OR Systems (per OR summarization or device or system The Responsible Entity has The Responsible Entity sampling of capability) but did documented and implemented one or did not implement or logged events at not generate alerts more process(es) to identify document one or more least every 15 for all of the undetected Cyber Security Incidents process(es) that calendar days but required types of by reviewing an entity-determined included the applicable missed an events described in summarization or sampling of logged items in CIP-007-5 interval and 4.2.1 through 4.2.2 events at least every 15 calendar days Table R4 and did not completed the and has identified but missed an interval and completed identify, assess, or review within 22 deficiencies but the review within 30 calendar days of correct the deficiencies. calendar days of did not assess or the prior review but did not identify, (R4) the prior review correct the assess, or correct the deficiencies. OR and has deficiencies. (4.2) (4.4) The Responsible Entity identified OR has documented and deficiencies but The Responsible implemented one or did not assess or Entity has more process(es) to log correct the documented and events for the deficiencies. implemented one Applicable Systems (4.4) or more (per device or system OR process(es) to capability) but did not The Responsible generate alerts for detect and log all of the Entity has necessary security required types of documented and events (as events described in implemented one determined by the 4.1.1 through 4.1.3 and or more responsible entity) has identified process(es) to for the Applicable deficiencies but did not identify Systems (per assess or correct the undetected Cyber device or system deficiencies. (4.1) Security capability) but did OR Incidents by not generate alerts The Responsible Entity reviewing an for all of the has documented and required types of implemented one or events described in more process(es) to log summarization or 4.2.1 through 4.2.2 events for the sampling of and did not Applicable Systems logged events at identify, assess, or (per device or system least every 15 correct the capability) but did not calendar days but deficiencies. (4.2) detect and log all of the missed an
summarization or sampling of logged events at least every 15 calendar days but missed an interval and completed the review within 22 calendar days of the prior review and has identified deficiencies but did not assess or correct the deficiencies. (4.4) OR The Responsible Entity has documented and implemented one or more process(es) to identify undetected Cyber Security Incidents by reviewing an summarization or sampling of logged events at least every 15 calendar days but missed an OR The Responsible Entity has documented and implemented one or more process(es) to identify undetected Cyber Security Incidents by reviewing an entity-determined summarization or sampling of logged events at least every 15 calendar days but missed an interval and completed the review within 30 calendar days of the prior review but did not identify, assess, or correct the deficiencies. (4.4) Systems (per device or system capability) but did not generate alerts for all of the required types of events described in 4.2.1 through 4.2.2 and has identified deficiencies but did not assess or correct the deficiencies. (4.2) OR The Responsible Entity has documented and implemented one or more process(es) to generate alerts for necessary security events (as determined by the responsible entity) for the Applicable Systems (per device or system capability) but did not generate alerts for all of the required types of events described in 4.2.1 through 4.2.2 and did not identify, assess, or correct the deficiencies. (4.2) OR The Responsible Entity did not implement or document one or more process(es) that included the applicable items in CIP-007-5 Table R4 and did not identify, assess, or correct the deficiencies. (R4) OR The Responsible Entity has documented and implemented one or more process(es) to log events for the Applicable Systems (per device or system capability) but did not detect and log all of the required types of events described in 4.1.1 through 4.1.3 and has identified deficiencies but did not assess or correct the deficiencies. (4.1) OR The Responsible Entity has documented and implemented one or more process(es) to log events for the Applicable Systems (per device or system capability) but did not detect and log all of the