The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources; The Responsible Entity has documented that the Cyber Asset is not updateable; or The Responsible Entity has documented that no patching source exists. CIP-007-5 Table R2 Security Patch Management – Part Applicable Systems Requirements Measures 2.2 High Impact BES Systems At once every 35 calendar An example of evidence may include, and their associated: days, evaluate security patches but is not limited to, an evaluation for applicability that have been conducted by, referenced by, or on EACMS; released since the last evaluation behalf of a Responsible Entity of PACS; and from the source or sources security-related patches released by the PCA identified in Part 2.1. documented sources at least once every 35 calendar days. Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources; The Responsible Entity has documented that the Cyber Asset is not updateable; or The Responsible Entity has documented that no patching source exists. CIP-007-5 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.2 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA At once every 35 calendar days, evaluate security patches for applicability that have been released since the last evaluation from the source or sources identified in Part 2.1. An example of evidence may include, but is not limited to, an evaluation conducted by, referenced by, or on behalf of a Responsible Entity of security-related patches released by the documented sources at least once every 35 calendar days. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
RSAW_CIP-007-5_BC.docx