assessment, and the execution status of that action plan. Documentation Review and R5. The Responsible The Responsible Entity did not The Responsible The Responsible Entity Maintenance The Responsible — Entity did not review, update, and maintain greater Entity did not did not review, update, Entity shall review, update, and review, update, than 5% but less than or equal to 10% review, update, and maintain greater maintain all documentation to and maintain at of the documentation to support and maintain than 15% of the support compliance with the least one but less compliance with the requirements of greater than 10% documentation to requirements of Standard than or equal to Standard CIP-005. but less than or support compliance 5% of the equal to 15% of with the requirements documentation to the documentation of Standard CIP-005. support to support compliance with compliance with the requirements the requirements of Standard of Standard CIP- The Responsible Entity shall R5.1. N/A The Responsible Entity did not The Responsible The Responsible Entity ensure that all documentation provide evidence of an annual review Entity did not did not document required by Standard CIP-005-2 of the documents and procedures document current current configurations reflect current configurations and referenced in Standard CIP-005. configurations and and processes and did processes and shall review the processes not review the documents and procedures referenced in documents and referenced in Standard CIP-005-3 Standard CIP-005. procedures referenced at least annually. in Standard CIP-005 at least annually. The Responsible Entity shall R5.2. N/A N/A N/A The Responsible Entity update the documentation to did not update reflect the modification of the documentation to network or controls within ninety reflect a modification calendar days of the change. of the network or controls within ninety calendar days of the change. The Responsible Entity shall R5.3. The Responsible The Responsible Entity retained The Responsible The Responsible Entity retain electronic access logs for Entity retained electronic access logs for 60 or more Entity retained retained electronic at least ninety calendar days. electronic access calendar days, but for less than 75 electronic access access logs for less Logs related to reportable logs for 75 or calendar days. logs for 45 or than 45 calendar days. incidents shall be kept in more calendar more calendar
assessment, and the execution status of that action plan. R5. Documentation Review and Maintenance — The Responsible Entity shall review, update, and maintain all documentation to support compliance with the requirements of Standard The Responsible Entity did not review, update, and maintain at least one but less than or equal to 5% of the documentation to support compliance with the requirements of Standard The Responsible Entity did not review, update, and maintain greater than 5% but less than or equal to 10% of the documentation to support compliance with the requirements of Standard CIP-005. The Responsible Entity did not review, update, and maintain greater than 10% but less than or equal to 15% of the documentation to support compliance with the requirements of Standard The Responsible Entity did not review, update, and maintain greater than 15% of the documentation to support compliance with the requirements of Standard CIP-005. R5.1. The Responsible Entity shall ensure that all documentation required by Standard CIP-005-2 reflect current configurations and processes and shall review the documents and procedures referenced in Standard CIP-005-3 at least annually. N/A The Responsible Entity did not provide evidence of an annual review of the documents and procedures referenced in Standard CIP-005. The Responsible Entity did not document current configurations and processes referenced in Standard CIP-005. The Responsible Entity did not document current configurations and processes and did not review the documents and procedures referenced in Standard CIP-005 at least annually. R5.2. The Responsible Entity shall update the documentation to reflect the modification of the network or controls within ninety calendar days of the change. N/A N/A N/A The Responsible Entity did not update documentation to reflect a modification of the network or controls within ninety calendar days of the change. R5.3. The Responsible Entity shall retain electronic access logs for at least ninety calendar days. Logs related to reportable incidents shall be kept in The Responsible Entity retained electronic access logs for 75 or more calendar The Responsible Entity retained electronic access logs for 60 or more calendar days, but for less than 75 calendar days. The Responsible Entity retained electronic access logs for 45 or more calendar The Responsible Entity retained electronic access logs for less than 45 calendar days. CIP-