Assets, where technically feasible. (1.4) R2. Each Responsible Entity The Responsible The Responsible Entity did not The Responsible The Responsible Entity CIP-005-5 allowing Interactive Remote Entity does not implement processes for one of the Entity did not did not implement Access to BES Cyber Systems have documented applicable items for Requirement implement processes for three of shall implement one or more processes for one Parts 2.1 through 2.3. processes for two the applicable items for documented processes that or more of the of the applicable Requirement Parts 2.1 collectively include the applicable items items for through 2.3. applicable requirement parts, for Requirement Requirement Parts where technically feasible, in Parts 2.1 through 2.1 through 2.3. 2.3. CIP-005-5 Table R2 Interactive – Remote Access Management. R1. Physical Security Plan The N/A N/A The Responsible The Responsible Entity — Responsible Entity shall Entity created a did not document, document, implement, and physical security implement, and maintain a physical security plan, plan but did not maintain a physical approved by the senior manager gain approval by a security plan. or delegate(s) that shall address, senior manager or at a minimum, the following: delegate(s). OR The Responsible Entity created and implemented but did not maintain a physical security plan. R1.1. All Cyber Assets within an N/A N/A N/A The Responsible Electronic Security Perimeter Entity's physical shall reside within an identified security plan does not Physical Security Perimeter. include processes to Where a completely enclosed ensure and document cannot be that all Cyber Assets (“six-wall”) border established, the Responsible within an Electronic Entity shall deploy and document Security Perimeter also alternative measures to control reside within an
Assets, where technically feasible. (1.4) CIP-005-5 R2. Each Responsible Entity allowing Interactive Remote Access to BES Cyber Systems shall implement one or more documented processes that collectively include the applicable requirement parts, where technically feasible, in CIP-005-5 Table R2 – Interactive Remote Access Management. The Responsible Entity does not have documented processes for one or more of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for one of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for two of the applicable items for Requirement Parts 2.1 through 2.3. The Responsible Entity did not implement processes for three of the applicable items for Requirement Parts 2.1 through 2.3. R1. Physical Security Plan — The Responsible Entity shall document, implement, and maintain a physical security plan, approved by the senior manager or delegate(s) that shall address, at a minimum, the following: N/A N/A The Responsible Entity created a physical security plan but did not gain approval by a senior manager or delegate(s). OR The Responsible Entity created and implemented but did not maintain a physical security plan. The Responsible Entity did not document, implement, and maintain a physical security plan. R1.1. All Cyber Assets within an Electronic Security Perimeter shall reside within an identified Physical Security Perimeter. Where a completely enclosed (“six-wall”) border cannot be established, the Responsible Entity shall deploy and document alternative measures to control N/A N/A N/A The Responsible Entity's physical security plan does not include processes to ensure and document that all Cyber Assets within an Electronic Security Perimeter also reside within an
VSL_Matrix_Complete_2016_01_01.docx