For each method deployed to detect, or prevent malicious code that uses signatures or patterns, verify the associated process is implemented. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R4 Supporting Evidence and Documentation R4. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 Security Event Monitoring. – [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations and Operations Assessment.] M4. Evidence must include each of the documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 Security Event – Monitoring and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-007-5 Table R4 Security Event Monitoring – Part Applicable Systems Requirements Measures 4.1 High Impact BES Cyber Systems Log events at the BES Cyber Examples of evidence may include, but and their associated: System level (per BES Cyber are not limited to, a paper or system System capability) or at the Cyber generated listing of event types for EACMS; Asset level (per Cyber Asset which the BES Cyber System is capable PACS; and capability) for identification of, of detecting and, for generated events, PCA and after-the-fact investigations is configured to log. This listing must of, Cyber Security Incidents that include the required types of events. Medium Impact BES Cyber includes, as a minimum, each of Systems and their associated: the following types of events: Detected successful login PACS; and attempts; PCA Detected failed access attempts and failed login attempts; Detected malicious code. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
For each method deployed to detect, or prevent malicious code that uses signatures or patterns, verify the associated process is implemented. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R4 Supporting Evidence and Documentation R4. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 – Security Event Monitoring. [Violation Risk Factor: Medium] [Time Horizon: Same Day Operations and Operations Assessment.] M4. Evidence must include each of the documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R4 – Security Event Monitoring and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-007-5 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.1 High Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems and their associated: PACS; and PCA Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Asset capability) for identification of, and after-the-fact investigations of, Cyber Security Incidents that includes, as a minimum, each of the following types of events: Detected successful login attempts; Detected failed access attempts and failed login attempts; Detected malicious code. Examples of evidence may include, but are not limited to, a paper or system generated listing of event types for which the BES Cyber System is capable of detecting and, for generated events, is configured to log. This listing must include the required types of events. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement.
RSAW_CIP-007-5_BC.docx