4.3 High Impact BES Cyber Systems and Where technically feasible, retain Examples of evidence may include, but are their associated: applicable event logs identified in not limited to, documentation of the Part 4.1 for at least the last 90 log retention process and paper or system consecutive calendar days except generated reports showing log retention PACS; and under CIP Exceptional configuration set at 90 days or greater. PCA Circumstances. Medium Impact BES Cyber Systems at Control Centers and their associated: EACMS; PACS; and PCA Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days, where technically feasible, except under CIP Exceptional Circumstances. For each Applicable System, verify logs are retained for at least 90 consecutive calendar days
4.3 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems at Control Centers and their associated: EACMS; PACS; and PCA Where technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances. Examples of evidence may include, but are not limited to, documentation of the log retention process and paper or system generated reports showing log retention configuration set at 90 days or greater. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days, where technically feasible, except under CIP Exceptional Circumstances. For each Applicable System, verify logs are retained for at least 90 consecutive calendar days
RSAW%20CIP-007-6_2015_v1_TRE.docx