High Impact BES Cyber Systems and 3.1 No later than 90 calendar days An example of evidence may include, their associated: after completion of a recovery but is not limited to, all of the following: EACMS; and plan test or actual recovery: documentation of identified PACS Document any lessons deficiencies or lessons learned for learned associated with a each recovery plan test or actual Medium Impact BES Cyber Systems at recovery plan test or incident recovery or dated Control Centers and their associated: actual recovery or documentation stating there were EACMS; and document the absence of no lessons learned; PACS any lessons learned; Dated and revised recovery plan Update the recovery plan showing any changes based on based on any the lessons learned; and documented lessons Evidence of plan update learned associated with distribution including, but not the plan; and limited to: Notify each person or Emails; group with a defined role in the recovery plan of USPS or other mail service; the updates to the Electronic distribution system; recovery plan based on or any documented lessons learned. Training sign-in sheets. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 3.1 This section to be completed by the Compliance Monitor Administrator Verify that no later than 90 calendar days after completion of a recovery plan test or actual recovery, the Responsible Entity has:
3.1 High Impact BES Cyber Systems and their associated: EACMS; and PACS Medium Impact BES Cyber Systems at Control Centers and their associated: EACMS; and PACS No later than 90 calendar days after completion of a recovery plan test or actual recovery: Document any lessons learned associated with a recovery plan test or actual recovery or document the absence of any lessons learned; Update the recovery plan based on any documented lessons learned associated with the plan; and Notify each person or group with a defined role in the recovery plan of the updates to the recovery plan based on any documented lessons learned. An example of evidence may include, but is not limited to, all of the following: documentation of identified deficiencies or lessons learned for each recovery plan test or actual incident recovery or dated documentation stating there were no lessons learned; Dated and revised recovery plan showing any changes based on the lessons learned; and Evidence of plan update distribution including, but not limited to: Emails; USPS or other mail service; Electronic distribution system; or Training sign-in sheets. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 3.1 This section to be completed by the Compliance Monitor Administrator Verify that no later than 90 calendar days after completion of a recovery plan test or actual recovery, the Responsible Entity has:
RSAW_CIP-009-5_BC.docx