Manager; and updated within 30 delegate by name, title, days of any change to the date of delegation, and delegation. Delegation changes specific actions do not need to be reinstated with delegated, but did not a change to the delegator. document changes to the delegate within 60 calendar days of the change. (R4) Awareness The Responsible N/A N/A The Responsible Entity — R1. Entity shall establish, document, The Responsible[] Entity did not establish, implement, and maintain a did not provide security implement, maintain, security awareness program to awareness reinforcement or document a security ensure personnel having on at least a quarterly awareness program to authorized cyber or authorized basis. ensure personnel unescorted physical access to having authorized Critical Cyber Assets receive cyber or authorized reinforcement in sound unescorted physical security practices. The program access to Critical Cyber shall include security awareness Assets receive reinforcement on at least a reinforcement in quarterly basis using mechanisms sound security such as: practices. Direct communications (e.g. emails, memos, computer based training, etc.); Indirect communications (e.g. posters, intranet, brochures, etc.); Management support and reinforcement (e.g., presentations, meetings, etc.). Training The Responsible — R2. N/A N/A The Responsible[] Entity The Responsible Entity Entity shall establish, document, did not review the training did not establish, implement, and maintain an implement, maintain, annual cyber security training
Manager; and updated within 30 days of any change to the delegation. Delegation changes do not need to be reinstated with a change to the delegator. delegate by name, title, date of delegation, and specific actions delegated, but did not document changes to the delegate within 60 calendar days of the change. (R4) R1. Awareness — The Responsible Entity shall establish, document, implement, and maintain a security awareness program to ensure personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets receive reinforcement in sound security practices. The program shall include security awareness reinforcement on at least a quarterly basis using mechanisms such as: Direct communications (e.g. emails, memos, computer based training, etc.); Indirect communications (e.g. posters, intranet, brochures, etc.); Management support and reinforcement (e.g., presentations, meetings, etc.). N/A N/A The Responsible[] Entity did not provide security awareness reinforcement on at least a quarterly basis. The Responsible Entity did not establish, implement, maintain, or document a security awareness program to ensure personnel having authorized cyber or authorized unescorted physical access to Critical Cyber Assets receive reinforcement in sound security practices. R2. Training — The Responsible Entity shall establish, document, implement, and maintain an annual cyber security training N/A N/A The Responsible[] Entity did not review the training The Responsible Entity did not establish, implement, maintain,