correct the deficiencies. OR unescorted physical The Responsible Entity (5.4) access by the end of the The Responsible Entity has has implemented one next calendar day OR implemented one or more or more process(es) to following the process(es) to revoke the determine that an predetermined date, and The Responsible Entity access to the individual no longer individual’s did not identify, assess, has implemented one or designated storage locations for requires retention of and correct the more process(es) to BES Cyber System Information access following change passwords for deficiencies. (5.2) but, for two individuals, did not reassignments or shared accounts known do so by the end of the next transfers but, for three OR to the user upon calendar day following the or more individuals, termination action, effective date and time of the The Responsible Entity did not revoke the reassignment, or termination action, and did not has implemented one or authorized electronic transfer, but did not do identify, assess, and correct the more process(es) to access to individual so for within 30 deficiencies. (5.3) revoke the accounts and individual’s calendar days of the access to the designated authorized unescorted date of termination storage locations for BES physical access by the action, reassignment, or Cyber System end of the next transfer for one or more Information but, for three calendar day following individuals, and did not or more individuals, did the predetermined date, identify, assess, and not do so by the end of and did not identify, correct the deficiencies. the next calendar day assess, and correct the (5.5) following the effective deficiencies. (5.2) date and time of the OR termination action, and The Responsible Entity did not identify, assess, has implemented one or and correct the more process(es) to deficiencies. (5.3) determine and document extenuating operating circumstances following a termination action, reassignment, or transfer, but did not change one or more passwords for shared accounts known to the user within 10 calendar days following the end of the extenuating
correct the deficiencies. (5.4) OR The Responsible Entity has implemented one or more process(es) to change passwords for shared accounts known to the user upon termination action, reassignment, or transfer, but did not do so for within 30 calendar days of the date of termination action, reassignment, or transfer for one or more individuals, and did not identify, assess, and correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more process(es) to determine and document extenuating operating circumstances following a termination action, reassignment, or transfer, but did not change one or more passwords for shared accounts known to the user within 10 calendar days following the end of the extenuating OR The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information but, for two individuals, did not do so by the end of the next calendar day following the effective date and time of the termination action, and did not identify, assess, and correct the deficiencies. (5.3) unescorted physical access by the end of the next calendar day following the predetermined date, and did not identify, assess, and correct the deficiencies. (5.2) OR The Responsible Entity has implemented one or more process(es) to revoke the individual’s access to the designated storage locations for BES Cyber System Information but, for three or more individuals, did not do so by the end of the next calendar day following the effective date and time of the termination action, and did not identify, assess, and correct the deficiencies. (5.3) The Responsible Entity has implemented one or more process(es) to determine that an individual no longer requires retention of access following reassignments or transfers but, for three or more individuals, did not revoke the authorized electronic access to individual accounts and authorized unescorted physical access by the end of the next calendar day following the predetermined date, and did not identify, assess, and correct the deficiencies. (5.2)