implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has not documented the results of the vulnerability assessments, the action plans to remediate or mitigate vulnerabilities identified in the assessments, the planned date of completion of the action plan, and the execution status of the mitigation plans. (3.4) R4. Each Responsible Entity, for its CIP-010-2 The Responsible The Responsible Entity The Responsible Entity The Responsible high impact and medium impact Entity documented its documented its plan(s) for documented its plan(s) Entity failed to BES Cyber Systems and plan(s) for Transient Transient Cyber Assets and for Transient Cyber document or associated Protected Cyber Cyber Assets and Removable Media, but failed Assets and Removable implement one or Assets, shall implement, except Removable Media, to implement the Removable Media, but failed to more plan(s) for under CIP Exceptional but failed to manage Media sections according to authorize its Transient Transient Cyber Circumstances, one or more its Transient Cyber CIP-010-2, Requirement R4, Cyber Asset(s) Assets and documented plan(s) for Transient Asset(s) according to Attachment 1, Section 3. (R4) according to CIP-010-2, Removable Media Cyber Assets and Removable CIP-010-2, Requirement R4, according to Media that include the sections in OR Requirement R4, Attachment 1, Section 2, Requirement R4. Attachment 1. Attachment 1, Section 1.2. (R4) (R4) The Responsible Entity [See Table R4 of the standard.] 1.1. (R4) documented its plan(s) for OR Transient Cyber Assets and OR Removable Media plan, but The Responsible Entity The Responsible failed to document mitigation documented its plan(s) Entity documented its of software vulnerabilities, for Transient Cyber plan(s) for Transient mitigation for the introduction Assets and Removable
implemented one or more documented vulnerability assessment processes for each of its applicable BES Cyber Systems, but has not documented the results of the vulnerability assessments, the action plans to remediate or mitigate vulnerabilities identified in the assessments, the planned date of completion of the action plan, and the execution status of the mitigation plans. (3.4) CIP-010-2 R4. Each Responsible Entity, for its high impact and medium impact BES Cyber Systems and associated Protected Cyber Assets, shall implement, except under CIP Exceptional Circumstances, one or more documented plan(s) for Transient Cyber Assets and Removable Media that include the sections in Attachment 1. [See Table R4 of the standard.] The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to manage its Transient Cyber Asset(s) according to CIP-010-2, Requirement R4, Attachment 1, Section 1.1. (R4) OR The Responsible Entity documented its plan(s) for Transient The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to implement the Removable Media sections according to CIP-010-2, Requirement R4, Attachment 1, Section 3. (R4) OR The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media plan, but failed to document mitigation of software vulnerabilities, mitigation for the introduction The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable Media, but failed to authorize its Transient Cyber Asset(s) according to CIP-010-2, Requirement R4, Attachment 1, Section 1.2. (R4) OR The Responsible Entity documented its plan(s) for Transient Cyber Assets and Removable The Responsible Entity failed to document or implement one or more plan(s) for Transient Cyber Assets and Removable Media according to Requirement R4. (R4) 2,