enabled, the Responsible Entity not implement strong shall implement strong procedural or technical procedural or technical controls controls at the access points to ensure at the access points to ensure authenticity of the authenticity of the accessing accessing party, where party, where technically feasible. technically feasible. R2.5. The required documentation N/A N/A N/A The required shall, at least, identify and documentation for R2 describe: did not include one or more of the elements described in R2.5.1 through R2.5.4. R2.5.1. The processes for access request N/A N/A N/A N/A and authorization. R2.5.2. The authentication methods. N/A N/A N/A N/A The review process for R2.5.3. N/A N/A N/A N/A authorization rights, in accordance with Standard CIP- Requirement R4. R2.5.4. The controls used to secure N/A N/A N/A N/A up accessible connections. Appropriate Use Banner — R2.6. The Responsible Entity Where technically feasible 5% Where technically Where technically Where technically feasible, did not maintain a but less than 10% of electronic feasible 10% but less than feasible, 15% or more electronic access control devices document identifying access control devices did not 15% of electronic access electronic access shall display an appropriate use the content of the display an appropriate use control devices did not control devices did not banner on the user screen upon banner. banner on the user screen upon display an appropriate use display an appropriate all interactive access attempts. all interactive access attempts. banner on the user screen use banner on the user OR The Responsible Entity shall upon all interactive access screen upon all Where technically maintain a document identifying attempts. interactive access feasible less than 5% the content of the banner. attempts. electronic access (Retirement approved by FERC control devices did not effective January 21, 2014) display an appropriate use banner on the user
enabled, the Responsible Entity shall implement strong procedural or technical controls at the access points to ensure authenticity of the accessing party, where technically feasible. not implement strong procedural or technical controls at the access points to ensure authenticity of the accessing party, where technically feasible. R2.5. The required documentation shall, at least, identify and describe: N/A N/A N/A The required documentation for R2 did not include one or more of the elements described in R2.5.1 through R2.5.4. R2.5.1. The processes for access request and authorization. N/A N/A N/A N/A R2.5.2. The authentication methods. N/A N/A N/A N/A R2.5.3. The review process for authorization rights, in accordance with Standard Requirement R4. N/A N/A N/A N/A R2.5.4. The controls used to secure accessible connections. N/A N/A N/A N/A R2.6. Appropriate Use Banner — Where technically feasible, electronic access control devices shall display an appropriate use banner on the user screen upon all interactive access attempts. The Responsible Entity shall maintain a document identifying the content of the banner. (Retirement approved by FERC effective January 21, 2014) The Responsible Entity did not maintain a document identifying the content of the banner. OR Where technically feasible less than 5% electronic access control devices did not display an appropriate use banner on the user Where technically feasible 5% but less than 10% of electronic access control devices did not display an appropriate use banner on the user screen upon all interactive access attempts. Where technically feasible 10% but less than 15% of electronic access control devices did not display an appropriate use banner on the user screen upon all interactive access attempts. Where technically feasible, 15% or more electronic access control devices did not display an appropriate use banner on the user screen upon all interactive access attempts. CIP- up