CIP-005-5 R1 Electronic Security Perimeter – Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems Where technically feasible, An example of evidence may include, with Dial-up Connectivity and their perform authentication when but is not limited to, a documented associated: establishing Dial-up Connectivity process that describes how the PCA with applicable Cyber Assets. Responsible Entity is providing authenticated access through each Medium Impact BES connection. Systems with Dial-up Connectivity and their associated: PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets, where technically feasible. For each Cyber Asset of an Applicable System, verify authentication is performed when establishing a dial-up connection. Note to Auditor: If the Responsible Entity does not have or does not allow Dial-up Connectivity, the Responsible Entity is not required to document one or more processes to perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets. It is sufficient to verify that they do not have Dial-up Connectivity. CIP-005-5 Table R1 Electronic Security Perimeter –
CIP-005-5 R1 – Electronic Security Perimeter Part Applicable Systems Requirements Measures 1.4 High Impact BES Cyber Systems with Dial-up Connectivity and their associated: PCA Medium Impact BES Systems with Dial-up Connectivity and their associated: PCA Where technically feasible, perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets. An example of evidence may include, but is not limited to, a documented process that describes how the Responsible Entity is providing authenticated access through each connection. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets, where technically feasible. For each Cyber Asset of an Applicable System, verify authentication is performed when establishing a dial-up connection. Note to Auditor: If the Responsible Entity does not have or does not allow Dial-up Connectivity, the Responsible Entity is not required to document one or more processes to perform authentication when establishing Dial-up Connectivity with applicable Cyber Assets. It is sufficient to verify that they do not have Dial-up Connectivity. CIP-005-5 Table R1 – Electronic Security Perimeter
RSAW_CIP-005-5_BC.docx