communication with its command and control servers and by preventing its spread to other systems. Then the malicious code can be removed at a later time such as a plant outage. CIP-007-5 Table R3 Malicious Code Prevention – Part Applicable Systems Requirements Measures 3.3 High Impact BES Cyber Systems For those methods identified in An example of evidence may include, and their associated: Part 3.1 that use signatures or but is not limited to, documentation patterns, have a process for the showing the process used for the EACMS; update of the signatures or update of signatures or patterns. PACS; and patterns. The process must PCA address testing and installing the signatures or patterns. Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 3.3 This section to be completed by the Compliance Monitor Administrator For those methods identified in Part 3.1 that use signatures or patterns, verify the Responsible Entity has documented one or more processes to update the signatures or patterns. The process must address testing and installing the signatures or patterns. For each method deployed to deter, detect, or prevent malicious code that uses signatures or patterns, verify the associated process addresses testing and installing updates to signatures or patterns.
communication with its command and control servers and by preventing its spread to other systems. Then the malicious code can be removed at a later time such as a plant outage. CIP-007-5 Table R3 – Malicious Code Prevention Part Applicable Systems Requirements Measures 3.3 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA For those methods identified in Part 3.1 that use signatures or patterns, have a process for the update of the signatures or patterns. The process must address testing and installing the signatures or patterns. An example of evidence may include, but is not limited to, documentation showing the process used for the update of signatures or patterns. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 3.3 This section to be completed by the Compliance Monitor Administrator For those methods identified in Part 3.1 that use signatures or patterns, verify the Responsible Entity has documented one or more processes to update the signatures or patterns. The process must address testing and installing the signatures or patterns. For each method deployed to deter, detect, or prevent malicious code that uses signatures or patterns, verify the associated process addresses testing and installing updates to signatures or patterns.
RSAW_CIP-007-5_BC.docx