Examples of evidence may include, but are 1.2 High Impact BES Cyber Systems One or more processes to determine not limited to, dated documentation of if an identified Security Incident Medium Impact BES Systems Cyber Security Incident response plan(s) is a Reportable Cyber Security that provide guidance or thresholds for Incident and notify the Electricity Sector Information Sharing and determining which Cyber Security Incidents Analysis Center (ES-ISAC), unless are also Reportable Cyber Security prohibited by law. Initial notification Incidents and documentation of initial to the ES-ISAC, which may be only a notices to the Electricity Sector Information preliminary notice, shall not exceed Sharing and Analysis Center (ES-ISAC). one hour from the determination of a Reportable Cyber Security Incident. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R1, Part 1.2 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more Cyber Security Incident response plans which include one or more processes to determine if an identified Cyber Security Incident is a Reportable Cyber Security Incident and notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law. Initial notification to the ES-ISAC, which may be only a preliminary notice, shall not exceed one hour from the determination of a Reportable Cyber Security Incident.
1.2 High Impact BES Cyber Systems Medium Impact BES Systems One or more processes to determine if an identified Security Incident is a Reportable Cyber Security Incident and notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law. Initial notification to the ES-ISAC, which may be only a preliminary notice, shall not exceed one hour from the determination of a Reportable Cyber Security Incident. Examples of evidence may include, but are not limited to, dated documentation of Cyber Security Incident response plan(s) that provide guidance or thresholds for determining which Cyber Security Incidents are also Reportable Cyber Security Incidents and documentation of initial notices to the Electricity Sector Information Sharing and Analysis Center (ES-ISAC). Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R1, Part 1.2 This section to be completed by the Compliance Enforcement Authority Verify the Responsible Entity has documented one or more Cyber Security Incident response plans which include one or more processes to determine if an identified Cyber Security Incident is a Reportable Cyber Security Incident and notify the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), unless prohibited by law. Initial notification to the ES-ISAC, which may be only a preliminary notice, shall not exceed one hour from the determination of a Reportable Cyber Security Incident.
RSAW%20CIP-008-5_2015_v1.docx