days of being approved by the within 30 days of being senior manager or delegate(s). approved by the senior manager or delegate(s). (Retirement approved by FERC effective January 21, 2014) Documented exceptions to the CIP-003-3 R3.2. N/A N/A The Responsible The Responsible Entity cyber security policy must Entity has a has a documented include an explanation as to why documented exception to the cyber the exception is necessary and exception to the security policy in R1 any compensating measures. cyber security but did not include policy in R1 but both: (Retirement approved by FERC did not include effective January 21, 2014) 1) an explanation as to either: why the exception is 1) an explanation necessary, and as to why the 2) any compensating exception is measures. necessary, or 2) any compensating measures. Authorized exceptions to the CIP-003-3 R3.3. N/A N/A N/A Exceptions to the cyber cyber security policy must be security policy were reviewed and approved annually not reviewed or were by the senior manager or not approved on an delegate(s) to ensure the annual basis by the exceptions are still required and senior manager or valid. Such review and approval delegate(s) to ensure shall be documented. the exceptions are still required and valid or (Retirement approved by FERC the review and effective January 21, 2014) approval is not documented. Information Protection The — CIP-003-3 R4. N/A N/A N/A The Responsible Entity Responsible Entity shall did not implement or implement and document a did not document a program to identify, classify, and program to identify, classify, and protect
days of being approved by the senior manager or delegate(s). (Retirement approved by FERC effective January 21, 2014) within 30 days of being approved by the senior manager or delegate(s). CIP-003-3 R3.2. Documented exceptions to the cyber security policy must include an explanation as to why the exception is necessary and any compensating measures. (Retirement approved by FERC effective January 21, 2014) N/A N/A The Responsible Entity has a documented exception to the cyber security policy in R1 but did not include either: 1) an explanation as to why the exception is necessary, or 2) any compensating measures. The Responsible Entity has a documented exception to the cyber security policy in R1 but did not include both: 1) an explanation as to why the exception is necessary, and 2) any compensating measures. CIP-003-3 R3.3. Authorized exceptions to the cyber security policy must be reviewed and approved annually by the senior manager or delegate(s) to ensure the exceptions are still required and valid. Such review and approval shall be documented. (Retirement approved by FERC effective January 21, 2014) N/A N/A N/A Exceptions to the cyber security policy were not reviewed or were not approved on an annual basis by the senior manager or delegate(s) to ensure the exceptions are still required and valid or the review and approval is not documented. CIP-003-3 R4. Information Protection — The Responsible Entity shall implement and document a program to identify, classify, and N/A N/A N/A The Responsible Entity did not implement or did not document a program to identify, classify, and protect