For each Applicable System, verify inbound and outbound access permissions are implemented. For each Applicable System, verify each inbound and each outbound access permission includes the reason for granting access. For each Applicable System, verify inbound and outbound access is denied by default. Note to Auditor: Some vendor firewalls contain an implicit statement in the Access Control “deny” List (ACL). Vendor documentation of that configuration is a form of evidence to demonstrate the deny by default requirement within this Part. Auditor Notes: R1 Part 1.4 CIP-005-5 Table R1 Electronic Security Perimeter – Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems with technically feasible, perform An example of evidence may include, but is Dial-up Connectivity and their authentication when establishing not limited to, a documented process that associated: Dial-up Connectivity with applicable describes how the Responsible Entity is PCA Cyber Assets. providing authenticated access through each dial-up connection. Medium Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document
For each Applicable System, verify inbound and outbound access permissions are implemented. For each Applicable System, verify each inbound and each outbound access permission includes the reason for granting access. For each Applicable System, verify inbound and outbound access is denied by default. Note to Auditor: Some vendor firewalls contain an implicit “deny” statement in the Access Control List (ACL). Vendor documentation of that configuration is a form of evidence to demonstrate the deny by default requirement within this Part. Auditor Notes: R1 Part 1.4 CIP-005-5 Table R1 – Electronic Security Perimeter Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA Medium Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets. An example of evidence may include, but is not limited to, a documented process that describes how the Responsible Entity is providing authenticated access through each dial-up connection. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document
RSAW%20CIP-005-5_2015_v1.docx