2.1 High Impact BES Cyber A patch management process An example of evidence may Systems and their associated: for tracking, evaluating, and include, but is not limited to, installing cyber security documentation of a patch patches for applicable Cyber management process and PACS; and Assets. The tracking portion documentation or lists of sources PCA shall include the identification that are monitored, whether on an of a source or sources that the individual BES Cyber System or Responsible Entity tracks for Cyber Asset basis. Medium Impact BES the release of cyber security Systems and their associated: patches for applicable Cyber EACMS; Assets that are updateable PACS; and and for which a patching source exists. PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources;
2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 2.1 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more patch management processes for tracking, evaluating, and installing cyber security patches for Cyber Assets of Applicable Systems. Verify that the tracking portion of each patch management process includes the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for Cyber Assets of Applicable Systems that are updateable and for which a patching source exists. For each applicable Cyber Asset, verify at least one of the following is true: The Responsible Entity has identified one or more patching sources;
RSAW%20CIP-007-6_BC.docx