shall R1.1. N/A N/A N/A N/A create, implement, and maintain cyber security test procedures in a manner that minimizes adverse effects on the production system or its operation. The Responsible Entity shall R1.2. N/A N/A N/A N/A document that testing is performed in a manner that reflects the production environment. R1.3. The Responsible Entity shall N/A N/A N/A N/A document test results. Ports and Services The — R2. N/A N/A N/A The Responsible Entity Responsible Entity shall did not establish establish, document and (implement) or did not implement a process to ensure document a process to that only those ports and services ensure that only those required for normal and ports and services emergency operations are required for normal and enabled. emergency operations are enabled. The Responsible Entity shall R2.1. N/A N/A N/A The Responsible Entity enable only those ports and enabled one or more services required for normal and ports or services not emergency operations. required for normal and
purposes of Standard CIP-007-3, a significant change shall, at a minimum, include implementation of security patches, cumulative service packs, vendor releases, and version upgrades of operating systems, applications, database platforms, or other third-party software or firmware. The Responsible Entity did not address one or more of the following: R1.1, R1.2, R1.3. R1.1. The Responsible Entity shall create, implement, and maintain cyber security test procedures in a manner that minimizes adverse effects on the production system or its operation. N/A N/A N/A N/A R1.2. The Responsible Entity shall document that testing is performed in a manner that reflects the production environment. N/A N/A N/A N/A R1.3. The Responsible Entity shall document test results. N/A N/A N/A N/A R2. Ports and Services — The Responsible Entity shall establish, document and implement a process to ensure that only those ports and services required for normal and emergency operations are enabled. N/A N/A N/A The Responsible Entity did not establish (implement) or did not document a process to ensure that only those ports and services required for normal and emergency operations are enabled. R2.1. The Responsible Entity shall enable only those ports and services required for normal and emergency operations. N/A N/A N/A The Responsible Entity enabled one or more ports or services not required for normal and