CIP-007-5 Table R5 System Access Control – Part Applicable Systems Requirements Measures 5.4 High Impact BES Cyber Systems Change known default Examples of evidence may include, but and their associated: passwords, per Cyber Asset are not limited to: capability Records of a procedure that PACS; and passwords are changed when PCA new devices are in production; or Medium Impact BES Cyber Documentation in system Systems and their associated: manuals or other vendor documents showing default EACMS; vendor passwords were PACS; and generated pseudo-randomly PCA and are thereby unique to the device. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to change known default passwords, per Cyber Asset capability. For Cyber Assets of Applicable Systems with the capability to change default passwords, verify the Responsible Entity has changed the known default passwords. For Assets of Applicable Systems that do not have the capability to change default passwords, verify the incapability to do so. CIP-007-5 R5 System Access Control –
CIP-007-5 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.4 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Change known default passwords, per Cyber Asset capability Examples of evidence may include, but are not limited to: Records of a procedure that passwords are changed when new devices are in production; or Documentation in system manuals or other vendor documents showing default vendor passwords were generated pseudo-randomly and are thereby unique to the device. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.4 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to change known default passwords, per Cyber Asset capability. For Cyber Assets of Applicable Systems with the capability to change default passwords, verify the Responsible Entity has changed the known default passwords. For Assets of Applicable Systems that do not have the capability to change default passwords, verify the incapability to do so. CIP-007-5 R5 – System Access Control
RSAW_CIP-007-5_BC.docx