commands, or Removable Media. For each Cyber Asset of an Applicable System, verify that the unnecessary physical input/output ports used for network connectivity, console commands, or Removable Media are protected against use. Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented process(es) that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 Security Patch Management. [Violation Risk Factor: – Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 Security Patch Management and additional evidence to – demonstrate implementation as described in the Measures column of the table. R2 Part 2.1 CIP-007-6 Table R2 Security Patch Management – Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and A patch management process for An example of evidence may include, but is their associated: tracking, evaluating, and installing not limited to, documentation of a patch cyber security patches for applicable management process and documentation Cyber Assets. The tracking portion or lists of sources that are monitored, PACS; and shall include the identification of a whether on an individual BES Cyber System PCA source or sources that the or Cyber Asset basis. Responsible Entity tracks for the release of cyber security patches for Medium Impact BES Systems applicable Cyber Assets that are and their associated: updateable and for which a patching EACMS; source exists. PACS; and PCA Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.
commands, or Removable Media. For each Cyber Asset of an Applicable System, verify that the unnecessary physical input/output ports used for network connectivity, console commands, or Removable Media are protected against use. Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement one or more documented process(es) that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 – Security Patch Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-6 Table R2 – Security Patch Management and additional evidence to demonstrate implementation as described in the Measures column of the table. R2 Part 2.1 CIP-007-6 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Compliance Narrative: Provide a explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the exact location where evidence of compliance may be found.
RSAW%20CIP-007-6_2015_v1.docx