physical entry into each Physical Security Perimeter with sufficient information to identify the individual and date and time of entry. (1.8) OR The Responsible Entity does not have a process to retain physical access logs for 90 calendar days. (1.9) CIP-006-5 R2. Each Responsible Entity shall N/A The Responsible Entity included a The Responsible The Responsible implement, in a manner that visitor control program that requires Entity included a Entity has identifies, assesses, and corrects logging of each of the initial entry visitor control failed to deficiencies, one or more and last exit dates and times of the program that include or documented visitor control visitor, the name, and the requires implement visitor’s programs that include each of the point of contact and identified continuous a visitor applicable requirement parts in deficiencies but did not assess or escorted access of control CIP-006-5 Table R2 Visitor correct the deficiencies. (2.2) visitors within any program – Control Program. Physical Security that OR Perimeter, and requires identified continuous The Responsible Entity included a deficiencies but escorted visitor control program that requires did not assess or access of logging of the initial entry and last correct visitors exit dates and times of the visitor, the deficiencies. (2.1) within any name, and the point of visitor’s Physical contact and but did not identify, OR Security assess, or correct the deficiencies. Perimeter. (2.2) The Responsible (2.1) Entity included a OR visitor control OR The Responsible Entity included a program that requires The Responsible Entity visitor control program to retain continuous has failed to include or visitor logs for at least ninety days escorted access of implement a visitor and identified deficiencies but did not visitors within any control program that Physical Security requires logging of the
physical entry into each Physical Security Perimeter with sufficient information to identify the individual and date and time of entry. (1.8) OR The Responsible Entity does not have a process to retain physical access logs for 90 calendar days. (1.9) CIP-006-5 R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented visitor control programs that include each of the applicable requirement parts in CIP-006-5 Table R2 – Visitor Control Program. N/A The Responsible Entity included a visitor control program that requires logging of each of the initial entry and last exit dates and times of the visitor, the visitor’s name, and the point of contact and identified deficiencies but did not assess or correct the deficiencies. (2.2) OR The Responsible Entity included a visitor control program that requires logging of the initial entry and last exit dates and times of the visitor, the visitor’s name, and the point of contact and but did not identify, assess, or correct the deficiencies. (2.2) OR The Responsible Entity included a visitor control program to retain visitor logs for at least ninety days and identified deficiencies but did not The Responsible Entity included a visitor control program that requires continuous escorted access of visitors within any Physical Security Perimeter, and identified deficiencies but did not assess or correct deficiencies. (2.1) OR The Responsible Entity included a visitor control program that requires continuous escorted access of visitors within any Physical Security The Responsible Entity has failed to include or implement a visitor control program that requires continuous escorted access of visitors within any Physical Security Perimeter. (2.1) OR The Responsible Entity has failed to include or implement a visitor control program that requires logging of the