Part Applicable Systems Requirements Measures 5.6 High Impact BES Systems and Where technically feasible, for Examples of evidence may include, but are their associated: password-only authentication for not limited to: interactive user access, either EACMS; System-generated reports or technically or procedurally enforce PACS; and screen-shots of the password changes or an obligation PCA periodicity of changing to change the password at least once passwords; or Medium Impact BES Cyber Systems every 15 calendar months. Attestations that include a with External Routable Connectivity reference to the documented and their associated: procedures that were followed. PACS; and PCA Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. Relevant Revision Page(s) Description of or Document or Applicability of File Name Document Version Date Section(s) Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.6 This section to be completed by the Compliance Enforcement Authority For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months, where technically feasible. For Cyber Assets of Applicable Systems, if a password for password-only authentication for
Part Applicable Systems Requirements Measures 5.6 High Impact BES Systems and their associated: EACMS; PACS; and PCA Medium Impact BES Cyber Systems with External Routable Connectivity and their associated: PACS; and PCA Where technically feasible, for password-only authentication for interactive user access, either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the periodicity of changing passwords; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Compliance Narrative: Provide a brief explanation, in your own words, of how you comply with this Requirement. References to supplied evidence, including links to the appropriate page, are recommended. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Audit Team Evidence Reviewed (This section to be completed by the Compliance Enforcement Authority): Compliance Assessment Approach Specific to CIP-007-6, R5, Part 5.6 This section to be completed by the Compliance Enforcement Authority For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce password changes or an obligation to change the password at least once every 15 calendar months, where technically feasible. For Cyber Assets of Applicable Systems, if a password for password-only authentication for
RSAW%20CIP-007-6_2015_v1.docx