unless: An approved TFE covers the Applicable System; or A documented CIP Exceptional Circumstance exists. If a TFE is applicable to this Part, verify the compensating measures identified by the TFE are implemented. If the Responsible Entity has experienced an exception for CIP Exceptional Circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies. Note to Auditor: The Responsible Entity may reference a separate set of documents to demonstrate its response to any requirements impacted by CIP Exceptional Circumstances. Auditor Notes: R4 P4.3 Notes Summary RSAW Box The Notes Summary for Report R4 Part 4.4 CIP-007-6 Table R4 Security Event Monitoring – Part Applicable Systems Requirements Measures 4.4 High Impact BES Cyber Systems and Review a summarization or sampling Examples of evidence may include, but are their associated: of logged events as determined by not limited to, documentation describing the Responsible Entity at intervals no the review, any findings from the review (if and greater than 15 calendar days to any), and dated documentation showing the PCA identify undetected Security review occurred. Incidents. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended.
unless: An approved TFE covers the Applicable System; or A documented CIP Exceptional Circumstance exists. If a TFE is applicable to this Part, verify the compensating measures identified by the TFE are implemented. If the Responsible Entity has experienced an exception for CIP Exceptional Circumstances, verify the Responsible Entity has adhered to any applicable cyber security policies. Note to Auditor: The Responsible Entity may reference a separate set of documents to demonstrate its response to any requirements impacted by CIP Exceptional Circumstances. Auditor Notes: R4 P4.3 Notes Summary RSAW Box The Notes Summary for Report R4 Part 4.4 CIP-007-6 Table R4 – Security Event Monitoring Part Applicable Systems Requirements Measures 4.4 High Impact BES Cyber Systems and their associated: and PCA Review a summarization or sampling of logged events as determined by the Responsible Entity at intervals no greater than 15 calendar days to identify undetected Security Incidents. Examples of evidence may include, but are not limited to, documentation describing the review, any findings from the review (if any), and dated documentation showing the review occurred. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended.
RSAW%20CIP-007-6_2015_v1_TRE.docx