Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented visitor control programs that include each of the applicable requirement parts in CIP-006-5 Table R2 Visitor Control Program. – [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-5 Table R2 Visitor Control – Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-5 Table R2 Visitor Control Program – Part Applicable Systems Requirements Measures 2.1 High Impact BES Systems Require continuous escorted An example of evidence may include, and their associated: access of visitors (individuals who but is not limited to, language in a visitor are provided access but are not control program that requires continuous EACMS; and authorized for unescorted escorted access of visitors within PCA physical access) within each Physical Security Perimeters and Physical Security Perimeter, additional evidence to demonstrate that Medium Impact BES Cyber except during CIP Exceptional the process was implemented, such as Systems with External Routable Circumstances. visitor logs. Connectivity and their associated: EACMS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.
Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented visitor control programs that include each of the applicable requirement parts in CIP-006-5 Table R2 – Visitor Control Program. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations.] M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP-006-5 Table R2 – Visitor Control Program and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-006-5 Table R2 – Visitor Control Program Part Applicable Systems Requirements Measures 2.1 High Impact BES Systems and their associated: EACMS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: EACMS; and PCA Require continuous escorted access of visitors (individuals who are provided access but are not authorized for unescorted physical access) within each Physical Security Perimeter, except during CIP Exceptional Circumstances. An example of evidence may include, but is not limited to, language in a visitor control program that requires continuous escorted access of visitors within Physical Security Perimeters and additional evidence to demonstrate that the process was implemented, such as visitor logs. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.
RSAW_CIP-006-5_BC.docx