The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Title Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R3, Part 3.1 This section to be completed by the Compliance Enforcement Authority Verify that no later than 90 calendar days after completion of a Cyber Security Incident response plan(s) test or actual Reportable Cyber Security Incident response, the Responsible Entity has: Documented any lessons learned or documented the absence of any lessons learned; updated the Cyber Security Incident response plan based on any documented lessons learned associated with the plan; and notified each person or group with a defined role in the Cyber Security Incident response plan of the updates to the Cyber Security Incident response plan based on any documented lessons learned. Auditor Notes: R3 Part 3.2 CIP-008-5 Table R3 Cyber Security Incident Response Plan – Review, Update, and Communication Part Applicable Systems Requirements Measures
The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-008-5, R3, Part 3.1 This section to be completed by the Compliance Enforcement Authority Verify that no later than 90 calendar days after completion of a Cyber Security Incident response plan(s) test or actual Reportable Cyber Security Incident response, the Responsible Entity has: Documented any lessons learned or documented the absence of any lessons learned; updated the Cyber Security Incident response plan based on any documented lessons learned associated with the plan; and notified each person or group with a defined role in the Cyber Security Incident response plan of the updates to the Cyber Security Incident response plan based on any documented lessons learned. Auditor Notes: R3 Part 3.2 CIP-008-5 Table R3 – Cyber Security Incident Response Plan Review, Update, and Communication Part Applicable Systems Requirements Measures
RSAW%20CIP-008-5_2015_v1.docx