4.2 High Impact BES Cyber Systems Generate alerts for security Examples of evidence may include, but and their associated: events that the Responsible are not limited to, or Entity determines necessitates an listing of security events that EACMS; alert, that includes, as a the Responsible Entity determined PACS; and minimum, each of the following necessitate alerts, including paper or PCA types of events (per Cyber Asset system generated list showing how or BES Cyber System capability): alerts are configured. Medium Impact BES Cyber Systems with External Routable Detected malicious code Connectivity and their associated: from Part 4.1; and Detected failure of Part 4.1 event logging. PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 4.2 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): Detected malicious code from Part 4.1; and detected failure of Part 4.1 event logging. Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and
4.2 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): Detected malicious code from Part 4.1; and Detected failure of Part 4.1 event logging. Examples of evidence may include, but are not limited to, or listing of security events that the Responsible Entity determined necessitate alerts, including paper or system generated list showing how alerts are configured. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 4.2 This section to be completed by the Compliance Monitor Administrator Verify the Responsible Entity has documented one or more processes to generate alerts for security events that the Responsible Entity determines necessitates an alert, that includes, as a minimum, each of the following types of events (per Cyber Asset or BES Cyber System capability): Detected malicious code from Part 4.1; and detected failure of Part 4.1 event logging. Verify the Responsible Entity has determined the security events that necessitate an alert. Verify the security events determined to necessitate an alert include, at a minimum: Detected malicious code; and
RSAW_CIP-007-5_BC.docx