Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and detected failure of logging. For each of the security events determined to necessitate an alert: If alerting is performed on a per Cyber Asset basis, is the Cyber Asset capable of alerting on the event type? If yes, verify either: Alerting is configured for the Cyber Asset for the event type; or an actual alert has been generated. If no, verify the inability of the Cyber Asset to generate an alert for the event type. If alerting is performed on a per BES System basis, is the BES Cyber System capable of alerting on the event type? If yes, verify either: Alerting is configured for the BES Cyber System for the event type; or an actual alert has been generated. If no, verify the inability of the BES Cyber System to generate an alert for the event type. CIP-007-6 Table R4 Security Event Monitoring – Part Applicable Systems Requirements Measures 4.3 High Impact BES Cyber technically feasible, retain Examples of evidence may include, Systems and their associated: applicable event logs identified but are not limited to, documentation in Part 4.1 for at least the last of the event log retention process EACMS; 90 consecutive calendar days and paper or system generated PACS; and except under CIP Exceptional reports showing log retention PCA Circumstances. configuration set at 90 days or Medium Impact BES greater. Systems at Control Centers and their associated: EACMS; PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version
Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and detected failure of logging. For each of the security events determined to necessitate an alert: If alerting is performed on a per Cyber Asset basis, is the Cyber Asset capable of alerting on the event type? If yes, verify either: Alerting is configured for the Cyber Asset for the event type; or an actual alert has been generated. If no, verify the inability of the Cyber Asset to generate an alert for the event type. If alerting is performed on a per BES System basis, is the BES Cyber System capable of alerting on the event type? If yes, verify either: Alerting is configured for the BES Cyber System for the event type; or an actual alert has been generated. If no, verify the inability of the BES Cyber System to generate an alert for the event type. CIP-007-6 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.3 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Systems at Control Centers and their associated: EACMS; PACS; and PCA technically feasible, retain applicable event logs identified in Part 4.1 for at least the last 90 consecutive calendar days except under CIP Exceptional Circumstances. Examples of evidence may include, but are not limited to, documentation of the event log retention process and paper or system generated reports showing log retention configuration set at 90 days or greater. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) Description of Applicability of Document
RSAW%20CIP-007-6_BC.docx