5.3 High Impact BES Systems and Identify individuals who have An example of evidence may include, but is their associated: authorized access to shared not limited to, listing of shared accounts accounts. and the individuals who have authorized EACMS; access to each shared account. PACS; and PCA Medium Impact BES Systems with External Routable Connectivity and their associated: PACS; and PCA Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to identify individuals who have authorized access to shared accounts. For each Cyber Asset of an Applicable System, verify the Responsible Entity has identified individuals with authorized access to shared accounts. Note to Auditor:
5.3 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems with External Routable Connectivity and their associated: PACS; and PCA Identify individuals who have authorized access to shared accounts. An example of evidence may include, but is not limited to, listing of shared accounts and the individuals who have authorized access to each shared account. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.3 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more processes to identify individuals who have authorized access to shared accounts. For each Cyber Asset of an Applicable System, verify the Responsible Entity has identified individuals with authorized access to shared accounts. Note to Auditor:
RSAW%20CIP-007-6_2015_v1.docx