Action plans and procedures to R2.2.4. N/A N/A N/A N/A recover or re-establish Critical Cyber Assets and access thereto following a Cyber Security Incident. The Responsible Entity shall R2.3. N/A N/A The Responsible Entity The Responsible Entity maintain documentation that did maintain did not maintain training is conducted at least documentation that documentation that annually, including the date the training is conducted at training is conducted at training was completed and least annually, but did not least annually, attendance records. include attendance including the date the records. training was completed and attendance records. Personnel Risk Assessment R3. N/A The Responsible Entity has a The Responsible Entity The Responsible Entity Responsible Entity shall personnel risk assessment has a personnel risk does not have a have a documented personnel program, as stated in R3, for assessment program as documented personnel risk assessment program, in personnel having authorized stated in R3, but risk assessment accordance with federal, state, cyber or authorized unescorted conducted the personnel program, as stated in provincial, and local laws, and physical access, but the risk assessment pursuant R3, for personnel subject to existing collective program is not documented. to that program after such having authorized bargaining unit agreements, for personnel were granted cyber or authorized personnel having authorized such access except in unescorted physical cyber or authorized unescorted specified circumstances access. physical access to Critical Cyber such as an emergency. Assets. A personnel risk OR assessment shall be conducted pursuant to that program prior to The Responsible Entity such personnel being granted did not conduct the such access except in specified personnel risk circumstances such as an assessment pursuant to emergency. that program for The personnel risk assessment personnel granted such program shall at a minimum access except in include: specified circumstances such as an emergency.
R2.2.4. Action plans and procedures to recover or re-establish Critical Cyber Assets and access thereto following a Cyber Security Incident. N/A N/A N/A N/A R2.3. The Responsible Entity shall maintain documentation that training is conducted at least annually, including the date the training was completed and attendance records. N/A N/A The Responsible Entity did maintain documentation that training is conducted at least annually, but did not include attendance records. The Responsible Entity did not maintain documentation that training is conducted at least annually, including the date the training was completed and attendance records. R3. Personnel Risk Assessment Responsible Entity shall have a documented personnel risk assessment program, in accordance with federal, state, provincial, and local laws, and subject to existing collective bargaining unit agreements, for personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets. A personnel risk assessment shall be conducted pursuant to that program prior to such personnel being granted such access except in specified circumstances such as an emergency. The personnel risk assessment program shall at a minimum include: N/A The Responsible Entity has a personnel risk assessment program, as stated in R3, for personnel having authorized cyber or authorized unescorted physical access, but the program is not documented. The Responsible Entity has a personnel risk assessment program as stated in R3, but conducted the personnel risk assessment pursuant to that program after such personnel were granted such access except in specified circumstances such as an emergency. The Responsible Entity does not have a documented personnel risk assessment program, as stated in R3, for personnel having authorized cyber or authorized unescorted physical access. OR The Responsible Entity did not conduct the personnel risk assessment pursuant to that program for personnel granted such access except in specified circumstances such as an emergency.