CIP-006-6 R1 Physical Security Plan – Part Applicable Systems Requirements Measures 1.5 High Impact BES Cyber Systems Issue an alarm or alert in An example of evidence may include, and their associated: response to detected but is not limited to, language in the unauthorized access through a physical security plan that describes the EACMS; and physical access point into a issuance of an alarm or alert in PCA Physical Security Perimeter to the response to unauthorized access personnel identified in the BES through a physical access control into a Medium Impact BES Cyber Cyber Security Incident response Physical Security Perimeter and Systems with External Routable plan within 15 minutes of additional evidence that the alarm or Connectivity and their associated: detection. alert was issued and communicated as EACMS; and identified in the BES Cyber Security PCA Incident Response Plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.5 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more physical security plans to issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection. Verify that an alarm or alert is issued in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection.
CIP-006-6 R1 – Physical Security Plan Part Applicable Systems Requirements Measures 1.5 High Impact BES Cyber Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection. An example of evidence may include, but is not limited to, language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a Physical Security Perimeter and additional evidence that the alarm or alert was issued and communicated as identified in the BES Cyber Security Incident Response Plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated and communicated. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 1.5 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more physical security plans to issue an alarm or alert in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection. Verify that an alarm or alert is issued in response to detected unauthorized access through a physical access point into a Physical Security Perimeter to the personnel identified in the BES Cyber Security Incident response plan within 15 minutes of detection.
RSAW%20CIP-006-6_BC.docx