ports used for network connectivity, console commands, or Removable Media are protected against use. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 Security Patch – Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 Security Patch Management and additional evidence to demonstrate – implementation as described in the Measures column of the table. CIP-007-5 Table R2 Security Patch Management – Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems A patch management process for An example of evidence may include, and their associated: tracking, evaluating, and installing but is not limited to, documentation of a cyber security patches for patch management process and applicable Cyber Assets. The documentation or lists of sources that PACS; and tracking portion shall include the are monitored, whether on an individual PCA identification of a source or BES Cyber System or Cyber Asset sources that the Responsible basis. Entity tracks for the release of Medium Impact BES Cyber cyber security patches for Systems and their associated: applicable Cyber Assets that are updateable and for which a EACMS; patching source exists. PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required):
ports used for network connectivity, console commands, or Removable Media are protected against use. Compliance Summary: Finding Summary: Primary Documents Supporting Findings: Auditor Notes: R2 Supporting Evidence and Documentation R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, and corrects deficiencies, one or more documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 – Security Patch Management. [Violation Risk Factor: Medium] [Time Horizon: Operations Planning]. M2. Evidence must include each of the applicable documented processes that collectively include each of the applicable requirement parts in CIP-007-5 Table R2 – Security Patch Management and additional evidence to demonstrate implementation as described in the Measures column of the table. CIP-007-5 Table R2 – Security Patch Management Part Applicable Systems Requirements Measures 2.1 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA A patch management process for tracking, evaluating, and installing cyber security patches for applicable Cyber Assets. The tracking portion shall include the identification of a source or sources that the Responsible Entity tracks for the release of cyber security patches for applicable Cyber Assets that are updateable and for which a patching source exists. An example of evidence may include, but is not limited to, documentation of a patch management process and documentation or lists of sources that are monitored, whether on an individual BES Cyber System or Cyber Asset basis. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required):
RSAW_CIP-007-5_BC.docx