documented one or more processes to either technically or procedurally enforce the following password parameters: Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and minimum password complexity that is the lesser of or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, non-alphanumeric) or the maximum complexity supported by the Cyber Asset. For each Asset of Applicable Systems, for password-only authentication for interactive user access, verify password length is by either technical or procedural methods, per 5.5.1. For each Cyber Asset of Applicable Systems, for password-only authentication for interactive user access, verify password complexity is enforced by either technical or procedural methods, per 5.5.2. Note to Auditor: This Part does not apply to multi-factor authentication. CIP-007-5 Table R5 System Access Control – Part Applicable Systems Requirements Measures 5.6 High Impact BES Cyber Systems Where technically feasible, for Examples of evidence may include, but and their associated: password-only authentication for are not limited to: interactive user access, either System-generated reports or technically or procedurally screen-shots of the PACS; and enforce password changes or an PCA periodicity of changing obligation to change the passwords; or password at least once every 15 Medium Impact BES Cyber Attestations that include a calendar months. Systems with External Routable reference to the documented Connectivity and their associated: procedures that were followed. PACS; and PCA Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s)
documented one or more processes to either technically or procedurally enforce the following password parameters: Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and minimum password complexity that is the lesser of or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, non-alphanumeric) or the maximum complexity supported by the Cyber Asset. For each Asset of Applicable Systems, for password-only authentication for interactive user access, verify password length is by either technical or procedural methods, per 5.5.1. For each Cyber Asset of Applicable Systems, for password-only authentication for interactive user access, verify password complexity is enforced by either technical or procedural methods, per 5.5.2. Note to Auditor: This Part does not apply to multi-factor authentication. CIP-007-5 Table R5 – System Access Control Part Applicable Systems Requirements Measures 5.6 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Where technically feasible, for password-only authentication for interactive user access, either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the periodicity of changing passwords; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Title Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document
RSAW_CIP-007-5_BC.docx