Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented visitor control program(s) that include each of the applicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-6 Table R2 Visitor Control – Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-6 Table R2 Visitor Control Program – Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Require continuous escorted An example of evidence may Systems and their associated: access of visitors (individuals include, but is not limited to, who are provided access but language in a visitor control program EACMS; and are not authorized for that requires continuous escorted PCA unescorted physical access) access of visitors within Physical Medium Impact BES Cyber within each Physical Security Security Perimeters and additional Systems with External Perimeter, except during CIP evidence to demonstrate that the Routable Connectivity and their Exceptional Circumstances. process was implemented, such as associated: visitor logs. EACMS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s)
Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented visitor control program(s) that include each of the applicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-6 Table R2 – Visitor Control Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-6 Table R2 – Visitor Control Program Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unescorted physical access) within each Physical Security Perimeter, except during CIP Exceptional Circumstances. An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within Physical Security Perimeters and additional evidence to demonstrate that the process was implemented, such as visitor logs. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document
RSAW%20CIP-006-6_BC.docx