R1. Each Responsible Entity shall CIP-009-5 N/A The Responsible Entity has The Responsible The Responsible Entity have one or more documented developed recovery plan(s), but the Entity has has not created recovery plans that collectively plan(s) do not address one of the developed recovery plan(s) for include each of the applicable requirements included in Parts 1.2 recovery plan(s), BES Cyber Systems. requirement parts in CIP‐009‐5 through 1.5. but the plan(s) do OR Table R1 Recovery Plan – not address two of Specifications. the requirements The Responsible Entity included in Parts has created recovery 1.2 through 1.5. plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. R2. Each Responsible Entity shall CIP-009-5 The Responsible The Responsible Entity has not tested The Responsible The Responsible Entity implement, in a manner that Entity has not the recovery plan(s) within 16 Entity has not has not tested the identifies, assesses, and corrects tested the calendar months, not exceeding 17 tested the recovery recovery plan(s) deficiencies, its documented recovery plan(s) calendar months between tests of the plan(s) according according to R2 Part recovery plan(s) to collectively according to R2 plan, and when tested, any to R2 Part 2.1 2.1 within 18 calendar include each of the applicable Part 2.1 within deficiencies were identified, assessed, within 17 calendar months between tests requirement parts in CIP‐009‐5 15 calendar and corrected. (2.1) months, not of the plan. (2.1) Table R2 Recovery Plan – months, not exceeding 18 OR OR Implementation and Testing. exceeding 16 calendar months calendar months between tests of The Responsible Entity has not tested The Responsible Entity between tests of a representative sample of the the plan, and when has tested the recovery the plan, and tested, any information used in the recovery of plan(s) according to R2 when tested, any deficiencies were BES Cyber System functionality Part 2.1 and identified
CIP-009-5 R1. Each Responsible Entity shall have one or more documented recovery plans that collectively include each of the applicable requirement parts in CIP‐009‐5 Table R1 – Recovery Plan Specifications. N/A The Responsible Entity has developed recovery plan(s), but the plan(s) do not address one of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has developed recovery plan(s), but the plan(s) do not address two of the requirements included in Parts 1.2 through 1.5. The Responsible Entity has not created recovery plan(s) for BES Cyber Systems. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address the conditions for activation in Part 1.1. OR The Responsible Entity has created recovery plan(s) for BES Cyber Systems, but the plan(s) does not address three or more of the requirements in Parts 1.2 through 1.5. CIP-009-5 R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, its documented recovery plan(s) to collectively include each of the applicable requirement parts in CIP‐009‐5 Table R2 – Recovery Plan Implementation and Testing. The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 15 calendar months, not exceeding 16 calendar months between tests of the plan, and when tested, any The Responsible Entity has not tested the recovery plan(s) within 16 calendar months, not exceeding 17 calendar months between tests of the plan, and when tested, any deficiencies were identified, assessed, and corrected. (2.1) OR The Responsible Entity has not tested a representative sample of the information used in the recovery of BES Cyber System functionality The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 17 calendar months, not exceeding 18 calendar months between tests of the plan, and when tested, any deficiencies were The Responsible Entity has not tested the recovery plan(s) according to R2 Part 2.1 within 18 calendar months between tests of the plan. (2.1) OR The Responsible Entity has tested the recovery plan(s) according to R2 Part 2.1 and identified