4.1 High Impact BES Cyber Systems and Log events at the BES Cyber System Examples of evidence may include, but are their associated: level (per BES Cyber System not limited to, a paper or system generated capability) or at the Cyber Asset level listing of event types for which the BES (per Cyber Asset capability) for Cyber System is capable of detecting and, PACS; and identification of, and after-the-fact for generated events, is configured to log. PCA investigations of, Cyber Security This listing must include the required types Medium Impact BES Systems Incidents that includes, as a of events. and their associated: minimum, each of the following types of events: EACMS; PACS; and Detected successful login PCA attempts; Detected failed access attempts and failed login attempts; Detected malicious code. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.1 This section to be completed by the Compliance Enforcement Authority
4.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA Log events at the BES Cyber System level (per BES Cyber System capability) or at the Cyber Asset level (per Cyber Asset capability) for identification of, and after-the-fact investigations of, Cyber Security Incidents that includes, as a minimum, each of the following types of events: Detected successful login attempts; Detected failed access attempts and failed login attempts; Detected malicious code. Examples of evidence may include, but are not limited to, a paper or system generated listing of event types for which the BES Cyber System is capable of detecting and, for generated events, is configured to log. This listing must include the required types of events. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R4, Part 4.1 This section to be completed by the Compliance Enforcement Authority
RSAW%20CIP-007-6_2015_v1_TRE.docx