For each identified patch source, verify the results of the evaluations for applicability. Auditor Notes: R2 Part 2.3 CIP-007-6 Table R2 Security Patch Management – Part Applicable Systems Requirements Measures 2.3 High Impact BES Cyber Systems and For applicable patches identified in Examples of evidence may include, but are their associated: Part 2.2, within 35 calendar days of not limited to: the evaluation completion, take one Records of the installation of the of the following actions: PACS; and patch (e.g., exports from PCA the applicable patches; automated patch management or tools that provide installation date, Create a dated mitigation verification of BES Cyber System Medium Impact BES Cyber Systems plan; or Component software revision, or and their associated: Revise an existing registry exports that show mitigation plan. software has been installed); or PACS; and Mitigation plans shall include the A dated plan showing when and PCA Responsible Entity’s planned actions how the vulnerability will be to mitigate the vulnerabilities addressed, to include addressed by each security patch documentation of the actions to be and a timeframe to complete these taken by the Responsible Entity to mitigations. mitigate the vulnerabilities addressed by the security patch and a timeframe for the completion of these mitigations. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Revision Description of or Document Relevant Applicability of File Name Document Title Version Date Page(s) Document
For each identified patch source, verify the results of the evaluations for applicability. Auditor Notes: R2 Part 2.3 CIP-007-6 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.3 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA For applicable patches identified in Part 2.2, within 35 calendar days of the evaluation completion, take one of the following actions: the applicable patches; or Create a dated mitigation plan; or Revise an existing mitigation plan. Mitigation plans shall include the Responsible Entity’s planned actions to mitigate the vulnerabilities addressed by each security patch and a timeframe to complete these mitigations. Examples of evidence may include, but are not limited to: Records of the installation of the patch (e.g., exports from automated patch management tools that provide installation date, verification of BES Cyber System Component software revision, or registry exports that show software has been installed); or A dated plan showing when and how the vulnerability will be addressed, to include documentation of the actions to be taken by the Responsible Entity to mitigate the vulnerabilities addressed by the security patch and a timeframe for the completion of these mitigations. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) Description of Applicability of Document
RSAW%20CIP-007-6_2015_v1.docx